{ "Event": { "published": true, "date": "2026-03-06", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-03-06", "timestamp": 1772841781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "21040572-f08c-4c6a-b3b3-6c50c3b84717", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01a4e355-1905-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772764471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764471, "uuid": "310c1f9b-9ce4-4d0a-a445-f424ea5af6fa", "comment": "Malware payload (Mirai)", "value": "124a3af41b4eb8d5b8b3f7e7701dfa49", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764471, "uuid": "06bc8c1d-29e0-4d0e-814c-acf2e013a466", "comment": "Malware payload (Mirai)", "value": "002755d98cede8bf9bb7fa3dd4665cb35aaa8ac3b7b3ad4a81befb64622cbe55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764471, "uuid": "b49dc50b-aefd-41f8-9061-d84ca254c376", "comment": "Malware payload (Mirai)", "value": "dde18a945f021c6a3357d8f31592a0951aac3613", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764471, "uuid": "3561ca42-86cc-4a08-8c46-5d018840b782", "comment": "Malware payload (Mirai)", "value": "b3053e0ec77bd328b17f3c1c2960350410068108ec1abbe998f388d70da5b7395fd279f15a1f998255fcb4d07f622a07", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772764471, "uuid": "40b4bdc2-079a-4028-a8c8-5c351d44df22", "value": "T16FB339C1BA43D4F5EC1641306177F73B9A32F0791239DA87E7A89E327C92A419D0A39D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772764471, "uuid": "f03b085e-80f8-4268-aaca-868e97dc018a", "value": "3072:PbKW4dCLFaGFBu3/45g1rcV2w4zSr9bMFfln:Pbj4doYGFB0/45gdQ9uln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772764471, "uuid": "9c6e6612-d3f5-4828-85f2-0269c8839174", "value": 107824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772764471, "uuid": "1fedc882-f59e-4b0e-b004-9ee31db41bb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772764471, "uuid": "63973fb8-e4e2-458f-a226-83f385b9c46d", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8af8544-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (DDoSAgent)", "timestamp": 1772809017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809017, "uuid": "578d557f-a47d-4f8a-a4f0-b1909069169f", "comment": "Malware payload (DDoSAgent)", "value": "c5f518f180b5178d08b77dfafe0ce340", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809017, "uuid": "b1c1c685-b8ad-4672-bad9-23a80669f987", "comment": "Malware payload (DDoSAgent)", "value": "007d03943732fab4ca97c45fe367bb043ece03fde8576bef6ce727dc4dd68980", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809017, "uuid": "da82ffce-0dbc-4be2-8313-99fa5a4d841a", "comment": "Malware payload (DDoSAgent)", "value": "2162bc554c27a4a0a781244b52b4ed1bcfde6cab", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809017, "uuid": "a5bc4fe5-8bcb-424a-9bd9-3b98058a1618", "comment": "Malware payload (DDoSAgent)", "value": "2abdc1d4576be6e876547e24d49ce4881ea7222a968189b447cf5a904aa7c83f1a917c460f0fee458d3d0d7ca345ac8e", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809017, "uuid": "6e173607-131d-4a12-b302-b23213acdf58", "value": "T155571B14AD856BF6C86D4E3490EACAA512701E1059F14B7A22E0FFACF8772757F4788C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809017, "uuid": "ee75f55e-9c87-45de-975a-47eca0935daa", "value": "196608:BSYXnhQqZ7aCNXPvcrIgoz56xeTaSI/48zH9:BSUgozUx/ZzH9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809017, "uuid": "44ec076a-ea7b-4933-84c6-6a2d260d7d58", "value": 29425879, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809017, "uuid": "8a8703df-0a9e-49a0-86c6-f00da3c8888a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809017, "uuid": "86d4c53c-6f2c-4d2c-8509-fe0175177c13", "value": "apex.mipsle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f6fb1dc-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819202, "uuid": "73d6ad39-4385-4aab-9c29-6f77d0ff8f51", "comment": "Malware payload (Mirai)", "value": "d48a6a6a486f1772e4bb79e0cc3967af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819202, "uuid": "a72b95cc-09d4-4d10-8b5f-a0b75557cdae", "comment": "Malware payload (Mirai)", "value": "00acbcb5360b8614e6109b9b75d7ff88faef746a50144bb0ab1c30b9f25d091a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819202, "uuid": "0117ae57-29dd-4613-a73d-9ccdc5dc7c03", "comment": "Malware payload (Mirai)", "value": "ffb7a27072510fce7f7ba0473d7f54ad15b6180b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819202, "uuid": "1e06e9a7-454c-4a9d-84fd-1ea02d46cefd", "comment": "Malware payload (Mirai)", "value": "1b644422e57478f621b55374e9e60885eb3fcb8876e16d0562cdcfb59f1b8aa04c252653fbdc538e48018b706102496f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819202, "uuid": "52f68657-09b4-4fc3-bb7e-29a77dbb2fc8", "value": "T1CE258D5AF2B371BDC057C030439BD7A16935F47851322D7B62C4AA353EA2E701B2AF66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819202, "uuid": "41b8396f-488a-4881-b2ea-4444e204b875", "value": "24576:3aQyxk5Ns2zQow3GLFMK47zqyc+ItU2xx:qQyYN7zQoYGLFMK2+0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819202, "uuid": "42aacf27-a126-41dd-bb95-29f58b3dd947", "value": 1032192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819202, "uuid": "5a9e390a-5f71-4f7c-8985-9ef0711d1518", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819202, "uuid": "b9e55ec7-36e5-425b-85ad-1e53f151bba2", "value": "sora.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3644dc83-196b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808368, "uuid": "d95948cc-fc0a-42e8-b568-2ca754753381", "comment": "Malware payload", "value": "936ae0a47bd03a733baf225089daf8e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808368, "uuid": "10ab10f2-1d50-4e17-8ca7-fc846d2bf5f7", "comment": "Malware payload", "value": "00dcb399c586c167e4b979b4ea1ffb1847889c1f610a3c4d02223f0aadbf92b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808368, "uuid": "aee510e3-a6de-4d9d-bdb4-97d1648413e8", "comment": "Malware payload", "value": "0cfc104c4c50ca844bd121d92b40e0e6c369d461", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808368, "uuid": "8dd3a28e-bb1b-4d1e-b279-f960d2fbc8ef", "comment": "Malware payload", "value": "154ad2a84510d3e2e372547b126be5d2a930cefa91e861676cbd8b96bd5a6a994fc9101e6a34c71b31e3dc83100850a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808368, "uuid": "12458a90-abd6-44f4-9a28-d157306d2be4", "value": "T1E646E14650F050FBF27439F8CDBBA6600C3C3E575E64886FF6C09AC59B62D426531AEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808368, "uuid": "d66f811a-2a7a-4cb2-a0f1-0359eab2639e", "value": "336c69b6e8562d1c5231f219b62d7473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808368, "uuid": "90f2cbda-d5fd-4c90-9212-ed527bb98e30", "value": "49152:r9t9ux578/tr/FgJfxoBKCfpqHTItkcecLwWq8KhQ7S3fIjRGOS+L5JV4J3BESyF:r9zuxWFxuopwRcEWq8K4S3H8Jk3BZy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808368, "uuid": "afe625e3-ab19-4362-a91c-632c3686c0f5", "value": 5419520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808368, "uuid": "714f8449-e822-4759-bb95-3043f8c762b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808368, "uuid": "5fd44de1-9007-4479-ba01-58f001b76199", "value": "00dcb399c586c167e4b979b4ea1ffb1847889c1f610a3c4d02223f0aadbf92b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95969c4d-1972-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811535, "uuid": "fd3e1337-64af-4951-becc-e671bdb9a91a", "comment": "Malware payload", "value": "e9feb497ea4fa824f3e58c5abbfd8a6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811535, "uuid": "4026eddf-7fcf-4b61-a705-10f83bb0eb15", "comment": "Malware payload", "value": "010b5a6dc4eb1014bef46f68c4aa1fcc17cc9abb0ff3613e1446cf03f4410abe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811535, "uuid": "b0a0e4fb-7af2-4c47-8a2e-59f7f978d326", "comment": "Malware payload", "value": "e76b037d9b5b76775713b1bfe352b1f4ea3fb59d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811535, "uuid": "79eb9185-e7cb-42d5-923c-f13b0c27bfab", "comment": "Malware payload", "value": "ecacb2b577945924de8255e948c7e7d64feacdb3317d0c0d5f2bac60fbd1a615bff0a9f514d8824c453a0c4cc57a23ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811535, "uuid": "b803bec2-2c7f-4af1-bd41-a847e770aea8", "value": "T10742E8017BECCA3AF1FE0FB865B2521007B6B6255821D35E2DE824DD4CE1B58C6217BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811535, "uuid": "138d9bac-e9b5-40fc-9887-5562427a54f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811535, "uuid": "30e9cdb6-75f4-4ce2-b7c8-d74bfb9f7635", "value": "192:CwdD+mQKxOflEHkeX7zdAcC32S+76RrTYX9/bi5yNBruadbP9P0QxVECfBn:CwdkflEHBVAJGgRXUFb9NBruMPvXf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811535, "uuid": "e463be03-ed0f-4f15-b62f-0d551c09b900", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811535, "uuid": "e3236fa6-7e95-4fcb-b7f9-46fcf68a66af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811535, "uuid": "71aee1f5-8cad-4579-b2a4-44ae1be2a0cf", "value": "010b5a6dc4eb1014bef46f68c4aa1fcc17cc9abb0ff3613e1446cf03f4410abe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ef20608-1982-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772818261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818261, "uuid": "d0037cd4-387c-4c1f-9d94-aaf0911fb4a9", "comment": "Malware payload (Mirai)", "value": "fd418cf0c00857ddccea1713e31256ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818261, "uuid": "4c78eb67-03c6-44e9-9512-63bfce662838", "comment": "Malware payload (Mirai)", "value": "01254fb72eba1a001cff23fe94a1d93918d8668d2f0fdc68e13473f5b150bfc1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818261, "uuid": "6c210fc5-d654-4101-b90e-2d2efb321b94", "comment": "Malware payload (Mirai)", "value": "7ba65d3948b38f9de30e6884e9a2c56539741a56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818261, "uuid": "be1b72f6-547b-412f-9046-c41d125789fe", "comment": "Malware payload (Mirai)", "value": "e1f8719a11437c4ed711f1d8d2eff67f10250d4f859d5d91e9bb042d89a2b936c67b068d44618f050b93396bd6c0c284", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818261, "uuid": "65c150aa-52ee-4d7d-84a7-838d772509b2", "value": "T10EE35D8AF4029E7DFD4FE5BE44670E09E931A39131831B2A53DBFDA3A9311990D17E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818261, "uuid": "10264ded-0cc1-4a3a-a426-c2ba385e3b69", "value": "3072:noDlIyA+oy+ZGiTgnlXkgt7ZLgLq2e9FdlJcNNg:RDy+ZG2g7l2e9rcNNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772818261, "uuid": "ce063d21-333f-468f-91d4-759dfb0c1f59", "value": 147336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772818261, "uuid": "acb920c8-61a3-455a-b79f-118eb8e74125", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818261, "uuid": "25204f36-2772-4143-a507-b8d795b3a68f", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed261b76-1971-11f1-a769-42010a9c0008", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1772811252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811252, "uuid": "fa67ce83-21e6-463c-8ce8-d10932ff80a3", "comment": "Malware payload (ScarfaceStealer)", "value": "b1e5f92206ae569dbf5190174029d395", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811252, "uuid": "7c65bb6b-85e7-4d6f-993d-1c64318f050f", "comment": "Malware payload (ScarfaceStealer)", "value": "0194d6a8297949f7fafe29ff0a1c48ad9126607c47a8516fb84dd86f4a886c75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811252, "uuid": "1280f4f6-30e7-4bcb-b631-1236ce7db72d", "comment": "Malware payload (ScarfaceStealer)", "value": "14c4c92012116819f7a2b433140a31da3d2f2b3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811252, "uuid": "d417b445-977d-423e-b1a1-2f6bb84f78d5", "comment": "Malware payload (ScarfaceStealer)", "value": "9b548f1e6ffa601f174d63e4b8b89f05ae453face2319e5cb0132477939980df1b28995de0328a251bb7d4b3465bd544", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811252, "uuid": "1d7957e8-fd0a-4518-8c94-8f214a604782", "value": "T17BF7594262EA04C4F9F7DA359AE65217D673BC166F3081CF325C172A1F736E08976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811252, "uuid": "d9543cbb-06be-4004-b7f7-d13c744cad2e", "value": "772ec87d3452991a9933a3ba0d9963a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811252, "uuid": "0a2f1dea-58f8-4311-9880-d56fd636524b", "value": "393216:dn1XQgPR2k3m5C507G9ITEc5eAlkLbQurxMWhAsIyNOPS0B4AycWsCYaxFzwW/tb:d1XR7AsxYqt2oRGj5rs3wb8/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811252, "uuid": "f05cae16-a3b6-4ebb-abf9-491f8b9d0cdb", "value": 71542272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811252, "uuid": "f2c0a54c-9998-4904-9d8c-f7e3fac295de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811252, "uuid": "7acdde0c-4832-472a-9903-244747cbaa18", "value": "0194d6a8297949f7fafe29ff0a1c48ad9126607c47a8516fb84dd86f4a886c75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2fbaf39-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1772811665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811665, "uuid": "20661dd4-3376-42ff-b762-1e5e9c38f2d8", "comment": "Malware payload (GuLoader)", "value": "4b23315f8f95d371e8f4e27deeb20333", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811665, "uuid": "e1d73150-469b-4877-9fe1-e0a11c5b4dac", "comment": "Malware payload (GuLoader)", "value": "01d7a671885ca694434ac2dc2a1612dee663decb7389a258006ff194314c0af0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811665, "uuid": "ca57b91b-7aef-46ac-94d7-289e3f0b9af3", "comment": "Malware payload (GuLoader)", "value": "bdcfc65f501e321fb390db2371170e5d687f3831", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811665, "uuid": "a90e2aa6-4ffa-4b1f-9303-0ee3d9ea2c82", "comment": "Malware payload (GuLoader)", "value": "eb65134d4c77a6bb1b0627a2ede314ff1731c97b3d85aff5b717a097bf08860085e598850fa08a1a19a731233be1d52d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811665, "uuid": "281afa04-7acc-48ce-99be-8b35ad2fc074", "value": "T197B4E191F756D9E6E8360375993A6E311763FE3A98700B0F329C726969F33A20027D47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811665, "uuid": "98831f4b-0474-40b8-82c1-3e7065efe504", "value": "5f0c714c36e6cc016b3a1f4bc86559e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811665, "uuid": "722b386c-1743-47eb-a8ee-6785be5a4485", "value": "6144:kDfe6EKGDcqpyf5TeDgdygNGiwJX1bWIxTt88pmgsmFgat/CwFz84Ken2syf7ojY:MnqpyMcdbTSd1pmcFgk1zY2F4VP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811665, "uuid": "a90155c0-7289-453b-819f-2782604cf71b", "value": 507672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811665, "uuid": "feb2c050-a816-4e3a-9a52-5e57c299db9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811665, "uuid": "9926cc2c-09db-4e53-b119-cd039583a29e", "value": "01d7a671885ca694434ac2dc2a1612dee663decb7389a258006ff194314c0af0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ab9dd22-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772810094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810094, "uuid": "8f9337bf-cf1e-40f2-a372-4c7085805aeb", "comment": "Malware payload (Formbook)", "value": "e3f941468279bb428a8ecad3f583b3e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810094, "uuid": "ccc76cc7-7274-4062-a9f4-9f894cef754f", "comment": "Malware payload (Formbook)", "value": "01f107c87c2769533bf1e5c2f31868ab298511fa195276e4606483fc087a335c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810094, "uuid": "37e4dc92-aa8b-4483-b294-75ddee4e9d0b", "comment": "Malware payload (Formbook)", "value": "6beb2e148abf6fc580741cb0acfb16b93aa6dad5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810094, "uuid": "cb8d3298-db0e-4d05-bdce-67482a664bd5", "comment": "Malware payload (Formbook)", "value": "972cbb9aa867fcac86e5d043c243c1d59e27822f990fadb5dd7e4b327ad906568cddb718da12b1876fdfbd890aa99ad3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810094, "uuid": "4dca5478-aeca-4a19-bc9f-1371496fe200", "value": "T186A4E101B65921FED29BC874C6025A52EE3278470B61BADF07904BB76F53AE89F3D701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810094, "uuid": "800f7417-5d66-4d7b-ae50-25a606f94d0b", "value": "15305bfbfba9b7bf4b30eee53c3c0d17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810094, "uuid": "cfb6b456-8557-4d44-b593-a6d1199c290d", "value": "12288:fMn6RzDHi/MZJdhX4fNzclgE4qw57/9ol9R/:fMnBUZJdB4fJqgXR1lojp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810094, "uuid": "23653670-206c-4aea-9fc5-7a7e640d3d59", "value": 489997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810094, "uuid": "39ece591-1814-4c87-9523-7024d85e1141", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810094, "uuid": "f0566f7c-6ddc-48be-bebf-ce3e583030cd", "value": "01f107c87c2769533bf1e5c2f31868ab298511fa195276e4606483fc087a335c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f072dd8-1967-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772806665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806665, "uuid": "ed64156b-5a15-4380-8852-08e3d98e8bfe", "comment": "Malware payload", "value": "30d6fc6c86ca0b45a117e104197e6cf7", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "wiosyrondaty-com", "colour": "#68F1E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806665, "uuid": "80e5e6cc-462c-49b8-9420-fc2a40fb9922", "comment": "Malware payload", "value": "020ced99e043bb97799619962dc488420ab34e406595f7323d3f2226e6d5d94c", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "wiosyrondaty-com", "colour": "#68F1E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806665, "uuid": "2ef70c38-58c6-49df-81e6-3770a1567227", "comment": "Malware payload", "value": "db5242fbfc8a977bcdf12026186aa9b4ca3f7752", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "wiosyrondaty-com", "colour": "#68F1E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806665, "uuid": "a5b638cd-e9a9-4811-a007-df1d53ddcc33", "comment": "Malware payload", "value": "5b7527d7031f4efbff88f5aa5a89ebea5b46d897f6363dfd80153a8c855dc629153b45125f2a9d736a3612803d8f2c43", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "wiosyrondaty-com", "colour": "#68F1E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806665, "uuid": "b4e25c27-4daf-463b-a8ff-1f6c6305eab4", "value": "T1FA33C7F61944C4860687571420C6FD7123D9E96B7EEC57AB02FE73CA22C098B92FB4D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806665, "uuid": "ba631b05-649e-46f8-b025-8dd4e90d6910", "value": "768:tc86PsbOWJIaTYplP5ywaRv4evenB4L3dVsHG4WiZ4w+IfbEM579aPPGLolXSwKS:tc0KWJHYpJaRvK+3Ib47X67wnCdYcu5J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772806665, "uuid": "8920c12d-a519-4b33-a55e-41f2027c009a", "value": 53766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772806665, "uuid": "5f6f4372-07f9-4578-be3a-dd3519f8410b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806665, "uuid": "fd6fda32-e68b-4ec3-8a1c-d048100faacf", "value": "020ced99e043bb97799619962dc488420ab34e406595f7323d3f2226e6d5d94c.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c9f9bb7-196d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809157, "uuid": "4fc1aa78-1e45-454d-bdca-b56f18b03379", "comment": "Malware payload", "value": "df0a6df9d876a941694272e442eb012b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809157, "uuid": "88db0cc3-1907-45f1-a524-7940fcc2b040", "comment": "Malware payload", "value": "0250aba960605a96caf7840c20b3d102353dbaff5880e1a1f039e0d298950171", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809157, "uuid": "db8e097c-df0d-430e-be91-1dce658a4dd5", "comment": "Malware payload", "value": "9b1b030a98b4cfc177f5fbb206f7aaacd2ad188c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809157, "uuid": "1fc75918-75ee-4a5e-8af7-116cbaf6154b", "comment": "Malware payload", "value": "fed7bfb0396597b25e61bfd0dc8c59ac4901088e81d4259d37713b2b1528a282bfa31f1b53e3866eef4c737796f6a313", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809157, "uuid": "20eb8eee-d809-4702-beb2-6cad5c19e78d", "value": "T17A4412233364E4A7E1B51230557B9527DFF3DB244AE44A5B3748BE3E7436382863B892", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809157, "uuid": "621bce82-8627-4a62-a973-b77a5de12996", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809157, "uuid": "4815bb38-5fdf-48b5-9a99-66ee56e3c475", "value": "6144:mcBvWb06v7/cj83Iw8vvYHEQWOc4WvXw3Ou+B7P2Ox3WNP/d4u4:DO06z/cIR8XYHEW/W+994u4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809157, "uuid": "9467dbba-e290-4cc1-b2bb-2e5c90bb22c1", "value": 277696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809157, "uuid": "8f57a1f1-0263-43a9-9cf8-56b978bb31bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809157, "uuid": "2860d19b-650b-414c-9507-0543db744c97", "value": "0250aba960605a96caf7840c20b3d102353dbaff5880e1a1f039e0d298950171", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a8d1148-196a-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808027, "uuid": "dd58afb3-e213-4fd3-aa26-aa965d613493", "comment": "Malware payload (GCleaner)", "value": "9d9fc7f29806ced13568b07b00e4c23c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808027, "uuid": "56101dfa-f062-4694-b098-040b0e0a4db4", "comment": "Malware payload (GCleaner)", "value": "02e0d5f00e3a6b85238906e35f1b5037191190ff4fd054467a496399e71b1572", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808027, "uuid": "e393717d-b71a-4af8-9347-b0c2141b6063", "comment": "Malware payload (GCleaner)", "value": "f38df4e5c0b1ab1963ec47d18e9710cc65d33ac7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808027, "uuid": "f7ac9fa9-ba85-4f32-8949-06df95329113", "comment": "Malware payload (GCleaner)", "value": "ed1e65343fdec0a138702f3cd6df88b0e784889390551bf52d57bfe3f76ca7bd3fc15d93ca6d2646944cc09b98f38978", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808027, "uuid": "08ae2c0a-f72f-4dd6-b172-fef8732365e3", "value": "T14906E0D3DA59002DC3BAE1B439F39678D40C9B141A6BEF3815ED6FC9172A1C9333A691", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808027, "uuid": "3b361fbf-8750-4423-96bf-c8c5a6870f36", "value": "e5f32a93ddcf3aa9009cd70911b0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808027, "uuid": "ed77eaac-6a88-4067-baa0-4c070f39379f", "value": "49152:f9CiLx9yuif+5DS75mDhadmyM6BTfgP8tv/bIIG+aPnr+RIfRf/Z0As4Ol2qaaI:f9CexoQW7oezpvNG+WXf04Ole", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808027, "uuid": "e027e8f4-fbeb-4edd-8c7e-eb95a92ca666", "value": 3821056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808027, "uuid": "2e2388a0-a26a-4483-b610-6e5ceb1f401d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808027, "uuid": "d92af7cc-5cf8-4454-be36-1b4f41906d40", "value": "02e0d5f00e3a6b85238906e35f1b5037191190ff4fd054467a496399e71b1572", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6b992ec-1970-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810758, "uuid": "a7080c15-8d46-4264-8bd4-2f37e948668b", "comment": "Malware payload", "value": "de866ab506a2fd1568a16612ed21cd2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810758, "uuid": "b67a1fa1-3637-4b10-9053-ce2cdbfb5b10", "comment": "Malware payload", "value": "0320749b9a15ad5d4ea691d3cbb01aca2a484a2886f5df4e1aa907e04bee4385", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810758, "uuid": "fe7dc4fe-2280-4048-a5a8-62987b247518", "comment": "Malware payload", "value": "29e4cec27cdd1578fa75d6c570ee3681c799bb3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810758, "uuid": "5389ca08-3ac3-4834-8a8a-6fb16646be3e", "comment": "Malware payload", "value": "5d739b3644f78350c667d7fcbf41145bca8dde2f82d110e3540060f4502df0db7b6e41c20f93e691fe207e58b4f1b431", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810758, "uuid": "97f3c3c7-3808-4a12-a354-6677a1440918", "value": "T11C55CF0273D1C062FFAB92334B5AF6115BBC79260123AA1F13981D79BE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810758, "uuid": "b42fc4b7-3aa7-487a-8875-479e2a2fb892", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810758, "uuid": "db6e5537-ecfe-486f-930f-0c739ebe1a56", "value": "24576:D5EmXFtKaL4/oFe5T9yyXYfP1ijXda+3WNipKQB17W43DU52lZ:DPVt/LZeJbInQRa+Eipx7P3wo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810758, "uuid": "d7bbdfb5-a35e-4424-bdcb-21e5383e137e", "value": 1292800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810758, "uuid": "8093b40f-1537-47ec-9cd1-77a97091164d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810758, "uuid": "3febd5d9-a908-40a8-900e-6205866c0a80", "value": "0320749b9a15ad5d4ea691d3cbb01aca2a484a2886f5df4e1aa907e04bee4385", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b676ce39-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (DDoSAgent)", "timestamp": 1772809013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809013, "uuid": "cd6b4b9b-5f31-4dfd-898b-8369e78fc2d2", "comment": "Malware payload (DDoSAgent)", "value": "23bfde69eced4eb3b1ef37430bc6b002", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809013, "uuid": "aaed4b1c-f9ee-4a57-9172-0afd48faa41b", "comment": "Malware payload (DDoSAgent)", "value": "0377d82fed702278699764f0a16b5d5fa566581f9f6e4d147268c019293b7388", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809013, "uuid": "a2f91050-a7be-4ba0-bfb9-2bb197404af1", "comment": "Malware payload (DDoSAgent)", "value": "84c77a10d911d0ee296e0a0a1d38242f7cd289d9", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809013, "uuid": "fd5887e5-d6d8-4fa4-9d49-fe84bcb68386", "comment": "Malware payload (DDoSAgent)", "value": "ddffb1fcbe20b570673f3db85490f74d2b41c6f2395a97a0c43aefe32d8d95f85e18de278159f5b3682e4346dec58d92", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809013, "uuid": "257d4e4f-28b5-4df2-845a-caf5a7654024", "value": "T141473B51F9CB04F6FA031D3140ABB22F63305D458B28EBD7DA447F2AF93B992493615A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809013, "uuid": "7f9462af-fcec-4f72-a99f-c5457d4310d1", "value": "196608:cRlr9DrKm9aybwRT3Frq5RUuy6x5XZf8HbDTsJKj:4/qbtuRxrIvTsgj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809013, "uuid": "8deaba44-3f13-4fbb-a1c1-25bc8f5b71c9", "value": 26267832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809013, "uuid": "8c274431-8f2f-47c6-87c9-3858bfa6015d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809013, "uuid": "6bdf7c2e-a2dd-4a96-bb29-9b9b0b352ca3", "value": "apex.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "073c6379-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772811296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811296, "uuid": "0791f765-c634-41de-b790-ced30e7d68ba", "comment": "Malware payload (Smoke Loader)", "value": "c7413fd3690789cb2bb318f7ddcb3778", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811296, "uuid": "7e6a0251-aa9a-4479-bd63-2ef47ebe406a", "comment": "Malware payload (Smoke Loader)", "value": "03ceed8719bdcef60a9a3b46fee00c2f02df9035e8b9f37b7058e1fc022bbbe9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811296, "uuid": "67ca5fe9-cf78-4a4a-97e9-ab269f7bf99a", "comment": "Malware payload (Smoke Loader)", "value": "119660dcf6a8f8861d0cd64c07d20219a9640105", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811296, "uuid": "58e4f24a-8bda-40a9-bf33-2751968e135b", "comment": "Malware payload (Smoke Loader)", "value": "6e5abad89fa75c90991ec00939c4c513afebb6a2a8ccf3b57416c2b7af695262264aac9d40957eba50bd11b8b2160599", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811296, "uuid": "b5f08c3d-d7e0-45a7-9a64-52ca7d2e26b3", "value": "T10BA5380F7D9508E5C0698676C8B6D1927B33B8490B3E27C31E907634AE726D59C3FB1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811296, "uuid": "73a97f15-1b5c-4c43-9df8-c59fcb194ea5", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811296, "uuid": "57553f13-9f32-43c9-b275-5cd37c689ae7", "value": "24576:32kwbTKlpDXwmugpH7W4RalZFC1rtP/zqS+/O5lsHC:32k4TKlpDXwmuaW4RalZFC1YDJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811296, "uuid": "ffa97416-0e27-4a1d-a1d2-90be8d039fd6", "value": 2113536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811296, "uuid": "95979939-30f5-4b19-a500-4e8acbcec987", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811296, "uuid": "bd946e31-b567-4d43-904a-1afe0b8415e1", "value": "03ceed8719bdcef60a9a3b46fee00c2f02df9035e8b9f37b7058e1fc022bbbe9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0806b85-196a-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772808198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808198, "uuid": "5e2fb4f3-b182-40ac-b853-eb474e258f61", "comment": "Malware payload (Formbook)", "value": "1c75ada947b45971f3db807ab4ce30e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808198, "uuid": "90f0ec7c-2bb3-49ad-84c9-5979cbfa5d13", "comment": "Malware payload (Formbook)", "value": "03fcf4d1928631193b9ef5fc41984317e7b0ba5248dc1f50e0e2b6267d4e19e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808198, "uuid": "fefea705-5fe0-4d0e-b787-33528daa67f8", "comment": "Malware payload (Formbook)", "value": "436a5d7c25ad0bd8d8ca70acdbdba34215968936", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808198, "uuid": "b8a76485-143c-4bfd-a821-c194bf4d9990", "comment": "Malware payload (Formbook)", "value": "88742314bda708ab6bf9caf9d5d03861ee3fad7b5943c36c9a9feb8737ee8524a8d904e79d33b312c6e2718b05c0727a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808198, "uuid": "25cca92d-a83e-4422-aa4d-458f5cc0423a", "value": "T19935121073AFCD23C2A41BB254E1E77003B58E59E513D217AEDE6DEB3A27B964D80643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808198, "uuid": "b93e3740-c7f6-45ee-9bb1-0ebace1857e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808198, "uuid": "63c5f011-64e5-4496-b59e-10e0c6460ac2", "value": "24576:qAOFOEyQBpq0+7wZRTjZzxqZyysEhzG0rTDCrHMQsguQlVict:qAS5hq0+7Ud9x4TX1tzouWQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808198, "uuid": "1f110421-c3cd-478b-895d-4611fbf4eda4", "value": 1091584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808198, "uuid": "c4108c4b-9583-45df-94a2-feae9575ab69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808198, "uuid": "16672e43-9270-4043-93e8-da227f4f9f4e", "value": "03fcf4d1928631193b9ef5fc41984317e7b0ba5248dc1f50e0e2b6267d4e19e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbf44e99-197a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772815142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815142, "uuid": "914eadff-a938-4337-84e3-9dbad996d2f5", "comment": "Malware payload (Mirai)", "value": "46df6c34e1abbd693aef6e0439ead502", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815142, "uuid": "b7651bd8-b5da-4454-ade5-441231957349", "comment": "Malware payload (Mirai)", "value": "04457096271432b6c1253bcd11e02fabf97b303f579c299e01d2ef9d9db3520f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815142, "uuid": "1b687972-b261-4dad-8db2-f8b560daccc7", "comment": "Malware payload (Mirai)", "value": "cc707695a3aa5d637b78e19033733e3be1a0b352", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815142, "uuid": "c2e2fa29-ad8b-4340-8a1b-18838199ad7a", "comment": "Malware payload (Mirai)", "value": "65f326dd1f718a8013b49a076c2e684ffcd22a12dfa80dfe1f7aa6f3e1cd4e97fe52d67c639e84ea1654a209446d10f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815142, "uuid": "492276c3-8305-48c6-b46d-d23cc1ddb1e1", "value": "T139837CC6FB43C4F4E8120A712177E7318A73E53D502AEE83D769A872BD12641E75A39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815142, "uuid": "5b9da220-9261-457e-80a3-812637f59ba7", "value": "1536:4NGfle9cPS4HSY6iAXVE143RrFUCeWtsrswWdZc:4cEWS6SY6iA6143RhUCeAszt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772815142, "uuid": "812115f8-0bd5-4174-a50a-2b560080167b", "value": 83600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772815142, "uuid": "832e8000-088d-4331-add7-39f4be0ab9ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815142, "uuid": "8467b01b-5ea0-4e8e-b5e8-6da78a78a627", "value": "titanjr.x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69260a90-1963-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772805018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805018, "uuid": "5256747f-e30b-470d-bfa6-10fe195e3643", "comment": "Malware payload", "value": "53610c8951b951464d4c6c67f71c7a79", "object_relation": "md5", "Tag": [ { "name": "abcknIe", "colour": "#31F8E7", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805018, "uuid": "025cc194-f3b0-4caf-9f65-164d359724ad", "comment": "Malware payload", "value": "046ef1c213aae4a5a7758af1e1ebb04ec8500ed1c1ff6aca4d4c91ace06602e0", "object_relation": "sha256", "Tag": [ { "name": "abcknIe", "colour": "#31F8E7", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805018, "uuid": "5b13bee0-52c0-4822-b5cf-f3e4e54e563b", "comment": "Malware payload", "value": "6725450fe18efe7af94c4bed479d81867009ac43", "object_relation": "sha1", "Tag": [ { "name": "abcknIe", "colour": "#31F8E7", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805018, "uuid": "508af3a3-b6c3-4614-993c-380f6af91bee", "comment": "Malware payload", "value": "65928a6d5e1ad8deba53d1fa068cb5eed7f2f9c0734908066e974af1b0859cdb8f2281dbc8dff4a02aee75674f473127", "object_relation": "sha3-384", "Tag": [ { "name": "abcknIe", "colour": "#31F8E7", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805018, "uuid": "79d00b2f-7183-49e7-bb35-b1dd063ffa0d", "value": "T13AE260E2B130C13942DDC8001BFAE94CC15D05E09E05540AF2BDCE8DBA7674A7BDA7AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805018, "uuid": "8e4e1ab0-35e7-4191-8eaa-4012c9c570a1", "value": "192:2FROgp1Mt1sz4M33UF3zBAM2JqXWdImah73ZORBUAc:WROm1MtsUF3zBAM2J6Rh73ZORRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772805018, "uuid": "bfaf8a85-c5ab-4769-a1e5-8b44523dd9cc", "value": 34066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772805018, "uuid": "a98e9523-4622-4448-829d-7f2adb01cf6d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805018, "uuid": "ebfb2fdd-ff12-4321-86ab-b4e08d9391ab", "value": "Bank Transfer Form.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcd1911a-1970-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810795, "uuid": "07f097a5-cc4d-4dc5-91dd-0d9d7e6c473e", "comment": "Malware payload", "value": "898f717a70ef5c3918a79744cc0ac692", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810795, "uuid": "71029896-2219-4ec3-a0c7-3ee54f66ccb6", "comment": "Malware payload", "value": "04747c51231d4890e70faab31fbd1ee37e31890c64b19f01ef60d3c17ec2a773", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810795, "uuid": "e647cef5-69f3-4356-af4e-d50adc86b569", "comment": "Malware payload", "value": "29e1c5640299c0a36d73bc0c8be45046160a78c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810795, "uuid": "33ea8de5-3196-41ec-b5b7-380db7206172", "comment": "Malware payload", "value": "93cc580bc5638980ceb32edce3bb247f011f4d59a2144af9a78b10f015084fa9dcfada9c6f2bad18a0906c44dad8e79d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810795, "uuid": "69de5db8-f1bf-47d2-a033-b00154d8e5d8", "value": "T1E6C4220607B4E917C9221DB619E31B9BEFF8DE031530A3176B40EB2DBC7765069463AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810795, "uuid": "6cc56469-f717-40e7-bcc2-c329ee5b6140", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810795, "uuid": "9629cd7d-9ec0-450f-89e0-387889866a85", "value": "6144:RR+xXuhPqBFlZPR3tLxljrv/8GvFv8L7DoonDkChfFTskVF7+EOQn+hx0UcWMLO6:f1yDJxzviDkChFTtVFPOaVzch2SsFx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810795, "uuid": "ecc08d18-5d2e-47b3-ab33-7c3c3549ecaf", "value": 549472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810795, "uuid": "fd7d806c-74ef-4359-8934-e9399afded7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810795, "uuid": "2235b8f4-9f9e-4919-9970-5303356f27d2", "value": "04747c51231d4890e70faab31fbd1ee37e31890c64b19f01ef60d3c17ec2a773", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02f931ee-197b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772815154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815154, "uuid": "bc417759-e02d-48dd-82d1-1eb254bda395", "comment": "Malware payload (Mirai)", "value": "ea9902e016999ffbf4b4bba5513b0b0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815154, "uuid": "0816f0a2-fc2b-48e3-9920-1cebcbdce36d", "comment": "Malware payload (Mirai)", "value": "0474b0ce5ba46379553327c202548576b2b3f69d63cd9111e41a5c0fe12f7f0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815154, "uuid": "3b641056-2d43-474f-af6e-3a8c0daa6f65", "comment": "Malware payload (Mirai)", "value": "3031a980850c9533292128a260aebe1226ce9ce8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815154, "uuid": "4935672d-4cc9-4478-9eae-28c26c006462", "comment": "Malware payload (Mirai)", "value": "4e881d494ec0b6942e365e7b9ee9845631da8ef4304f55efc944bd13d72dfa7b2b65d6ec332c44416e5778dea071c7fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815154, "uuid": "be0403cf-4424-4b3c-a740-9eede66461e3", "value": "T1FFD34A07B5C180FDC4DAC1744F9BF53AED32B1A91239B16B2BD4AB221E89E315F1DA44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815154, "uuid": "8971aaa9-af18-4caa-aa58-a19f0823f78e", "value": "3072:SxhiZfgBgmcGKAXvypbS2rrE+lxV7BMgQyF5iMUeZGXx:SxhiZfgBgmcGKAtReFUfx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772815154, "uuid": "29296eff-cf5e-49b7-bcb8-0dbc0be28ee2", "value": 141784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772815154, "uuid": "d6dd76d6-fbbd-4247-b3f7-9726c2abbc90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815154, "uuid": "332f95d0-f07a-464e-866d-722865e8ffab", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81d7a811-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1772819232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819232, "uuid": "4183bdc8-1fe3-4484-8337-d08a95caf258", "comment": "Malware payload (Gafgyt)", "value": "a58b6e6957fc494eaaec12184bcb8af7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819232, "uuid": "816e80a6-f766-4ffa-9e85-fdb7d6ae0584", "comment": "Malware payload (Gafgyt)", "value": "0480e1be9f8e591c414c82cbe8717b3a81afacca4c141d2b454e14b390332257", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819232, "uuid": "8d46d3d8-9270-48d2-8f32-5dc1000618e8", "comment": "Malware payload (Gafgyt)", "value": "1c36a9328327668b0f8057e36d8213a1d3ff5160", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819232, "uuid": "34a88dca-e6f2-4c25-b63b-721b3a647c4c", "comment": "Malware payload (Gafgyt)", "value": "36c9f6e61efbc49d49f887af6b0eb8f8adcb217584eccb1b39dff0e94ac7593834f83478673d383c01467d592cadd8dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819232, "uuid": "12c27ee1-c565-4e63-abb1-c8a03e069603", "value": "T12824F901A9518B57C6D22BBFFB8E429D37365B1897DB33019E24BEB02F8578C5E3A111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819232, "uuid": "8478437e-ac4f-4fec-9ddd-a89fe4e926a8", "value": "6144:qmFlJ1TX+/hlxq5oI3ntDG13r+MvjOjRbeZBV/rgUMX08C:qm91TGsn9KTvjOjRbevV/rgUMX08C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819232, "uuid": "747b3277-68c1-42fd-9324-28552a03e2c6", "value": 228577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819232, "uuid": "1cc75b83-d3b5-43aa-b109-f1a1e81d10d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819232, "uuid": "2ab5c139-e29e-4dd2-83e2-368d0acd8547", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "680c4d2b-1972-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811458, "uuid": "3f38c62c-34b4-450d-b9b9-b9c7f7d14d8a", "comment": "Malware payload", "value": "aef2a16082d0302646aa9fef390d2d1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811458, "uuid": "53fba689-2d33-44c2-909b-2688dbcd7627", "comment": "Malware payload", "value": "04abd60e49b28e5c6eab8d3445f32e444d09a95324cb0d06a1695185f74b004d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811458, "uuid": "f3d14d16-31bf-496b-a020-0b92fb537e24", "comment": "Malware payload", "value": "d5473434e07ec25dbf10f606b141dbf661acc122", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811458, "uuid": "21b7569e-0418-4ee1-b35b-2f65cef8fe7a", "comment": "Malware payload", "value": "97e29f854101da1e5875ca446778ff76fc3d698b41beba9f19a03e441cb1cab369ec43fa2117e0276bf27694bc404805", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811458, "uuid": "1a54b07e-3228-43b8-8346-e752a9c498ff", "value": "T12525332A9374EDB7E5B21B309CCE20263AF4700325B983DF1350AB956C1D7A49A2F7D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811458, "uuid": "5b89162a-7c4c-43ef-b358-9474ccdf87d0", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811458, "uuid": "d17ffd12-7726-446c-b49a-9acea16aeca0", "value": "24576:Lmr/GquJ6RmgJ3aloHw+djApl/kT57wBRhJSfVl/Xio9E/v:gQJpgolaRWHkT50LEio9+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811458, "uuid": "5614341b-9b18-4f26-9a2b-6b7d4c808e87", "value": 1040584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811458, "uuid": "9265f1d1-4c2d-42aa-85a9-5ee59ed19b3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811458, "uuid": "a7821fad-b537-4110-a248-e42a760bcbfc", "value": "04abd60e49b28e5c6eab8d3445f32e444d09a95324cb0d06a1695185f74b004d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e3a389f-1964-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772805295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805295, "uuid": "2c09121b-19e3-4f54-9ca5-5b804e953550", "comment": "Malware payload (AgentTesla)", "value": "b6b6676130a7a79ae8be4a940cc7ac35", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805295, "uuid": "7a5d6194-3d14-442e-a600-0bfa58a028d5", "comment": "Malware payload (AgentTesla)", "value": "04d2c4a9718298c1e38be2061c3e5afc958532162aba22020c189c98a6594726", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805295, "uuid": "349afa08-d0ab-4c1b-b096-a6ea0ced7c06", "comment": "Malware payload (AgentTesla)", "value": "72ebee399feed0415a92317696c768dbb5dcc254", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805295, "uuid": "1fe99c3b-695d-46c3-bd12-dfc889a9ede3", "comment": "Malware payload (AgentTesla)", "value": "afce2c936053fb8d0fa0109d4ebf9354f605c3acc40eb4616de70d6b07d306c0f9b12eb7dc4aa45d964e972024208406", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805295, "uuid": "1c3816ec-0d29-4566-80bf-78ec458ddcaa", "value": "T19945BF0273D1C062FFAB91334B5AF6115BBC79260123A61F13981DBABE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805295, "uuid": "66f89174-a7cc-4a22-9699-49969f4cd501", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805295, "uuid": "df24210b-cbbf-43c8-ae3f-0071045468ae", "value": "24576:f5EmXFtKaL4/oFe5T9yyXYfP1ijXdaxIhP4GD2YD3Q0o:fPVt/LZeJbInQRaxIhAGDz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772805295, "uuid": "a14ad424-8aa3-4016-a1de-46f5e123f26d", "value": 1249792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772805295, "uuid": "db06fc12-bf0e-4eaf-a646-42f1eacaa5f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805295, "uuid": "2fafa7b8-6a35-449c-9d1c-5462b9baa096", "value": "04d2c4a9718298c1e38be2061c3e5afc958532162aba22020c189c98a6594726", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13e61369-1971-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772810888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810888, "uuid": "6b59509d-3947-45f8-b105-190fec89f58b", "comment": "Malware payload (Formbook)", "value": "aa08efd099f444e79ac40bbb1a87580a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810888, "uuid": "d276ceb2-eb2d-41ab-b117-cd884772c1be", "comment": "Malware payload (Formbook)", "value": "04daf75499c786239f5f2c25dd1ee4ad7d15d750518e319b69597a73824676f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810888, "uuid": "2f5378ef-ce67-4947-a5ba-c40b28d99af1", "comment": "Malware payload (Formbook)", "value": "3974b95190ef4f2f062fe3be394e0cb67758416e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810888, "uuid": "20a5118f-878f-4214-b06c-7feff07f0eb5", "comment": "Malware payload (Formbook)", "value": "5aa0047f39d7d99110bb83a54adb9f79f0d6063f85de0adf8430eb9fc0857b350fb12dfb1f5816a9c53cc0995f90ecf9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810888, "uuid": "dad6712b-4dca-4cae-a134-f54fd989c918", "value": "T1CB45CF0273D1C062FFAB96334F56F6115BBC7A660123A62F13981D79BA701B1463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810888, "uuid": "41f576a7-7374-44d7-a96a-a6f7e0255fca", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810888, "uuid": "a82cd056-d21a-4142-b676-a6fc23326d2a", "value": "24576:i5EmXFtKaL4/oFe5T9yyXYfP1ijXdajRCGysuM05f:iPVt/LZeJbInQRajRgW0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810888, "uuid": "6b15b55a-0f6e-4bd6-b581-c4bbc2337f63", "value": 1280000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810888, "uuid": "087116a6-cb90-4851-8626-133a8d58adda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810888, "uuid": "c5501292-7f40-4139-b7f1-5092a2cc3251", "value": "04daf75499c786239f5f2c25dd1ee4ad7d15d750518e319b69597a73824676f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80a8c6c8-1951-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772797326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797326, "uuid": "18204d44-1548-4270-b2b7-1646d07fb309", "comment": "Malware payload", "value": "f9e7be7dbb2a400cc58341211c130650", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797326, "uuid": "f31e42ed-9ac6-424a-a85e-4737bd932924", "comment": "Malware payload", "value": "050241b7685e48fc4a1a042a1f45a090ce33abf72ea8ee339d7a66b48e621ef5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797326, "uuid": "d06738d9-46cc-41bf-a8f5-0e1326777004", "comment": "Malware payload", "value": "aab2e321b4d2c22e08147fb1e07a61528402c156", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797326, "uuid": "93dd8736-d2cb-4724-bf8a-73d6745123f7", "comment": "Malware payload", "value": "8033537ee7706d2bc981d850c37265f80395a49182dab6a2b282ec6dddc2fcf78779dee38e883da00719994c9d358b18", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797326, "uuid": "dfb84f41-1ac4-4466-8c99-8ebb0b0df22f", "value": "T15B41D79733FE397A8A9614A7842E9405D6754EA11C065C00BACD0E076C5D6883FBAF38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797326, "uuid": "5bad699a-28b5-4093-9a7a-93fcdcfbe83d", "value": "48:7jOgo7b5jag3L8GbE4+EvPbjrXecbtlaw6QRnpoQp8Owg/Rf6WcCE1+0nL:7jqjHG4PPrXecbuNQFKSRf6n4K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772797326, "uuid": "f481765e-326b-4148-81cc-4e72f3f56e57", "value": 2207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772797326, "uuid": "0de41016-b98b-4789-81cf-5bea21e802ed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797326, "uuid": "0c8a6d59-d700-4f50-b618-13556b54292f", "value": "050241b7685e48fc4a1a042a1f45a090ce33abf72ea8ee339d7a66b48e621ef5.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc439aed-194c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772795386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795386, "uuid": "6af20cba-4e23-4bea-abfc-18a3176cbb1b", "comment": "Malware payload", "value": "70483bc8b0e55c9cf6f27f7049beb728", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795386, "uuid": "f0bdfcf5-6485-4d56-aab1-e5d3c3e0fa13", "comment": "Malware payload", "value": "05cf4074761f8d60963bceb9533ba4c168586d861caf8decacf0fe92f8ac292b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795386, "uuid": "99b81d02-0b1d-4faa-969f-4c994b18f0cf", "comment": "Malware payload", "value": "6c65b363f0f891b73d6fea4e0023dc238b1da9cc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795386, "uuid": "91364b05-d204-495a-b36d-3382c27e4eb6", "comment": "Malware payload", "value": "1ef7eacb9ad3d99888544747731b28aef95d854206973188a0b1c9edab3e434a9e1b8ea4ece677d205c00d9fabba96c6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795386, "uuid": "1c50a584-516d-44aa-83a9-30480e9a93de", "value": "T1A507AE23AAD08174E6D691FD86FA373AC97DA905033881D785C46C945F32AE23B3E717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795386, "uuid": "129be6b5-2ed6-4632-b2c0-0ca7cee35701", "value": "0bf4447fda89303e8c2644bb6df92eb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795386, "uuid": "c882f70f-6b60-498c-80ed-50dd55a8f230", "value": "196608:wQke5A05AXFN3delxDtPAFGfcn+hr7fTmCwmDoYzPpze:wYA0aFsDXcn+B7imDoAPpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772795386, "uuid": "235306af-35d7-4c42-9cb1-ff8fc45cd482", "value": 17988088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772795386, "uuid": "c6f17c6e-2854-487b-aa3d-79c16bf19574", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795386, "uuid": "6b257265-0a90-4f52-ae35-84f66d03568b", "value": "wke.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54c1422c-197f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772817009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772817009, "uuid": "a01bf229-2ebe-4acb-be73-9868025187e8", "comment": "Malware payload", "value": "dfa6b624cbc76b78c0f374d8b324de34", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772817009, "uuid": "bba966df-b6a5-4fd7-8f25-e06d6ea7b0c3", "comment": "Malware payload", "value": "05d6f4e462065f3c5c3710775f15f96d333ff3d35ea7860536c6208ff4c2f294", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772817009, "uuid": "d9df4088-2792-4e4e-8656-bc9a737e974f", "comment": "Malware payload", "value": "803ce49d77f3f94d04d7d2aefd26127644889daa", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772817009, "uuid": "e24e5d1e-4ebf-4767-95e9-72f3934f2cf2", "comment": "Malware payload", "value": "41f812e137befc9d78d8e4a9c5c0aa4a1a663b2b7c8543e2589890d296224775fc2f5c7115cf3bc8531a87351e858580", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772817009, "uuid": "566c9688-ec8b-45c7-8801-a40867be1678", "value": "T14831E02778368210DBE056F89A1D3A61B757834BA701FFC5B3C16197A80B22687F06ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772817009, "uuid": "0d9648f0-dc5d-4c49-b895-525936e6c160", "value": "24:wtOS6O3KfdpBwa2pdu4FOwfjJ396+4ef1jSvJfdA0VCCJlTQfsz8V7PCOwfjJ39z:CefpXY3o2jSv/A0v8Ve3s3UDrH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772817009, "uuid": "ea6d6b60-8003-4d5e-9605-e9fe7d24a4a1", "value": 1824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772817009, "uuid": "3b123131-4c76-4da9-87ad-67e4ca0b49cf", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772817009, "uuid": "3f7f7220-5022-44b5-84b4-246fa250f07c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0f9bbe9-196c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809004, "uuid": "089ebe28-21c2-44c4-9d59-181a1048835d", "comment": "Malware payload", "value": "e270e30c1861ec8b0967fafe03b4a178", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809004, "uuid": "00fe552c-9651-4edb-93d0-51cd44f3bd67", "comment": "Malware payload", "value": "062c3c93ed5729c7965b7dc1bc56a8cbd024efccaaa4ab90bd701311bda6a90e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809004, "uuid": "fffe3b07-67a0-4fe8-8886-9e221d419167", "comment": "Malware payload", "value": "e850168609d26230075da75bf6d967c4174ee682", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809004, "uuid": "f5287c5c-9f03-474f-8813-4a44aadf215a", "comment": "Malware payload", "value": "c69da74057ce4423566d02482bdf86a96de211176db066d98a9d04c48124655b3357439e1403e9dc7b51ef6e720bf444", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809004, "uuid": "d53c8349-c7ad-4c02-87e0-6e54136e2e4e", "value": "T1FE472A87B8924952C5E83A77F8BD81D832720EF98B97525B5D05FE383EBE4D90A35340", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809004, "uuid": "8214a156-3aba-47bb-8ce2-94509776c11b", "value": "196608:xYDbAzQYKByMJj5q0ZYE0h0GW+D06x72FOW8PSnbbqH:Jz7y0h0sxCFOWyH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809004, "uuid": "33033a0b-bedf-4ec2-b3ec-8ae27e618a67", "value": 26149048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809004, "uuid": "3c90f658-9bf0-4fa3-9b6a-539f89e5233c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809004, "uuid": "0ab852d8-7450-45f0-b174-689a8ea58a4c", "value": "apex.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42835569-196f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810107, "uuid": "49a8aa7c-3d42-48c5-a833-c0fa39ff57be", "comment": "Malware payload", "value": "70dbc9a136e8c38a0fe97ab3f010e847", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810107, "uuid": "a2fbe713-6968-4d0a-813d-1b6743e01de2", "comment": "Malware payload", "value": "066b34ad913a5b7fa8c840e9a7b071c88eb0459d5aab6ffaaa5d04f35a2657e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810107, "uuid": "de850466-15f6-4aec-a28d-5be843acbc41", "comment": "Malware payload", "value": "37c8573acdf1068d39b12e0914fdbdbbbb1d6f63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810107, "uuid": "f9799af8-231b-4fdc-996e-ddd5a313133f", "comment": "Malware payload", "value": "16ca2ce2877d796fec0a60e85e9c87d9844e16bca5519cdd7f75561d4e54819da9167a17f939f4cb0dca24fada170b0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810107, "uuid": "02374594-efc5-4b2c-a04a-96fabe33c6be", "value": "T157251255125EEB03D4971FF40AB1E6B147B82ECDA862E31A4EE67CEB743A7C45C40392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810107, "uuid": "937b08ad-3dbe-4ad9-8f02-f2e1a61f2e2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810107, "uuid": "fc3bcdfb-5465-47f9-ab54-ce3e7879897e", "value": "24576:geqcnDI82O9Cm10GEG3w/r2VNCWSHER+TZsSnJ/:geK8tCm10nYw/UYJEgTqSJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810107, "uuid": "704fbcb9-0012-4036-b6f7-9ee58a63677d", "value": 1027584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810107, "uuid": "344c34b3-4b4a-441e-9ed2-bb4933de8bd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810107, "uuid": "c52d8a92-52bb-40d2-91e8-18bd21ce5a87", "value": "066b34ad913a5b7fa8c840e9a7b071c88eb0459d5aab6ffaaa5d04f35a2657e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dcc9e6c-190b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772767096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772767096, "uuid": "9ca97e81-e459-49d8-a039-6a2608b2ee75", "comment": "Malware payload (Mirai)", "value": "09d8de8902ac92200824a0e81a944f2d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772767096, "uuid": "bb0735b8-6b81-4519-9cac-fb5bad0a7182", "comment": "Malware payload (Mirai)", "value": "0675fbff70f3a74eb40e1434e0e9550aa98393d529692946db1bf9b2529fb8ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772767096, "uuid": "47de41f3-666b-47eb-9d23-2d2db54f39f3", "comment": "Malware payload (Mirai)", "value": "7920ddc601059a9c9db2e4a7bc5ae161c58ca2f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772767096, "uuid": "d06ed81d-5002-490d-a086-ac196c9ea007", "comment": "Malware payload (Mirai)", "value": "b5bcd565c3e2b319203335f1280b6f60dada4e21f22ed45a66c1cd04c3de99f19db8e52aab4b0412b27a044e9eb40461", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772767096, "uuid": "e4c95d0c-40e3-4799-9197-417404564ea3", "value": "T13FC36CB3C8666F58D559D1B4B0608F792F53A91182871FBE2977C2B68083D8CFA053F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772767096, "uuid": "a428d386-e0a8-48ee-8189-20293dd75ef2", "value": "1536:75KpJ/jGeQvZzZXn0FyCucKsEYoeTiT6Hk9pAWvuoFPocdOsn:75EJLGe+0Fy3DsHiGUpAW2QP3OG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772767096, "uuid": "542b33bd-4bba-41e3-ba85-0db542e941b8", "value": 121664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772767096, "uuid": "1eaf0823-450d-4d90-ac39-2726594c5c46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772767096, "uuid": "1c55ab29-0c6f-4678-bc55-d50caa7873c9", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cf15744-196d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809373, "uuid": "9d12289d-e9e0-45b4-bcde-3639f3b018d5", "comment": "Malware payload", "value": "8ad0c26953db7253876338b387d547d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809373, "uuid": "bfa0ef11-64c4-4ed1-a92c-7e4e5f610e7d", "comment": "Malware payload", "value": "0678e82774ae268fefe1d4d050453992d8afc816e793f44684530c11f07f9c95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809373, "uuid": "29952486-48b6-4a11-9575-168cbb827dfc", "comment": "Malware payload", "value": "e68b3cfdf6d86cfc0c841dbf59c6dfe47e9c0d78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809373, "uuid": "a07c0638-e9cb-4538-8c95-927e99c263b8", "comment": "Malware payload", "value": "a3f077902caa518071d0160d85a18b6563604846c39f72009696a27088e75d9df2e77ec9399a6d3038bfe13ec94423c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809373, "uuid": "571e7795-62b1-48b1-b035-84cb7fb06986", "value": "T1EE94E416E760B426E89349B02D78A256391D3D3A2581ED0BB78DDF4A3B71983B1F431F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809373, "uuid": "d88fea7f-29e9-4cf8-9694-0f20f8467884", "value": "35dc8f6e4741152373bb10383b865ed5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809373, "uuid": "fc0b5df4-145b-4980-8853-1f7eae263e64", "value": "6144:Qt4+q1NEGP390lLHmmySEBW+rowlr2WHPjKka/Ct2uxVeQ8bz04y9NjjaVPBN6dW:QW+4E+uEBW+rowlr2UrRxVeQ8s5eBWW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809373, "uuid": "7d58c3ee-0403-4e48-999e-30d13d38cb44", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809373, "uuid": "adba46e7-a226-4503-bff6-96defa83f135", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809373, "uuid": "b21a54bb-78d5-4820-9d62-93ec22fbf0f3", "value": "0678e82774ae268fefe1d4d050453992d8afc816e793f44684530c11f07f9c95", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "758e3b09-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819212, "uuid": "6a3e96f9-21a2-41ab-a1c4-b4b04a05bf93", "comment": "Malware payload (Mirai)", "value": "868f1f947820bd3e1e233f030d684dba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819212, "uuid": "412b0c1b-6901-4d34-a145-968561746359", "comment": "Malware payload (Mirai)", "value": "068ad91e7770d17d9222f3cdce5e8136fa506a7a36a1c11ca791d55fe010ee56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819212, "uuid": "a3b77a6c-5837-4615-9975-a5634eda4bf2", "comment": "Malware payload (Mirai)", "value": "00bb24a2c8ed8ec78823f7d242f7b9f18e89b0e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819212, "uuid": "ef2a8545-c3a6-4558-8e65-b7c09ee3e5fa", "comment": "Malware payload (Mirai)", "value": "b4f0c89d9b1449f2ac3f7374f48a64f32fa7960b9a246070b3df302c9128fad59e37c6f545d117648a01b9d09a18bc3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819212, "uuid": "3578faec-ff9e-4e22-a7e9-291674defc08", "value": "T1C3C33902F58584FDC18AC2300B6FB63B9936F1DD4238B2EB6BD4EB127D4AE214E1D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819212, "uuid": "42d063a2-f530-4aaa-bb3e-6489a47a9956", "value": "3072:UXbg5lvpREgWUhWpN1sP6Gf3qllxu7fWJfDDJ+oJvc05su5o5x:l5lvpREgWUhWpNmP6Gf3qllx6GrcyU6U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819212, "uuid": "d044d757-c8ae-4173-8e12-45a120a9deed", "value": 129088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819212, "uuid": "ce295710-b6c5-4080-8c8a-ac5e0bc82bf2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819212, "uuid": "f59feee0-07d1-41c6-a95a-09979447e979", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a308820f-196c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808980, "uuid": "b44c9a40-eb9a-457b-a11b-7892e4b9118f", "comment": "Malware payload", "value": "b30430aa42b1b34e45bc76ae4c1e084b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808980, "uuid": "e2c574db-e45e-411d-bf7c-e466582a93b5", "comment": "Malware payload", "value": "069e4614606ef738a8c4420ad04f78b8dc920f0ed21a917f2190c345eb316db8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808980, "uuid": "735e0c08-555d-4346-a556-635ff019c9da", "comment": "Malware payload", "value": "f1a39123883bf20c98aebcd160c68e86708d7304", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808980, "uuid": "bd463e6d-a2ca-4fb1-939d-fad1ff034d71", "comment": "Malware payload", "value": "a904b66db41570f91a08d6793ba88318bef79062dacecedf0e90a9a7e3523036c95cf19f75ecf8200840a6d6cb028c57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808980, "uuid": "d368a5d5-fe3e-4d57-b567-17431dddf59d", "value": "T12C45DF4627E85A58F5FA9F38297464140BF9BC279939D72D2A4840FD0C72F45EA22F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808980, "uuid": "3ad18e31-1f4d-45f0-b1bf-05b68f6d2d62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808980, "uuid": "15f7bc34-7677-4337-a1b6-490beade2e3a", "value": "12288:tLBYzyKMJ5r4s7GszIMjy1j89CFnLT/N0HPNI0iAxxrKXBxoo1C7D/hPkg+CaHmq:U0ghpLT/4PPH7caoc7DRkWaAJX/Wtv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808980, "uuid": "5a35a2fe-5a40-4c3b-a2ca-6dd8055b80d5", "value": 1188864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808980, "uuid": "07505070-c0a9-48bf-ac68-cba551391236", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808980, "uuid": "d3270d39-cbdd-46da-a94d-8e68b3f591e2", "value": "069e4614606ef738a8c4420ad04f78b8dc920f0ed21a917f2190c345eb316db8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "257c0714-1954-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1772798462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798462, "uuid": "a78ebe5f-c0e5-45b4-953d-20fff0ed65e9", "comment": "Malware payload (QuasarRAT)", "value": "5b8302f4d40bdae9ecc9752c9c0e62c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798462, "uuid": "4128eabd-7dd5-4f03-a55c-086ae9c06ee4", "comment": "Malware payload (QuasarRAT)", "value": "06c3f12b3da7d065ff2a77c888ecbfa7afb1fd0b0b66e3322f52f8001d5317f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798462, "uuid": "00f53e7c-548e-4768-b524-9ab392c8edb8", "comment": "Malware payload (QuasarRAT)", "value": "5000467ccc15b535f9dd594d10cf27c69bfde118", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798462, "uuid": "124389db-3745-485a-bd88-16f64a4a5899", "comment": "Malware payload (QuasarRAT)", "value": "c3bc6062316c99ee3110407aa72695dd1f5f2463c66b1340997844c239db37c23e1a14d338358c423bfdd99d78b8cef9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798462, "uuid": "0e6c6bec-f20e-4de0-bbf5-c3e31a76a312", "value": "T1610639143BE85E22D03B92B295B0D13663F1EC2AB363EB1B51E1AE7B7C537405C416A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798462, "uuid": "21628fe6-9c2c-4694-a44c-3c65f32addc7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798462, "uuid": "bdbd6576-fc0b-44f5-9235-babf16009f1e", "value": "49152:iv+I22SsaNYfdPBldt698dBcjHdarbfkwvJSLoGdGTHHB72eh2NT1:ivz22SsaNYfdPBldt6+dBcjHGkLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772798462, "uuid": "df6b66ce-8cb9-4c62-8d7c-ca792f7e3efc", "value": 3698688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772798462, "uuid": "3a0f3b2f-9c0e-4f35-ad54-8b1cdb87f752", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798462, "uuid": "0105ae8c-fe72-4bf2-a51a-858019f86cfb", "value": "MW19-Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "980991a2-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772809391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809391, "uuid": "93b2342f-68be-44f6-8cc4-a87764602c53", "comment": "Malware payload (AsyncRAT)", "value": "8f66108ec8f997b14f660e576bdca751", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809391, "uuid": "2e03f25b-ee75-4899-9518-bebbb9e1ec7c", "comment": "Malware payload (AsyncRAT)", "value": "06c4acccda31358fd172466d6245f827c2b5075dec6496516286f936f22ef771", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809391, "uuid": "392722eb-d2c2-4d41-b0dd-a0084e90d3d8", "comment": "Malware payload (AsyncRAT)", "value": "800b1bcb91f794af35e5e823c53d6e58150d2395", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809391, "uuid": "d6cb545c-1de1-469f-b136-85c05d274038", "comment": "Malware payload (AsyncRAT)", "value": "721e3ff30bbffb62f38545e8d9a88369db69b6dcd9fd15da1f23d435e0dd0c1d9e7f0d49f9bf7d8f4a9f943fbf317938", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809391, "uuid": "02f9c3de-19e6-478a-a0a5-06987d7739df", "value": "T1E4259E0273D1C062FFAB92734B56F6115BBC79260123A61F13981DBABE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809391, "uuid": "8d9d08a6-bd88-49d3-a7e8-0a671b6f862d", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809391, "uuid": "0fc8d59f-3a3e-41a8-a854-54647544531b", "value": "24576:j5EmXFtKaL4/oFe5T9yyXYfP1ijXda60Xhw:jPVt/LZeJbInQRa6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809391, "uuid": "5cab9fca-b174-40af-a48c-4513889a4b38", "value": 998400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809391, "uuid": "dfe62606-325e-4845-94cf-b0bd16e1d939", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809391, "uuid": "4911e32c-a186-47c6-90ae-224f8e2e102d", "value": "06c4acccda31358fd172466d6245f827c2b5075dec6496516286f936f22ef771", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db954e4a-197e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772816806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772816806, "uuid": "087acfde-d671-47dd-8dae-98d0b7ea7373", "comment": "Malware payload", "value": "171c5de4b007a16a7710f3686d8d0e1f", "object_relation": "md5", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772816806, "uuid": "a961a85b-cc4d-4a63-9cda-79cd302099b9", "comment": "Malware payload", "value": "072e30bbf2bb844cb0b93d460581f1a80fa8fac75fded6d80802a8b0dbbe52f5", "object_relation": "sha256", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772816806, "uuid": "50b03ecd-3c14-409f-b70b-2494ec273d31", "comment": "Malware payload", "value": "ba65710d9611b1311b366e851146f899f8e6d7da", "object_relation": "sha1", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772816806, "uuid": "27e40381-1a83-4c87-8b40-18ca7d973931", "comment": "Malware payload", "value": "5fabda0543b68c447f3fb97897e7a4f42df582aac36f917842a6b3075f998b4b09fea6953331f2820ef686c0a319f4ef", "object_relation": "sha3-384", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772816806, "uuid": "c9534707-8105-4dab-9ef7-59b1c44b37e9", "value": "T1EAC5331B93091612236B73B56826CDB988F3C3BDE8655F3A63003C3C51BAD9D961B1ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772816806, "uuid": "4775457b-644c-43b0-86d1-7f384d221dc3", "value": "49152:YILW9JyukOPMRgoX7JRkJ2zVybF/fRxxVE8RiH+7:09Jj5MRgoXVeugb1fRxxV30H+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772816806, "uuid": "532a167f-a080-4c56-89d9-a373f214b772", "value": 2639708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772816806, "uuid": "8b53952b-900b-43a1-9d4b-f47dd4109f60", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772816806, "uuid": "10b1473a-075f-4bd6-9ef5-485e1e30d883", "value": "Executor_x64.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fd8dadf-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810237, "uuid": "bb03ce75-a93f-4846-ae6b-cee9461a5398", "comment": "Malware payload (GCleaner)", "value": "50434586184936a864747b0a862274fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810237, "uuid": "ace8ed29-bd7a-4f4c-b953-2c8e5c10539d", "comment": "Malware payload (GCleaner)", "value": "0731ebda003d3e01739d55734eaa5dfb08a34537f3cc606f5bcd753be70fcb4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810237, "uuid": "eb592a78-f5c0-4220-a604-ee08c92d9468", "comment": "Malware payload (GCleaner)", "value": "45fe404403fd4a1a2a4f96ab5d2cb2357f4c0701", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810237, "uuid": "f4da8841-070b-44cb-abd3-33f93dba7e68", "comment": "Malware payload (GCleaner)", "value": "93686b00cdf49b974936512fdad45a6990f39624b22ddfdd9c301b17e3c29a57fedad8a92ca7f5edae58728da051257f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810237, "uuid": "f148b5df-189f-469a-91ef-fe3ccb10c67c", "value": "T1C355AE22F2925133C17216389C27E7659D2ABE113EBCA84B2BEF1DCC5F3524179352A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810237, "uuid": "40ef7379-5576-40ad-aec8-50cb60037238", "value": "0eefadf8e9087d6d95cc4aedf30a5018", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810237, "uuid": "bdd43f81-5276-43b2-824e-211f22fc0417", "value": "12288:JVLMD7V2wGymFSmu4eDCQi0628ZhcPaGfEdERlSdpgdICRqi9/Ci5Ig+FZOxny:JVwXV4HSmYq7MPPfEd+epgf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810237, "uuid": "bc19ef9c-d2bc-4d7d-be92-e9b9fbcf06ef", "value": 1396736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810237, "uuid": "d195ee83-eaca-4d71-86ce-7839e5482c85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810237, "uuid": "5b5c3599-f94a-4243-b589-bda9bb9aa474", "value": "0731ebda003d3e01739d55734eaa5dfb08a34537f3cc606f5bcd753be70fcb4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b35c440a-196a-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808149, "uuid": "bc27ed71-cf30-4e47-ab89-8d2845e56cf2", "comment": "Malware payload (GCleaner)", "value": "2272118a24950de23cc894da2ef9aa4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808149, "uuid": "077354f5-5fa1-4a52-8214-e2343e9c33d7", "comment": "Malware payload (GCleaner)", "value": "073279a2543e2ad7247d2ee56236adf1647db762673ab8c0ecd0eceb9381b658", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808149, "uuid": "cc210eb8-b956-484b-b9b4-1d8d481aa532", "comment": "Malware payload (GCleaner)", "value": "2e26b2492283ad5e9ba2067219ef09c0274c0c5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808149, "uuid": "4c9c6681-dc03-4ed7-b88d-34a953d47aeb", "comment": "Malware payload (GCleaner)", "value": "8ffeb3f2cbd80bc3031eba9f088d1afa8ffb22c1b3c06107f4eeec8e13a81ea74a541324f44e2be4f54ca9a56b2d7636", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808149, "uuid": "fd8fa8e3-bf66-4c2b-8bca-3156d992a997", "value": "T15526D023A2E0313DCAAF7E37851698EE90E53C943C9A5FC165C69BC76E19112EDE1133", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808149, "uuid": "291de093-66cf-47fd-8ef3-10bec8eb6217", "value": "e5f32a93ddcf3aa9009cd70911b0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808149, "uuid": "476426eb-9d5e-4192-8238-daf066c38aa4", "value": "98304:w9Cex3hHycui2/YzkJJfyzADRuigrytEtpP:w9hFs/YGiAYiCyt6pP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808149, "uuid": "e09ac336-585d-42fe-9b76-ab2d58007dc4", "value": 4832768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808149, "uuid": "5775a7b4-abbb-40f3-8049-b114d04654f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808149, "uuid": "caddd1e5-02bd-4884-971b-48fb32bc94f6", "value": "073279a2543e2ad7247d2ee56236adf1647db762673ab8c0ecd0eceb9381b658", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6b86a24-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772810704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810704, "uuid": "b57f6f71-fd93-4a79-8b0c-a29ebb079b34", "comment": "Malware payload (PhantomStealer)", "value": "fe5189cab405efadf391dca79793e26c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810704, "uuid": "62bda564-0656-4081-930a-32083df8f2b3", "comment": "Malware payload (PhantomStealer)", "value": "07432c11f1bb3a5f299aab53022620ece4ca677dc81f18cb1f5ce9c41b6b4553", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810704, "uuid": "b539e2c4-f61e-44b0-b42c-e87bb5516469", "comment": "Malware payload (PhantomStealer)", "value": "28250dc9e37274e0a13c337927ac8074ede60414", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810704, "uuid": "81d4822f-4b53-45bd-9d84-3d9d69024561", "comment": "Malware payload (PhantomStealer)", "value": "54018d02731de10fc1fa846481ea701ec68b33c5d5487aec0ae7d529219d7b008bf6b3c92d42d64fa43f1a2b81737db4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810704, "uuid": "d2697e5a-1e3f-4122-a4a3-d0bc223f9918", "value": "T1236523A92202CD07E59B2B755AB2F5B0177D2DDFA401E30B5FD9BDFBB4A2B510C50282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810704, "uuid": "b2a8a5d2-dc3e-4a1d-a278-b159e71b78f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810704, "uuid": "25d77447-6484-4a8b-b97d-26e0a50c1fa2", "value": "24576:/EJDPPeromyoaakFeha7ExsmCWEo1z08y8qDiZLzeWCj:/EZPPeomyoaaE4+ExyWEKALaLCWCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810704, "uuid": "8cd1ac80-7ed2-4ee2-bcda-9040d7109748", "value": 1536512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810704, "uuid": "a3d7c66c-1892-4373-82df-190da8b0e483", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810704, "uuid": "c4f39ec9-b91f-4146-a384-b19ff4520453", "value": "07432c11f1bb3a5f299aab53022620ece4ca677dc81f18cb1f5ce9c41b6b4553", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7647f8c0-1996-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772826944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826944, "uuid": "d122c8d5-92b8-4251-8b75-03d1fac2a444", "comment": "Malware payload", "value": "97d67632afe554ff42c5fdbb1c6de176", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826944, "uuid": "662de5ca-9a04-495a-8cec-e38f2bf57988", "comment": "Malware payload", "value": "0782c2520a476fb98e6a0bd01937df57a0c730b113c8ec149e2c6be534aa91a3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826944, "uuid": "cfe48367-4421-43d9-8a93-c98fcea286a8", "comment": "Malware payload", "value": "635997eee32bf2ffe4e25e53d206e9c540430b63", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826944, "uuid": "cb3b5335-8d79-4678-9805-c9f7762b3834", "comment": "Malware payload", "value": "dd2387d597cfaa61a0652df911aae35885c35b047dcc6bb1948adf28bf06c6ff250eecbf9b7ed545e2e6e3d97082cd4d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772826944, "uuid": "45be324c-7b58-488d-868a-6bf0a28570d0", "value": "T18581CAC9715207E52F2CEA3267BFC50C5785D1CFE4C11F99FADA6AA44D8CDC82C841A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772826944, "uuid": "71936943-4523-4901-b29a-54f96f3da555", "value": "48:v8UrUQxlUoUOEUYUvUpUCUdUuUCU5UtUPn:v8UrUGUoUOEUYUvUpUCUdUuUCU5UtUPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772826944, "uuid": "cdc8787c-f949-42aa-85c4-0f0a1fc0b6e8", "value": 4050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772826944, "uuid": "a5ae548a-c0cb-4009-88fd-a584fd154299", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772826944, "uuid": "27f07c3c-560f-488f-8fdc-4f0f7e867b1e", "value": "cache", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa6540fb-197a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772815140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815140, "uuid": "1ef296f2-4338-46be-826b-ea89a2211bb8", "comment": "Malware payload (Mirai)", "value": "32ca4e76ab8c3f9f0096b40d3bbbe6e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815140, "uuid": "09afeb7f-e368-4aba-8cf9-8c4a91d24a58", "comment": "Malware payload (Mirai)", "value": "078cf00268c2def420f07a3625d1f191f7a97f57b68af6fa590ef12f78365b53", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815140, "uuid": "22632994-46b3-496f-9d96-7ba2fa1a19f3", "comment": "Malware payload (Mirai)", "value": "f741535fe18aeb3053728eb11dae831c2133413b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815140, "uuid": "0ff2ce48-756b-429b-bb97-fea04191a4ed", "comment": "Malware payload (Mirai)", "value": "2a4021833782d0fd647a72011fe6992c2a7c8ca14118f5b0a41e024e0bac430328cd01e90971495998dd7aebf52ee742", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815140, "uuid": "1dc4c662-3661-44ff-9ef2-654bd82f82f4", "value": "T1B5D30945F8404B27CAD612BBFB5E428D7B2A17E8D3EF720399216F20378795B0E36546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815140, "uuid": "4e522f78-ecb8-45fb-8b19-ad8d2455510d", "value": "1536:zNLAVG5wSCgkC8lgBm7XWeA0Zm4VEdTJTMj04WO3Iv4crxqRd+R2lD6wywHRP1D0:zNUyeC0TzWew4kJ804WqIrFmogzJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772815140, "uuid": "607b7ccf-76a9-4556-9e50-435abbf5a14c", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772815140, "uuid": "7bd7ed1f-b8ba-4efb-b2f8-a03da5e875a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815140, "uuid": "e9cc8ed7-583a-415d-a1e6-54ca5991ac01", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e68d435-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808543, "uuid": "bb6ddb5d-44d2-45fd-be93-16ad89bf433e", "comment": "Malware payload (GCleaner)", "value": "b5047ade94c913e3e456feea0f23d2b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808543, "uuid": "4dd1137d-55fe-41d9-a88b-4c5be7ca4656", "comment": "Malware payload (GCleaner)", "value": "07c8536646a1c50ae39d64a8c8a5bfcecf8b37b6ddacf5fdf068194eaea6ebc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808543, "uuid": "1fd7c2bb-5589-4fe5-81f8-c414f7523dfd", "comment": "Malware payload (GCleaner)", "value": "0c1913ec3628abc62faa6b88df1d343046a3e27a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808543, "uuid": "d6565aba-d718-4205-8ae3-4e4875ab918e", "comment": "Malware payload (GCleaner)", "value": "67375c725fd76c53b9aec3e693d9f25b1d4e40bc050244d9a703d99a35f0bc1210a8da4eb32e8a6ecf4c5eb902472976", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808543, "uuid": "d8639c29-5cac-42b4-807c-29c347e7ca23", "value": "T15646D03AA0E35FBBE690447D4F956B0E273E5A1B5424F6C6BEC8CDCC092B7C104A5792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808543, "uuid": "d23b2bca-a7a5-43e2-a100-8595edfe0a43", "value": "c243d5a6283f8eb7bff20dd0797e21c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808543, "uuid": "77fc705c-e141-48b3-a9a0-1b365c489982", "value": "98304:TH5uRhLyf1ZYnrUDFdblE3yNnBnFmCgzo05:TkDLeyr+ECR2L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808543, "uuid": "e38277d9-d20f-41a4-84b7-bfdd1b5cceae", "value": 5641216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808543, "uuid": "ac468417-8226-4c6e-af47-ad05760d1d77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808543, "uuid": "ac6b3d14-bd21-4880-8b65-b144842e987c", "value": "07c8536646a1c50ae39d64a8c8a5bfcecf8b37b6ddacf5fdf068194eaea6ebc0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "707c4e62-1969-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807607, "uuid": "b784a513-176d-4f80-a1a9-93ba7df7d8a0", "comment": "Malware payload", "value": "399bd408df8d4c649668e4376fcb3580", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807607, "uuid": "75be7b6c-350a-4e1e-94be-3d9a5a5c8f68", "comment": "Malware payload", "value": "083ec9b49d1fda4e4485781203013d8552a71eb8f2b464acaab9cbd97b4ac3d6", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807607, "uuid": "21bef3b0-dc18-4ee1-8672-aae127db1fef", "comment": "Malware payload", "value": "b1fb42e369fc969c6fdbcf6045953f11c782e199", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807607, "uuid": "62cf497d-05a3-46c4-8efe-4bb9dd1ca050", "comment": "Malware payload", "value": "8de0c3c746f76b8cdb55f887734bfbd49218dcc9d0aa94a989cd5307653519847eac0904bd24f638e31c729b4a93d728", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807607, "uuid": "fb789da8-a267-47ad-84fe-9fd8305511d4", "value": "T15894238F1337C2ADF5B795F11CA5705EBB247441A62E6BEA08971E8EEF58403C84806F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807607, "uuid": "9847b3b9-4ec7-4a66-9023-5a5585277d3c", "value": "50c828126d9fa81b292ecb6b956cb2cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807607, "uuid": "5e265b01-a22e-4d70-b91a-6368a67469a1", "value": "12288:0Sa25F2xSEWxV+4Spb3BHxFoKhLNrhTnlLtc:o25Fxe4axHxGSbnl2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807607, "uuid": "c6e3fab1-c725-419c-a119-998a11203df2", "value": 436736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807607, "uuid": "ac5d7c46-13f3-4b7c-96ac-c31fffc08b62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807607, "uuid": "03acaf80-1db1-4e62-bad2-82846b0951ba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2994ddad-199e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772830251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772830251, "uuid": "1721af07-ea3a-4d62-b1f6-9a188578064c", "comment": "Malware payload (Mirai)", "value": "06838c1091298310b8f7d2f4d59203c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772830251, "uuid": "7e6d4dcf-ff3b-41c5-825b-0a9e91a484be", "comment": "Malware payload (Mirai)", "value": "094e9d6ee057d38f40c35f018488e35ab6ccd006ed261b17322e78fd5ea2c0cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772830251, "uuid": "dbfbdd29-98a3-4da3-8e4c-091685bc779e", "comment": "Malware payload (Mirai)", "value": "e5e99c4fe76c083335519db7247b929adb3bf634", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772830251, "uuid": "1fa18cd3-39c4-4979-913d-9649c3912d45", "comment": "Malware payload (Mirai)", "value": "157946b5723ca1dfad891b5752740fcf2145f0dd575e169d345323c71a4bb9cfd0710ae5d099fe9d6b4f27ceaa266d30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772830251, "uuid": "5e0dfc04-d518-47b5-a521-9a76634597da", "value": "T1F1B30737A691CA3AC04752F12AEBD9729C13BCBF0732214A33D47D656F368C61D99B06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772830251, "uuid": "caeb32a5-81bf-42bc-847b-80cb28d486e1", "value": "3072:jir5l8kbD6FHemRUOx9mgWRKHDXvJ3QEP7GzjHVmaFHJp28fpm7FnVqJwXFWnNb:CbD6FHemRUOx9mgWREbJj7oZ9hm7FnV4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772830251, "uuid": "91338ce0-c9eb-457b-84ec-8ded31fa9138", "value": 117649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772830251, "uuid": "037cf70c-3792-42ed-8048-e8dfe4e39c42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772830251, "uuid": "e66a3b49-1a4e-4b34-b76a-17a7990dc1ea", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a027d7d-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1772810200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810200, "uuid": "ab3f6aa4-2dbb-48da-82a6-8c973134e73d", "comment": "Malware payload (SantaStealer)", "value": "7927d172f15046a323b400856b881b22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810200, "uuid": "ad340eef-d8f5-4287-87f8-b38429e27031", "comment": "Malware payload (SantaStealer)", "value": "09843e14f9dbf432eba3ef9530dc295b48280a14dec0d49507c54206d5fb173f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810200, "uuid": "23fe89a9-ca70-4e19-a5e6-f94917c4f2cd", "comment": "Malware payload (SantaStealer)", "value": "394b232cbab734c0a9c0dd23357bd678c2551453", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810200, "uuid": "6d98079c-fd4c-4f3d-9949-2968ca31a728", "comment": "Malware payload (SantaStealer)", "value": "e0d62985f5ebd8e82f90c7bf1d567d87194531ee2cf86ad4a67f1e6a7c8144172449a828c01fe653db6b055ef1e864a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810200, "uuid": "9edba32d-b45e-42c1-8e3c-e18fbd846d62", "value": "T1829623BD228933D8C41AC8346037F945A1F7561F46E8C6D971EFB9C03F6B8219A52F4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810200, "uuid": "a1121675-4579-47cc-9793-b1c977165f34", "value": "b4436fe2ccd1a0108c1cda48be61b0bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810200, "uuid": "03be4515-7810-4952-88bb-64e2c85b4ef9", "value": "196608:cDnehlKe1+9uOYfC9Ak1Mw8RU1fz1ZpCN:un2OuJ0DEq3Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810200, "uuid": "368e571b-63a3-43be-8f06-450f360918f9", "value": 9326080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810200, "uuid": "9383e77a-d3a3-4c48-9ce5-408da6f0ce1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810200, "uuid": "ff641d69-ed9a-45bd-a937-263332f3ec93", "value": "09843e14f9dbf432eba3ef9530dc295b48280a14dec0d49507c54206d5fb173f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faaa9277-193d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772788941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788941, "uuid": "aaa975fd-96cc-4580-8474-457fb3ce998a", "comment": "Malware payload (Mirai)", "value": "8f14584ef4f55894ef95c17419276888", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788941, "uuid": "377439e9-e003-4616-a024-38c1c8f8b545", "comment": "Malware payload (Mirai)", "value": "09d8b4a98a67b5df0e0a82488ec4cb305862d0054dfd43a2fd229f4d1a413d2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788941, "uuid": "1505d2b8-23f1-4703-a7c8-b633d589085c", "comment": "Malware payload (Mirai)", "value": "6795d573b2ac058802a48f04b774f265b78075ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788941, "uuid": "4ef3edfb-0750-42b6-8c6c-fb6783501243", "comment": "Malware payload (Mirai)", "value": "9b0226887e09204aae681f96d34a9a5f4e9cc41ef17a1343e583baf60ba1c492fa76de785c321e6ace12e0fee5efe908", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788941, "uuid": "87776bd5-2f46-4651-aa0b-1c822db1048e", "value": "T168B2D02062AA84B1DB614176F97447F742BE5AF8E3EE72305BA4064828C66CDB3BC4C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788941, "uuid": "3eec3003-cfde-4ed1-8339-0e8c014c247d", "value": "384:v979FDQ06u6LeuIYhdZJ+k7qPHZLlxxUyFJ/oSfpb9iV9+INJhymdGUop5hSK:C063eEh4tPH1lxFFJ/XBb9iaIns3Uozn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772788941, "uuid": "d4c3ee3d-2ec1-4d67-8f62-87c37163fbff", "value": 23572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772788941, "uuid": "2dc2ecde-3c51-4255-94b0-cbd98823622f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788941, "uuid": "2b6caa95-605a-450d-93f9-1550aa557ec3", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3662fce2-1969-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807509, "uuid": "5691fd7d-5157-4e80-8376-e2b15b11b2de", "comment": "Malware payload", "value": "c04c87243c1adc87a2d919d63abd4cfc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807509, "uuid": "03731190-5270-41b3-a09a-27935ef5d8d9", "comment": "Malware payload", "value": "0a2a9d9e37b867ac0305afeea3c098cc5138c6bcb840ab0bb795b17bff93e345", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807509, "uuid": "6527bcfd-f9f7-4932-9c7b-c33b3b275b05", "comment": "Malware payload", "value": "14ef2931dcf0a686653e36c0665826a84ef1d6e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807509, "uuid": "2c639abe-eaee-42dc-aad4-8f42c24817f8", "comment": "Malware payload", "value": "4e95beef8a2ae8052cd956f56522623bdfbca0d3b5c31bd94b9ab0ce6a8d49674a0371cb72193cc8da3d1e0ce26fb493", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807509, "uuid": "8ea6a5f7-d295-4731-91b4-714164c0197e", "value": "T1F0E423AD95A1C81FC0B25631B9349297FFFE9C21102AA62F72527FEE2878347644E354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807509, "uuid": "8f0fb7a8-1fd1-4014-9646-45dcff8da1b1", "value": "24f4223e271413c25abad52fd456a9bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807509, "uuid": "6edd60c0-c5d4-4bab-b48e-4553cf072037", "value": "12288:5DW2vV3MEBS8t0ZfmOJHbq4X86d8zI0EBI59sxfuZSVRY+qsYI1zKdS:5DrvxL091bqv59sxGZ67j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807509, "uuid": "0fd95afa-192a-4aca-8b3b-375c58ead57d", "value": 713056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807509, "uuid": "165b1e0b-6249-4105-8117-3930bfef9712", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807509, "uuid": "5ff80139-e6c4-4353-abb4-400836b08984", "value": "0a2a9d9e37b867ac0305afeea3c098cc5138c6bcb840ab0bb795b17bff93e345", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7d2cb46-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811243, "uuid": "7a227d54-bffe-4aac-98ad-27744c39c4a9", "comment": "Malware payload", "value": "f93e57b671358e509e6089b04cf34f00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811243, "uuid": "f3c0b881-b303-4671-92ef-22733b8f40fb", "comment": "Malware payload", "value": "0a3e6422f7cd32f9d2eedde1ab4e6b56ba4cfe4833d2ea90512e9646fe42ace4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811243, "uuid": "c5f233bb-1390-4228-8ce0-e26a1ee54d69", "comment": "Malware payload", "value": "540e580803030da4c37c04f39a1572cdb2b9ba16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811243, "uuid": "7a1b9b94-d053-48c9-b98a-10769a35e78b", "comment": "Malware payload", "value": "302c4c159ab3ed82d9ba6483c31ba0866ff9209e68441e7cdef84833922f03b919a1763c6f884e19922a31c4200a10d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811243, "uuid": "f81fdfc2-cd10-416e-88aa-556189b3fb10", "value": "T115E4AFE5F2E08437DC325A3BDD0B56A958257E8069385B062AD81FBC5F3C3913825E9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811243, "uuid": "c70fc3a5-40fa-4167-9fba-bc66c5c110e4", "value": "ce7a1d07b14b49824555865592c3af45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811243, "uuid": "c2d856e7-ff18-433e-a4ed-3ac3bc17bc57", "value": "12288:dkAJdZJGY+5K/Lo9r7WTB+rP3tRO7b1W5Zcnb9OAXepxSnRN:PXZJeK0Z0ktRO7b1W5OTXepxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811243, "uuid": "252bc377-eb5c-4449-ac76-a9e7a72c5425", "value": 677376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811243, "uuid": "ebef3baa-ac20-4baa-8004-0918d7632ead", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811243, "uuid": "e0810996-5c21-4c45-8bc9-764522df2074", "value": "0a3e6422f7cd32f9d2eedde1ab4e6b56ba4cfe4833d2ea90512e9646fe42ace4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76da1f18-1980-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1772817496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772817496, "uuid": "b0e1cc4f-b615-4237-a949-d6dd47943241", "comment": "Malware payload (LummaStealer)", "value": "4f65de1121eb545f116270b2129c4864", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772817496, "uuid": "88ecd5f1-3584-425b-b57e-162d5dc1f3f2", "comment": "Malware payload (LummaStealer)", "value": "0a3f28a6a00303569b639c450319916ca31339ac4a4e9d6535a7104925d83ff4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772817496, "uuid": "547b5ac4-9964-497b-957b-73347c910af7", "comment": "Malware payload (LummaStealer)", "value": "746cbb3b13269461cd48b9ae41a98928b55b8ee4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772817496, "uuid": "e42a2876-0742-4e2e-b08c-3a4a9d09590e", "comment": "Malware payload (LummaStealer)", "value": "3ae0640789587990c8136a9ef548fb1cb2e4e03479c35bc8c611dccea410b3771fb8de9daf43b50d10b7e28553825447", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772817496, "uuid": "8afe6fdb-ab2d-419f-90b0-155fe274183a", "value": "T155E53B72BA09A1DFD88E1774D827CEA7D95D03B94B1049C7EC5CA47A7E63CC111BAC28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772817496, "uuid": "134119fe-0fff-4ffb-9bb5-5af2f1e04ec2", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772817496, "uuid": "5e3f777d-7021-468f-9705-4783cfc43aad", "value": "49152:oBwGC1ylfDfQf8NSCGLjFuJw/glWvVvz5wV6j58hm1q:oWkfDfQf8NSCGLhBglW3wV6mb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772817496, "uuid": "5f8dcd0c-e696-445e-9831-4d53d08b0982", "value": 3173888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772817496, "uuid": "7223c885-fb73-4b71-9987-889b457d817d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772817496, "uuid": "10396c08-ed62-4f96-aabd-3dc6e5e83d75", "value": "0a3f28a6a00303569b639c450319916ca31339ac4a4e9d6535a7104925d83ff4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "099c06c0-1964-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772805287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805287, "uuid": "3a36b76f-e7d6-4a6e-902d-88fb2ff5dae2", "comment": "Malware payload (PhantomStealer)", "value": "b188ba0d4e60e871608368c4478b807a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805287, "uuid": "53a3690c-fb91-4e2f-820c-bf34247ea347", "comment": "Malware payload (PhantomStealer)", "value": "0a9b209c687285dfe10f2c07e6055336b550a601b521030dd1f3b6dbe672f43b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805287, "uuid": "15075459-5781-43a4-ae30-0b3e5809eef7", "comment": "Malware payload (PhantomStealer)", "value": "1078288f42170994c300d7cb81f5cc28f0547664", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805287, "uuid": "873967d3-394f-48fc-84ce-1309d8e27161", "comment": "Malware payload (PhantomStealer)", "value": "10092c594bac3b2d6982f4f0e7f467c4a7858530e3440b8dfcc9b87692f53220308827bb7b87f0ef6c9cbab482aa37de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805287, "uuid": "8cb2eda7-e5c1-4093-b4d3-d0257bba4b06", "value": "T19D75E00273D1C062FFAB92734B5AF6115BBC69260123E62F13981DB9BD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805287, "uuid": "66df54a9-6e4a-451b-84d0-0f5838ae708a", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805287, "uuid": "b7173398-3b23-4908-aa30-1dc6cdc988ba", "value": "49152:kPVt/LZeJbInQRaYCEcSqHi+GBkodqLW4x:aTYbInQGi+GZJ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772805287, "uuid": "d315e7f1-54a7-4802-8e0b-1764e3346812", "value": 1671680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772805287, "uuid": "e928c873-ec8f-40b5-9ad5-29eae934d276", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805287, "uuid": "6f069532-bc2e-4746-92f7-a251ab839346", "value": "0a9b209c687285dfe10f2c07e6055336b550a601b521030dd1f3b6dbe672f43b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "869e6384-196a-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808074, "uuid": "5d7f40bf-6b87-45e5-8909-44a53ac51fac", "comment": "Malware payload (GCleaner)", "value": "101738a3e76d545d5036c6b5edd59675", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808074, "uuid": "25c7334f-e206-4ea5-b03d-2813e2d8c251", "comment": "Malware payload (GCleaner)", "value": "0aed66abbbd5e5544f59fca6a5673ba3c3d3a18eadda161fdf6b50442a0f49f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808074, "uuid": "baef6793-deeb-4472-92bd-e1da30a7b398", "comment": "Malware payload (GCleaner)", "value": "526d7a46e25ecfe43edbef17503ac7f924125d7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808074, "uuid": "1668f09c-38ba-4084-bc32-0abf4010f14b", "comment": "Malware payload (GCleaner)", "value": "86b5905aa7d2796ac9d580c537428135cafdee30ba8ee583662d1ea88aabc74f1919b40a06780c4bbbb63ffe3c38818e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808074, "uuid": "b260947b-10be-4272-937a-c69ec84e7393", "value": "T11516E00E78B36CF9E55D88756C1476D8490D2B2CBE3460C7EDC408CEB71A99C66A8FD2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808074, "uuid": "e906183e-c78f-48a7-965e-df6535896d66", "value": "e5f32a93ddcf3aa9009cd70911b0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808074, "uuid": "c2755df8-a799-4ac9-abd9-9468a17bde08", "value": "49152:19CiLxQzzocBhmbcEqRZoBFBJh0RtLRv8D8bj3DS/yGZ+hY4jLeiq9+uCw:19CexQzpEPBFBJh0h0gveqq9N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808074, "uuid": "9624877b-2e7a-43dd-9231-a4639ffd921a", "value": 4086272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808074, "uuid": "391c9603-6f23-4cfd-80a9-0ccb37f20ae8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808074, "uuid": "f4d1e190-454d-4358-bdba-21bd0896ecee", "value": "0aed66abbbd5e5544f59fca6a5673ba3c3d3a18eadda161fdf6b50442a0f49f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b84be162-1969-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772807727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807727, "uuid": "c1da9b01-9963-41ad-9637-b7aa11872d1f", "comment": "Malware payload (GCleaner)", "value": "4597a15ed3cab5b5aee5fc44e86e5ac4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807727, "uuid": "0d42c755-31c0-42f5-82b7-f18f73788fcd", "comment": "Malware payload (GCleaner)", "value": "0b21ac09096daa1da20319807a2ff2dcdca87b3d3e42007bb1f4961d0ad24b34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807727, "uuid": "bda77a79-c012-4c4f-8332-e38f923e6d32", "comment": "Malware payload (GCleaner)", "value": "b63e9c63ed7021f1c0f0d67663449968f7477ec7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807727, "uuid": "8c6abc1d-4cf6-4bbc-85b3-28bf98df52fc", "comment": "Malware payload (GCleaner)", "value": "d847a2b014d38443721b8cc2941f69e26d9e57c9b350d8255a7d2c557b952a923ea7b1babbb77f2efeaf6ddeb6dc01db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807727, "uuid": "32f12405-e44e-4a1a-a2d8-b6dfb515f805", "value": "T19E16D032CA505AFFC52926FA4C1254DEE9F27928ACE71507BF98DCC5A31BB0D74211E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807727, "uuid": "2a077eba-2b94-4d9c-84a8-1e7c4900d8ea", "value": "e5f32a93ddcf3aa9009cd70911b0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807727, "uuid": "f3ec4149-3e9b-4940-9c54-5c38b9cfc4b3", "value": "98304:h9CexG1tgZFyOeJUP/dhZI2daUhLxc9U:hGtg7wUPNIybLxf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807727, "uuid": "0d43cb4b-5702-4a5b-9a2e-87e2f6f3abfa", "value": 4096512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807727, "uuid": "4fb4c0aa-e31e-4928-8a3b-cebb0adb1aa7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807727, "uuid": "cc49093c-cc60-4c19-ade3-8072eb4508c3", "value": "0b21ac09096daa1da20319807a2ff2dcdca87b3d3e42007bb1f4961d0ad24b34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bb51c6e-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819195, "uuid": "95b3499d-8cbd-46fa-a1a6-2052afca5230", "comment": "Malware payload (Mirai)", "value": "88b3cdc3efc403c8f105995f669db0b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819195, "uuid": "bc7647cd-0490-4366-806a-83a83b4d7de9", "comment": "Malware payload (Mirai)", "value": "0b3ff46c98980133f02a8a4d3c1d675451f308e03a665b866bb4968e000275ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819195, "uuid": "59b293ba-6fd6-4f59-9f96-1d0e24e0ca8a", "comment": "Malware payload (Mirai)", "value": "7db2e54e54f93998d3d39f66a3fb4ec97e512f9e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819195, "uuid": "8e13ede0-66a0-4b35-92d2-b4607f9a0514", "comment": "Malware payload (Mirai)", "value": "1aecb8b802d57f2d87cc1d4f9c0a0b458c93393439c91a327a928579059ddf20193f5e62f5a255ab671bca2b7216509c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819195, "uuid": "f68d3949-9ef0-469c-bdd1-81af729a1390", "value": "T135C31859F882AB12D4C625BAFF4E419933131B6CE3EA7212DE204B3533CAA5B0F77515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819195, "uuid": "d7c8f2c3-93b5-40f6-8a6a-f996c6a1b23f", "value": "1536:eEnSyBSVGcCk/b2Po7XxYaTfaIQOpN3ygB0ylDRi/N8KmW+3ZZqvfki9CWe7PT:4rCkx7XxvTfa3OpN74N8KmW+3Zgv8es", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819195, "uuid": "06d7f48e-95ea-4d6c-a4d6-ecc47dafcb7f", "value": 118348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819195, "uuid": "ef7d9a2e-0eb1-4654-aa99-24a80f8756fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819195, "uuid": "6f9c3c50-c920-4275-8983-d845564bfff7", "value": "violetarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6f65c2d-1983-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772818999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818999, "uuid": "c3cd2263-0e72-4510-9eef-026d68984b27", "comment": "Malware payload (Mirai)", "value": "37d2682a93c7e6f1cfaa6b5444d6c45e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818999, "uuid": "2054458a-933b-4e64-8ed5-9cd9cab39a19", "comment": "Malware payload (Mirai)", "value": "0b75728c66d2254a5622017ab375525b0e8e085e5c8cc2b2dc8ca8a09f57c7a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818999, "uuid": "469e5d07-a2aa-48c9-ae7e-18366776c5df", "comment": "Malware payload (Mirai)", "value": "d9ef578f3e7692477e9fc4da6b8452f605bb842c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818999, "uuid": "15a90de1-60fc-4f83-8a6c-57a6ac26bee4", "comment": "Malware payload (Mirai)", "value": "473b012a80ae3232160f04ed9550c71c504629e2ea25292082fa49ce2ee013ec06ef096615bd60d4aad4c636d19f8d05", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818999, "uuid": "a195103c-92cb-438f-aa6a-4a1e6372a319", "value": "T198933A52FD818622C6C116B7FB2E428E376613A8E2EE7203DD255F2137C795B0E7B542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818999, "uuid": "16b6f4f5-0cd7-49a2-ae0d-0b45239c5f64", "value": "1536:xFju64oZnUCIK86kGHL2XrHH9FjmlHa/ZJd1KyjqdvXLB:xFi64odUCnKbHHDSlH0Hwl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772818999, "uuid": "8b53e392-0be0-495b-8a1b-b35329455835", "value": 93452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772818999, "uuid": "c33cd1ad-3a2f-43ae-bf02-528c1b4f50a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818999, "uuid": "c78c5e6a-f2f5-40b5-b937-659df3c41ed5", "value": "jawirbot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a28adfe-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (NovaShadowStealer)", "timestamp": 1772809234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809234, "uuid": "aa2309eb-54c7-4d7d-9639-8050c734f9e7", "comment": "Malware payload (NovaShadowStealer)", "value": "0709df027271605a5cf0a620b6739e56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NovaShadow", "colour": "#69E761", "exportable": true, "hide_tag": false }, { "name": "NovaShadowStealer", "colour": "#D793B8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809234, "uuid": "3a4babc2-d8df-4db6-83d1-3a3b2889d5d8", "comment": "Malware payload (NovaShadowStealer)", "value": "0ba60875de190dc353c4972053b326634cb23ec8fddc0b7de3d8d67fca11436b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NovaShadow", "colour": "#69E761", "exportable": true, "hide_tag": false }, { "name": "NovaShadowStealer", "colour": "#D793B8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809234, "uuid": "680823c2-0560-4b79-bb30-de48a30521fb", "comment": "Malware payload (NovaShadowStealer)", "value": "461623fe88ad2acc23577f29c84a7e9120ec002c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NovaShadow", "colour": "#69E761", "exportable": true, "hide_tag": false }, { "name": "NovaShadowStealer", "colour": "#D793B8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809234, "uuid": "dae68da2-7b44-4182-918b-4f2fcd5c4292", "comment": "Malware payload (NovaShadowStealer)", "value": "023b2f8f9a9fab6f4a8c36e31a195751a11edc6a30c5221f4ffd8405a3906b18f50d15e9f9e4103f4613aad7d0a057de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NovaShadow", "colour": "#69E761", "exportable": true, "hide_tag": false }, { "name": "NovaShadowStealer", "colour": "#D793B8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809234, "uuid": "693585e2-32c5-4cc5-9d91-d3b4ce1d9baf", "value": "T12808337723CCB486EF4183F039AD723779421951E7E9AD0A7DD351EE2435E22660CBA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809234, "uuid": "f69c7a6b-8cce-4ae5-9b92-d4034f9e6f83", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809234, "uuid": "aeed8d51-d89a-49c5-8876-5c7c1f604460", "value": "1572864:C4gPXMoao5ur+FKXoTkdH57eTJHuzcbKPb0te8QMnnb/7:C4AcWuIKXoTkN572Az6GyiEnb/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809234, "uuid": "69ecd1bd-0932-4053-800b-6f53abf2d874", "value": 83073786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809234, "uuid": "951ab896-e0ed-4fb8-b005-28814f31b984", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809234, "uuid": "c7a3fb79-ac4d-4c3a-b876-6b0a994889a1", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48d663f6-1969-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807540, "uuid": "2d63c60b-f8b2-40dc-b1ea-90ef502617a9", "comment": "Malware payload", "value": "5030f31933144b5b43f6dfc63870d198", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807540, "uuid": "7fa17a9c-e0ce-4de3-a48a-fc3fdafe0ae2", "comment": "Malware payload", "value": "0bde8358b4c836488dbf078dda0539636dc04921b1402a7118334dabe225300d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807540, "uuid": "209673bd-63ca-45f6-9feb-96cfd933990b", "comment": "Malware payload", "value": "9a03cbdaa879611e3322e12c242a5e20b789bc8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807540, "uuid": "7da4016a-b7f3-40c2-bb78-2676e12c5600", "comment": "Malware payload", "value": "4049d3d34ac92da4d245fe5bceffb5ac01a317f6e916fd57bec873a7a47eab109a6b8f8b346f1a45f586d2b4d5442f46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807540, "uuid": "a013c238-2e5e-498f-84fa-6be6aaaf9644", "value": "T13FA4E816E6A0B92AF95345713D78B25A2A2C3C392641EC0BF7C99F5A3A7158370F071F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807540, "uuid": "3aa2662f-22ae-42bf-b807-4d15db2b8e85", "value": "9dea662b6d9f21fcd24ed155c275fc33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807540, "uuid": "5a53e893-5262-40eb-a15a-24e6bac367b1", "value": "12288:Y35SA/LCbpXjuAm8FDEdcfp2h7s7x0c0Ls4477Xues:Y3PIXUo3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807540, "uuid": "b3cbe696-0111-4563-b616-ade1602ad9ab", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807540, "uuid": "d91e1792-855b-4e41-9d67-77f836214792", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807540, "uuid": "32ae2b2b-d095-4a43-b58f-5df340239dfa", "value": "0bde8358b4c836488dbf078dda0539636dc04921b1402a7118334dabe225300d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "544b029e-196b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808419, "uuid": "a186e25b-276c-4a52-aa47-d8544dd7186c", "comment": "Malware payload", "value": "daaa9e40e51717861fe7788b27665204", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808419, "uuid": "7844c04f-cd75-4f23-b72e-d7f61d72f2ed", "comment": "Malware payload", "value": "0c150020cbb47d68b1414b0c93834cdc90ca2d8064354964893b3aba9e553676", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808419, "uuid": "0c83ac3b-b9ad-4ef5-af43-c4c7da206ce4", "comment": "Malware payload", "value": "8ca168b99e3371df4bbd43e1316134401fa4464a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808419, "uuid": "4a87e842-a362-463f-bb66-7666d9ac43f5", "comment": "Malware payload", "value": "280c338d974dc6191ff35565ff28893b1d035da3853d23aeb4b5c73bcaa42138d2e37a3336ea4cb70a060efb6a6836db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808419, "uuid": "903db88c-d461-4aff-9861-5f4b5ba56193", "value": "T19D0512600B51649FE4134871ACF27376F798AE2A377DC3827680B598BE3B2454F693C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808419, "uuid": "6721ede3-f1cd-4a80-a0d4-635ba57e7f05", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808419, "uuid": "ea1d0385-2db0-42d9-b05d-ff0ed77a6f23", "value": "24576:tHO/MdQJNoqtlmfmjcYtEXBWdBz6kqd43jbz1HVkMIwSqLbBYNG0:tHO/u079tEXBWdBGzKb0wSqp90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808419, "uuid": "e6d3736d-52f1-494c-91f5-6ac0fd38e14c", "value": 861496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808419, "uuid": "6369e988-25e2-4383-b04f-ae723cbb1eba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808419, "uuid": "6bdd0ddb-6c53-4c2b-8ce8-9a131b0190f6", "value": "0c150020cbb47d68b1414b0c93834cdc90ca2d8064354964893b3aba9e553676", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72a79eda-196f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810188, "uuid": "08bcb979-ab02-4af8-ab79-2871114b4de9", "comment": "Malware payload", "value": "1b9513f22556276d29188efcb7ae1533", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810188, "uuid": "baa94e2f-4827-432a-ab24-6f5c7f316b47", "comment": "Malware payload", "value": "0c189c41e94658eea3482f30109656d3c911f683698ce5ad531e396d64596542", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810188, "uuid": "b50034cc-e38e-4938-b5b0-6fa2c1030949", "comment": "Malware payload", "value": "b5b31bb3ce499eef41f6ec98389994ffc6733ff5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810188, "uuid": "b8e36653-f4e4-4e2d-a805-111eb35aeba8", "comment": "Malware payload", "value": "c4ae491a23f9705d10e8a8f05e31c9873b61258081b7af9f5b1ca9ad266a03828d7825c2b52b1e4e689b218ef5fd1adc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810188, "uuid": "15939ccb-e6e2-4fe8-9bf7-66fe5663ac47", "value": "T194D55C52BE809478D0ABE335E8F11251AA607C5D07303BE32F5A7AFA1D36BD40E36759", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810188, "uuid": "c82de64b-19b4-4d19-8b00-377f80ec9c4c", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810188, "uuid": "a51005b6-ab34-442d-bdb8-4d28c70f3c18", "value": "49152:ijVfkU14zjM47jAt7JhoNoqHWSgnzuK1/:emzh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810188, "uuid": "55eee997-37d8-4f92-8780-d308eca217d2", "value": 2814464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810188, "uuid": "8277ea35-0643-4844-b30d-ce3b40a9d96d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810188, "uuid": "a6172435-a253-47ac-8566-9ffb84dcd51f", "value": "0c189c41e94658eea3482f30109656d3c911f683698ce5ad531e396d64596542", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fe94aff-1974-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772812223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812223, "uuid": "1adbb113-f36e-4bb1-83d5-d3bbee17e940", "comment": "Malware payload (Mirai)", "value": "56f11a020dc69bae62fbc327987ec57e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812223, "uuid": "8bf1f823-deab-43ae-b96c-ebb04b253bbb", "comment": "Malware payload (Mirai)", "value": "0c1dc0c5ab0a63a964a8114860c58d7a9d4922990e13414abdee19cff4044c28", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812223, "uuid": "798a4ecf-b271-4516-8eec-04f2b84aea44", "comment": "Malware payload (Mirai)", "value": "acf0d59211c900233eceb11d4a1b1109a09f44b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812223, "uuid": "fb9fc9c0-9603-4d68-8377-db702951d7a0", "comment": "Malware payload (Mirai)", "value": "27f2a84859e5416de2f31ba0623e816121890b2f42626c5c8989ce7f0ef70fb3bb0f8e8d53a772610d549e11a8d4c21c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812223, "uuid": "0f81bcd1-724b-4901-927f-64d2c55c0459", "value": "T10114E81AAF511FBBD86FDD3742D8071135CCA54722A93B3A3178D928F54A50B4AE3CB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812223, "uuid": "6b1cce20-d98d-45b7-a77c-7aca36d009f7", "value": "3072:tTPVDCa7E+0nf5khQ6ecSWvkKL8+jSzFB:tTPVmqc8aWvtL8+jSzF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772812223, "uuid": "07d67f7c-7d12-46ae-b723-da394cce9cbc", "value": 197636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772812223, "uuid": "d7d0672a-78c2-4f98-88b1-f331fc30eb48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812223, "uuid": "9e57cb7c-df07-4d9c-903a-68ddb74b0c13", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16fe0cdd-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1772808745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808745, "uuid": "75caeae2-52cb-4117-ac3e-cfe5490df6fc", "comment": "Malware payload (GuLoader)", "value": "54ec0c8ebcdc101887fb8904ef992b46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808745, "uuid": "3a77459a-ab58-4990-9b8f-c5e8a4496b47", "comment": "Malware payload (GuLoader)", "value": "0c9e0b19e3596d6b2cd821435316d85141b41aaeeae15f3a9777804b01515eea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808745, "uuid": "902494dd-91e3-4b6d-bdc9-b01001dbfd41", "comment": "Malware payload (GuLoader)", "value": "6dcfd76e92982e437bc56411691059f254744fe1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808745, "uuid": "232d8c26-a379-498a-b6cc-2e6e53003e9f", "comment": "Malware payload (GuLoader)", "value": "5479bc6750bc2622d4ef3bc2c20a5b27ab558f71faff9fd0137756fe58a6f24437fa5a42fee842acdf970d579fdd1146", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808745, "uuid": "b8896538-443b-496b-965f-347ae5471408", "value": "T177341226B2A0D56BE67527320EBBAF3BFFF6790110948F032354AB6E7D72581901F416", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808745, "uuid": "cca4ab04-2fa8-4214-9f23-e2731a179782", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808745, "uuid": "1c54f1ec-27b1-44ba-b7c4-51104eed3e89", "value": "3072:5WIWYHxfvyH+cd459DsvhLyNB0r2eyaR4TeEofbfM61ATiLk+7hJuGkY32CNjJBy:kcBvWb0IvG/RaIeEoeMk+pNzvowq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808745, "uuid": "b267e44b-797b-471f-b280-87ba79b3516f", "value": 240743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808745, "uuid": "c62f4f84-dd4d-406d-9074-f9d7b2f1317c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808745, "uuid": "6954ffc5-aac0-4c7c-9f9a-3edde9cf27d4", "value": "0c9e0b19e3596d6b2cd821435316d85141b41aaeeae15f3a9777804b01515eea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88bdc46d-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819244, "uuid": "93a5d9bd-c9b9-4eaf-aa40-304bcf65610b", "comment": "Malware payload (Mirai)", "value": "394e9d485bb9ea3367028b7e1b39afba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819244, "uuid": "d71dabc0-7182-4c44-ae64-44ee12ab49fd", "comment": "Malware payload (Mirai)", "value": "0ca850adf73b299f9d3cf3edb41ceb83dc50c352f5788ae1cf7e2813ad56186d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819244, "uuid": "439e258c-cb58-41c2-ad52-b53d850c90fc", "comment": "Malware payload (Mirai)", "value": "7c4d8490ba57bd56d06c16232070b281485c6037", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819244, "uuid": "ed7fb3b9-fb22-4675-8dde-c8e2a1ab60ce", "comment": "Malware payload (Mirai)", "value": "30df22d2da7699d43ab83546f3a0daec3649cc5dbad5400d422604971018f324529e87409ecaf48bc65654229a0eaebd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819244, "uuid": "c71ee03a-4416-4a80-ab4d-1b53ee1c780d", "value": "T136C3FA5E6F329F6DF12CC33147B78E21975813D223E1D685E2ACD6055E6038E981FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819244, "uuid": "a4ddef00-c6ef-4abe-b7a6-b577e79af9a5", "value": "1536:iWQ5Ri8+v/t5rm4RfWuQNC8RLipYJPRUx3nfylJZ74uk97H9NefxTLRo1xWe7HA/:qrNiN9fuLipKQukpH96o1zi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819244, "uuid": "63ad3939-87ad-4bd3-a6f9-dc261436c6dd", "value": 118724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819244, "uuid": "4f9242fa-25b2-454d-987d-b82f01474271", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819244, "uuid": "1e045b70-4386-4ab3-b277-38f463dd5c0a", "value": "violetmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "558b3cd2-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772808850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808850, "uuid": "b59bd56d-7a7f-455b-8c8f-fe2cad2ec3ba", "comment": "Malware payload (Formbook)", "value": "65831a6209060d39487c945ce916a33e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808850, "uuid": "318a9db6-f8cb-45ac-9016-9a4bcf16584c", "comment": "Malware payload (Formbook)", "value": "0cd839c7cabceabe9324f0a440d99669a6e4f4c7975e2a19170d7289b5408ef1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808850, "uuid": "9040696a-9117-4ee3-9f02-a5bee8c1811e", "comment": "Malware payload (Formbook)", "value": "7fa5eb306d8cbbfc593c605cb3ce53342258a5f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808850, "uuid": "c646eb89-7692-4407-89df-d75778b73d2c", "comment": "Malware payload (Formbook)", "value": "a1ff0f7213e8743b6aee44499985e8b5e0177ce100aaf002c3c1f1a40328678f3e1430c3f688a74729c59532257c20cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808850, "uuid": "3c35353a-861b-4ad7-840b-e3b6b577638a", "value": "T1A4F49F2DB4E2A0D1ED2198F30F5E97E04E1B731367A61C5723B802448B954FF1E6EA67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808850, "uuid": "844542ce-451f-4e31-b342-76ce1b28fd2c", "value": "96944a9beff3e19cb1f487616a09413c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808850, "uuid": "56c2abcd-3c37-47b8-8357-016bc5b50ba5", "value": "12288:PDeS37qWkCQ/y2iARBRnjQzyBtthtaxriaCoCM7Bmt1/uVgr6Yla+ck7BrH7FGhj:LLEfypAnRjbBPhtHdp6Bmv/uVsZg+Z7S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808850, "uuid": "1285213d-dc61-4951-8a2e-c63e7080e295", "value": 783360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808850, "uuid": "5cb7ee78-22ce-4ea8-a9b5-297528cb9250", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808850, "uuid": "5776cd1b-c951-4671-a0a2-029da3afd25a", "value": "0cd839c7cabceabe9324f0a440d99669a6e4f4c7975e2a19170d7289b5408ef1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ad19a60-193b-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1772787680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772787680, "uuid": "991911f6-ab07-41b4-935b-59bcd5785295", "comment": "Malware payload (Efimer)", "value": "273c3e6fdeba4b856584f808038319a0", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772787680, "uuid": "42b7ac09-8008-4129-866c-e95040c8197c", "comment": "Malware payload (Efimer)", "value": "0ce51c33748070cc56b345617ea0ca6ff289db196dc2db802e1004ed66c11bdd", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772787680, "uuid": "ea364b08-08f3-41df-a16e-990b337bb0cf", "comment": "Malware payload (Efimer)", "value": "2654b7bf3a71de51b8e737b491d1b5a157134e03", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772787680, "uuid": "3a989d69-c26c-43fb-ad94-ca195e356c87", "comment": "Malware payload (Efimer)", "value": "6f2121111459f98062c2f1514f53046f6e780fd801998a05e5862dd49e13141d21b7c5a006e626892fc94bdce42fc528", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772787680, "uuid": "09668eeb-d5ab-4a93-b85f-34f8e43172f4", "value": "T162D633187BD006EAFA73803DABD14165F979B4B54374C2EB2B6C8B615F271E04D3A263", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772787680, "uuid": "b20338d2-24f6-49f0-abf8-62c99a2545ab", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772787680, "uuid": "54f4b800-cc80-4c82-959a-574312e27462", "value": "393216:BN+37QU0aRjzGJft/ncIQc4vvkJxdEyXMCHWUjXBcuI3/PGTAI:BM3MU5Axnccqi3rXMb8XWH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772787680, "uuid": "0d448a11-77b6-48e2-8605-97efa8cd2566", "value": 12749761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772787680, "uuid": "77b75bf9-5183-4652-9d18-1cee8ca6933c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772787680, "uuid": "d95cde13-2dde-4217-ad80-1035e5fe2b74", "value": "0ce51c33748070cc56b345617ea0ca6ff289db196dc2db802e1004ed66c11bdd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df5f383f-1928-11f1-a769-42010a9c0008", "comment": "Malware payload (Heodo)", "timestamp": 1772779876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772779876, "uuid": "380b6aac-ddc6-44ec-9e71-045331cbde67", "comment": "Malware payload (Heodo)", "value": "58b4d0e400c76005d3d5060c38aaf324", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772779876, "uuid": "508f6d50-af31-42b1-80b3-1fcecb2fc2c4", "comment": "Malware payload (Heodo)", "value": "0d06b42a2f780cd8e9be998b25a5187b1479521d39417c0f815b84e1fa822070", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772779876, "uuid": "d787d96d-594b-42bc-8972-a18a5660d3a6", "comment": "Malware payload (Heodo)", "value": "6fd985c1909251cbc4660a376cccbed33d3635d3", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772779876, "uuid": "2769fbfa-8dfe-4d3c-a202-83b75b96ae44", "comment": "Malware payload (Heodo)", "value": "7fe4265977989ff19e47bd24486873b90d29c4b62fc16bd13325af0272f540a411c65277ca045b9afc855e440d320c19", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772779876, "uuid": "5d9ff9a8-f496-48e0-8fb7-a80db1f00184", "value": "T1EFA63332C32AF955D95372B939BBC61A942FD6883343A5CF17B819DCACC19D05B2E309", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772779876, "uuid": "1d917ade-4329-4c61-8ed6-ea6e31914584", "value": "196608:o6gGLdq/Q3Y0iNSrb1Gf0suSMMl0bu6Z7EfxrA+O7i:ZI/Q3nJb1GfeSM+0buiIxrA+O7i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772779876, "uuid": "e3dc0847-d68b-4530-9798-25cae6fd3552", "value": 9563667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772779876, "uuid": "abf8300e-715d-4a1d-998b-54dff88e2fd4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772779876, "uuid": "fe3df6fc-bd76-4c15-b1be-acaee5bb262f", "value": "0d06b42a2f780cd8e9be998b25a5187b1479521d39417c0f815b84e1fa822070.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bf99ab5-1970-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810499, "uuid": "697def54-2ccf-4d00-a6b1-d618609fbc0d", "comment": "Malware payload", "value": "1f3db92afe323ae80d5f24bd5691d09e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810499, "uuid": "78c4fbd5-ce45-4c2c-80c5-123a2f3aed18", "comment": "Malware payload", "value": "0d26f7dbf57f5046777613ba4b28856e2375a31971a9d5ff789d9d265d88eb9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810499, "uuid": "3bc8bb3e-8ea9-4473-b8c6-10cc5d40133b", "comment": "Malware payload", "value": "b658a98dad7fad3bdf174b3fa34994dedef37bad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810499, "uuid": "8de7d20c-b660-48a0-a5a8-d9d5244b15e8", "comment": "Malware payload", "value": "ce2b3237179fd9ba3f442076ab16bf94c5ce454079b48382e61e461ca10e063dd466e3b852ce7324c572f7a0a9948e54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810499, "uuid": "44be97e3-9fea-4066-9287-ff6c1df7bb42", "value": "T10425230822CA89FAC5E96F32E1E583648F46DC39139817CFA388FE98F115BD15E1F651", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810499, "uuid": "0f84a68e-5d0f-44ee-a538-edf4db4b0274", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810499, "uuid": "64619b93-b638-4f6f-86ba-98ac6dac464d", "value": "24576:pyHHVMpu34YdcFfDYs/MhKCrzVpMRKBQRKrXWi:8HHupqir5MhKCnQkLXWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810499, "uuid": "06e6f4e1-78ae-449f-8278-0df72557491f", "value": 1055616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810499, "uuid": "650f2477-b867-4c65-bd26-0918a02c6cc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810499, "uuid": "923dad5f-be91-4d7c-aa56-38bf3802d5dd", "value": "0d26f7dbf57f5046777613ba4b28856e2375a31971a9d5ff789d9d265d88eb9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "012adc54-196e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809568, "uuid": "01b150c3-8abd-4b8f-a053-5d2d94f16fa3", "comment": "Malware payload", "value": "8d1239e20b67d593e731a873755b65b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809568, "uuid": "f477e0af-a431-4498-9317-3e82f647f4de", "comment": "Malware payload", "value": "0d29b2a99c1b1b49458edf202feb084c020a1abfe8d6b5ea6ef609ce615c4624", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809568, "uuid": "c615568e-1f2d-4e66-a673-386a16af91b8", "comment": "Malware payload", "value": "8e5db74778f74eea45a3693c8c0718fc7ed45a8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809568, "uuid": "a6828113-e604-479e-8e69-b1faf32308de", "comment": "Malware payload", "value": "f5735a5868f98237565d99516a1e77305e9a2e4c98f0870b05f4944b899aad93bba7bf583ef06e654bfe12996efbb537", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809568, "uuid": "18f4d605-64bd-47e2-a344-397454db41f0", "value": "T191C4AF91F711DAEBE5A60ABA4CBBC43135676C6E8AD2111E316DB22825F331111DFE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809568, "uuid": "05b29fd3-3c28-40c6-b343-398034fd5c8a", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809568, "uuid": "f0034a20-92f5-46bb-9cab-b0d94fc2d29a", "value": "6144:fwq3NpQ3wDIywUF5ykHERIe6McaazxpwErQMlWUYMuhlhGzcOV1U4f73IH6aq:fzcae63aIQwWRbGzxTx73qo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809568, "uuid": "d76951bf-19be-4f54-a6b2-b2a409cc4407", "value": 553120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809568, "uuid": "63865f95-ec1b-4e71-95b0-180caf8ff47d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809568, "uuid": "d4d5a684-9ed7-4cba-afd0-c02953dd9727", "value": "0d29b2a99c1b1b49458edf202feb084c020a1abfe8d6b5ea6ef609ce615c4624", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "960b0c00-196a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808099, "uuid": "88268f9a-64e1-431d-9f32-a78d56f5d0a8", "comment": "Malware payload", "value": "c991d4c044e445a00c885a4faedc2529", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808099, "uuid": "649e161d-1beb-4fe8-9414-034a9fb67646", "comment": "Malware payload", "value": "0d414e464e17678b9aaa10d953677a5f7bb0680ff4df2d21d33a47eaaaa5f900", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808099, "uuid": "c021d6af-dfa0-4cf4-8de9-52f54f0bf053", "comment": "Malware payload", "value": "14f9e5bbf686b1075643cacdf282765964f503c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808099, "uuid": "ce5085b0-f0e9-4033-b02d-15276395de76", "comment": "Malware payload", "value": "3a689ec421554c3aac156a0bd60b6274881ed5bac7b27e5af30f6a4a452436a54a682a4adbf0dc6d1673c2c3f81eddc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808099, "uuid": "d1ee46eb-537a-497f-867b-63ec1e59dd4f", "value": "T19D05AF4DE5E160D1ED2288B30F9E97D1891B7313A7A5189723B802044B974FF6F6EB27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808099, "uuid": "25acd02a-c3a0-4460-ada4-57e50a4fe2f0", "value": "79b51b0b8fa06ebea3a256fd7f7ce2c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808099, "uuid": "1f765efc-a326-4b61-8091-3bae12d106be", "value": "24576:CayxlixTtcRIa6ctfnQL35Lx49dTcP9g+fS:CadbEdnQ75C9dk9g+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808099, "uuid": "ed5cdd54-8e53-4796-8323-63fca7c00094", "value": 862720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808099, "uuid": "91b47816-778b-450f-894b-a6d61a116a50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808099, "uuid": "677134e0-677a-4ecd-af08-57d8d223b3c9", "value": "0d414e464e17678b9aaa10d953677a5f7bb0680ff4df2d21d33a47eaaaa5f900", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbfdfc09-1928-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772779843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772779843, "uuid": "ef392a99-aedb-4d8a-acf9-7722916622b0", "comment": "Malware payload", "value": "550a48c47e4be4adb5bd13b2c893e57d", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772779843, "uuid": "1214977d-89fa-4f22-a12e-579d17642872", "comment": "Malware payload", "value": "0d5de95ffecdad96465389a555f9132fef20557430ee7e4b15a372608c3019bd", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772779843, "uuid": "6454910a-388b-4684-b883-dfd4d6309600", "comment": "Malware payload", "value": "18e30d147205c4a5ff0728befcec00ef514c5d95", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772779843, "uuid": "ab2eb237-0c05-46e5-9c88-d85b0dd1c0a3", "comment": "Malware payload", "value": "bda5e93d16973154c333d64cab6bbb9d2123dcecdf3b1ffe01d399f982e62a1dcf7c61935e4b57bcb9ee89cad8158782", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772779843, "uuid": "90e682aa-c6a8-48b4-8a9e-ff2d3d62fc0e", "value": "T1C9E523849EF26701F6D682CAB16BE5C4FD2E1C223418CAC8BA7FD4D464D1D25FE4864B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772779843, "uuid": "9ec7919b-b47f-476e-8463-cc3f7dad0627", "value": "6144:QsmnUs7QjOvfAMsmnUs7QjOvfA7eNxnzV7Iplm0lGALblU54:DmnUHOnAnmnUHOnA7CzV7Iplm0ll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772779843, "uuid": "1c5d2c6c-e32c-4c32-8100-02c33ccc5773", "value": 3068079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772779843, "uuid": "178f7d48-49e0-484f-b686-84fa9fe1d240", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772779843, "uuid": "83c0a688-ffd5-4070-9c26-3fc1dc1e8c40", "value": "flow.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24f1ed5f-195b-11f1-a769-42010a9c0008", "comment": "Malware payload (NirCmd)", "timestamp": 1772801467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801467, "uuid": "9a7211dc-9071-427d-bcb1-213dc270bf0c", "comment": "Malware payload (NirCmd)", "value": "09cf561dcf3b0f81fa241bcb170b3c2a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801467, "uuid": "af140e30-e2a5-44a1-aa85-e9d142e17da5", "comment": "Malware payload (NirCmd)", "value": "0d6f9701bbe0142a18e081bdd354895d9e3d678bbacd0a84c4080ea3eaeed5eb", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801467, "uuid": "b7aa879f-0221-4ad5-8865-459d6a922fbb", "comment": "Malware payload (NirCmd)", "value": "95be34ed1052be2f0ef91709a6651d60637aef81", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801467, "uuid": "b05b8039-5425-4871-9879-221c871d6378", "comment": "Malware payload (NirCmd)", "value": "4a87af0728bbe431d560b05ca19f700340658525666da2d43bab2b68f528704cb367af26189ae81df144473321953de4", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801467, "uuid": "27c5a8cf-a5eb-4ff7-83ae-9e9a9971e6f2", "value": "T10FA52342F8C485F3C4511C331B65A7616A7DBE202F268EDBB3856B1DE9614D0EB31AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801467, "uuid": "6603ee02-c85e-404e-8fb4-ed47d6d9ecab", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801467, "uuid": "084c438e-949a-4caf-92e1-8a93241c590e", "value": "49152:ABROTpc8iYM5pF9UBB6jdLXsuuX4/cqZIiQx6lSONx:a8TFM5pXUBB6BLXTuoEXx6lSONx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772801467, "uuid": "9ac90cb8-9a10-4392-9ed7-94c18608751f", "value": 2110512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772801467, "uuid": "8290d513-d686-43ee-8473-151f5ccf1728", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801467, "uuid": "07ade4d8-12e3-4b71-a8b3-2cff3ca3eeb9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e41e796-1900-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772762426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772762426, "uuid": "2e8a45f6-26b9-4771-92df-f51dc8e63b02", "comment": "Malware payload (Mirai)", "value": "e5eb776367d69089c847972b9b22b852", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772762426, "uuid": "d185ec02-e394-4455-9523-8b582dd77f5a", "comment": "Malware payload (Mirai)", "value": "0d8132bdedb562bf7dc10a1d7e81607ecb4d090ed96bf1a118da4e1084504845", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772762426, "uuid": "ca844814-6a1e-4b2f-9b6d-d5c5dfec36dd", "comment": "Malware payload (Mirai)", "value": "cffa8c21a594fd3c653310ae7b3b5a909e1657f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772762426, "uuid": "e8cec07a-8897-45c6-88e2-3d05e986cc94", "comment": "Malware payload (Mirai)", "value": "01af5aac2f343027b9b9150dbdae811a5e7836d13564d2a7aba6635f8b19d68ec6e9b2e0ecac7dfc4f2658c1b71d4dcd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772762426, "uuid": "132a9455-36d9-44fb-9d9d-b48eeaae141d", "value": "T198E44A55F8C09F62CAD56576F65E82683313477DC2D7F30689188B383BA78AE0B3B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772762426, "uuid": "26fb860f-12e3-4653-a2e9-00fe8118902e", "value": "12288:glwOAUlS0XpX3WW/dMSD8dbyqzQr4+f5qevQXfW6pZTbkvVFAOEHh52:gphjmdbyqY4+f5qek0VFAOqh5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772762426, "uuid": "e06e0e43-d0f5-440a-bfa7-b7ae45d2c13a", "value": 717168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772762426, "uuid": "3d3aef1e-1e52-48c2-b705-3da3a9854ab0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772762426, "uuid": "9eb1ed1a-9308-4b95-97af-3f67fc1a376f", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41a160dc-196b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808387, "uuid": "338c22e5-0738-4df5-84fd-3b7a58008963", "comment": "Malware payload", "value": "5ecfe80edd641cbb651548b8b614d7ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808387, "uuid": "43d4470f-ab46-4217-85e5-f689836b85a4", "comment": "Malware payload", "value": "0d8e84be1e43c2a884bd80f7fbdfd1e82c26cd9a58d700599ad4b16d162d1610", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808387, "uuid": "b177e8a6-b7ba-4df6-a006-440316536d2f", "comment": "Malware payload", "value": "5e3e6e61daa6aa2ce58f89ff3d986c2d9aaeb91b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808387, "uuid": "0444461b-4bb3-4a46-a181-8a808e37497d", "comment": "Malware payload", "value": "804c642dcd45fbc937e2fa1bdd32b964e1fcd6e34ebba4cf0faeada1bab29ef61136b10421078dfe6174654569c9eb28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808387, "uuid": "b5f898ef-81f6-408a-a3a3-1de395cd6779", "value": "T1A155CF0273D1C062FFAB92334B5AF6115BBC79260123A61F13981DBABD705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808387, "uuid": "38f2706a-5488-487d-915f-ded388501808", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808387, "uuid": "ba713e59-bce9-4894-8ff9-801e8ca706aa", "value": "24576:v5EmXFtKaL4/oFe5T9yyXYfP1ijXda+ftXj1lHeftVrB:vPVt/LZeJbInQRa+ftXjbHK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808387, "uuid": "43de89ec-6d15-44ac-a858-4d65e8005eb0", "value": 1282560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808387, "uuid": "6803b0e8-f885-4331-9fef-be975c55cb65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808387, "uuid": "d88b7bc6-46dc-490f-a55d-759fafe91567", "value": "0d8e84be1e43c2a884bd80f7fbdfd1e82c26cd9a58d700599ad4b16d162d1610", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff12d068-193c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772788519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788519, "uuid": "b5523560-751d-43f0-8a4c-2e8fd3eff66e", "comment": "Malware payload", "value": "b6d22b744358b322a7d79c9756356092", "object_relation": "md5", "Tag": [ { "name": "157-20-182-49", "colour": "#B32581", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788519, "uuid": "21b0216b-622e-4044-b491-69e2d11d7ae4", "comment": "Malware payload", "value": "0db367ed84c2722c3d05642c46b7b584dfc42dd622249954b9e143c9388dd1a7", "object_relation": "sha256", "Tag": [ { "name": "157-20-182-49", "colour": "#B32581", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788519, "uuid": "4acead9d-b9f8-4f5e-a9d7-3dde0443279a", "comment": "Malware payload", "value": "d7818918dd500cece588e8e25991489774555ca5", "object_relation": "sha1", "Tag": [ { "name": "157-20-182-49", "colour": "#B32581", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788519, "uuid": "1718406c-f584-426e-86fa-41a0d83e7f54", "comment": "Malware payload", "value": "02872693db04ffdcfdf11f4da8b011b8aa60f5eeb7a50254ec96bd678fb2ecede4e20abc76e586fb9db1278624f9a8a5", "object_relation": "sha3-384", "Tag": [ { "name": "157-20-182-49", "colour": "#B32581", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788519, "uuid": "95c5c86b-efce-4c54-839a-58927f2d4846", "value": "T1E4878D87E8A045E4C5A9C534C6659163BBB1BC894B3467C7BB9DFB242F327D0B97A300", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788519, "uuid": "3e37ab67-2868-4252-aa8e-435c32644c1d", "value": "196608:TnNHg0pnB1bLFs4TyDarXvTrAqdvyijU2bo8jJgp/xVfqzF6IOQq2U/e:VDnPbLFs4TyD8vAqnU2bLJgprfY61r/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772788519, "uuid": "c1ce1dbd-e7ca-48ee-af8b-6087bf13de6a", "value": 38533120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772788519, "uuid": "02ac5dde-7494-4b1d-811a-ca548e624f92", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788519, "uuid": "c8de9e5a-14a1-498b-9dbb-3c6aae01f838", "value": "0db367ed84c2722c3d05642c46b7b584dfc42dd622249954b9e143c9388dd1a7.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ae3d6c2-196b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808322, "uuid": "b68de386-6d80-4514-a5f5-e5c3fb42f5fa", "comment": "Malware payload", "value": "37ec20a39c4f0fafcd4135f4b8b75f63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808322, "uuid": "f74a987e-4bbf-452a-87d5-d6881df271e5", "comment": "Malware payload", "value": "0e1d94083848098aea2d7134176935f801ce8113f1ddf504fb7df027461597de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808322, "uuid": "4f635292-3cde-4bff-b17a-c8ff7b32a027", "comment": "Malware payload", "value": "b5b151c16414248acfcb0a6f441368f95bb4d028", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808322, "uuid": "a46e1ecd-b6e6-41ea-96a3-42d3657704a5", "comment": "Malware payload", "value": "1cfd8f8744fc817aba9aac023015fa62d89f9dd284c309f71fe8d06e2b033c90f66323959c870da093de0c86ad132abc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808322, "uuid": "110cdf62-5491-4705-b59e-adf5c0a34d0a", "value": "T12B94F612D650716AF89749B02D79A256782D3D3A2E80EC0BB78D9F5A3771683B0F431F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808322, "uuid": "d66c49ca-28d2-4dba-8360-bbd647bcbd20", "value": "61faa009f32abd23d86bdfa12f5e8077", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808322, "uuid": "8e696f00-77e1-481d-8aef-f5021c9d2e6c", "value": "12288:SjSFdgE7Opncn++J6zGTN3rod9RfAHoVKaK:1i+gzQGwq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808322, "uuid": "f33b6833-a00a-45e4-aa35-05bc0bf99cab", "value": 417792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808322, "uuid": "6cf45dd9-7e07-46b8-99c1-a1482c1f2869", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808322, "uuid": "211241e6-36b7-430d-8e5c-8ea205190856", "value": "0e1d94083848098aea2d7134176935f801ce8113f1ddf504fb7df027461597de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6d70160-196b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808611, "uuid": "2c53d0f6-0db0-4af0-bc40-ce45335e49ca", "comment": "Malware payload", "value": "bc9f6b481ceee95985c423d5d9fe7795", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808611, "uuid": "39d0e79b-0194-4d35-9ded-4180832c4bd4", "comment": "Malware payload", "value": "0e2ab7d1f3695a9aa5ebf1c294c8782fad5673eff65b7e0cea5b33e136f46e8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808611, "uuid": "6d1cc282-9bed-417e-9c3b-2efc924ba42c", "comment": "Malware payload", "value": "4546f57f723e6fe89896285ac4803f65b2fe0b65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808611, "uuid": "4f3406df-bc66-4e0f-9d8a-1148d9b7817e", "comment": "Malware payload", "value": "c4b5793e742f86251773e2c99865ae1e206eded72e0f966b210a8ee9cf2cbeacc5453fa0e2304793dc82c9072ee830de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808611, "uuid": "b37a4d89-4c77-4653-8e25-403488c66b0b", "value": "T1D205F158271ADE02D4B20FF04E71E7F54BB85E99A411E3438FF6BDDBB92A7006D41292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808611, "uuid": "8ece18ac-a5db-4b4b-8ba4-21e974823b68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808611, "uuid": "af8baf6f-c2fe-4feb-85a1-27b599150ab9", "value": "24576:tqu2VhG6TLiIfq4U1w/qyky6SIMCF1EA:teVhGwzU1QdVIXEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808611, "uuid": "c0f18d02-bb0b-4d32-b3fc-858b4c26c227", "value": 821248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808611, "uuid": "1ec0ebf7-e484-45a0-b86b-b803681ee8d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808611, "uuid": "04eef963-3318-4013-886e-15131aeb5b6a", "value": "0e2ab7d1f3695a9aa5ebf1c294c8782fad5673eff65b7e0cea5b33e136f46e8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b0d64e6-1995-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772826576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826576, "uuid": "a1f41995-a736-48ca-a67e-7d60e2175e88", "comment": "Malware payload", "value": "a019e10f2b09e29be244f3c9e430a34a", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826576, "uuid": "1c6fb5e1-6bb4-4f1b-b001-5ea74989b82a", "comment": "Malware payload", "value": "0e331a3e7fd3d6ba920d13beddb1cf4145fa3d76adae5c95c95878f4fcac1932", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826576, "uuid": "e09605f0-d62d-4699-a2b3-9a571d6657a8", "comment": "Malware payload", "value": "86516e7564d0e0362989c9336f1960d18ce498aa", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826576, "uuid": "859c5b54-cb24-4855-bf65-e648b361fd93", "comment": "Malware payload", "value": "57df87232c07ae67c556393caea7901580f234be98537b4c65b175d0b92fb69ef8b01d7f5fbfd31c543923d0592e9390", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772826576, "uuid": "15829079-f6b1-47ab-98cb-a88694897c7d", "value": "T1B8052214C3A4B5F9F504A236716454CA68A04923E109F65E59E7382F8E63FF4AEF9C3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772826576, "uuid": "29a5e7c5-78dd-47aa-ac43-8a4de4111898", "value": "12288:7uGtl1z3aUMxanB0fgUlZOHmbGNECrdRN+snRBolgkaas32A3fF2AYiEZxbY2zGB:PX3Eytw2mKtdHR9dPMAYiEjbNzGYoIw1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772826576, "uuid": "678f79b1-860f-4a55-8863-b5a69f2f9527", "value": 827690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772826576, "uuid": "e6df11d3-c63f-428b-acc6-3dc4bbaf0b61", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772826576, "uuid": "f0014eab-59cd-4271-84f1-aa703ebe6a62", "value": "SecuriteInfo.com.Trojan.GenericKD.79643133.1427.4763", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db3e0d26-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772809504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809504, "uuid": "39655b3d-3e89-4df6-ac20-6b51543f75af", "comment": "Malware payload (GCleaner)", "value": "fa9671e4ea5aca22253c8f8e0b6248d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809504, "uuid": "3f3ab7f1-8016-47e3-a81f-52b1fe818781", "comment": "Malware payload (GCleaner)", "value": "0e4038c71e12dee0e050106c1a6fc5070dadcf25f23828333ba830936ce656ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809504, "uuid": "20896e79-dde5-4161-811e-06811db24640", "comment": "Malware payload (GCleaner)", "value": "5c39e7f64297810cd2a056f0130d86f47fce72c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809504, "uuid": "23ca6090-9eb2-4bd9-97b5-5b475c10d569", "comment": "Malware payload (GCleaner)", "value": "0ab55ad642d6e3034a5b5265047b926de37ad77dd96d876e49b9a7f9a0972526ca98bf8087200eec66c9149dcd17ee73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809504, "uuid": "c38303b3-3712-4d33-a469-72299b8e6b2b", "value": "T10316E027DD4F6229D4282C375C2967EF96DC7F02289E45C84E690DCA4E7FA9B38CC581", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809504, "uuid": "24cc0621-1c33-4986-a5fe-d5171dbfad1d", "value": "345624d13ffc2b7f296b9d2972b1c0a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809504, "uuid": "3ee1895b-b276-4483-aa4b-0cbd87aee601", "value": "98304:siZnokHrT5QfmusRenOZEuuREgkcPoYfYF8p0AlY//:sY9LlNusReYEuOEgk7Yf68BO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809504, "uuid": "38c2315e-1a39-4fa9-9755-8f210c1fd4b8", "value": 4290048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809504, "uuid": "3617c9d2-daff-454a-90fe-0bfbba4d5099", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809504, "uuid": "a0d560a1-2be9-4dc0-b2bc-083c40f5a678", "value": "0e4038c71e12dee0e050106c1a6fc5070dadcf25f23828333ba830936ce656ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "386fb569-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808801, "uuid": "64738fac-e2da-4d6f-b83d-66ccb43942f8", "comment": "Malware payload (GCleaner)", "value": "c9edf7efdd7a472b29129c42066ef1a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808801, "uuid": "7384f7f5-b1de-46ff-b2df-0a70fea60585", "comment": "Malware payload (GCleaner)", "value": "0eb657033b8d77480d42e76f90271d731f5bd8ef2c1f56276834afa4eb01aa18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808801, "uuid": "5a3ec638-08c5-4fb5-888e-73ff1102ccbe", "comment": "Malware payload (GCleaner)", "value": "498961a998b18e8fc36a0acc47dea958aa5a35f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808801, "uuid": "622d9354-2f16-4d78-ac8f-73a68133fdc3", "comment": "Malware payload (GCleaner)", "value": "e9fc83de01cd38e1c43a87e6527b3402c51e2936345ee31c1195bc2394bd9ce35695033cc91680ea76a0164f573b6ce7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808801, "uuid": "c59fd8f4-6d50-4fdc-b21c-b64756b6a245", "value": "T1F316E022E3025C56CDB9B3B1F55D9EDD0A442CF63E058B8F25DC88FB4A37641692A1E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808801, "uuid": "68b7555f-7677-4110-941c-cad38cf61cb8", "value": "234372fce9eaa047bc4c39047910954c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808801, "uuid": "16e39e64-3ade-4cdb-a59f-56d3856c0342", "value": "98304:mBJMPoNA3knp/0kn8wW8yDzBx0dkg/NeD0p2mPqZ4jG8wvVfX:mooiknpV9W8yDz8pB2mfK8wvVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808801, "uuid": "3bf19f1e-65fe-4323-a7cf-9539d6ff6c20", "value": 4165632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808801, "uuid": "cb55a253-739a-4173-9d5b-dd513740e569", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808801, "uuid": "652139ec-2395-4cb1-a809-39bc2966010d", "value": "0eb657033b8d77480d42e76f90271d731f5bd8ef2c1f56276834afa4eb01aa18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "993d6d61-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772811541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811541, "uuid": "fefa6efb-01c8-47bb-8d7c-47ae0edc5ea5", "comment": "Malware payload (Formbook)", "value": "d82353d8067a923392593b8df7ec13e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811541, "uuid": "f685f360-c9e1-4a8d-9d78-07488b7b0825", "comment": "Malware payload (Formbook)", "value": "0eb78aae5ca026250c363e0ff5432ef65f6e5beb31e3f309d93e851ce2dd7be8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811541, "uuid": "1c73595a-3ddb-442f-93a8-4c71b300ba97", "comment": "Malware payload (Formbook)", "value": "bb62fe560bced33eaddf9f10d2bf805b97932082", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811541, "uuid": "15a1d0a3-97ec-4c96-89fc-0f453e2e9ac7", "comment": "Malware payload (Formbook)", "value": "58d50ff3bf15205132332fe307efe97b4625747a5ac26944b67920ecab7e186d9914de25a3bfb4bb6b340818a5911341", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811541, "uuid": "bf3f45cf-e113-4b6d-9d2f-1c833908def8", "value": "T15C45BF0273C1C062FFAB92334F5AF6115ABC79660123A62F13981D7ABD705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811541, "uuid": "4d6449f7-158d-4297-b2b1-965c3a49fbc0", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811541, "uuid": "ee48ccc2-da35-48a7-8e4a-6cdf91200bdf", "value": "24576:E5EmXFtKaL4/oFe5T9yyXYfP1ijXdatSwDKBIYF5ek2iGo9bNUDiBu:EPVt/LZeJbInQRatX+5eN8Xc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811541, "uuid": "84a422bf-838b-49a6-880a-105ca5b5f18e", "value": 1271808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811541, "uuid": "9c58509d-ce76-4eb3-9c86-32d99175e651", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811541, "uuid": "e16928f4-448d-4920-b380-63a3dda4ed13", "value": "0eb78aae5ca026250c363e0ff5432ef65f6e5beb31e3f309d93e851ce2dd7be8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b9ad60e-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819249, "uuid": "dcecbd40-0c26-4cfd-a12e-bcbd032b0f4c", "comment": "Malware payload (Mirai)", "value": "37f0da2a0ebfd71464168b6bf677c344", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819249, "uuid": "92a9bd61-19f9-4929-b301-3afd9d4b9dad", "comment": "Malware payload (Mirai)", "value": "0efc7793506a58ac8f6e14771e7f333f27bf4ba910369d828c378cdae6cce201", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819249, "uuid": "a5b57d41-2dcc-40f3-ba35-b8a9303a47e6", "comment": "Malware payload (Mirai)", "value": "a0e53090edc5bb55eeb97ebbe093e716f05e0313", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819249, "uuid": "15f94f7c-e9a2-40ce-9a12-fe387788200a", "comment": "Malware payload (Mirai)", "value": "ad43da909cd40da2399cfd39fcd2a3d4354bcebee1518a3daaf61d1816a5ef721d9b11de1287d7a0d32efc51dc9ab0ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819249, "uuid": "492e29ce-7cc0-491e-a6c5-adcef258d853", "value": "T116C31A09AFA21EE7D46FCD3702AD0B0634DC5B4612B9BB3A7274C928F55958B0BD3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819249, "uuid": "2125f537-72da-4c07-9cc1-8c246adc6539", "value": "1536:m6cc1JkfWV4+FwmW/7emzjRx1EUEuZm5xHaCZDptatlZP8YUVJT2gWe7g:pVIfWhamW/TRfExuKpsPUC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819249, "uuid": "c6565a88-4e24-4c2f-80cf-24ace30e82d3", "value": 118884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819249, "uuid": "5f82252b-661e-4579-b1d6-04d0c09dc8c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819249, "uuid": "b8affd52-0c51-435b-a9b5-1329d0e21b57", "value": "violetmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65f445f2-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819186, "uuid": "ab1bc519-fa50-446a-8674-f36130bce492", "comment": "Malware payload (Mirai)", "value": "a21c19a56f1a995a76401a49ff043e16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819186, "uuid": "40ca931f-5d39-4c0e-9dff-62e3ef440f34", "comment": "Malware payload (Mirai)", "value": "0efcd580a3ddfce60fcd5ccc25cf815572f80cfb84fef7f939efe6bdadfc109e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819186, "uuid": "86e4a9e0-7951-40cf-ae32-156c873dfee0", "comment": "Malware payload (Mirai)", "value": "20ff99cb99ea80a3df85ac06dbfea5808bbf7fa7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819186, "uuid": "a25a33d5-0b8a-4912-b35e-79a705c4d73c", "comment": "Malware payload (Mirai)", "value": "fbe7a80fe062dcb6ffb053e9577006bfa899d42bacb8fdbc8982fa03a9ff749a830b8d7ee517996dcca368a9309b6c6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819186, "uuid": "2fa80edb-1894-4333-b3b8-bd19e86e6a7a", "value": "T1A9932A51F9829613C9C556B3FB5E429937160368D3EB3203AD288F65338E9AB0F3BD45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819186, "uuid": "c5bf5a82-613a-4fdb-99a8-e8a4a10650d4", "value": "1536:KezHkSpNayqhbAku0Vgn8X7NlByi2ueFzVUDfI+3nSjXteOtcWe7lX:bkhbDu0Vgn8JDyiowwq2e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819186, "uuid": "9e7b8922-5dce-4d79-bff3-f20f67b99d84", "value": 93404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819186, "uuid": "ddc5b104-fcad-42f3-9f7f-47400a930aac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819186, "uuid": "f6dfa8be-e8e8-47e2-a60c-164632b37f22", "value": "violetarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b86d6d91-1985-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1772819754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819754, "uuid": "c652c65d-fc03-463b-9236-534042c33b40", "comment": "Malware payload (Stealc)", "value": "eedbade9b236357a82284694e51ce1bc", "object_relation": "md5", "Tag": [ { "name": "80-97-160-190", "colour": "#FFCA15", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819754, "uuid": "7f41aa5b-e863-451d-abc5-8c0b85771746", "comment": "Malware payload (Stealc)", "value": "0f033735da6f1724e690a790dc9e53c399a1b64e67bcc892e1ad59d12ed7e40a", "object_relation": "sha256", "Tag": [ { "name": "80-97-160-190", "colour": "#FFCA15", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819754, "uuid": "540f0231-98be-4473-8f61-6d16b0c46f33", "comment": "Malware payload (Stealc)", "value": "2fca034b1e89a7c49107dc4f9f02bbf6cb399f69", "object_relation": "sha1", "Tag": [ { "name": "80-97-160-190", "colour": "#FFCA15", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819754, "uuid": "e05a6aa0-9b3e-4d60-83a2-1e3fe63e4ad5", "comment": "Malware payload (Stealc)", "value": "373c8612e8220c8eb31f135db4c2102d8f221749f80f19a64d23da57b677294a5be2cbef42b4f0ad97a41e27e75671fd", "object_relation": "sha3-384", "Tag": [ { "name": "80-97-160-190", "colour": "#FFCA15", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819754, "uuid": "fe9ba374-434c-481a-80fa-ee2b53196b7e", "value": "T1B0A6BE06BAD840B5D4BB923589BB9362E770BC150730A7CB2654BB7D2F73BD04A39352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819754, "uuid": "fda8ce2e-2965-40ab-8d3a-848ab0c9a23f", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819754, "uuid": "eac87a2b-21ca-48e6-8ae0-1e63a525a1ff", "value": "98304:dEpjltk3KPxUxIVzAnIaQ8Lazhs9Ftx5ueE:MlC3KZUx0zV8Ladgtx5bE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819754, "uuid": "ee0039a7-281d-49d2-bd2b-d795bc5da547", "value": 9768448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819754, "uuid": "5c981721-3fa9-4f0a-a872-ed117b6129d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819754, "uuid": "9c35bcc7-db2c-496b-ac48-67cd06ca3b00", "value": "downloadsetup_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0be4b919-19a2-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1772831920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772831920, "uuid": "c563828c-8c91-479c-8fbc-41812c02fa7f", "comment": "Malware payload (Gafgyt)", "value": "b1bc44a58f0e4342538bc7d09976fe3f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772831920, "uuid": "da52abb4-2ba4-4981-9744-6c5fca3a89d6", "comment": "Malware payload (Gafgyt)", "value": "0f3b6cea0bf1a53f233565ef14577676c69bf5fee82ceca029e1287670fe4ff7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772831920, "uuid": "83d01302-e2eb-4e8b-89c4-b9e31cd0d07f", "comment": "Malware payload (Gafgyt)", "value": "47f5005e3c30216a7c25c133dfbe819355462121", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772831920, "uuid": "c0ce8eee-81df-4a14-9fbb-5251afebee74", "comment": "Malware payload (Gafgyt)", "value": "6d183b6d2e1cfb1cbed69cff36cce5544c189819385e3e60213ea83f50df8a4f60e9d83a0dd869dcd88b980461d1ee45", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772831920, "uuid": "737c0ef2-eefb-427b-830a-b56833eb4135", "value": "T135C30871E8044B1BC2D223FAA79A429E3F355E9757E733115B38B9B02FF27891D29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772831920, "uuid": "99d92e7e-2286-46e9-be29-cea4b9a89b6c", "value": "3072:xHySRuf1WxlT+XMnzUPmI+OfYicm7/L7QsRPGfImNb:7ReWxcXMzUPmwOm7/L7QsRPGfImNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772831920, "uuid": "07159a80-b23d-4b6f-9abe-51339b265339", "value": 125138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772831920, "uuid": "2ab942b7-3d21-4c91-a6c6-d88c1793ff7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772831920, "uuid": "7341ce69-825a-44fc-9d3c-b74925b93b16", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69fb8c07-1949-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772793852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772793852, "uuid": "880f030e-0ecf-41d4-9709-93667f0a3124", "comment": "Malware payload (Vidar)", "value": "3ef8789b65ac65590fdaa8d06c3cf377", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-OpenClaw", "colour": "#525D1F", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772793852, "uuid": "503702a1-19eb-4f72-a4e8-c5bf970fb3a0", "comment": "Malware payload (Vidar)", "value": "0f69513905b9aeca9ad2659ae16f4363ac03a359abeac9ac05cab70a50f17b65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-OpenClaw", "colour": "#525D1F", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772793852, "uuid": "d4b99415-d482-4921-b174-c0fa429b494e", "comment": "Malware payload (Vidar)", "value": "89f04bbe88c83882827a5164ade78fd4db24b667", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-OpenClaw", "colour": "#525D1F", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772793852, "uuid": "0156b60c-fd55-48a4-b05d-4de25e40d451", "comment": "Malware payload (Vidar)", "value": "a534fbea39070d1f83cadbeaceed97365021d1dee68135afacb8f2eb6fd1890b60fafa9f5593dd8fcde4ddea74539d67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-OpenClaw", "colour": "#525D1F", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772793852, "uuid": "e0c8d2ac-1ce2-45ab-b1fa-e19af2f121e0", "value": "T1F5282302BA8B1964C05EC8B4D2474A934F3130DB163BA5BF50E942683FAB7B49B3F755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772793852, "uuid": "108df67f-052b-40ec-8d8e-5cc2eb0f8d3e", "value": "e61251d70770a939fcd72f2941900a06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772793852, "uuid": "bb8d758b-76b5-416e-b01e-765b1d887f5c", "value": "1572864:AiEyfxBpoYRS4XSJB4Gn0fXt8wr2PX7hhNExO5pSs97tFfBJtUe9LAs7B9k:ANyfxBiGS4XOl0fXtMPd5pJ95FfdF3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772793852, "uuid": "cd79acb0-0ea4-4106-b35d-c84d8cb2342e", "value": 99634176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772793852, "uuid": "7caebbfa-35d1-418e-b1ea-1a905053fd1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772793852, "uuid": "f056721a-0591-48ba-a3ef-361aa9cbd5cb", "value": "0f69513905b9aeca9ad2659ae16f4363ac03a359abeac9ac05cab70a50f17b65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fd9b1cb-1951-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772797271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797271, "uuid": "d2e17395-51c9-4e30-91b4-afbefd5a260b", "comment": "Malware payload", "value": "8d8aa0be8f82d22deab96f96d9af34b8", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797271, "uuid": "6b3d4749-27b4-4900-8f03-69e2108063e5", "comment": "Malware payload", "value": "0f9cf1cf8d641562053ce533aaa413754db88e60404cab6bbaa11f2b2491d542", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797271, "uuid": "ad659ca6-0fb6-4e25-8424-eb8e8ee30d94", "comment": "Malware payload", "value": "42111d2ebcd42fa1fa7069560401db736c483776", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797271, "uuid": "0ce8a626-5dd7-47b6-a3f8-4f21fc25e856", "comment": "Malware payload", "value": "a8174cae513b8fc6db126f976e7313faa5ca879fc42ec1ed98b7f369d31fbbe4cc359f1fd1fc74cf079cd713b38b4606", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797271, "uuid": "20fb1d1b-6309-493a-bed7-901352f72e9f", "value": "T188352314FCA42B2FC60F1F72190BEA513FED6C41DFB150639718B25D6A362B179D20AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797271, "uuid": "78793bf3-50ba-4de2-ab73-4ee24da169e9", "value": "24576:mNOmTRC/KmPbeqL+FnXvO9+f1KUw+T/s/N:mOmVv+bD+1X29WKwE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772797271, "uuid": "8ec440aa-664a-44f9-8075-f0c4f6fbf6a8", "value": 1080832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772797271, "uuid": "e20cca30-ab4e-42ab-883d-f83f44810875", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797271, "uuid": "acabe9ef-f204-4bc8-af7e-a775774b3380", "value": "0f9cf1cf8d641562053ce533aaa413754db88e60404cab6bbaa11f2b2491d542.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ef1d89c-196a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808034, "uuid": "ef81c044-f62b-4ffd-aeac-d9a48e850a39", "comment": "Malware payload", "value": "fe9eec34e12f32f7e436ea2641fc41fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808034, "uuid": "fbbd2273-ea0c-4f99-a1f0-6cfa05fcdf07", "comment": "Malware payload", "value": "0ffadcf982cb2a10d0a6cb05aef628c5796465f37bcbd7f3f41237df9e72a479", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808034, "uuid": "f3a10cf7-4080-4809-9222-6313464cfa21", "comment": "Malware payload", "value": "bb75cfd3eea4f8d689f2eb85a03a86e1c0069bb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808034, "uuid": "a2fb07c1-7668-41de-9f85-24a93c72afb0", "comment": "Malware payload", "value": "1393b608525fef6918952301859e409b14e6af8183a4c08c654e420637bbb40316652cbc9424544b80756cbf65bea4e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808034, "uuid": "098d491e-3dab-4a01-b7ec-9c3f52c79b9d", "value": "T18CE4BF0723D44A68E5BD977A8466409147FFFB42AB32EB1DAD0A51EB0C27B41DE41F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808034, "uuid": "6a04ce9f-42a7-4810-a992-850fa26ec725", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808034, "uuid": "396ce176-adc8-4a63-b143-a77ae561acb0", "value": "12288:GbzCiB3nlPAg0C6+6w6ZD5Ww702NUAHKbNCX0WT0D88NoV0NW+LOw0+Kr5D6q:q/h6fZNC8ZHKJCX0fI8mVS7p0Fr4q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808034, "uuid": "80fd5ea3-31f3-426e-a17c-ca8e7c933439", "value": 718336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808034, "uuid": "494780f1-0e3c-4acc-a3f2-ad67d7c7e38c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808034, "uuid": "a0d39a61-7df8-4009-ad89-c02543553ac1", "value": "0ffadcf982cb2a10d0a6cb05aef628c5796465f37bcbd7f3f41237df9e72a479", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60bfdb0e-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772809299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809299, "uuid": "b8354b05-c57a-424e-92df-f693fd4fc272", "comment": "Malware payload (RemcosRAT)", "value": "6acfc5427d17033b4dac50e601d20c0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809299, "uuid": "13720503-a22f-491b-881e-38d6c75f844a", "comment": "Malware payload (RemcosRAT)", "value": "106e554628c27e84b06b88652149c5468bca392b0de55322d6c96735e21235c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809299, "uuid": "cd03b9f5-af29-42a5-9c41-7eacdf8111ba", "comment": "Malware payload (RemcosRAT)", "value": "8bf1ea4c705f35b3460f18d04dce67cd2cae9780", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809299, "uuid": "40e3b409-b10b-4a74-a26f-ccea82679f19", "comment": "Malware payload (RemcosRAT)", "value": "0252e947cdca7bf08b91538725a0699c5b6c51af96c52a3c702fcd79fba826e3bf7da0c8365d127d9772ce4190c35984", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809299, "uuid": "e234257f-0890-4da0-bb75-bf3494ed3dd0", "value": "T11C6512082729DC03E4B65BF056B1D3B41BF89E8AB611D353CFEAADD7B5363501889392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809299, "uuid": "ced11cf9-42a0-4760-8022-691f7fe9ef2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809299, "uuid": "76cebff0-ac0e-4684-870a-7dbebae5d892", "value": "24576:Pqu2VWl7OPVaMNxtWJnS50YYheNApknRCkJVtr3lYPcDZWV9Rr3PNJn+OP:PeVkyyS50YAeepaRCkJVnIq2Hr3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809299, "uuid": "926a34f7-e459-4ca0-9cb4-084ce0744d5c", "value": 1545216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809299, "uuid": "cb578fb3-4e6b-44ca-bbb4-f0cc4960f4a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809299, "uuid": "30a6adc0-4064-46c9-99cb-cfb3b75753b6", "value": "106e554628c27e84b06b88652149c5468bca392b0de55322d6c96735e21235c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b2bf4a5-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772809692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809692, "uuid": "458c872a-f389-4dc8-9781-71943735003d", "comment": "Malware payload (Formbook)", "value": "de3f098df40cb413dee6d1627c3cf153", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809692, "uuid": "25e57203-bcd7-4418-b2fb-62111ce0e1fa", "comment": "Malware payload (Formbook)", "value": "1084633d1e01346d5971b8ede307bf25f2d05ad354563ee3dd5540c79b1d97b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809692, "uuid": "cbfd96a3-c0bf-4ddf-97a3-b1b60d8dcabe", "comment": "Malware payload (Formbook)", "value": "c9b00637595849949b66edb95772e8433b96f42d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809692, "uuid": "1b8c2301-cd47-4803-8bcc-2ec4f3aaeb92", "comment": "Malware payload (Formbook)", "value": "ca6f6acb41ba7be1251a81949efc7836487e154f9e3d24c6fab4061bb217433c9a422550ba1dd3d5286932baf434a4dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809692, "uuid": "607f9b62-6af0-4e83-9fb8-24d8dcee727e", "value": "T137F49F2DF4E66091ED21C8F31F5E97E10D1A73136BAA189723B807044B954FF1F6AB26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809692, "uuid": "cde9fd04-09ea-4c76-955a-eba45ae7928a", "value": "c2356eaefac76ce13634b53b65aeb72c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809692, "uuid": "e982dbd5-0b3b-4dc8-980e-ecbaf551bd01", "value": "24576:Oo5NHfYYn5XCNT3dt6yX8uL7QkhWnYySG4:BJfYy5SNTtt6yX8uL7eYySG4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809692, "uuid": "cc143606-99a8-454e-a65c-f9f06e628928", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809692, "uuid": "adf17f04-86d7-4427-9d7e-c81c642523ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809692, "uuid": "547fd6ec-eea3-42b4-b5c2-20d20f8919b7", "value": "1084633d1e01346d5971b8ede307bf25f2d05ad354563ee3dd5540c79b1d97b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39ffecb2-1946-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772792483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772792483, "uuid": "9a5dc0a6-156e-411c-84fe-92609ea2a811", "comment": "Malware payload", "value": "1a987f3421e052323760e9889721a0a3", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772792483, "uuid": "129b5959-0000-40ce-b7ad-65518900989d", "comment": "Malware payload", "value": "1097080886d6c93d1cd3ec877d9640f84e765edfd813953729f934a243a04a03", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772792483, "uuid": "2993f1ee-ff40-4268-86ae-68181536714b", "comment": "Malware payload", "value": "cd1cbc546b4f01c8022152474d89b36e629a4543", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772792483, "uuid": "c30f6c05-811e-4705-aafe-9250c4cbc004", "comment": "Malware payload", "value": "14a7e774e3c2d844f139ad12d8c2db39dc8d56e6c982b15f42312a169f6bc1c021ea2ea21422a3b09a7579668f4116cd", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772792483, "uuid": "c1f88373-cbb8-4c01-8741-dc351882ba16", "value": "T16A534D2B19F8EB2D0A5B28207038B7142E6957BF864C6F5993B150F3729E2FA135E534", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772792483, "uuid": "18010b05-ec51-4ad0-8571-93ad104271ea", "value": "1536:jvoQWYuuuuuuuuIIIIIIIIIIIIIIIIIRAWmmmmmmmmmmmmmmmmmmmmmmmmmmmr:jxzxxxxIIIIIIIIIIIIIIIIIRAWmmmm6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772792483, "uuid": "d7e606d9-94fd-4455-b06d-d441b6fa0e97", "value": 61081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772792483, "uuid": "1102a94a-9566-44d8-8703-0bad6710466d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772792483, "uuid": "baf50343-f410-4a21-98e2-9b5566f23d4a", "value": "2_13_2_1903_25.02.2026.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c0527d3-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819223, "uuid": "6e33d1f2-31c2-4839-9346-e4e8bce59c59", "comment": "Malware payload (Mirai)", "value": "6ea16d15963ec1727ef55c44d0a2ea9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819223, "uuid": "1d2923e9-aeed-47e0-9f9a-9fcfbdffbed9", "comment": "Malware payload (Mirai)", "value": "10d09e5c9a15ff0a87b5f1e6824637943624b239d84b4df927ed06a95a720161", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819223, "uuid": "cb81f518-e9e2-4ed1-903f-eb8953eb68d2", "comment": "Malware payload (Mirai)", "value": "1c3bd11e8c298fce23a1547bd0fcd052311da4d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819223, "uuid": "55456788-8b7e-45ea-80bd-9b4cf58f9ec9", "comment": "Malware payload (Mirai)", "value": "84bb842c8405df4021e72c2300905d00eef5c7a4634f126478ac81678e5e27d6d887a17533531843fcae778e91528feb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819223, "uuid": "0b0dd479-0db8-4484-9836-f4c820a3de40", "value": "T10CD35B0673180E17D5A34AB02A3E17F083FED5C121F4BA89691F9B6A4676E371582FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819223, "uuid": "223aa842-cd47-446a-b5bb-7539b969e482", "value": "3072:NCboo0CJacgjLPeD2OacUC32UtyMJ9qlRCn1:NslzqLtOacUC3vtyMJ0lR41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819223, "uuid": "0644fbb1-699a-4170-a378-aae0fab23477", "value": 138800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819223, "uuid": "329b9bb2-77db-487a-a4ed-29c159b1bc44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819223, "uuid": "939e563a-25e6-4656-829b-a378749ce259", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d95b480f-1950-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772797045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797045, "uuid": "3c3fb184-682d-4b33-b28c-75cf1bc71055", "comment": "Malware payload (Vidar)", "value": "52353db06ea4bb4f76273af1a2b2654d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797045, "uuid": "22fd895a-8653-4713-98ea-ca20962acb64", "comment": "Malware payload (Vidar)", "value": "1107b0f7d0c91d82cf71ed1c8c0d1708f0668b5067cf79d7a6d10ab0e31882f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797045, "uuid": "8769b27b-1452-4df6-a3d0-fe0482322fc5", "comment": "Malware payload (Vidar)", "value": "7aada1c46e8144594542d8c8b78b1b74e2e3e94b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797045, "uuid": "01486353-a3fa-4295-b217-e308c8b5aa2a", "comment": "Malware payload (Vidar)", "value": "46044e97cef6ec8c97157cfd9f8c3e6942c254cadb31c976bc32e053c46649ae0609e1472073671ecd64454dd79a4562", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797045, "uuid": "9ee4c530-96fa-45c6-9420-5a60aedd69da", "value": "T155959C47BCC060B9D5A9D2328AB151A17B30F85A0B3137C32E55B7B92EBB7D41E39394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797045, "uuid": "441b9700-cd81-4c47-83e2-00870cbc8152", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797045, "uuid": "97c02f9e-98e9-438b-939c-a58c652cf3dd", "value": "24576:UH1GGd3Djzqp0SQSYGWAowudrLICJjT/otdTg3IsbJ/BnOcsYgts1sxK1ub:UVGGd3D3qR3mrkEmdT6I6TnMYgtdxK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772797045, "uuid": "bf4098d3-78f1-4e69-8ad3-7e3b20243177", "value": 2014208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772797045, "uuid": "4717d8f0-1d80-4839-8039-efe1205f7ec5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797045, "uuid": "a94b11ed-cf26-4280-b580-f004b009a7d2", "value": "52353db06ea4bb4f76273af1a2b2654d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f42bf4d9-197a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772815129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815129, "uuid": "a946df62-601c-4110-b85a-fd3bd7d71808", "comment": "Malware payload (Mirai)", "value": "95d4d703a16259ce649d81ab8e1927ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815129, "uuid": "69f8cb3d-d4e5-4ebb-a1da-84d3866bd9e5", "comment": "Malware payload (Mirai)", "value": "113aeed282f4fa932881f140e0569e6795f5a42409e2ae90d865d2008cd9d2d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815129, "uuid": "490571bb-8cd0-481e-9193-fdfa68ff64ad", "comment": "Malware payload (Mirai)", "value": "5281afed679aaf2279fcb4cf6e93427491aa1458", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815129, "uuid": "881e712f-dacb-4c74-98e9-032f9b91bbbb", "comment": "Malware payload (Mirai)", "value": "952831e9cd69c4d4d5860d64e6eec34fab3de8033bf808455a4506d2b2916d8fbc704c7ca640851a5d56a5fc7b88f70c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815129, "uuid": "6f0523c1-62ad-4bf6-abc5-37626d87ba40", "value": "T10C935C02B70C0E43D1675DF02A3F27D1D3EEA5E021F4FA88691F9A8591B2E325586FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815129, "uuid": "a3eaa648-eace-4fc7-8605-9f42d4053f1f", "value": "1536:pcBZli/TwLrLnyUiQI0tdpDjnPqGD0M39+7BAnKEAilKmMGXyCPTEA2lfBUB:2Li/T+xPbTMAn66MNCNlB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772815129, "uuid": "803d00af-e0a7-464b-9950-ea096f2ab055", "value": 92048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772815129, "uuid": "b138a3f1-c39b-4b0f-824a-5b176957d418", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815129, "uuid": "bb245950-c485-4fa5-8e60-c2f1f3ad8bf2", "value": "titanjr.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5da8bc8-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772811589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811589, "uuid": "4d65e84c-07b8-4a2c-a08b-5ef751c1a479", "comment": "Malware payload (RemcosRAT)", "value": "3964a61d0e5673c967ddf25fef239f3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811589, "uuid": "e3454127-e037-44de-a233-6a28b8564ae6", "comment": "Malware payload (RemcosRAT)", "value": "1148fa91ce87cc06cbd373b0bd40eb1de0ede6e438262dda0ca8bea60b9239f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811589, "uuid": "6f2c607e-bf2c-4328-b550-fd98b3a356a9", "comment": "Malware payload (RemcosRAT)", "value": "1c6c710568566d0c52de1d224f551bef36d66a32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811589, "uuid": "65482171-2d59-47a5-82e6-5a2455a873e3", "comment": "Malware payload (RemcosRAT)", "value": "a1a6e8e3c39c7f635c9623375ec9f029ab385943ec9aaac68347bcd7b02f96f9d40ab5a80c5692d22720fd7993fe25b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811589, "uuid": "6f465ab4-0fce-4902-bbac-0a897b0be703", "value": "T1FB65CF0273D1C062FFAB96334F56F6215ABC79260123A61F13981D7ABE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811589, "uuid": "a6a0d8a8-1c7f-4b73-9752-b18e0b7a29d7", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811589, "uuid": "3bf352cf-0994-42be-a054-4d51669f50f6", "value": "24576:B5EmXFtKaL4/oFe5T9yyXYfP1ijXda1dSbU4BX/ei+fLAZRX0Qx8YrPNTQb8VH:BPVt/LZeJbInQRa1dKeffLayUTQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811589, "uuid": "5553d2f1-1ae4-4047-b732-aa79a78c93cd", "value": 1414144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811589, "uuid": "9d53b003-0970-4e6a-953f-37cd4f4df363", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811589, "uuid": "313ebe99-7ab8-41db-b207-27e574201fe8", "value": "1148fa91ce87cc06cbd373b0bd40eb1de0ede6e438262dda0ca8bea60b9239f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cd05a96-1982-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772818392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818392, "uuid": "72b425f3-1968-4f9f-b4bc-2586e2c3b9a4", "comment": "Malware payload (Mirai)", "value": "610c75187fba6ebc5ebba2d722d198e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818392, "uuid": "062a8b06-1796-4c21-8a4a-8caf56fea8fd", "comment": "Malware payload (Mirai)", "value": "1165640c96fd44b4ec275c6e800d0101133aa62b4c6427a37505ddae034b8529", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818392, "uuid": "ef3184be-62b1-452e-a840-a8584b33a96a", "comment": "Malware payload (Mirai)", "value": "63a136bce2e96dc20f523524fe77947acf3fccef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818392, "uuid": "33f226cc-8cbf-4139-9480-bc112aad359a", "comment": "Malware payload (Mirai)", "value": "42fa69f0a1090add2067a262ed46524b755c34112a9587701e54dcde35ce0de2b64e1f1408af14af40699aa4a855fabd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818392, "uuid": "821fe0e0-8773-4a90-8475-64ccba4e5f64", "value": "T115C3AE73D42A7EC4D1554030B8B5FEB51B61A5C041935EBB26E9C87A00CBEA4FA0AFF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818392, "uuid": "29f6f6f7-749c-4528-b843-5325560c4964", "value": "3072:hfpZykqkt436I+9eIHfmNOkSMPXeC4GnH8:hRZ0F3BcONOkvZhnH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772818392, "uuid": "7f53886f-1aed-4f50-8dbf-487f27ade4df", "value": 120332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772818392, "uuid": "e1dcd465-142b-417e-a2aa-9ab7cdd2381e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818392, "uuid": "f777ae6c-e0f5-4211-9bbc-97068794798b", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d17dbc0e-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810347, "uuid": "30ead51d-401e-4247-bb61-834b5f6e005a", "comment": "Malware payload (GCleaner)", "value": "29854fb0956cefe10b174959907853b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810347, "uuid": "aa6d5303-6026-476e-9058-c196bfb22acc", "comment": "Malware payload (GCleaner)", "value": "118415042c798f71eef0254dc60b0b66e237fd908c96d62a030fc4771f2be77f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810347, "uuid": "fa086952-f7c9-4e10-b221-1adeebc2adcc", "comment": "Malware payload (GCleaner)", "value": "8c41eb5eb79e7201dd6e7b8d50929ff1e4bb8003", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810347, "uuid": "63bd1366-5596-4bbf-b0b4-1dfded8febd7", "comment": "Malware payload (GCleaner)", "value": "3050c917302208c82a1f09a694aba3b868f3a961c7eb3405c7b240b4cc6a79fa730eddacf4dd119474738d7288494d5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810347, "uuid": "4f7880d0-8c11-4529-a510-ea74c10f8a8f", "value": "T10725AD26A2F27837C1673A38AC1B569DA839FF3029285C462BD41ECC4F35F95F4651A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810347, "uuid": "6cbfdd38-1cae-46e9-b159-a89353bbadfd", "value": "fe4280c06246cc873fe89746dadec91e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810347, "uuid": "786788db-4301-4b37-9c81-a30fc2cae7a4", "value": "12288:oNnqG7tucDD94ypPY2VKHF7O4Cy4MOjE9taCb6mI9/wgQHqak0ABvoC71:olluEBpPj6o4CPbE9taCbdIWgsFGvoC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810347, "uuid": "944daf42-6231-46bd-8064-c650e29d0156", "value": 987136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810347, "uuid": "0d23f8c8-379d-4d30-b52a-7b8fb7789747", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810347, "uuid": "69eb0f63-0fbd-4f9a-b6f3-d1ad0342767b", "value": "118415042c798f71eef0254dc60b0b66e237fd908c96d62a030fc4771f2be77f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ae4542e-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1772810175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810175, "uuid": "63512f92-45c2-4398-afeb-99f04bf09945", "comment": "Malware payload (CoinMiner)", "value": "53d461c92c187fc8b7eec8548a69e34d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810175, "uuid": "6708f1f8-206a-406f-ac54-9930ddc77e8b", "comment": "Malware payload (CoinMiner)", "value": "11dafc9f077ea507a88277b30dc8b1868e73c0e93d8fd80bf5530b4888f22434", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810175, "uuid": "ff4d343f-d95f-44ba-9418-1e01707ef3b8", "comment": "Malware payload (CoinMiner)", "value": "dfb515394c29c67f9fb393e17ae0840fe181e4f7", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810175, "uuid": "d383d57d-566e-4071-a8b5-3e94e5f300be", "comment": "Malware payload (CoinMiner)", "value": "c76461a9da95053872a4efa98c61d719877c5f7f1f8567c8e6f47a62ee006ab28aa6ef1652bfd481ae3f394ba293659d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810175, "uuid": "849ef055-1276-4ec7-9d14-bd2bf0af2f0a", "value": "T11E3633127F83E470D165063194B69B964AB9EFA00760D6E7DBB83923BC313C279376C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810175, "uuid": "c2267a53-b601-4f95-96c9-91d2d4589e6e", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810175, "uuid": "f746db71-d30e-47dd-9a08-fea73a27d9ab", "value": "98304:vu5WqOQQvCiWP1IPxkwYACcHxvxLLnNb48TfSlJRuJUJuq7/8IBrjA4T:vu4qR+8dIZkwYA/vNPOlN9/rjAC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810175, "uuid": "025f3af4-a0f2-4947-955a-bc826ab176c3", "value": 4877312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810175, "uuid": "1bc87393-8fac-47e3-b8be-54197932b3de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810175, "uuid": "336107d3-3934-4807-a247-1006a4e17691", "value": "11dafc9f077ea507a88277b30dc8b1868e73c0e93d8fd80bf5530b4888f22434", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a989f86-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819220, "uuid": "d2b2bb7b-cfc7-4e19-8a9f-ebb92e88ca31", "comment": "Malware payload (Mirai)", "value": "a20fd71a5513d3d483ac6774279ce45d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819220, "uuid": "8507aa3e-0c4e-498f-8961-9726ed0a4bc5", "comment": "Malware payload (Mirai)", "value": "121bf02f4fc60863bfb6dc9134de7a136c661db132d1500459ad9c63f50d988e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819220, "uuid": "8778994b-9c44-4cd5-bd8e-4455e6b87e92", "comment": "Malware payload (Mirai)", "value": "10ece6a2c5af74d22528d8f67561f655eed6b225", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819220, "uuid": "5c2dfd5e-236b-42f6-9f0d-94c6c103c797", "comment": "Malware payload (Mirai)", "value": "e454d15b36fa8aa2109ea8060637aba664b0affac92a6126dc98ec78305b6af7d89ad6b160c4826d3258240ca3c4d12c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819220, "uuid": "7759ffdb-3038-4d39-b1a9-60b4e2bdeab3", "value": "T132558E5AB2B370BDC057C030939BDB62A835F47505322E7B65C4DA352EA2EB01B19F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819220, "uuid": "cccce1cd-3bb1-4c26-b468-0029674fb6b0", "value": "24576:XNvo4+Av5Th+VKhWxVZuXacdW0vY3+D/WcBlF8KWA8kMX:XZo4rv5Th+whWPZuKcdBYubVWKWTX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819220, "uuid": "a4a517b0-b8c1-4d00-bb45-4b79901b7bd6", "value": 1343888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819220, "uuid": "b6e990cb-f85b-4303-809e-5f3fdec3c63c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819220, "uuid": "23edef8e-902f-4bee-ac04-d80ee453b6f5", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f307ae6d-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772809114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809114, "uuid": "c56d5957-dcd7-4b30-b35a-c8a51860f248", "comment": "Malware payload (Formbook)", "value": "87dae6aec3e6fdfb7086af69d8f6ba65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809114, "uuid": "795b748a-5d67-466e-91d9-0dc2e107ede0", "comment": "Malware payload (Formbook)", "value": "12312f4f00b04ee1bbbced370335dba32914f75a5aed504f473d425939dd975e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809114, "uuid": "7051fb2b-e531-46ae-b93a-ebd1145441bb", "comment": "Malware payload (Formbook)", "value": "d7b909e5e55e52802b52fe8080cee0f1b944133d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809114, "uuid": "f0874419-815f-40c0-b881-51249de817ce", "comment": "Malware payload (Formbook)", "value": "f575f2a0de08d82f484bf2f0826404eec96d101cc663eabd95530b08af6001cadd87f670faedc880703adf73315c7b47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809114, "uuid": "093a3dda-d502-4b82-8baa-c1ec023e0460", "value": "T1DCF4AF2DB8E2A0D1ED2188F30F5E97E04E1A731367A91C5723B806444B954FF2F5EB66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809114, "uuid": "7cefe589-dbec-4059-b169-f0aaa3550b97", "value": "96944a9beff3e19cb1f487616a09413c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809114, "uuid": "886d8a47-7185-4d77-8b40-61b92c51f824", "value": "12288:mDeS37qWk7hQxuE8yh6lK1W+esq1CcFPGEhWF1MUXCA2KRIqo23UBuIyGBeC:eLE7h+uE8y4lK1W+eRCgNWbMUSsECUEL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809114, "uuid": "eda45c65-f95e-4b8a-a08c-2f8f1d59ee2b", "value": 783360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809114, "uuid": "df4eaddd-24f8-4ac2-bc23-c273cc22245a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809114, "uuid": "d36b9929-9e98-477c-a2af-fb7c11f6e640", "value": "12312f4f00b04ee1bbbced370335dba32914f75a5aed504f473d425939dd975e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5e29129-193f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772789765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789765, "uuid": "ccf24eec-b893-4e8a-950a-5b00b06bd652", "comment": "Malware payload", "value": "392cb269f4f219a3b14007ccdfcd21b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789765, "uuid": "9d587bd0-e723-46cb-bdef-2a175ef84f76", "comment": "Malware payload", "value": "1251d54fbeddcda6d0fe88bab0932e34bf2ae53406f1781f85615a7c5c39a83d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789765, "uuid": "cc8fe652-0035-4fb3-806c-dd26d72a3f06", "comment": "Malware payload", "value": "ddf941e05b090767fd30e4982a41b49caa86fee7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789765, "uuid": "50f5b8a2-23cb-49a2-9a78-82787853b293", "comment": "Malware payload", "value": "f27838cf46584c4c004569998fa7f41447f9813f21f54e8bb3f507990989e794ad8033f67e6b3c0a1b723bff6324f24f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789765, "uuid": "1d81ea08-58f1-445c-bca3-7f3761455f6d", "value": "T18B087C42A3EA05D5F9F79A3489E65213D673BC063B3082DF325C172A1F736E08976B61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789765, "uuid": "65da3675-3353-4521-97cb-44028a0de602", "value": "8062a445f5cd940b5daefb09f80bc2a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789765, "uuid": "bbd0ac76-6244-4166-a6cf-ecb0f804e9f2", "value": "393216:r9UZyW0PYsIUmgB9S7QJrojJgVXIXT9fN3aoIKF1H5XMutmnnY4nZFUT7HihCLJ+:rJX3mcLmSh81vxOtxth", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772789765, "uuid": "edea4cca-3f19-4356-ac6c-62aa31e91f89", "value": 82256896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772789765, "uuid": "e0362a22-d103-4766-84e0-0f56361ede58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789765, "uuid": "a2c101e6-6acb-4a7f-ae95-f7f5aa972549", "value": "CrimsonLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5547f232-1981-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772817869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772817869, "uuid": "4839d1cc-3233-404a-a901-0c4da42762cd", "comment": "Malware payload (Smoke Loader)", "value": "af72d60b4fbcbcf9109490bfeddf9263", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772817869, "uuid": "83f4bc66-0f7d-4245-b815-1fb5363a4286", "comment": "Malware payload (Smoke Loader)", "value": "1260de45ed2115518b558d266e32b733cbf8db8e464cb3a0e070e4c0149ec554", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772817869, "uuid": "8a5e4d27-5a4f-432a-9e76-4b5bed61c419", "comment": "Malware payload (Smoke Loader)", "value": "e9722ecb10c28e64ee1904040d290d5327b1dd3c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772817869, "uuid": "811429ea-5619-4cd1-b99f-25c8e4c76692", "comment": "Malware payload (Smoke Loader)", "value": "8b53085acd91d123d74bf0f3536b6226476ce53c5a9642bc749d2356bf6c21f05a002ea87232eb00fe4ed6e3becb7b14", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772817869, "uuid": "41d194d7-6d8a-4e8d-a9ab-efd5e57b1891", "value": "T193243A2BC25330FCE552C07892A66232B772BA3D47358EE70293D3359D61AC05FBA965", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772817869, "uuid": "0eaee4b5-26d1-4c5c-ad03-602aeb14aa16", "value": "c81db0a320cdad5ab41c9a291ea9b6e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772817869, "uuid": "d275d628-69cf-4e47-b8e0-1a85b2a5572f", "value": "3072:Ry+NC+3FGCgIuXHbTZvQJoUaCSC0CwMQv7PfyeLZlwABcJw3r:dDPgIuXHnZQyUSC/5ubfhce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772817869, "uuid": "888ecb94-af20-4324-850a-1092c76e9c80", "value": 223744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772817869, "uuid": "73886ba3-43a3-4f74-a24b-fd08021464f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772817869, "uuid": "d0a9ee07-fa6e-42b4-927a-e7173904b55a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91416806-190b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772767289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772767289, "uuid": "9e34cb31-3d50-412b-b7f2-d19c7fa822b0", "comment": "Malware payload (Mirai)", "value": "bb73c96692a3b2becc1d8f9a14d8f35e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772767289, "uuid": "9c9bedff-b0c9-4bfd-9437-040c4b0a8765", "comment": "Malware payload (Mirai)", "value": "126bb7fe59f613f236a4e007a19b4952241162b3af3f8a41e1b2faefd6746f67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772767289, "uuid": "406baacf-1e24-4f15-bc92-aa6aa06a0295", "comment": "Malware payload (Mirai)", "value": "96eb61793ea44ded12aae9a79e9559f208491b4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772767289, "uuid": "2cf6e0e4-3ee8-4d27-8783-c5cd17393b9d", "comment": "Malware payload (Mirai)", "value": "341df31514ce865f918fb2a7b258b3494bb7a233b9453ce0d9e75da1e15d8f07f6415f447bbf31cfadaf47e34fc3c742", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772767289, "uuid": "85ecbd8c-5235-48f4-88ca-a629ae28bd39", "value": "T10EE34D8AF802DE7EFC0BE57E44670D15FA30A7613243172D529BFDA3AC321A65D16E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772767289, "uuid": "796869cb-e4f7-42de-9978-565bae346074", "value": "3072:luWypdcGShA/TtPq6ND6ZJ243nxl9XzrTmduH:gCGShArdDPAxl9TmduH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772767289, "uuid": "98ef7a6b-bc0e-4d4c-a681-c2aa0e1b7e8d", "value": 146888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772767289, "uuid": "e15fb750-18bb-44bb-883f-88111056995f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772767289, "uuid": "aa836946-75ef-4fff-9d90-e0b82741334f", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fecbbd66-1983-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819013, "uuid": "2702f9af-f559-4a1e-a96a-360f34dd7ff4", "comment": "Malware payload (Mirai)", "value": "30f6640ce9b6dd238d66ca71c17ac09c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819013, "uuid": "05732bee-bf35-453c-b131-a4b4629aee21", "comment": "Malware payload (Mirai)", "value": "12cdb69e5d5798f8b5db55d59e36623ffd516e4f49c0e01885f7571a520ca765", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819013, "uuid": "044b9a3a-c3c0-4b4f-a525-05e11a5084ab", "comment": "Malware payload (Mirai)", "value": "6d3b6e4f627c233266dc216e97506dfaa2abb869", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819013, "uuid": "9083bef3-e84c-4601-bfc3-263c012bfe75", "comment": "Malware payload (Mirai)", "value": "dee5411ac0bc54e71d03e7664d253bc61a8d06c9f3209d3a551f5845b07e67f9e594118d53010e878ea9218cdc2156a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819013, "uuid": "900c888f-c502-458d-a35d-ec4666a91630", "value": "T172934992FD818662C6C116B7FB6E428D376653A8E2EE73039D256F2133C781B0E7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819013, "uuid": "05333e58-da7a-4e06-9969-b232e64b2360", "value": "1536:F0XpWNg043co/sTgvlwSBeMLs9jT9PSCp7Mn3qK+BQz0OckKM21:F0ZWNg0qvTe4mjTp3p76qKI+0Ozi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819013, "uuid": "b53b62f5-7daa-4475-bd17-44b9c382e8ff", "value": 89940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819013, "uuid": "f09b6cba-a4af-44b6-85d9-53097004aca9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819013, "uuid": "56db81db-69da-4d71-bd7a-a20288fd140c", "value": "jawirbot.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9a3b654-1969-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772807810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807810, "uuid": "24d31dbf-64bc-4bd0-891d-3de99bec220d", "comment": "Malware payload (GCleaner)", "value": "947dfcf02dcdef7dccccd944f7bde97c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807810, "uuid": "94812c0e-6c69-499f-8c95-c8a15d6d01c5", "comment": "Malware payload (GCleaner)", "value": "12d7d0612d9bde569dec9314e881817420d2f2b73cc4d1579889c5b5725aa9fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807810, "uuid": "9a3a13b2-5a5e-4d99-bc95-6edecbee75e9", "comment": "Malware payload (GCleaner)", "value": "8f65e5c5de4f909165dde1d1d928e5d10620b081", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807810, "uuid": "37c00b87-2c7e-4230-bdc6-c5bf3ea0b529", "comment": "Malware payload (GCleaner)", "value": "70e03815d4c7965ee462ac13d879db8a9174724e51a1e0f3cee50723bcf7ffd90e7840848e2f8833cb1056ef16cbef1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807810, "uuid": "a760170a-269a-4739-9053-e95828a0659f", "value": "T11C16BD2D73B04821C9ED1A399C29605E092BDD27D4ECC08CB1977EC7BDD6E159E6FA02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807810, "uuid": "9de33219-68c2-4835-af15-45254cc66548", "value": "85f3ca0400d93842304463da19f2baf9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807810, "uuid": "924c8c24-3f2c-4593-9a37-dcdd8420bc87", "value": "98304:AEz3SzGBDRqDtxjX6bcnY+oms2WKVAu4ACTWaQdw0dCE:AOfUtECYXmshKVAuXsWacwy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807810, "uuid": "b4b235b5-b6e8-4612-abae-001ddfd4f6dc", "value": 4393472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807810, "uuid": "3adbefd2-1ad0-4acf-a847-5f0a392308cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807810, "uuid": "44a67225-762d-40bd-ac18-d3d9bc7ca78a", "value": "12d7d0612d9bde569dec9314e881817420d2f2b73cc4d1579889c5b5725aa9fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b8a88e2-1948-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772793452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772793452, "uuid": "4e5cd068-6322-4178-88aa-c11abf4a3bbc", "comment": "Malware payload", "value": "af3b6fab01487c008bb87b2c49f3092e", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772793452, "uuid": "85f372ed-a6e2-4638-a685-c65fb03104b6", "comment": "Malware payload", "value": "12de518efad8c0ff2cf65c1e446dac209cb0bd6852bb3258bcdb81bd33568245", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772793452, "uuid": "abcc3a8c-b668-4016-b032-b90b33eb6b3f", "comment": "Malware payload", "value": "ca920d51ce070888dd3494ffa646a8a72b93b5bf", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772793452, "uuid": "5119b72f-1d32-4892-9496-42a0572f377a", "comment": "Malware payload", "value": "c3bad2d98f74129938f28b3c947b2445ab298322ddefbf88fc241171f33258540e3997eb2568e743741f44d977a30110", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772793452, "uuid": "e77b853e-6b7c-46ed-bb0b-f68fc593b590", "value": "T1AB67E086F20CC82BD9FAB07C9D8E07E378156C555B10C28B2915B60DBFB37D49A52BE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772793452, "uuid": "81c69c35-dc20-4420-b564-1c48a1eb5fd0", "value": "786432:XdJy7ONLv5wZ9D4pOBKAnV68xodcFv4wp:XdJQILK4pOYA9xrW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772793452, "uuid": "cabea03c-3628-42c4-a608-6780ebc891d7", "value": 32291163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772793452, "uuid": "c73a9e20-6779-4725-9b80-1fda2e4b0ca2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772793452, "uuid": "165209a3-7f81-4fc8-8fd9-844d85ee7365", "value": "com.message.inbox.sms.text_1.0.6.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5ec6227-197a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772815132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815132, "uuid": "f5673e04-1596-4816-9f46-4e70a9364c0d", "comment": "Malware payload (Mirai)", "value": "a8abb2cc82beb06cf95bfc6b4428036a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815132, "uuid": "68f5ddb4-f4f9-421f-98e4-f45c09a6b2f0", "comment": "Malware payload (Mirai)", "value": "13695088746965f1c31bfedc38d49e150e0cf20755fb1934aaff189e21657430", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815132, "uuid": "486391f6-c255-4af2-8bd5-0c4b2d306c14", "comment": "Malware payload (Mirai)", "value": "713dbadf1e592bd0144ff6603fdd408a7f340e5b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815132, "uuid": "334f735a-8ec4-4d1d-95e7-167b7517b6b6", "comment": "Malware payload (Mirai)", "value": "ea26d7fc321ea4a59763a2549137a5e6b8f35f22bbc82e8962a8bec9fb671bcb02a73371a5472255f2cfb1b97b6b209d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815132, "uuid": "98594203-9d94-4bb8-a801-8e3a442a1b90", "value": "T13FC35BB7D865AFA8C555C074B0708FB52F53A9A082871FBE19B7C2754083D8EF605BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815132, "uuid": "fc1cda9a-3d1a-4d0b-a8a8-567fb64fb188", "value": "1536:3QA/pBwTNoF5ZoJTOdgC6LKymJR8tOxarDvWQdQYO/SMCWql:3/7wTNdSdgjuyBOxuvW+QYXVJl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772815132, "uuid": "8190748f-4e21-4c7c-8a36-e5193dbe7ee6", "value": 121664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772815132, "uuid": "e971db2a-805b-4fae-a9e9-364fea0c6b28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815132, "uuid": "07a45c12-b408-4e96-9fda-501c09cf7df5", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4edbb1b6-1969-11f1-a769-42010a9c0008", "comment": "Malware payload (zgRAT)", "timestamp": 1772807551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807551, "uuid": "1f8c40fc-a3e5-4f8f-9f17-0565e39107dc", "comment": "Malware payload (zgRAT)", "value": "b3d8a3d3b59bfe7ff75919be2a0b9a05", "object_relation": "md5", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807551, "uuid": "b400e175-4931-44a4-b1d1-882756fd6a0c", "comment": "Malware payload (zgRAT)", "value": "137326ac5fc9563532826dccf4442886bef1ec94a41654b9cbb6c963d78a35d2", "object_relation": "sha256", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807551, "uuid": "3e02fabb-ab2e-45a9-acfc-2808f4b932c0", "comment": "Malware payload (zgRAT)", "value": "6c908e921ecb2f9e23ae89efbb35275aaa4e46b4", "object_relation": "sha1", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807551, "uuid": "a67c5041-a4ad-48bf-9c91-a7f0c4569fd2", "comment": "Malware payload (zgRAT)", "value": "a0fbf84e9f6786f33714a75b8d78af0c4fae1c67894352b9663c91900d6ae4f2362dc78fa5a01e4a915dcd5952cf240e", "object_relation": "sha3-384", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807551, "uuid": "ed4b7f48-c325-45dc-abec-f197610a0c74", "value": "T17DB66DD29D508A66D6EFF239ECB252427330B840433125E76B9526654D7BBC8133FB2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807551, "uuid": "1fd1d785-b444-45bd-a5f0-98f33da6732f", "value": "0951d9f67c9a9e1b6ea746ed01bccc26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807551, "uuid": "850d2724-e33c-4c1b-89fa-d7569c688de8", "value": "49152:4kNQ/uEj2EU8rFjH1K/gM2dMhFlbGxtHbjtxHAExkCjtNfGdxt6a+b2F9sAFX7lT:4Cmkt65b2Fdtl9ZqkKvI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807551, "uuid": "cba06423-b4ef-4aa7-9ae3-a1632b01f37a", "value": 11175320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807551, "uuid": "f8d6f4ad-c1c6-4ceb-9880-9bd52b49a3c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807551, "uuid": "ad476f45-ca27-4806-b570-c517fda06478", "value": "137326ac5fc9563532826dccf4442886bef1ec94a41654b9cbb6c963d78a35d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58179fcc-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808425, "uuid": "b9390a68-b331-4cac-aa5f-fbb0e7ac5ce6", "comment": "Malware payload (GCleaner)", "value": "4c721cc715437629645434db155928f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808425, "uuid": "52fea78d-aa61-4e4b-8d6f-72f34ff23afb", "comment": "Malware payload (GCleaner)", "value": "142f30da346b8ce1aa75cccb1dd12d61beae9fc42d71224ff8d24a394c9011cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808425, "uuid": "048fb121-309b-4d29-ac45-a91b4761af67", "comment": "Malware payload (GCleaner)", "value": "c92e837af93212b59ad4e2871c28a15357cbcc92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808425, "uuid": "1a54c888-e0cb-490d-b5db-abbeb3c19cfa", "comment": "Malware payload (GCleaner)", "value": "e56a8617e0fd74e22be54d97e6077951730ff430776551deea880ea6fe8e75c03ede73e01e5980ce0d3973040a275591", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808425, "uuid": "1895b028-5259-474a-b8d7-fa6ed2687d71", "value": "T10046E1C6DD7840B2FB5D1278EB17C4BD982C3B202A07700593CD8BDE5A7C74569A93AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808425, "uuid": "3b07e720-f373-4eca-b1b3-97e9941a4e10", "value": "336c69b6e8562d1c5231f219b62d7473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808425, "uuid": "93c0b538-29ba-451f-b73b-9d8adff0c656", "value": "49152:X9t9uLanwZBpIQaJd30HojjJX7oLGPOcPm15Gx6vip+iLmB2gTc:X9zuLVrt830iF80SGmj19", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808425, "uuid": "90e4dd15-b006-4c17-a154-9819042a4816", "value": 5670400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808425, "uuid": "581ef9f9-e83d-419a-83d0-29e13eb582ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808425, "uuid": "9a4f7e4e-1a86-41f7-ade3-6befb66ae285", "value": "142f30da346b8ce1aa75cccb1dd12d61beae9fc42d71224ff8d24a394c9011cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d903e54e-1948-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772793609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772793609, "uuid": "1145dbfd-8dc1-4949-b702-e28732f902a3", "comment": "Malware payload (RemcosRAT)", "value": "3087bac328df158ab2fd255c51102df1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772793609, "uuid": "0b2a449e-9592-44fd-9676-58b6f04cdca8", "comment": "Malware payload (RemcosRAT)", "value": "14432e750fb9b4c22c3ea6c2c4dda9d5338eebac5c86451d51c77358eabfda51", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772793609, "uuid": "1f9658ca-e689-4504-9c0d-f3dc3e705e51", "comment": "Malware payload (RemcosRAT)", "value": "aa44a1419a98ef24939cb09deca325774977406d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772793609, "uuid": "d5f950f7-d790-4b00-bf9d-76dc10f4aa8f", "comment": "Malware payload (RemcosRAT)", "value": "7f6844629eba01e5e9eda11c3d947166156155b76ab9c2877d97c3a78078728600a9929f25ed85b0d0d29f1fc92d3f73", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772793609, "uuid": "a404da03-5b04-4de6-81b4-94cdc691487a", "value": "T1D6E5B0AED9846F0ACB938B1D80FD8E5052976457716FB22B4633BD75D2F365E82004F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772793609, "uuid": "c37bc5bb-1e9c-469f-81f4-27e99dd36a64", "value": "24576:oETf0WKwQvB0zc7QJdX7tqD+JydLNhpFZ43u+hzpVQxPlcP6QZACYGfKqfuSfOWi:odUcUZppiqiqfuS/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772793609, "uuid": "f4c2ffd9-d94e-4ef7-a6e2-e743db0a697a", "value": 3249016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772793609, "uuid": "8b41ac99-4c78-4cb7-8639-1eb704eaf925", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772793609, "uuid": "ff608daf-2d0e-48a5-bc97-d6b34565d490", "value": "INB98767890.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe0c765f-1983-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819011, "uuid": "63b29e7b-3c1a-416d-aef6-7a8a83a1a308", "comment": "Malware payload (Mirai)", "value": "3375344b13f03922c1a29ee3899aa17f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819011, "uuid": "bb56975d-5e9a-45a5-b803-892f7c026db8", "comment": "Malware payload (Mirai)", "value": "14779a841ccb985767f66367ecd3644d826f23c921f52100eda9eefe9189fce9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819011, "uuid": "5454cc41-1efe-49a7-89c2-c094d577698b", "comment": "Malware payload (Mirai)", "value": "5cdb90738e726a1a885c8078ae7323533ec4846e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819011, "uuid": "cd886705-0019-4edc-87a7-f825fbeb4688", "comment": "Malware payload (Mirai)", "value": "5e01d9aa464f922e8000295e4708bf1adf4c48bd5313026dc2d2a80ff81735f3f9e4e49cffa848a78f5ecdd02e8987ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819011, "uuid": "fd0e6a87-41cf-4b89-a8dd-3027ab39b8fe", "value": "T163B34CC9F7ABE0F0F9060AB02063B72A9A34D9365111ED26F3D57D73AD35602916BB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819011, "uuid": "dc78b584-ec11-4088-b61c-4375ebf99929", "value": "1536:SiJpvf8XJwwBNV47YFx9K2ukqK8HtvPU6318aqoPMWwyPtJyinnn/iu4Bhr:xvf8Xvn4yBuVKe1+e7D7nqu4BV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819011, "uuid": "8c47f54a-4e64-476b-9a7e-4cf3620df7ed", "value": 112140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819011, "uuid": "325ade47-5acb-4033-8229-bdefa5507115", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819011, "uuid": "01dff885-725f-415e-b5c1-6917af0e53e6", "value": "debug.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "193092f6-196f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810037, "uuid": "188f3509-7079-46e1-8a0e-8e8a7841e990", "comment": "Malware payload", "value": "ffd12c48e8bc75f70e16ec70e7d102b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810037, "uuid": "eda3a1db-e709-48be-9a3b-0793bf324a63", "comment": "Malware payload", "value": "148d31f13b22a874b92def2ed334c0fbe72ea15494a7bdde9de752b3adac3453", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810037, "uuid": "e1e45677-6b3c-4b19-abee-74a5d80c4af8", "comment": "Malware payload", "value": "207682720482f8d91a053e9f7f118bd4fb19d043", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810037, "uuid": "cac02e95-4cc7-46c8-9dfc-f7b67ea11fe5", "comment": "Malware payload", "value": "2959b2b8c5d831e783991554adb6edf7cbad3e736b93621952c02f79cba6692835b5d56dd560039e3131e5ee23b46f0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810037, "uuid": "acff12ec-777b-4921-8ca0-d51ba3145fef", "value": "T16694E412EB107465F89349703E38A256782D3D352681ED4BB78D9F8A36B1A83B0F571F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810037, "uuid": "6c100875-e092-4e82-a128-7f24d88c847f", "value": "efdf248bdbf4a7ee72e7aa7964ad015f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810037, "uuid": "47341d67-fba2-4cd0-9cef-6b0f2ee95c18", "value": "12288:ZRm08V30cYwRinUZ2YMomSfc9DUPbpST80txvAQYt:vmNLmS09RTrA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810037, "uuid": "db82ea6f-68c1-42a4-a521-9fa75cae9510", "value": 417792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810037, "uuid": "c5297751-ae12-45ce-a55b-ebea208389a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810037, "uuid": "a0647184-b712-42f5-bd61-22985c08ee69", "value": "148d31f13b22a874b92def2ed334c0fbe72ea15494a7bdde9de752b3adac3453", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d963d79-1985-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819628, "uuid": "9d4d6b45-84a8-49dc-9435-08ee3a3e2e75", "comment": "Malware payload (Mirai)", "value": "4756faed68b604d469d52738eb35359c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819628, "uuid": "046bce8a-b8d2-4ee1-96ed-01ab718fe728", "comment": "Malware payload (Mirai)", "value": "14aa037691e7e19eb4d8c7857578e3fad0966c136fe803f6c1f108f1a63491b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819628, "uuid": "71c722bd-b921-4f3e-a95f-f6ce1ce29424", "comment": "Malware payload (Mirai)", "value": "975eec92ab1d8a5a2251aa75fdf5a9646379d0a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819628, "uuid": "98778d01-fcd2-4b79-a6e8-91d3bc669e5e", "comment": "Malware payload (Mirai)", "value": "d34e3902cdb7cf26a8f2cde7224653f92fc505cb5f0e081a1027781c8c87ab9e981d96c1da586b9fafa2e0498b6f1b2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819628, "uuid": "468ac983-6d15-4ab2-9cf3-17d4cf2dabf5", "value": "T1681633CDE97834A907F9C0AD375A92149F3E3683445B7EB87FF9709BC50865A2402CE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819628, "uuid": "ff4d8c2f-7de9-49f6-a6cb-d5ab0b3b6ca3", "value": "98304:ellxtvA8fr3veVvExF3JSBpW7zxVkTlV7vOvyqRKLjcK:ejXY8fr3veCxxJSBpW3xVmlwrgUK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819628, "uuid": "034f9522-1fa5-4f46-8829-0c8b396812d7", "value": 4170428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819628, "uuid": "65ae3dab-79d9-409e-b85c-b0df3ab530eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819628, "uuid": "7aa7e4b0-dd88-49d4-b401-80668e483619", "value": "bot_mipsle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7291d95c-198d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772823072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772823072, "uuid": "1f1ed497-4135-4495-8073-d56c57253fec", "comment": "Malware payload", "value": "3b5af92975900e4ef13e49ac899b64b2", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772823072, "uuid": "73160d44-0cc4-425e-8093-a107b3568fc4", "comment": "Malware payload", "value": "14cfadb8c0154dc1174b0b9af74765f769fad524d17eb2ec494ce02c9a221c8d", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772823072, "uuid": "0b8cd91b-c4a0-40b1-b4aa-e3ec19456214", "comment": "Malware payload", "value": "f0211a02144d6193191c1387cbbe6a983d226f18", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772823072, "uuid": "7e913380-252e-4b39-be9e-cff19658cade", "comment": "Malware payload", "value": "eb2b652249e9830580faa98e5be5fa991537874b118bf1bba87b8dd61a97fd3810db63636a03e023c4fe9157dfad5527", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772823072, "uuid": "4b5dc30c-14c8-4672-baa8-07f95f7f6f77", "value": "T1DB427A1037F44348F0B26F399A7B73658815BB16DF22DBCC0220800D1972321D869F2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772823072, "uuid": "0b327614-feae-4cf6-9f08-82f5211bff70", "value": "12:8d/2dSm3Sm3Os0oK9JuqVUKmQU4SK9Jo6jqs8XKYLXjtgBniQKXmZrYDeXqlhM6D:8d/2dRR4b1fWshiv2KDe6rglJtyFsnP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772823072, "uuid": "f54a5bfd-ff1f-458c-a52e-12dc1e0bec22", "value": 12385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772823072, "uuid": "3ca9518f-fba8-4efc-a68b-7142ebea8a62", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772823072, "uuid": "a366f863-d7c4-46d6-b772-e33b4aaba733", "value": "Dopovid_maino_09.01.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "232293ae-1974-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772812202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812202, "uuid": "da9f7843-6515-48dc-b4c8-a311b6a6d5c7", "comment": "Malware payload (Mirai)", "value": "37f6e92be6dad249c5fb6af45abb9f9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812202, "uuid": "3b457dbc-72fc-4f3a-afb3-7cc7983f8dad", "comment": "Malware payload (Mirai)", "value": "14f5f0adadc31567b70d1fd453afbebf68c7f7a469fa83cb4a670afa870688b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812202, "uuid": "b79db595-9beb-4aac-81f2-ba47d9ee0b41", "comment": "Malware payload (Mirai)", "value": "3d6a0be3fbcb499e95d5441de587edb38626f526", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812202, "uuid": "b9c789cd-5be1-4b8c-9b08-0e344a2d5018", "comment": "Malware payload (Mirai)", "value": "142fdf74f9f52dae2d84baced882fe88a4acb014d287f2b6f385c791fdcaaff6472ec3aac7516ab8c20d3893ce3f1366", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812202, "uuid": "9210d049-69dc-43ee-b3a3-6abb636181bd", "value": "T16D03D691BC824A26C5E4137AF67E17CF332063E9E2CBB217D9115B647AC690F0D22F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812202, "uuid": "adf1268d-d92c-4d4a-a598-7e3bf6701899", "value": "768:QnAj8PFqTSzrCk3mjqlm70FqlKwsXrl9RORY3Cg0S1sTPhPQQpv4ta+EbfwWSY:QnAj8PTCk7PE+nKYl0S1apQQp2fWS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772812202, "uuid": "dc284e71-c962-4aea-94af-f6b87df92310", "value": 39028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772812202, "uuid": "2830beb1-2af2-4c50-a90d-925f1aabf10c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812202, "uuid": "2f634a6a-7903-42b9-b2ee-829ad8b8152c", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "719e9009-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819205, "uuid": "dcbc318b-6221-4b6e-acc2-c666a57e8746", "comment": "Malware payload (Mirai)", "value": "15b35751a3a11cbfb52810ec324a62d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819205, "uuid": "84d40fe0-e3b9-41e6-9983-eaac2b84d46b", "comment": "Malware payload (Mirai)", "value": "14fde8e693ba9186c0202676aa997979a20dbd9a2a0dc26e06964e5d601fbe11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819205, "uuid": "a82a37e3-c9ef-4911-8d76-f55dc17e0ef7", "comment": "Malware payload (Mirai)", "value": "657f242072b88e0faea3b55349ae38ade5e36221", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819205, "uuid": "568ce3df-3c63-4112-a23b-ddd0f1ad7f5f", "comment": "Malware payload (Mirai)", "value": "2f1ae2fc9f6ed5f8436c0cb12b4c45e4e1a9395f5707e2e5ee35fd2a084585b2790fe3a9fbd2f7205f6db718535d246f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819205, "uuid": "611619ad-03a5-49b0-bf8c-948a2f5a6e5a", "value": "T18A831B46B9818B12C5D212BAFA6E518D33137FBCD3EE7212DD20AF5067864EB0D77612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819205, "uuid": "d30015e8-bd94-4d7a-9940-a4f6f1aeb4a9", "value": "1536:BDnwYvQWU/mL6hjlpLvFauPIFAQZbMNiFiEghBfZ7gL5hGYUs/gWty:L4W5CzLvFauMpiEghBfZELDG9ey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819205, "uuid": "a7619053-e25b-4d55-9ec2-f801ebd1b80e", "value": 83888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819205, "uuid": "cc634709-6fff-441a-a402-5c0c5eb82dbf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819205, "uuid": "44477799-38e6-4b26-b62c-2fa24c060b60", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cdb612a-1942-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772790877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772790877, "uuid": "1ea394cb-4271-4e11-9b78-3de2bdc8779b", "comment": "Malware payload", "value": "370ec4e513dc8ee94f5163f3ac09c592", "object_relation": "md5", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xrpnode-app", "colour": "#D7A51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772790877, "uuid": "d5c1e79f-c1b1-4155-8320-37ff31cd7b0e", "comment": "Malware payload", "value": "15015b739b901b6eb4849a504341068993de5ce324f619dc3f9d1230d3fa5759", "object_relation": "sha256", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xrpnode-app", "colour": "#D7A51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772790877, "uuid": "962ff597-72c2-41fd-81b6-8892cf43b368", "comment": "Malware payload", "value": "3cc13b6eb47d0f288ba651f0990098af7d9eb0a3", "object_relation": "sha1", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xrpnode-app", "colour": "#D7A51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772790877, "uuid": "5d8ef546-6fbb-43f2-b107-8b322d30a47c", "comment": "Malware payload", "value": "5cb00edc9fa5f90e662a2bab8fc9abc270413a21c81a75ee321c53bf92c9d28f72b36488523dc6b37de5089cc3dde44a", "object_relation": "sha3-384", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xrpnode-app", "colour": "#D7A51B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772790877, "uuid": "4dd2fe21-f9b3-435c-a1e6-abb260320a13", "value": "T17F31127789403C7EDF8645CE2C823911A587456B424F3D9CF69C48892BE7B7C947C06B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772790877, "uuid": "c3173775-eef8-47f1-bd04-3b51f9e1da98", "value": "24:1y2A4s9+NdgPWZP70da2A4Ax2Ag0qGaQH6xvu2AQ2AuRYzcz2Zfsz8eSO0Ga+8uA:1lI1Wh0bA6JQcCWcHF0r+zIepNhFO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772790877, "uuid": "dd8199a7-1174-4572-bc52-addfd82d7d69", "value": 1520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772790877, "uuid": "9ea7be71-d7f6-416c-8998-f6d97a18aa3e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772790877, "uuid": "04fd4687-3c6d-4251-88ca-d2ba672d9463", "value": "15015b739b901b6eb4849a504341068993de5ce324f619dc3f9d1230d3fa5759.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e80222e-192e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772782129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782129, "uuid": "5f151b8b-61e5-4611-a9f3-44e0be12d9c7", "comment": "Malware payload", "value": "fc94566e4fd0235624863475cc2892bd", "object_relation": "md5", "Tag": [ { "name": "api-devx-help", "colour": "#8AD189", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782129, "uuid": "51aed722-b3e4-45a3-9244-56270a319869", "comment": "Malware payload", "value": "150e2b307d306d8730f611a2c0c2613c9b3ad5ab3887a174b926a0a2a61c35e8", "object_relation": "sha256", "Tag": [ { "name": "api-devx-help", "colour": "#8AD189", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782129, "uuid": "2f7a9652-79e9-4d85-a0bd-3c96dfc76c60", "comment": "Malware payload", "value": "750b5aa9854293d6c5e9d772b4888142636347fc", "object_relation": "sha1", "Tag": [ { "name": "api-devx-help", "colour": "#8AD189", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782129, "uuid": "b6cd7131-f4a8-4888-9252-0cb3f638dbb1", "comment": "Malware payload", "value": "68c71912c1013743ec773437365d0052b2bb87cb9e176ea392c347c03107735b74a89bc8335fdf83fbf3dabcf2a0fc63", "object_relation": "sha3-384", "Tag": [ { "name": "api-devx-help", "colour": "#8AD189", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782129, "uuid": "86aef0ef-5b0f-4c4a-bf99-4c58b8294860", "value": "T1A0F733AE62C46F231DCA831E4976BB9CA121C325E1E4A4796DF82F4356E0B075F3D16C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782129, "uuid": "2cff5309-09ca-47a2-b536-1958e9a651ef", "value": "1572864:hBh+bST8j1cEiWoYFzZholtSEmxnkG2Su8nR9ZwLlAMu/Ya8B:hMr1cfFYFtholtSNb5nlMu/1y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772782129, "uuid": "75cc41c1-f14a-453c-8462-8480f9555f3e", "value": 73297640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772782129, "uuid": "2a6ca1fe-56ed-400a-9b2d-1d5245591f1b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782129, "uuid": "89022c9d-8f88-46db-9dcf-6a3349557c5a", "value": "53e0f3e2999b6f7963865a478ae53f86c3812aa27f36089f38e2d2e1e5de2b6b.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d559be85-19b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772839129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772839129, "uuid": "bcc8e868-2ef4-42f1-b4ea-453df0a332db", "comment": "Malware payload (Mirai)", "value": "353dc61374e69ba74192778525db70f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772839129, "uuid": "fdfa4405-014c-4567-9cdb-b5755be65147", "comment": "Malware payload (Mirai)", "value": "154e1a90d2a10c17d62ddc5933a45f2ea1aeeb13f8d93f450c70c423e8910f60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772839129, "uuid": "a149da4b-eb0b-4ace-b3b4-527fa04f14da", "comment": "Malware payload (Mirai)", "value": "067fe9bf640c58eaa7271f39ccce1dd7a63b9eae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772839129, "uuid": "70c99c0a-fd18-417c-a98a-0e6f4b2fed96", "comment": "Malware payload (Mirai)", "value": "a52ba955a85afbeba676f255ae2ee070ded0878e6aac8020a5520e27dfb325d028aac8809ecf9bcb59046700bb7eaf04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772839129, "uuid": "9ea61a4f-7b6a-4076-9442-cb63f0dc77fa", "value": "T1EAF3853E7A11AFBEE168827107F29F70CF9529D326A19381E26CF6185E7128D0C9F754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772839129, "uuid": "1d0119cc-5d6d-4165-a913-0fc8109548bc", "value": "3072:G103/L7OBjwobENT7nfIvT7JmrThPaL2IvP7Nb:s0JfQvxmrThPaL2IvP7Nb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772839129, "uuid": "0f732562-9ac3-4ee4-abf2-f7377aeec9eb", "value": 159678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772839129, "uuid": "3c46132c-4ca3-452a-b08c-27bd8b99f634", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772839129, "uuid": "1c8b091d-0e7e-4d30-96bd-fdde5eb1f1a7", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ec6893-1995-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772826574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826574, "uuid": "33a33cbc-e807-43f7-9588-a80b818b58f7", "comment": "Malware payload", "value": "ffac95db063dc00e53e14bfc7cb30c17", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826574, "uuid": "c82b1457-34ff-454e-a912-ddca7f52c147", "comment": "Malware payload", "value": "15779f5361fe4224a7333fe4402e8cc4ba6c1fc748907f0fd5b61446e5b0820c", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826574, "uuid": "869af2c5-5621-40bf-8972-25699f4e3bec", "comment": "Malware payload", "value": "745f2e25cf2aaf78b81ffc12e0b04872739b6216", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826574, "uuid": "d05e5abd-827f-41f9-8e0e-ead085b1709c", "comment": "Malware payload", "value": "f80f682f14e1497936bb33585958f2464f17e2ac2b82f35fbb3e398a87b325fb10d9ed9eb9343577149a8a89f0f2aa0b", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772826574, "uuid": "6689fa20-ab5c-47e0-9ef3-40b56a61eb31", "value": "T1C4252303B9D1FA5FD0075F7669D2A216600DED582B1C85977FCA732D6CB623392E3288", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772826574, "uuid": "7bd4c7ac-489d-4124-8a6e-427a9cb2e507", "value": "24576:JOaY0CJR8lffiwyceg8U6Y98FVkJfIaqiTKt6mh:JOjPGiwyceHE98kDW5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772826574, "uuid": "1abdef66-3819-4a86-a08f-bad8de517fe2", "value": 1057792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772826574, "uuid": "e6d97d97-bf02-4fb7-9740-71e5db96bc1b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772826574, "uuid": "7f913893-d4d7-47e5-94e6-5b0098f5593c", "value": "SecuriteInfo.com.X97M.DownLoader.2343.19025.22015", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "055721d0-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819024, "uuid": "0dc17875-c3bd-44b5-b04c-852fac2759e6", "comment": "Malware payload (Mirai)", "value": "608fb905a8f4a2d5a7311aeb85369878", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819024, "uuid": "a12c3038-8b5f-4e1c-87a7-bda45249fde7", "comment": "Malware payload (Mirai)", "value": "15833b64e5b5a08d9875c88c901c2687130618f4c283de2a6e699c66288a1657", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819024, "uuid": "2cad9c07-553e-4444-8a42-2bfab8cd5e37", "comment": "Malware payload (Mirai)", "value": "de3d85a75ef27f84bef38a8ec5babbb6b4c9d57d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819024, "uuid": "da015c32-fe2f-4765-94c1-ce30d07ee059", "comment": "Malware payload (Mirai)", "value": "ac2571f35f25c2955bb0362e3e153ada0871d088811539b80d5ba98238a292ca08b7936dcca640e8550b5c4d3762ace2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819024, "uuid": "12e70eab-4efa-4b18-b185-f6d425b5314d", "value": "T1F3839C23C9361DB4D45845B0B0A1CF355763E52681976EF698AACA3ED083ECCF94A3F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819024, "uuid": "6ede17cb-cb5e-4be4-b7ea-31f2f3bfe35e", "value": "1536:8OmkxPUOUubAF848Z+E7KEvnzho93CeXPF9lyD:8XkxtL1+E+Edo93tNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819024, "uuid": "4efa5323-4b4c-416e-babb-13a78c1d7a47", "value": 83812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819024, "uuid": "eac81c7c-730e-4bd8-b3d9-293344123321", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819024, "uuid": "e4c059aa-7521-4529-8e41-701f817dd280", "value": "jawirbot.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4bc5833-1929-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772780207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772780207, "uuid": "c6da4bc5-0277-49e1-9bd3-cc1e4c2cac2c", "comment": "Malware payload", "value": "19d73c6daa5183d7ca5713ce9e4b3c10", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772780207, "uuid": "8f8b4e83-5218-478f-9548-3a9b1e56b242", "comment": "Malware payload", "value": "15c58b3173cb547fd4ef4a109a50d5d7907c57d7f578f3bdc5e0b67afdc6049e", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772780207, "uuid": "72db4591-d4fd-4160-83d9-a890d0b2a741", "comment": "Malware payload", "value": "a4c1c1cd523b5ad6dac0cfc3e4e0da0e4265908f", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772780207, "uuid": "3d94b37c-af55-411e-a7b4-26c61c043deb", "comment": "Malware payload", "value": "9827adc3a0e97e38ea3a5c108abf48336b62403903b4f6c20f0b77a48c86ea0c862f66fdc036c4c6499f70be0ce1d598", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772780207, "uuid": "3fb73a07-9bda-41ba-9283-3086c26960b3", "value": "T12E249E021C76AA510774894AEF6C8750CB9B7606C41A3D1B746F58F02FBBB648B31FDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772780207, "uuid": "e257a714-896d-4eb8-9eca-f3f0e9ac2ec7", "value": "3072:kvuvxGvyPTPFynlfPEvT+BkMWo5xXThTKKkBRnJYEX6J8/tcBTP0:0uv9ylfPs+ia5xXU5nLoieBTP0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772780207, "uuid": "973fee64-bbfc-498d-8f94-325bb0451a9d", "value": 221535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772780207, "uuid": "cd5bc40e-1307-4b31-b27d-d2675b5aa107", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772780207, "uuid": "d7e7e936-23c2-43d1-bd4c-cc8a9ec788da", "value": "Protected (3).py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9193eb75-1984-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772819259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819259, "uuid": "79b73994-a3ba-42b7-8e88-eb7175458fd1", "comment": "Malware payload", "value": "2bc899ad2c68594b7d068d4af185db5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819259, "uuid": "e1b65607-31dd-4356-b229-1469a89483f4", "comment": "Malware payload", "value": "15e982a32165a377160260aceaac808131ac01be9f6588fe0f60038fefd64b90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819259, "uuid": "d23efea0-e123-4c85-a073-c23896092d7a", "comment": "Malware payload", "value": "37d7e531266a82775595d82ae5970a62d575081d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819259, "uuid": "ce20036f-32ad-42cf-a7e8-f141fd31f7e0", "comment": "Malware payload", "value": "f781e4e327646ffc83e3905f845fd4d2874ec359c0800c3d70eef8a77d64669bbb18e7397112b065a3f9503f6dbe4d9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819259, "uuid": "15d150cd-a59a-4edd-9cf8-a77e8f9475ce", "value": "T121231745F9819F15D4D525BAFF4F21897353472CE3FE7202DE210BA9278EA6B0B7A801", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819259, "uuid": "10f53c9d-6428-4d8a-a12a-5694b82708d5", "value": "768:BFnxZD2Dbxyyh1vnVZYLECjzEQZIIdzKRKluJiIdRYZv6v0RtTHgGAMe9:BFnxIxyyhtnV2xjzEGIIARKlMi6OEWAJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819259, "uuid": "37d657bf-f05b-4f08-b730-f324f7a7f3e4", "value": 49096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819259, "uuid": "22144acd-d8ba-4ad6-bdd0-e392dc835e38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819259, "uuid": "6da29746-8ab9-4615-8da9-f799726b8c33", "value": "violetarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28c86713-1974-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772812211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812211, "uuid": "733ecdd3-f459-4128-a15b-cd8c014cb9bc", "comment": "Malware payload (Mirai)", "value": "568500e2dca4941489be01a8cfd63f12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812211, "uuid": "28f89ce2-f47f-4e39-8fb1-0d7286878d2a", "comment": "Malware payload (Mirai)", "value": "1679d43b3c45312369aa2050559f3dae7e7213f43ae023163e263cf78a63fd68", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812211, "uuid": "cef25184-ef3c-4127-854d-e3bcf5511ceb", "comment": "Malware payload (Mirai)", "value": "8cf7d3c4c674e402e5b65d01210a47e7acd06ebf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812211, "uuid": "0bc29472-a21d-4a0f-be1f-367008f166ac", "comment": "Malware payload (Mirai)", "value": "5db05f4db18cf1f0ef1954f17e245442e11bb83210498115ade2ee52c79bf8ad2948b8dd331a6bcb43b0332c3939b042", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812211, "uuid": "68d6a55e-4a3b-48e1-9dc6-4d00ab39c469", "value": "T1ABE32A46EA418B13C0D61775B6DF42453323ABA4A3DB730699287FF43F8679E4E23A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812211, "uuid": "56ade3f4-8f83-4df0-a491-db018e1f864b", "value": "3072:03DeG9+AYBhQeqHaPAn0DG5OCYzUUtBfxn0DYM/9q2KzC:03DeJBaDHaPAn0DGzYvBfxn00M/9qFzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772812211, "uuid": "7b88c715-7ea1-497f-8551-d9ba39c9ad09", "value": 153730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772812211, "uuid": "75e2fc36-9ef4-4dad-b40d-b11a2f00ac9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812211, "uuid": "3fe6c339-d5f9-4d4f-8dcc-61b6d61cc12a", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "423f7915-1982-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772818267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818267, "uuid": "be13cc5e-2007-4c35-817d-8cd837e8a33d", "comment": "Malware payload (Mirai)", "value": "085efcef06ea995885d7879fd3af2be9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818267, "uuid": "96b1db29-f005-4468-bd4e-119fa4830e8c", "comment": "Malware payload (Mirai)", "value": "167a6cb4c56ddca68283a29cfee5a1f41799022cc4adbc873b71dc6d3f9759e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818267, "uuid": "41271b25-0970-48a5-b225-f0982dcdb78b", "comment": "Malware payload (Mirai)", "value": "f856a9cd772a954e8c308bff0da8a1ff520e82d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818267, "uuid": "a3f3434a-a792-4905-8c8d-89a95ec3b22f", "comment": "Malware payload (Mirai)", "value": "a0c7c582e34746292fa17268ca1cc12aa5de617eb16499ca8296cc55f04f25fbac5308bc9c7d4c2112e859655e0c9fb1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818267, "uuid": "c05a662f-e137-41c2-85c0-8902668be87e", "value": "T15F04B50E6E198F7CF79987345BB79E31925833872AE1C582E1ACD7105E6024F641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818267, "uuid": "cb6d1e7b-0cc3-435a-aec0-b8d8040fbc0b", "value": "3072:1OATXjpCgqDJHDexBJKfjPV4kuMu8hJBQX/uw9EfszRpSP/QBrj4jTv3TcJ2tD2i:1OATXjpCgqDJHDexBJKfjPV4kuMu8hJH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772818267, "uuid": "77aa45b2-877b-446b-82b5-7a9cb5e5d8c4", "value": 175820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772818267, "uuid": "a7020f7f-f70b-4118-a4ab-33f385ea89ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818267, "uuid": "3b950711-6c1b-4c13-aed0-d097b9b57ba9", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aa19331-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819032, "uuid": "b9642cb2-eb1c-4eef-b1f8-70788ee3427e", "comment": "Malware payload (Mirai)", "value": "8b562c98e8bb6f9b46620d0f74e0acfd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819032, "uuid": "7abba02d-c530-48df-bfd1-cd28ee41b28d", "comment": "Malware payload (Mirai)", "value": "16d4fd7dbc82af3f972fa860f39cbd08410a3f8b20bc1af3ed299dea44dc2222", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819032, "uuid": "866ee8cd-f8fe-4627-b712-731443ce80e3", "comment": "Malware payload (Mirai)", "value": "cdb7b9ac3a0008e62eee249070bfafae2e049e31", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819032, "uuid": "2a6732af-9c1f-4f6f-b15d-1a8498141d76", "comment": "Malware payload (Mirai)", "value": "115a0e302efb8fb2cea0ed8b95dcd1993bcba69eab255d69670d422685ce2dab7bba69788566f3d9d8f9806612559e8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819032, "uuid": "56bd313b-edbf-405e-aedd-d6ac8d781fe5", "value": "T10A83B786F8513B39D7E1FAFEE748139D723A0398A3D7B211CD38556263C8B58AD34624", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819032, "uuid": "ca99119f-3f84-4438-9c84-6cda827f64a5", "value": "1536:zknaZu4XoZuILp2TYouOnNTUGCHdbG70WM4DTrG5uVB:zknsuNuWp2TYouOnNfC9bG70WM4DfMuD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819032, "uuid": "b80bf13f-8a09-45b0-b9b0-7aca644f34cd", "value": 84664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819032, "uuid": "faca661f-5f64-4205-baad-2f81c0f5a655", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819032, "uuid": "34912034-1d91-4f9e-a05d-1be9b26200aa", "value": "debug.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ee2755d-1962-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772804598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772804598, "uuid": "74bd107f-4ffe-48d1-bb97-48d7ac7898f0", "comment": "Malware payload", "value": "66f4e04c4e25c98a8641f102b1aaeaad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772804598, "uuid": "1ce26c63-949e-4256-bca8-98662e49a994", "comment": "Malware payload", "value": "1700b3653df1f1b83115f46481dd086c8547a6e5b0691d402a89350dfb401a21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772804598, "uuid": "6601756e-f4c2-40e3-bde5-db4548c6a3e4", "comment": "Malware payload", "value": "ec1a11a9361d43fb3201700379dcfb142854a524", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772804598, "uuid": "dea69f2f-f096-4053-a63c-7963288b1ab6", "comment": "Malware payload", "value": "e61e25adf3db8369b23948f29cafe75e70524838f0a3aa2ba894592375d489395be46d200cb24c1ffd433eca0e522bf6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772804598, "uuid": "19a96aae-bf76-4049-9d5b-ce8d0287af52", "value": "T1B294C416EA1074A5F89345B03D79A246292D3C3A2680EC0FB78E9F563B71A8770F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772804598, "uuid": "82e8418c-e4b2-430f-8a1c-33d1fd84aaa0", "value": "6f5fa4bc892e6fc08316936b9720ff9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772804598, "uuid": "82b532d7-ad5d-49a8-8bbf-97823813e4de", "value": "6144:s8sUJ6pfFrWhVBfejGbubJX1ug9NX6z0Mil70irB5trZaIaCnVAyW6lL7D6B5FsV:NsUJ3fejGbubJX1ugqgTrZaIaCFug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772804598, "uuid": "46e8f502-74af-4fcc-82f5-e4c9d973b33d", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772804598, "uuid": "0f89b238-01fc-4551-b96d-76c82cbf07fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772804598, "uuid": "ecff90f9-8130-4f98-99b2-20308173aab4", "value": "1700b3653df1f1b83115f46481dd086c8547a6e5b0691d402a89350dfb401a21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41959ced-1970-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810535, "uuid": "76d9b36a-3448-4bfe-b359-87b6421beed4", "comment": "Malware payload", "value": "75833364a3dca6238dc94b5199227135", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810535, "uuid": "7757adc8-0b01-4f0f-9158-495b09ac248e", "comment": "Malware payload", "value": "1709f214312d94851629b41aa95b073ed9c9dd205853f0822285d1c50581d5ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810535, "uuid": "6cc2a0c2-ee30-442a-9b78-c9270e77ceb6", "comment": "Malware payload", "value": "02d8325c38a244f29abd9a71630983d6b6417e61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810535, "uuid": "29c4dc2e-97c4-4499-84ec-c07d8e48f990", "comment": "Malware payload", "value": "5db97ec0fe2b9386863382deb339a0847c7e60fdf573b413589e5914ec41642f9a13ae2d2ef04e591e9ec59a2a34315a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810535, "uuid": "a87bfca2-705d-4356-b563-9be3de379441", "value": "T143845B23E620A12EF1A3C9F1B9A5A25728263D3A5698EC47F3415F5834715E3ACF131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810535, "uuid": "1b2e5214-778c-4c8a-bb38-1b71571b12cc", "value": "252c027bda7298291893ceb108f11214", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810535, "uuid": "ae1058c0-0ded-4eaf-bee1-f50dfe15022d", "value": "6144:y8d1/w5KA81IJ8GpF6nuTmOOUWTUxcBfbbNcknSrnGRyZXPFnUY:hjYKkJj6GmZUWQCbcSRyZXt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810535, "uuid": "572c580c-5734-4aa1-9933-d3c24a0e9945", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810535, "uuid": "d1632f32-7ed1-41fc-a1ff-03f0bcb61d15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810535, "uuid": "071d4ca1-e3f1-4bb6-a7b2-b4957cb069f7", "value": "1709f214312d94851629b41aa95b073ed9c9dd205853f0822285d1c50581d5ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a05ff04-196b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808375, "uuid": "fc516402-08c7-4215-b658-811bf73b9be9", "comment": "Malware payload", "value": "fa1e01a7b0e427c055eeeed76d4dfc16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808375, "uuid": "e37c9075-a95d-47d8-a4e5-b5a10225367f", "comment": "Malware payload", "value": "17134855fb6c5c7d5357c6a3b87a3bff86c43501e3d6cdfc963204559b1e8d21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808375, "uuid": "1e32b58a-f38f-4317-93fa-bd21ed232c70", "comment": "Malware payload", "value": "76bfcd75eb207903bc01937892f86abe41e6a2e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808375, "uuid": "3de74d74-da7a-4a52-9537-9b1be7914344", "comment": "Malware payload", "value": "5980f03e62ea287194d7e6718efeac45ebffc31ed2e2474c521c78c1d46e5b5ee2b9e5ef682c97704e374a45e905a059", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808375, "uuid": "db5b45dd-8d87-4cc9-900d-f68571860f9d", "value": "T13455121162AFDD22C6A9177350E2E63403B09E5AE013D72B1DEE2FE7BA567D61D84303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808375, "uuid": "5f7fd1db-2931-42b8-903d-fd3fc1948dce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808375, "uuid": "a68453a3-8aea-4b8a-8730-4ee63a9bc7e4", "value": "24576:5SDGxm5ElNTuyRyYTdhfcyLF/s5WYt+RbAj/AJusucy1xqN9CaguQlVict:5SDGxXlNT95NcyLS5WdAj/A+fosuWQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808375, "uuid": "76a51118-11ef-49ee-ba76-98b7cbf207e0", "value": 1331712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808375, "uuid": "fdc01126-324e-4d40-a986-3c142ade8e11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808375, "uuid": "cdbd3771-2a70-4f3e-8f15-a02e5c6cd553", "value": "17134855fb6c5c7d5357c6a3b87a3bff86c43501e3d6cdfc963204559b1e8d21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f470b9a-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1772811470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811470, "uuid": "50810c34-1eee-408d-a2c1-454be8dc7c43", "comment": "Malware payload (a310Logger)", "value": "2f7e5639db38d71eccb29a0a88ece1a9", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811470, "uuid": "211bbf27-f94a-4be3-81b2-c0feb2f6f480", "comment": "Malware payload (a310Logger)", "value": "174cd71ba0adc35fb65689bc77b349fad38811d170053b087c4bf02a0a122ef8", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811470, "uuid": "4f0595da-c5d8-488c-8b3c-8f0fc2602ca3", "comment": "Malware payload (a310Logger)", "value": "25aff71b84da30a7475b7b5015271ae316829583", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811470, "uuid": "89337129-fab2-4eef-ae1c-df0d49d668c8", "comment": "Malware payload (a310Logger)", "value": "4f64d3b9aa4a0747af887484d94de208fc7dbcbb3ec66708a1a0b44b57d6dd55eac7eab47235909e2c05708ea5042a68", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811470, "uuid": "ba130b8d-01b7-4b61-af65-009409c2c549", "value": "T19B845A23EA50A12EF1A3C9F1B9A5A25728263D395688EC5BF3415F5834711E3ACF131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811470, "uuid": "4646cc10-abc1-4435-a54b-d6eb368836ec", "value": "252c027bda7298291893ceb108f11214", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811470, "uuid": "c10470f7-3007-44e0-9c9c-4f4ebee9d82e", "value": "6144:P8d1/w5KA81IJ8GpF6nuTmOOUWTPQCNE4EnvFEsvyF6GCyHxxBT7k:EjYKkJj6GmZUWDCv0nCyHxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811470, "uuid": "23f9f08e-da71-4114-ba42-8d958c5e7c9f", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811470, "uuid": "15d263b4-f3b5-43f4-bd11-80dd18c3c7a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811470, "uuid": "2a47db89-5a4d-4207-8a57-0f25c26194d3", "value": "174cd71ba0adc35fb65689bc77b349fad38811d170053b087c4bf02a0a122ef8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8205073-196b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808640, "uuid": "afe68a57-fa08-4f13-8fcf-8347a5d53f5c", "comment": "Malware payload", "value": "ed54dbfaa5010fbfb7725609ab39c35b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808640, "uuid": "069425c8-f2db-4b87-beaa-972f9379b04a", "comment": "Malware payload", "value": "175d125a3639d38212758b595a4bb8f476794bd92ddabd9069380ff33ffb307b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808640, "uuid": "b32b9a4d-76f6-440b-b68f-0191536174b8", "comment": "Malware payload", "value": "ac025005097b7f8a804d7e9fc0837760283a7a2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808640, "uuid": "a7cab7c0-21d0-4356-827d-2f74cb10fa67", "comment": "Malware payload", "value": "273a414633ed31326a8807353a74cdc7e0eec41fc2f7c77cbc2c84386fbfc2b2d1faac85a3235873a8acd93076857a52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808640, "uuid": "ff7cc3f5-dba9-4c85-8b83-18b167c575c3", "value": "T1FD0523203980D983DA535B35A536AB735AFFEE231BAC421F1761BE4C3C72646AD0B714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808640, "uuid": "67030cf4-69b6-4f32-844d-5fd2d43549d1", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808640, "uuid": "ed510ded-2dcb-4274-9fa9-4d0fec1116de", "value": "24576:gN8b+Puqn7vjSxiYBGkFL1bbxJDQVuoqjyFa/nJNGrkU:A1Wqn79Ih5VonKUahQrkU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808640, "uuid": "e7776e2b-ca95-42d1-84f6-87df6815def0", "value": 850760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808640, "uuid": "05260f32-c6ad-41b1-8b18-8462b16b924f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808640, "uuid": "55dc7ff6-5ad0-4f5b-9746-cb87bc521155", "value": "175d125a3639d38212758b595a4bb8f476794bd92ddabd9069380ff33ffb307b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74b231f5-1970-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810621, "uuid": "f84e0000-988c-433f-a473-056cf75218c3", "comment": "Malware payload", "value": "46f23ea9f80d13f89436c742eec63f57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810621, "uuid": "2c9acdd6-f212-438c-bbf6-85324483583b", "comment": "Malware payload", "value": "177c845c9a901583824521abbb5f9a97cb786b5a157b711668c1c196247065ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810621, "uuid": "6c6d6d62-f6e8-4115-aaeb-09a861dc6b14", "comment": "Malware payload", "value": "727dee4a05caf1fbd38519558268ac82d3eaf74b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810621, "uuid": "f5fe7ccd-57e5-4d59-ae67-177bed01947c", "comment": "Malware payload", "value": "0e73de13154f6df675ef782a6f4d0b5cb8739a14b3077ea35ec7507bafdbc257776b751f8c63e633439ed2ba30390cc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810621, "uuid": "be14d7d8-3916-4d23-b0e0-13ca2c214aa7", "value": "T18A4533403770691BE663307ADD79D99E2F7280A209F0730B77A035367A5A4CBE51EA1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810621, "uuid": "f07b74e8-0ba9-4d1c-81ca-54dcee693dd6", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810621, "uuid": "71884768-208c-4b57-801d-539ac585cb53", "value": "24576:R3WrDmoFFY2aZVfGmPVti6/KXvezY6HuxfCIeTmYAs9oLN7BwCArAWA4+uMU:RWeoFlwGmNM6/We0quxfW6wonwCAE3cV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810621, "uuid": "3e237741-c428-4326-928f-8189afebc3a6", "value": 1252328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810621, "uuid": "93107e87-df10-41b9-9f59-c31f233d677c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810621, "uuid": "74ace287-0b3f-4dff-a71d-fa2c620d9207", "value": "177c845c9a901583824521abbb5f9a97cb786b5a157b711668c1c196247065ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb80491c-1968-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807411, "uuid": "0cb81685-0263-44ac-ba46-dd3dcd4771fc", "comment": "Malware payload", "value": "1a3c1751280e8f154bf5e916b37ccacd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807411, "uuid": "bec677b5-b38d-494f-abc8-1571c1d6fe09", "comment": "Malware payload", "value": "1782f3db2231d7b7ab877c21fc550b44469e22126b17117e188d3317eed7d5ef", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807411, "uuid": "e2ad7928-4b53-46dd-8dea-41980229c0f3", "comment": "Malware payload", "value": "33287f3f8bc5c2e04f0b5ca638ad4f0d9ec2ed9d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807411, "uuid": "52804745-56af-479d-b999-064369a95662", "comment": "Malware payload", "value": "77e68a111c23c825302ed20a506cf9479d3c25e464e8ca1befa77ac70ede0ee2b696132a0b166099158240c0c80c0243", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807411, "uuid": "3f6ce38c-9c93-4903-a7d0-d380136fee5c", "value": "T1EE153AD176EAEFB9BA4B1F7BE627732F039546850B42C994D1623C43996364200FC8DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807411, "uuid": "d98ebf3b-80f9-408c-957d-826d3d5d8e67", "value": "154514cb767b5afbf381ac853ede8b45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807411, "uuid": "2f03283f-52dc-44ee-b54d-d9e83489de4f", "value": "12288:Om8NSyLJO6JAO9r5oB+XenrvM5Ewo3Wd8VFoEL5XV:Om8wBO9riM4vwk9V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807411, "uuid": "f226fd6d-489a-408d-8333-1548a0c996c5", "value": 928256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807411, "uuid": "3dad575f-0299-4c9e-9e1d-0a5272d29c9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807411, "uuid": "b2117a6c-4289-4624-a0ec-e00ffcb7d7fd", "value": "SecuriteInfo.com.Win32.MalwareX-gen.77937273", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0def71c5-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810019, "uuid": "b5fb187f-6912-4f47-a9a8-1a96ae3ea3d4", "comment": "Malware payload (GCleaner)", "value": "9c17b3f2f05ac2499bb9c2eb30b19f7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810019, "uuid": "e0a33f8a-f532-4a8b-8976-e29900fb4c80", "comment": "Malware payload (GCleaner)", "value": "179d2412844a501d0a1409d43d127c365d2e14d4956c291c2e1115b33bacf5df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810019, "uuid": "1443df28-53d7-4cec-973e-194c52092e97", "comment": "Malware payload (GCleaner)", "value": "0b4df0a7a9efd9de9ec0346c857dfb92b4bff0d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810019, "uuid": "5a7cdf8f-e4d3-497d-a17a-576fc0bc3f5d", "comment": "Malware payload (GCleaner)", "value": "42bc6b78589c9227dd53fef87ea1a28178f6d4740f12f691f21fa90bad9d993c2f349ae1506c167d487955e284b5195c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810019, "uuid": "083d72c5-96bb-4f2b-8113-db6bc144d766", "value": "T17BE49F36F6D04432D1226D78CC5F96A598297E803D287C4A2BD81DCD9F38382BD65E9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810019, "uuid": "2cd0c60b-a119-4b6c-b745-0c73a648353a", "value": "c475b6e242f56325f64c2b76233f720b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810019, "uuid": "70a32e64-cc88-4366-bfc6-5ec5f7647d0f", "value": "12288:tQ8mJu5T0Ns+MD77lUjVMXokTZ90/xfQFWl9On:uJFNhu7lK4okNG6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810019, "uuid": "0752a36a-e055-4f9e-b2a6-07b803280819", "value": 698368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810019, "uuid": "4b989cf6-eaaa-4708-ba6e-a9a02b39c0e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810019, "uuid": "f74f13ae-1d72-42aa-a91e-2eb683609062", "value": "179d2412844a501d0a1409d43d127c365d2e14d4956c291c2e1115b33bacf5df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f1a1e10-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772808329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808329, "uuid": "2c1e0352-8deb-4c9f-8ba8-653e27f1232b", "comment": "Malware payload (Formbook)", "value": "ab4d1bafed32cf699755bb58537c5baf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808329, "uuid": "0baf3d5f-a626-4e6d-a333-07df2f86ce41", "comment": "Malware payload (Formbook)", "value": "179f5d450a755a78da421044688b0be6375f0baa76ed4e9006ae87d363a4daae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808329, "uuid": "9db37b72-b8f9-40ef-ae0e-e2542987fe5f", "comment": "Malware payload (Formbook)", "value": "2b987068f0450440e55b4c5fff4a5ebfa875fb0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808329, "uuid": "b4147107-76a2-4a45-8c0d-61aac710eeeb", "comment": "Malware payload (Formbook)", "value": "718122a31d6ff5fd7aa766e52d4db2cba5904c0cf3364d983a9afbccd7c9bea3453385ed86f20b8a744634fa3a45c899", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808329, "uuid": "ae4a70d0-a92f-45fb-9c75-df61460b33af", "value": "T1CA05A01DF5E260E1ED2184B20F5D97E18E1B731767A5189723B802040F974FB6FAEB26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808329, "uuid": "188d4e44-f009-4a59-b6c0-be5909377962", "value": "79b51b0b8fa06ebea3a256fd7f7ce2c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808329, "uuid": "7a6f09f0-09d6-4a59-9656-65cdaa4591f2", "value": "24576:Aayxliu5lNiq5bJcdw9IgvJQLACYOlXnfqlHcz19vZb:Aau5lpFYw9PQLABOdSVcz/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808329, "uuid": "69d4c806-373a-4688-a31d-40b308d5650a", "value": 862720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808329, "uuid": "c453fcce-af4e-4d84-b6c6-f342166f647c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808329, "uuid": "4bc6647e-62b1-4364-9a10-b6180b1e1878", "value": "179f5d450a755a78da421044688b0be6375f0baa76ed4e9006ae87d363a4daae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11b04cf0-196f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810025, "uuid": "409bca42-8953-45e1-8c0e-bba8f637059b", "comment": "Malware payload", "value": "c9bda1799a28542f811447f957f78277", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810025, "uuid": "e5bab509-1146-4bab-a256-02cc07713c68", "comment": "Malware payload", "value": "17ab03a6e6ed47d50135268b0b7d59492ac02809edd49ac96efb0faded3aaa47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810025, "uuid": "a729bb65-6d3e-4c79-9053-804ab7c6f589", "comment": "Malware payload", "value": "73eb8be059360e26813abff33add2dd0b88bff2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810025, "uuid": "e86fd153-acf7-4c76-9164-2bffbdc369d5", "comment": "Malware payload", "value": "b84c90a38eb8ce08e333935a99d5b5afbe66520bb10253d537e36ee760d66cda163c0d81974e89e994df571d129781cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810025, "uuid": "09af08c4-5147-4183-9665-c2109c900563", "value": "T166E4CF1513E88E68F9BE973944F4341487F5F8369722EB2E2A1840ED2DF6F41DA52723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810025, "uuid": "b10d1e89-87f3-480b-a04d-1d0709c76954", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810025, "uuid": "df1fdd3d-306a-497c-8d67-e417a00b72b6", "value": "12288:5hTSFUOgQiS6izzSd+h5abG4XHBvQOmh5kHN:fO9zSoyNXBQJo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810025, "uuid": "16c09ad1-410e-45db-82c7-a90d0a6a14f7", "value": 689152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810025, "uuid": "3716726c-1675-49fb-9a7e-eb8516f136ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810025, "uuid": "60c6f8d6-4036-4ee7-9cd2-a29e870392e9", "value": "17ab03a6e6ed47d50135268b0b7d59492ac02809edd49ac96efb0faded3aaa47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5b86354-1969-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807804, "uuid": "ddf71c2a-9755-429b-97d6-4bf91c226f41", "comment": "Malware payload", "value": "9defd8133adf6aa2826598cd949241a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807804, "uuid": "543416d4-4f69-4a59-9be8-8340cdf86ef2", "comment": "Malware payload", "value": "17be5e78667db09c03cd2ab82009f31ff0c9032d22a9b149a81e8cd555e1078d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807804, "uuid": "3b55f8e0-3a96-49cd-855d-0e71eaca3692", "comment": "Malware payload", "value": "2a7df62a4d88d376a9311b497256c51136d2fdcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807804, "uuid": "53c4926b-7256-41b2-a752-fd346fcce6b4", "comment": "Malware payload", "value": "bba69cf1bf6fcb7ca63776380852f67f0031df4f89f0a05557612c486fa240f2a16e317409ba9f0236714424593115c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807804, "uuid": "488c1eff-7100-4c15-bb11-2372dd53d3cf", "value": "T18B35121D7AA5DA57C22C0B7B8403601C61F7852BF9B6F2AA1ED90DF10F5ABD0C44DAC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807804, "uuid": "33228c12-f96a-4fe8-af60-48397fc85aec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807804, "uuid": "69fc18dc-c86b-4edf-bc0b-fe89e5f6e9a1", "value": "24576:H7cUNONasp2D+zWUkQnmjg2vF1ZaDvo24TmaQWrNgEc7:HIUsNFpG+iUkQqr3ZUf4TmaQWR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807804, "uuid": "2a13537d-1169-406a-9015-31db15cc9283", "value": 1121792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807804, "uuid": "5c08bed6-4fb6-49e5-8124-3efdf928c75c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807804, "uuid": "7140f636-6843-4386-af8a-5308c717b03e", "value": "17be5e78667db09c03cd2ab82009f31ff0c9032d22a9b149a81e8cd555e1078d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a45c9543-192d-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1772781924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781924, "uuid": "933166e7-9d1d-4bce-b0ff-1025da4c9b2b", "comment": "Malware payload (ConnectWise)", "value": "bd54f1818c5ec9ec7cc9bbad19d671ee", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781924, "uuid": "03e89c2d-2d40-481d-aeb8-55023c91d8a4", "comment": "Malware payload (ConnectWise)", "value": "17d3da1d20564a5dfbe7c59eb6b0d3ba992c7acea3e5ae8887e53cb3408525da", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781924, "uuid": "83fd35d9-c928-4dfb-bf20-5f399baf629c", "comment": "Malware payload (ConnectWise)", "value": "08cc4fb6ee487691345d76fe559c2aab5b674021", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781924, "uuid": "0151a513-e45d-411f-866e-636d32ba0878", "comment": "Malware payload (ConnectWise)", "value": "5565153ae053cb69413a077ac84774782b14b4bed7d76abf1b638d3128626fce31cf088c10517bb6f563e69d9fd814b7", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772781924, "uuid": "0c33776f-cec9-46e7-a603-a7fab1852f99", "value": "T16ED623116BF89678F0F26A35E876A0B1A53B7D115E23D12E2224791E2C75EC0C9B3773", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772781924, "uuid": "a86d78d4-d62f-4b17-a26d-9dcc5db864a7", "value": "196608:nHxcp9ym3nltDUJVtHxcp9ym3EHxcp9ym3VHxcp9ym3THxcp9ym3UHxcp9ym30Hz:RGplp2GpiGpHGp9GpyGpSGp8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772781924, "uuid": "1d713ad9-2128-4e73-9840-8ed8268b5cce", "value": 13504512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772781924, "uuid": "d1b4d9cc-8e7b-47bb-a6d6-bafe3596ca39", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772781924, "uuid": "b90cd3a9-29c4-4f7b-931a-3b6a91097a5b", "value": "ScreenConnect.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6e99015-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772809980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809980, "uuid": "f95095f8-62ca-4a2a-be33-6b436f925221", "comment": "Malware payload (Formbook)", "value": "f9b4b74fe930b25eb59c3c435f0e23ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809980, "uuid": "690a4738-29e4-408e-8ae6-4eeadad230e2", "comment": "Malware payload (Formbook)", "value": "183c39bdd27dab318f776a71b1650db0b7e16b66933cafe70318386d955f924e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809980, "uuid": "646f64db-67d4-4e09-add9-792dc2b96e05", "comment": "Malware payload (Formbook)", "value": "bb25494848534b158249129876a311ab87660e3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809980, "uuid": "ab3bf62c-c0fa-49f8-80c6-d3684e80acfa", "comment": "Malware payload (Formbook)", "value": "5481af9b050bc62ac948961da1e376d4bfbd83cf693c4ba18ec6effd33d22fc9e3c5b98289479cb90d17cfcd6718a0eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809980, "uuid": "e5224b84-0b2a-47e2-b8a0-fb47697a7ec5", "value": "T1BD35AE0273D1C062FFAB92334B5AF6115BBC7A260123A62F13981D79BD705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809980, "uuid": "ab0a345c-a991-414c-ace1-6673dd6bb569", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809980, "uuid": "a36d0cf9-f7c3-4330-bbc5-258a1d1996d6", "value": "24576:+5EmXFtKaL4/oFe5T9yyXYfP1ijXdaXlJ3q2ZVgIDzzygVE:+PVt/LZeJbInQRaXLJZ3Dzzyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809980, "uuid": "cbb359b7-f3e4-4b9c-87ba-610ed975f1cc", "value": 1154560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809980, "uuid": "1f8e5b91-a892-4daf-8ae5-ee66bbcc61a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809980, "uuid": "c5e29d04-d7e4-4daf-bae8-95c47fca4306", "value": "183c39bdd27dab318f776a71b1650db0b7e16b66933cafe70318386d955f924e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e02284a7-18f5-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772757973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772757973, "uuid": "fead1c54-2c51-41cb-a531-a7bf3240d190", "comment": "Malware payload (Vidar)", "value": "c64a7c2570ec12be8ddb0b862454d5b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772757973, "uuid": "1c64644c-d195-4142-87c9-f8de1b7865a4", "comment": "Malware payload (Vidar)", "value": "185464ac8a19e981984af6cbdc091cb10dc0766b896155f13d85b1cb4d597779", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772757973, "uuid": "8884d304-2d74-4496-a4a1-bd0122642af0", "comment": "Malware payload (Vidar)", "value": "411fe0922273ab1ba75e2e1febe9834141527168", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772757973, "uuid": "08267a42-1f80-4e64-ae17-294fd2a4e69e", "comment": "Malware payload (Vidar)", "value": "70d5dea9dc361a22c0e3bde339b06dbc76b2468733c0c5a21c3e30e0a22275ce5a53b6a489e35c916a85dfc62e85dec7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772757973, "uuid": "3e1b9f34-1c1f-4bf9-bea8-3aed4a7c1c8a", "value": "T101D607EB67714DE8C1DE813AC0A6BF05A4F370B90F3EC6E7839007685A595F44E7A624", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772757973, "uuid": "9320f047-0ca2-4b0f-a6d2-a31a978a83bb", "value": "b11456eacd71c49a08181553a6a92704", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772757973, "uuid": "4ee44772-4f1e-4388-8085-2232b8eced41", "value": "49152:ttD+DUHAh4UxrzPrjzAj0tr5nS+mBrAo6d/V0nPMnIrLEp/2pPLmwJSDH/A/VDUP:exGLEUp9VDFtXdOTA4l8ndyUUVdQIv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772757973, "uuid": "837639e1-52ec-40bd-b323-ea81d3a35344", "value": 13872128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772757973, "uuid": "9f27c703-f80e-476f-b89f-bae1f9484878", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772757973, "uuid": "7ee9cb7b-41d4-465d-b966-2bb339ec3bfb", "value": "SecuriteInfo.com.Win64.Evo-gen.69568323", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ae91e56-193e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772789022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789022, "uuid": "fdf985d6-49a6-4f19-be59-16fe056d28f4", "comment": "Malware payload (Mirai)", "value": "422d1ea33b6f37b38d3a513724ea3aa4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789022, "uuid": "05e4fc63-7c11-4538-b0ec-7b33fd35cd45", "comment": "Malware payload (Mirai)", "value": "18aac30f5064d6c1d154d2ab32000b32a0bbef2e29d1ff8e3fe723f7aeaf6164", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789022, "uuid": "8a587966-8054-4594-86f0-ea8c56276867", "comment": "Malware payload (Mirai)", "value": "7cd21ac10ddee6d2d83ca4390a28c31f0532c4e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789022, "uuid": "bdaa52c7-8e08-436a-b0fc-6a15b40400e8", "comment": "Malware payload (Mirai)", "value": "5303b776234429ac07120f4b104e088c171a4773c1cca6e6fcbf299c56d3aa37496ae55b8fe018aec666314d5796367c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789022, "uuid": "0c6ce53e-788d-4070-82ef-4d95ede8625d", "value": "T140736BD2AA43C0F1EC9605322177F7724AB7E23E1058DA42D36ADD76FD12602E26739D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789022, "uuid": "fddd678c-cf60-4afb-9b4c-40348c9d5b69", "value": "1536:E8L860RVGLkahA27Jl3JT4qfRiwyIbgc7/7rBtL5:d0RekyxJl3V4mkJa/HBtL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772789022, "uuid": "77f493ae-d868-4df3-80c6-49e9b18842e8", "value": 75312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772789022, "uuid": "c0eb0f28-677e-4119-9156-4df0779ed185", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789022, "uuid": "6286bdbb-be09-4064-b38e-69fa2918f643", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f334364b-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772809974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809974, "uuid": "33072f55-8914-4af5-83d6-0c5c60c3b1fd", "comment": "Malware payload (Formbook)", "value": "86a40567abe8518d052c14e78d0a67dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809974, "uuid": "e7053e48-9050-4d6e-bb03-eda9af9bbd7e", "comment": "Malware payload (Formbook)", "value": "18b0513b837a7541044b9d63826485bdd9e3440109fcb3727142cd5cf332d6d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809974, "uuid": "e5aa0116-c0a3-4a71-9bf5-4455f63c3f27", "comment": "Malware payload (Formbook)", "value": "c4065a2b6364ac13e51d2cfb916a1e7025a3ded0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809974, "uuid": "24f739c5-f938-42f7-8a8c-52a62e21db81", "comment": "Malware payload (Formbook)", "value": "1163a469c9ceaed960f9bb266192423e9dd199c9679f9516edb702e08c15dcb9e77e75dbb2219c9bf3e01b2fc308b705", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809974, "uuid": "b0469fdf-b5e4-4d58-9cda-11f17ab70ed0", "value": "T1C745CF0273D1D062FFAB91334B5AF6215BBC79260123AA1F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809974, "uuid": "ba0cfda6-9909-47b2-8708-59fc54fa1a17", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809974, "uuid": "a8923da2-cc3f-48f7-b81b-4d5987be9ba6", "value": "24576:65EmXFtKaL4/oFe5T9yyXYfP1ijXdal7BTbziON133B1fYo:6PVt/LZeJbInQRalZpn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809974, "uuid": "7708e5ac-5647-4c58-9acf-da0e52a85184", "value": 1257472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809974, "uuid": "57b6c5d0-3ff5-4383-82ae-855fceae531f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809974, "uuid": "dcf0bc6e-f549-44b4-b227-cb2f2e4d438d", "value": "18b0513b837a7541044b9d63826485bdd9e3440109fcb3727142cd5cf332d6d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "942521dc-1995-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772826565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826565, "uuid": "11923adb-7bec-4783-a903-e1788771167b", "comment": "Malware payload", "value": "615c3a8748fb23cf56e48ab3d504082c", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826565, "uuid": "0268136b-4f73-4b0e-9bed-3eade56d5cfd", "comment": "Malware payload", "value": "1905914f4343f1e6daed07eb74ccedc386798ad7f61e264014d3939c24e8a219", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826565, "uuid": "41337d99-bdb1-4895-8274-20da69b7da9b", "comment": "Malware payload", "value": "4c6d0fe1323e06dc5ac19d8a73f758e625dc3882", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826565, "uuid": "9586fca1-f28e-4910-85c0-e6ae5a2c5cd9", "comment": "Malware payload", "value": "160f02faa36f073dec0ed6567a1abf40e504632698cff609d05a6e2cf09dadb6a8977a4ca074952ecf8c6f2999bb658d", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772826565, "uuid": "ed47fb9b-1f4d-4cb6-aebf-cef7d67cf4cd", "value": "T1E0D4230389A1BCDFE5035F77B8A43111601A902D835CA1A7AAC6B5745CF71BBE3FB198", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772826565, "uuid": "438642f7-2d2b-4e78-b8f9-3b13d97c2e5d", "value": "12288:ZiAOaYozIthC3GhdxFFvvR8lmoL6K6ZmidSy2tSPgZG2:POaY0CJR8lffiwyceg7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772826565, "uuid": "d49af627-1197-49a0-be06-30525f1b5c10", "value": 628409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772826565, "uuid": "58bc5c83-82a6-4ad4-8638-fa5ea3b2a9ac", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772826565, "uuid": "3d49c4e0-dac2-4dd3-8a15-631f26b5b262", "value": "SecuriteInfo.com.Trojan.GenericKD.79633335.16998.31984", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e165649-196d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809348, "uuid": "d501a4ce-4bd7-4664-ac0b-686ea7e02fd9", "comment": "Malware payload", "value": "94ca032414219144fda6ff5d6c3ad68e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809348, "uuid": "7769f269-7ba9-42c8-8bd2-8c98433f9fca", "comment": "Malware payload", "value": "1907f5aabf118dd685f88db5564e4accc4c0934725909196d79704f2ffa0f192", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809348, "uuid": "a03e578e-ea69-49e5-b4be-200478a13697", "comment": "Malware payload", "value": "7498a43038b8d510a0026ea9dd04f5716fa0bbc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809348, "uuid": "be153410-2d52-41bd-a40b-cbdb59675d47", "comment": "Malware payload", "value": "68fa847c234bfab419da81c8fc548b5c7a43bb6b24e498c4f1051385cedfd4e62777e85b30d6168128cbed6bfb81d8a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809348, "uuid": "c6288164-5e57-4416-8d13-6424ac7245e5", "value": "T12B2512281118DE03C4AB1BB85AA1F37853B80FDDB592D2578FD8FDD7742A7A414893CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809348, "uuid": "16aee09b-95d2-4480-b15b-7619526d73aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809348, "uuid": "1ca2de03-e060-4deb-a318-6f7adf97d603", "value": "24576:9Eni/4sYoQPvHuUAPz8BgM5ciOhPGuyyn1jffgCNsJgW5Jg9rSz:9Eni/sPnuUkz4ONIy1jgCuJgW5mZSz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809348, "uuid": "6623412b-4df6-4b93-b166-6b64dc24ab65", "value": 1006080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809348, "uuid": "97ce1407-7010-4b4a-8fd2-9eb91eb71534", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809348, "uuid": "988710c5-7f3e-4f6e-90fc-27123b04964e", "value": "1907f5aabf118dd685f88db5564e4accc4c0934725909196d79704f2ffa0f192", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b928b201-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1772809447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809447, "uuid": "46a92cea-8f02-4ee3-91f1-90a85ce6735e", "comment": "Malware payload (GuLoader)", "value": "0fb22642c0c3cb88ec40a1f387d35b4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809447, "uuid": "16be27da-71e1-4643-a798-78a01980fba2", "comment": "Malware payload (GuLoader)", "value": "195bc09ff1b365c0dd470aeaa1bc86f989c09e424fffbdfdeb0bcb2331385b28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809447, "uuid": "612d6971-29bc-42de-a613-f3867c652946", "comment": "Malware payload (GuLoader)", "value": "2d8b55e21c75731dbf5269976e915b041674eb66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809447, "uuid": "c85f9ea4-2c01-407a-a0a1-d0c520de08cd", "comment": "Malware payload (GuLoader)", "value": "bda23f23de033aa46e5be342a0ce3f4591cd641edc185993dfb90faa5e50a269bbfe683ace6b7d3fe862465f6f883169", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809447, "uuid": "f9961c63-e901-4e69-a58a-754849685c05", "value": "T135C4BFA0F611D9EBD5A709BA8CBBC4302167AD1E86D1111F32ADB62825B335211DFF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809447, "uuid": "364eb8d3-547e-4c6a-8e57-7c9acc0b3f62", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809447, "uuid": "bd708c9e-d9e4-4553-be0d-9dbebeed2e41", "value": "6144:/wq3NpQ3wDIywUF5ykHERIe6MyhdVgWfMnfYyumOk6mgcbpiOgizVaSuQ2/z/fw:/zcae65hmnumOkrDpupQ2bo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809447, "uuid": "e7e6e323-b78a-40c6-981e-79ace7a19d0f", "value": 582112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809447, "uuid": "44407f0b-bc75-4fdd-9a99-984d6bad2738", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809447, "uuid": "a323590a-9c6b-4890-9b9e-d647c0be5e45", "value": "195bc09ff1b365c0dd470aeaa1bc86f989c09e424fffbdfdeb0bcb2331385b28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ab7817e-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808752, "uuid": "2559a287-10ef-431d-a7da-461bdd509d4e", "comment": "Malware payload (GCleaner)", "value": "d676a1f481c90239477df8ef3fc2c1ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808752, "uuid": "d7090043-3dfd-435a-80c4-5accf51be1a9", "comment": "Malware payload (GCleaner)", "value": "19ad39d7fed91d68dbf10682baf88efa757d13d490b621e6f50b4a08c0291ab1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808752, "uuid": "3d499bdf-3fd5-45aa-b6f2-2e204062002b", "comment": "Malware payload (GCleaner)", "value": "9407b2471d27a5c3ce0c5c1b364e4055bbe9c720", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808752, "uuid": "5f1df92d-4261-4294-a313-861feeeb1a86", "comment": "Malware payload (GCleaner)", "value": "eceb2bf6e2b58c5df7705704ab7842842cc9b1220bf585d86e0c39e41b100e515dfb963d11030ef9985f99b41f18357c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808752, "uuid": "4ddd934c-0cd4-499a-ad0a-b7985573e8a3", "value": "T14306E0950FA5CA3EF41F0DF584574769603225EF0D27CAA31EA82498C9ED2D867F348E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808752, "uuid": "f4b53b46-2162-4ff7-bc3b-d073377b4411", "value": "234372fce9eaa047bc4c39047910954c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808752, "uuid": "e8fe7a65-466b-46b3-8d2c-828c7d680008", "value": "49152:yGQJMWwJGp9Y2euxLjg6t2SufjY+XwsfvIpF8Ot3+FtmHThshZ9LqQv59wija5:yBJMD8P2udU6x6jYB8+7MtmzaZseOij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808752, "uuid": "dd1a9fb2-7273-469a-ae24-fbd982cde0d5", "value": 3815936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808752, "uuid": "a022e1c2-b050-4416-b285-ebb25390048c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808752, "uuid": "6b72a6b2-be9a-432b-8f25-a0dcf5fedc09", "value": "19ad39d7fed91d68dbf10682baf88efa757d13d490b621e6f50b4a08c0291ab1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1ba20e2-199f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772831017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772831017, "uuid": "089e4da5-1c35-43bd-81e8-0a8cec0c2033", "comment": "Malware payload (Mirai)", "value": "f7e7436bd9112599b1d2e21266b188d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772831017, "uuid": "95f9d6db-6b05-4671-9d20-6b4e8aefb702", "comment": "Malware payload (Mirai)", "value": "19d872e13e242f6d0ac4a41916dc1138efdad28a2ce4f51c15fe1ca0c362cb62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772831017, "uuid": "6f2b05b3-f469-413b-92ca-30dad2543a8c", "comment": "Malware payload (Mirai)", "value": "8372aa0004c1028fcc20aecb29dedf823eab5fbc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772831017, "uuid": "464d9e32-4400-4f41-80f6-5ec89742351a", "comment": "Malware payload (Mirai)", "value": "89a4a89e4162e65a2549d0a939fba32fc5de85da3107fd18d6440b73fbd007b010cce70340b45c6f1471ffbfa87fef3a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772831017, "uuid": "64c577f4-382a-4983-8b3d-c72eae3d1392", "value": "T1E2B30877A4604FB6C041A5F125BA9D310F12AD931F5F1A94723CBAB04A3B5CEB84EF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772831017, "uuid": "ced13a0a-2785-4740-a980-f7302f6ab19f", "value": "3072:N8osRyHt6h0XhCENFbPrLxT3FPmH1cuOvvni2N/:N8ocyHt6KrPrLxTxmH1cuOvvni2N/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772831017, "uuid": "a37a1cad-a269-4498-9fa5-f1bd09e48a44", "value": 112751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772831017, "uuid": "e1767678-a33c-4b2c-a45c-706fdfee71f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772831017, "uuid": "008f6a4e-1ed0-4bcb-82cc-c608e571354a", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "091dc04d-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808722, "uuid": "588cbb2a-e4de-43bd-ace1-70c33b6563f3", "comment": "Malware payload (GCleaner)", "value": "3801804e3dfb99e23769c62685ee01cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808722, "uuid": "8d8c1804-d4f2-4b45-bb88-5356839f5d3d", "comment": "Malware payload (GCleaner)", "value": "1a07aae4ef7c8505392aeac8266dae98eed45c6c1023350b8050c9a0eebd387c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808722, "uuid": "ab45e698-6896-4a08-9836-bb5e7eb56479", "comment": "Malware payload (GCleaner)", "value": "9cfd798656bbe2a2514428a7e9de0be6dfa49040", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808722, "uuid": "3d179c45-be5d-4f55-89a3-9f8f8de7c4d8", "comment": "Malware payload (GCleaner)", "value": "a7dc06abe4a1f642081166d4e1eac243dfa5088c5bad5c7349b263e5555eefd46d0e49c5644201e59e96917a93c1e118", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808722, "uuid": "f43b027b-9a2d-418f-99ae-b4f3e59d4e2f", "value": "T19206DFFBA0BA4172E0899D3CA9E99D7FEC35EA301E2CA814DA9C194D7D64F11D0D016F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808722, "uuid": "96831ff9-9cce-4223-b0d9-203f4649246e", "value": "099b2b7fa2a0044e2ca25418be2f8a70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808722, "uuid": "fc0f2579-425e-43e5-b85c-9032cf10ceec", "value": "98304:ZtemcBn5wkKQlr5jdeozv9vnZhDMdMLQ8BCyz2Bh:ZHYxzDhzv9vJQry", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808722, "uuid": "98eee019-59b1-4fe8-a128-25f926f816ad", "value": 3982336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808722, "uuid": "3ae396ea-28b2-4cf5-a3d4-3877dbd79e53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808722, "uuid": "e7105343-03a1-41ea-9007-68a41488571c", "value": "1a07aae4ef7c8505392aeac8266dae98eed45c6c1023350b8050c9a0eebd387c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c46246c-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1772809801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809801, "uuid": "061b1943-a503-4dca-bb3e-e0bcf0026611", "comment": "Malware payload (SnakeKeylogger)", "value": "0b199d912cbbd4f44ec668ea8d121a70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809801, "uuid": "8994a832-3741-4a16-93b9-452d47231da6", "comment": "Malware payload (SnakeKeylogger)", "value": "1a4c5aa8c94861065bfafc94bd7650110e13b362aae14630971e96ab9914c187", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809801, "uuid": "39e08b7d-67c8-4c03-b937-d3e0f62621b5", "comment": "Malware payload (SnakeKeylogger)", "value": "4b08ace307a2ae4418f0de83a6944392a5e84669", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809801, "uuid": "8c96c40d-dc50-4157-8b00-1e00c1bffd6a", "comment": "Malware payload (SnakeKeylogger)", "value": "b96135b34b6a8c8e754d3d9b8db30a41b141deaf5c3035ed20245c279155df1299bced7f5b57e4eddb58858c1d093c37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809801, "uuid": "60585a9b-1012-49a6-a2cc-88ab8a2e72cc", "value": "T10D35AE027381C066FFAB92734F5AF6115BBC79260123A62F13981D7ABD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809801, "uuid": "cd991112-2799-40c3-b9b8-266786c2916b", "value": "c1ce208b1192bfcf652c179f34f034d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809801, "uuid": "3f14ac52-b9cc-42da-9f59-cdd2956f6227", "value": "24576:J5EmXFtKaL4/oFe5T9yyXYfP1MAXDz0mQ2+EZe:JPVt/LZeJbInGiz0mZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809801, "uuid": "94e6e09b-0189-4d1f-92f5-b37ebe852845", "value": 1104384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809801, "uuid": "d3be6e56-e7a4-42f8-b7e1-f7e3a7d84d6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809801, "uuid": "6c29a138-d4e5-41be-9a13-f5892af97c44", "value": "8c7214863d5cb9c77ec74b55c27062828cee382fb207a1aac8c6ec1f95808f4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29f1a632-1971-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810925, "uuid": "20f648da-cbb3-4018-bfdd-3bdaeb7ed27a", "comment": "Malware payload (GCleaner)", "value": "4a826ff61f26ef1c3c354833d1add48c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810925, "uuid": "aad29ad2-9549-462b-89fd-dee56b8979a8", "comment": "Malware payload (GCleaner)", "value": "1a5d385dfe06a4ea35d5516db579e7ae609eb5c3f67acac079e41537481a0531", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810925, "uuid": "24acd620-4aa7-4c16-885a-bf577618c9d9", "comment": "Malware payload (GCleaner)", "value": "c05427a0aa4f6df72f5918d8b5de6c39bc286fcd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810925, "uuid": "5d09eac8-76a6-4039-a872-a7d58ab05a55", "comment": "Malware payload (GCleaner)", "value": "81a049818cabfaad76d5358a9ba708980012cf2e4be0f5e719bf6ae02fb12dd147e84781e14a01ea9daa5336d956fc3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810925, "uuid": "67718047-6fd2-4d5a-96fa-01e0a5a14687", "value": "T1D0F49E21F2B08537D0327D39DD5B62949835BDC029E968463AE8DFCFBF297813425A87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810925, "uuid": "760b482f-4de2-423d-993d-2887e6be988c", "value": "ce7a1d07b14b49824555865592c3af45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810925, "uuid": "7f990210-5532-489a-b73d-0d57ba5dd2b1", "value": "12288:UkAJdZJGY+5K/Lo9r7WTB+rPc9jNQrGhkfwpKxvpa/fy:OXZJeK0Z0rTQySf8KK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810925, "uuid": "cd5143e4-7110-4565-86b8-edd2fcdf3b98", "value": 790528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810925, "uuid": "a8824d7b-d0ed-4caa-b42d-6de7ca379ecd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810925, "uuid": "41ae6bea-c3ff-48e5-af2a-c5bfd2af26f4", "value": "1a5d385dfe06a4ea35d5516db579e7ae609eb5c3f67acac079e41537481a0531", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afa24a1e-1985-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819739, "uuid": "e8dd76f5-38e8-4083-9cea-91d503ab7d8d", "comment": "Malware payload (Mirai)", "value": "0cf1db2ce8aa7caab50f3cdf256fbdd9", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819739, "uuid": "14758907-b754-4160-ad5b-d541c32949c1", "comment": "Malware payload (Mirai)", "value": "1aa2df01d4a6d619f2f42eb0adfc2b158ccb58bd4d8b96d2a629afee8ceec75e", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819739, "uuid": "af958bfb-c871-4cec-982e-4ad1e5ba1c4f", "comment": "Malware payload (Mirai)", "value": "65b5253ac30436ee695dff096dbee89e4a210b0f", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819739, "uuid": "4e94971a-37c9-41a5-a38f-bd8eb7975ad8", "comment": "Malware payload (Mirai)", "value": "686cda0fc2908515ee70cdd5af1b12c2fb62e72454fef543a9961f301351baa726b8f15ba941a747fdda5820eee23fc2", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819739, "uuid": "7691db59-6122-45d5-b7f6-fb7dbcacde92", "value": "T188A67B01FECB55FAEA430D3148ABA23F23315C018B69DF97EB447B28F97B5950836199", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819739, "uuid": "70b43a8a-b417-40dc-b8dc-6e28da32bcc7", "value": "98304:sANQOhK+mOuylkdqmIkfErDs+MxPGR6qTjMFx4dkGi2Uz:sRs3IqbrDOx+r/rdn+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819739, "uuid": "34ab1877-ba52-4ba7-b3b0-ebd61e329fa4", "value": 9494848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819739, "uuid": "3f1753e2-8bd2-40b9-8cea-1b1325d9cde4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819739, "uuid": "6d02e4cb-b5ff-4910-b4a9-21c9a194b9b0", "value": "bot_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "891f54b9-1956-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772799488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772799488, "uuid": "cdd05ac7-3cbd-4e58-8fe8-5e69c8cb3229", "comment": "Malware payload", "value": "d1b423712051d5687b073ff367e67c70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772799488, "uuid": "3d3302af-ba2f-413d-909d-319d76b5904d", "comment": "Malware payload", "value": "1ab39bc014f6b6124fbd72d6f6390af9dbb0b67b50112e911c508b81318a3c8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772799488, "uuid": "6307e2f1-a51d-4dd2-ac2b-bbdae41a8192", "comment": "Malware payload", "value": "07f251eee4b7c62d7c6d6ce313b4d8e71f46f231", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772799488, "uuid": "799f329c-d8c6-40b2-8ddc-2b9431046f71", "comment": "Malware payload", "value": "f281017ffec3770a991e9eec1c049a7fc7d5554676375017ad0b5a177a069c7185ddcc12c14b7769d3fecedae78e9a95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772799488, "uuid": "a767a366-4089-4a25-ae50-c8051011d631", "value": "T126B47BC0BD4260BBC4965C350524A77B7EB80F615329DCEFC11728E0E6B5EBB9272927", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772799488, "uuid": "6d87f033-20d5-43d4-b992-4a1bbe196a46", "value": "6313a99fffecb8759e5b2f8e8aff2a59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772799488, "uuid": "b26f3f55-b2f1-4d55-8fb8-ed766271faba", "value": "12288:GLmv6J3O1b3pwFRNkdgUkFnl3jURuRe5n4GZ91Rd6qIXzsQAXnuoMC0Y:Qmv66b32F7wQr7e5BnT6qkzsxMz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772799488, "uuid": "3dfe9788-4cfd-4890-9e5f-14f0106f2c8c", "value": 513024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772799488, "uuid": "2b87d183-9b9f-4069-9f2a-15e1452dffd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772799488, "uuid": "5b8ca949-a614-4e18-9c37-753bb3916a67", "value": "1ab39bc014f6b6124fbd72d6f6390af9dbb0b67b50112e911c508b81318a3c8d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15d4d109-196a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807884, "uuid": "3b782e02-9405-478b-8ac3-4336e1871081", "comment": "Malware payload", "value": "301403997d498247474ccb2f23082d26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807884, "uuid": "a6326248-0572-4edc-9a74-a6f5a3478f70", "comment": "Malware payload", "value": "1ac633410501eedd299e77f6f42aa8a3bbe78d470ed7487e1fb446e954359923", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807884, "uuid": "509f862e-8ac7-4fb8-8d8f-0df24fcc7031", "comment": "Malware payload", "value": "cf76975d9ebf88066fde2668e793eaa6f340b415", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807884, "uuid": "a8151fb9-eaa4-43a4-9b03-8b309c46731e", "comment": "Malware payload", "value": "37d5dcce7dfd29e2d5126fa52fc1dcf4af34b19cedc44ba08007ef7215ddd57151e26ea488983682bd82705a4aaba23d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807884, "uuid": "3597833a-efa3-42a1-a048-cd2673e0bf2f", "value": "T1C6351220529CCD26C8DA1BF92475D33463B2CD6EA422D396CEDE7CE778AA3D14D44263", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807884, "uuid": "e446561f-6bb2-4fdf-bf77-b7816b006cbb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807884, "uuid": "d41254b7-69a9-433a-842a-2d66a76b06d4", "value": "24576:VzHYguQvjcVGKHZVAURdnoHTOcQyx0XlQ7/zzN0CQd/ZeYVictuw:VzH9u3PHLAURdWvz40za7NZeYQc7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807884, "uuid": "4b723ac0-6ac9-4ece-baea-5c49baff3ff5", "value": 1100800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807884, "uuid": "32706db0-0650-45d1-b8a7-6e7942bdb462", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807884, "uuid": "eeee7448-9fa5-4eba-b832-1702e0c15a74", "value": "1ac633410501eedd299e77f6f42aa8a3bbe78d470ed7487e1fb446e954359923", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2613cd20-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808771, "uuid": "24da8efb-39dd-4d25-86ce-c246323f8bad", "comment": "Malware payload (GCleaner)", "value": "72adf6876abec6b043b36e19bbdb7e66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808771, "uuid": "377b6caa-2a17-42a3-8b66-26d28536968b", "comment": "Malware payload (GCleaner)", "value": "1ad43241e56f0a1d43316268a35f05b0c6d76d06817f06d3d3d49c4516f7f7fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808771, "uuid": "6c022afd-df2b-407f-872f-93889d6e42cd", "comment": "Malware payload (GCleaner)", "value": "e0a549e9d514ddeed74dc2ff92e6eeb927226024", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808771, "uuid": "44f1803a-b3ac-4a68-be4b-39e76723a43c", "comment": "Malware payload (GCleaner)", "value": "2ca6582e1d0c152086420dfb6597d8dcd5d31ecf7cfaa0f1361e56b1fbac3f4d073854f1abae73ef1aacd80ce06b2df4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808771, "uuid": "7aab54b3-132a-4a54-8b43-ccfe5d8f9807", "value": "T16A16E0F5C7D73772C5E6117849FD61F0283BA9E260A189C52A98AFDA820F6C7134DCE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808771, "uuid": "a562e6fc-e1d4-431d-bd98-cc9e3f8d943d", "value": "099b2b7fa2a0044e2ca25418be2f8a70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808771, "uuid": "16e7f2be-4a10-4ffe-9f69-874edea7a6cf", "value": "49152:Kto5haSDuQPEKU3U5DZSvRfGc7wJheKAURL9xMaU6Bhk9s7/vqgF:KteBDDPEfk5DKfvKAqL9xJhUszq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808771, "uuid": "4e831ff1-87f6-4ccb-975f-249a8cd511ec", "value": 4345856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808771, "uuid": "cd4dd5f8-b1fb-44a1-a4d0-4a79a1d2ba9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808771, "uuid": "532c60fc-6e16-4854-a755-124b9a007162", "value": "1ad43241e56f0a1d43316268a35f05b0c6d76d06817f06d3d3d49c4516f7f7fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d7686b4-196a-11f1-a769-42010a9c0008", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1772808005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808005, "uuid": "1c1f79b3-4203-4aa8-9d4b-618bafdb7881", "comment": "Malware payload (ScarfaceStealer)", "value": "763a0e62154d09fd8d3c9e7a71ac7f03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808005, "uuid": "45786543-4920-488a-8b6b-9b50233fb7c2", "comment": "Malware payload (ScarfaceStealer)", "value": "1b274a393634e2aaf1ab3d2d96e232b292ba74539420c74769fa2ad3ab9eafc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808005, "uuid": "1cc58b36-0a47-47e7-86b3-1a680a53af59", "comment": "Malware payload (ScarfaceStealer)", "value": "7ed8d121dbe676dd89c6a83d609cd988929b634e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808005, "uuid": "b72e412c-42dd-4611-9450-1d6af89af9f9", "comment": "Malware payload (ScarfaceStealer)", "value": "2994936539e8d91f3ade9cc15e70bd49e98fb10a92bc0bd0ce157f32dfdca4c8691e0e9fe16537f15b41455563434c0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808005, "uuid": "ba472d6f-ad16-4886-8173-846e00ae2d9f", "value": "T140E623EA949913F4C8D30A80764E13CE31D1A59E46ED6C2C7ADB1C41AF26DEF550EE23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808005, "uuid": "72eed150-b67d-480a-8def-d1bd9b026129", "value": "8739de86cd836ae1476705562c069cc0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808005, "uuid": "a6f1a4cc-1e91-41b4-99ed-73c356f0abcc", "value": "196608:6pncU/ZoVG6A5xdQKqF9m9mmCLh8CDjD3bGKgBl89GcRM95y2QJuhEXqkw:5uEG6AvOzFl58wDrGxy4/jy2mX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808005, "uuid": "26be76b3-04e1-4397-ab27-1812f9a41dc7", "value": 13877248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808005, "uuid": "b77a2c33-8cbe-41e5-a3c7-c28d33ce99aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808005, "uuid": "02c76986-b60c-499b-8ca3-cb5e211d3cc3", "value": "1b274a393634e2aaf1ab3d2d96e232b292ba74539420c74769fa2ad3ab9eafc9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32911ca6-1971-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkCloud)", "timestamp": 1772810939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810939, "uuid": "2deb8eab-4583-4e1b-872f-385fbc4844ba", "comment": "Malware payload (DarkCloud)", "value": "817bcef39bd9b16ee7005ab82f5d43d9", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810939, "uuid": "3c5450d2-b408-45cd-8a09-d4a1645f6f77", "comment": "Malware payload (DarkCloud)", "value": "1b820d25eb575ddb78cf2c0dba54ea33b000d106f1d10760047e2ff760cf0b07", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810939, "uuid": "6b0b6597-3fe1-4efe-9929-a715f9a3afe0", "comment": "Malware payload (DarkCloud)", "value": "8ce97e68a317a9a3152f49a3a91fb7561c3886da", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810939, "uuid": "c6fac9e7-2842-46c2-b3ef-26ca3c5aef5e", "comment": "Malware payload (DarkCloud)", "value": "c61372e5b1f0ceda71c51a3be245913a1884cb55cb420eafd20f26cf27fd13f2f829ff1df22ddf5807eb3d879b637ee5", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810939, "uuid": "29d7c41e-6a42-4073-acad-c78ac5efd38e", "value": "T1BD05234BB8D19961C2817730C436CC654A797931AD40676E837EE5EBBCB0383DA63A0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810939, "uuid": "596e2ff4-aaac-4674-8391-4f2873e8835c", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810939, "uuid": "7d32254b-36db-461b-aada-3d834c155f2d", "value": "12288:2z7hU5I5yuNHIgzSFKxWltRohBfSTso93ULYDEzDzkr0ybaMjgeZcLvxTFzsw04V:2f+iN57Gtene39Ez/knbkdLv3zi4Bf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810939, "uuid": "09b75edd-29f7-4ec1-a972-3bf4c50a7849", "value": 802816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810939, "uuid": "b10daccf-fafa-48e7-a465-9dfa2936a860", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810939, "uuid": "1dd7a427-5e26-4687-a71f-a8975fd1aa83", "value": "1b820d25eb575ddb78cf2c0dba54ea33b000d106f1d10760047e2ff760cf0b07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f53fddb8-197a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772815131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815131, "uuid": "383dc710-2114-4d8e-ad48-e784d02d4550", "comment": "Malware payload (Mirai)", "value": "9af3b8bbc46cd72743ee499ef20e348b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815131, "uuid": "1ddeb8fb-71ae-40b9-8c53-35424be9b9df", "comment": "Malware payload (Mirai)", "value": "1bcea661a5636b818c2eb6a8ab8fe85a0cf449f85d850b1019695abad595c390", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815131, "uuid": "c9eca89d-0b07-49bc-b547-5421f33198a6", "comment": "Malware payload (Mirai)", "value": "1cd98f3c16270abe3d7b16baee42133bfd1a6e99", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815131, "uuid": "898e2382-1c14-40c4-930c-9055d1e5cf92", "comment": "Malware payload (Mirai)", "value": "319436fdf09bbeb6d65f71cb879fb7fa591cf77f614ecaad92e917e0090e4834c82fbad95d9f861a82ad85a508a94408", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815131, "uuid": "466b71e9-5795-46b8-aaed-0e731ac2d19f", "value": "T122332912997C1A2BC4D4A77710A38363F2F62B954194EA4FBD710D4FEE983501ABB6F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815131, "uuid": "60c11d7a-35f0-440f-b040-a0f7334b6487", "value": "1536:4b34LHJRwGYtJLx1TBH4EmgSXUwdyq2NS:4LaQqUy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772815131, "uuid": "a8f8b7b1-73fc-41be-99f9-86bd2184a145", "value": 53812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772815131, "uuid": "4c0cac35-4bdf-4338-93b7-637d219f293f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815131, "uuid": "afb58d69-aa07-4ea7-8032-0a1c8e1dfbcb", "value": "titanjr.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff85d4ff-193d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772788949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788949, "uuid": "8d4f5471-f984-4cda-a001-54baf238f487", "comment": "Malware payload (Mirai)", "value": "3de12a4ae378a138edc32557d004f1c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788949, "uuid": "cb574d59-3906-440e-a49c-494e9e6cf02b", "comment": "Malware payload (Mirai)", "value": "1c0d10315f2c1577a89c29f948fbc77b020283cbc7701758cd5acb662a5bc4e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788949, "uuid": "c51c1ca0-13ee-4920-8383-03399ea75535", "comment": "Malware payload (Mirai)", "value": "d322599a8a1dd5e58be5d2230837d756b203705e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788949, "uuid": "a104334b-ff51-444a-8ce4-6d78573719f7", "comment": "Malware payload (Mirai)", "value": "8b229edb82383fc1f056b383f380a14bb340b1b4b8203c03208368e49abafb856d125c8ee25ff7f9ac7982eea2329c06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788949, "uuid": "5546b281-2551-4d35-9863-0d43674322b8", "value": "T141739D63C8362D68D14841F071B08F395763A92285871EF758AACA79D087EFDF2163F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788949, "uuid": "83ea2d56-f2b0-491e-ba2c-01211a5e58d9", "value": "1536:4t49SA5nI7L4KOL4d+eGU8C+AI6I9oKA:4tSjnIP/OleGU82I9I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772788949, "uuid": "a4741351-4fb4-4377-9449-a65171c7d852", "value": 75528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772788949, "uuid": "60a9acba-ae86-489e-8a5c-837ea0a97dff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788949, "uuid": "3deffa30-f4b4-4274-ad2a-b8bf2c4845bd", "value": "morte.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21d87fc8-1954-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772798456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798456, "uuid": "34ad131d-7470-42ad-aad2-b965e7fdf223", "comment": "Malware payload", "value": "411a3840b936261298a9907a3f4d42e5", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798456, "uuid": "c036ee21-a60d-4c80-9bcf-bf6bb109e3fd", "comment": "Malware payload", "value": "1c63dd5c645b215c7dc0e0e4ef509e9394da2669564f79eb4caae43ad59fe0d6", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798456, "uuid": "c662e0d7-e375-460c-b507-ff8014af308e", "comment": "Malware payload", "value": "a7235131432fd890072a0ab88e25333394630020", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798456, "uuid": "585306cf-2f3b-4b9a-a7b6-422933da250c", "comment": "Malware payload", "value": "3aa2d03077abe224833ff63213ec7f6e369e1581a81c0d0f42c86b1782499613c1e178b3d7a9a2e3858ae43307c6e8d3", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798456, "uuid": "a797c06d-4390-4caa-bfe1-49289dbca7ba", "value": "T1519423EA118DC0BCC9A925BA452234AD762E215CFF67DF220D2AFE7F158884C36547C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798456, "uuid": "a8faaca8-4e8d-49d9-9af0-3f4a6169b37f", "value": "6702f1bd13a4e9743588bf4e6892ab6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798456, "uuid": "c8f8900b-dc13-4564-badd-495c08207061", "value": "6144:0TzDNAjPol0E0Y4NiCVaU06dNsOz4zaQwOo62NoNgVzJ7BRHJCP/2a9TYrJCfA/H:szK0leo+SO99X6EoNgr7BRHJma/UnNA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772798456, "uuid": "c5121fef-f188-4c65-826b-789cc68a3fe9", "value": 443904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772798456, "uuid": "eb728caf-41a6-48cf-ad83-74df532428bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798456, "uuid": "8bcc9add-beea-4f4c-b54e-ecdaa2316d64", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20532a11-196d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809190, "uuid": "7ba32d1a-690a-4e54-8bd7-d0f99be50e48", "comment": "Malware payload", "value": "37687c1ec7df8b465b1b0f7c73257336", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809190, "uuid": "d11de9c4-6fb0-415a-b387-3c4d64ee9391", "comment": "Malware payload", "value": "1cd85d2a12b11b71598543c00607e74e3a48c66d2508dfd0676e42d204c39e8b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809190, "uuid": "3ee64fb3-fe5e-491e-97ea-85a963522f87", "comment": "Malware payload", "value": "2137b496ca5b09af12232be9465158ca1e6536aa", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809190, "uuid": "b776ecb8-8d47-4ff2-9a71-f2c142695b82", "comment": "Malware payload", "value": "bb1b83f16aac32772c07344122a827d4dbc304d2e95e63848621ff1ab4c32051c6d349d70b89046d4dab0045cc4b4a1e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809190, "uuid": "7fdeed6b-0468-488c-b80a-76db82ec12a2", "value": "T1D5068C93A693E9E9C31BCCF9C551673EA7D3BC29231DB2530A69F34DAA33D246604704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809190, "uuid": "9b722684-dedb-495c-b915-2b6facb0dce0", "value": "c05eafbf2c8c8448f56fb1998451e045", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809190, "uuid": "6d3b913e-8694-4032-a385-510cc6f1f7bf", "value": "49152:HoJesTo/llvt+4hzsifepH7ZBkwIO/yXgoGIAb9VFd5gI1hJYOfCo:9lVoWztmpH7ZBkwIoyTGIIb5LnJYOfC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809190, "uuid": "06892311-831c-4f6e-8698-dc4b0eef88e1", "value": 3850240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809190, "uuid": "651b3661-0ea0-4754-a11c-b29bd9f7b234", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809190, "uuid": "ce83b527-51f0-4c4c-9cfc-67f4dd030b98", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72cb4255-1924-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772777976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772777976, "uuid": "3eb6e0b2-0237-4754-88cb-007f73874deb", "comment": "Malware payload", "value": "b595afb8ab2c4ab2ee7dc4bf1b256002", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772777976, "uuid": "0b8662d4-b6d4-417e-bb06-1cd3e72ce386", "comment": "Malware payload", "value": "1d501c439b40ffcf1239a6d575b04ce0fc5dea2bf399f01b9957293ba4293e18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772777976, "uuid": "9f2f64c9-59bf-4fb2-9af7-590f011a48bd", "comment": "Malware payload", "value": "9eca05f1200c3e97cc6a18a49feafcebcd8777f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772777976, "uuid": "2a822a82-7ceb-4a56-bab5-d72a14e54dd4", "comment": "Malware payload", "value": "b284ae9b3a0ccf54e9e86e817522ca898148ab27c6242ec865da2581a186a2b73f6224364669a8b4b74178d4c7c77ffe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772777976, "uuid": "a48969ad-327e-4346-98a1-cd5a7b082e29", "value": "T13644C6077B919EB7C89BCD3306FA860110CEE45726A56B2B7774DA1CBA0B90F49D3C94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772777976, "uuid": "5fb5ae6d-56f2-44a5-b491-75f940b0e2f7", "value": "6144:n/dXObJcq26/6dFOzvXaLXJmAOWGhoYSf3U6LwIMr:nFCJL6dxJmAOWGhoYSf3U6LwIMr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772777976, "uuid": "b5855684-c2a1-4b32-ae1d-3ed4d90ba1d4", "value": 260802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772777976, "uuid": "2c61ac24-a9db-4b88-8fa1-52be43ca98e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772777976, "uuid": "aa30db60-2651-4ad2-9cd6-3adfe47f7c06", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "279d612f-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772808344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808344, "uuid": "df1d5711-abea-4215-b52a-73b907da5e19", "comment": "Malware payload (Formbook)", "value": "56a87ba94df8d4b8fcd952d9dced2aff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808344, "uuid": "8cbacfef-3b8e-4161-88c5-4eea83c7413d", "comment": "Malware payload (Formbook)", "value": "1d940966ac64ef594b93203b056ec7b8554c0f6ec93f03cf48bd63a3eb1f3a49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808344, "uuid": "11623c63-4b7c-48d6-a0e7-b9aaace4b444", "comment": "Malware payload (Formbook)", "value": "2808ea8406e7a40da6b9328a54880797240d513a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808344, "uuid": "ccb93c18-afce-41fb-a2bc-be99b75bb0fe", "comment": "Malware payload (Formbook)", "value": "ab2385447f946eb13f58cf9329e2715552e842ac19cecf55e1670b7453f46e8fd5ac7ddc55a4e41ee767bae94d1c44ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808344, "uuid": "61a7427f-8e60-48e9-be84-8be120723036", "value": "T1C7350221739FCE22C2945B7B80D2D67413B4CE49A413D26B6EDD6DDB3A66BD70A80343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808344, "uuid": "fa825ffd-f44b-4a03-9e45-d00e8e1f9b13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808344, "uuid": "2700cd18-0a7b-487c-94c1-5c58c201b69d", "value": "24576:Sn4yFdYSIHlJFA4QIQY59081mafaZ8PzgguQlVict:kVdYPQIR59081m8cOuWQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808344, "uuid": "09c89414-0fb5-4183-b92a-1673dad2e2eb", "value": 1112064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808344, "uuid": "11470c03-dca2-45fa-ae6d-079180d098ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808344, "uuid": "43553283-b6fe-4e3c-8a84-683a4478cb55", "value": "1d940966ac64ef594b93203b056ec7b8554c0f6ec93f03cf48bd63a3eb1f3a49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bc47e5d-1951-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772797291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797291, "uuid": "9089eecc-a6be-406f-88c8-e2c3a9931ffc", "comment": "Malware payload", "value": "41c19fc6c8a8687988f28fc487048bf3", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797291, "uuid": "af8c11f9-fffb-47c5-8a98-1cab5baa4077", "comment": "Malware payload", "value": "1d984d4b2b508b56a77c9a567fb7a50c858e672d56e8cf7677a1fca5c98c95d1", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797291, "uuid": "f1881397-5099-488e-b8b2-4ad475da7e2a", "comment": "Malware payload", "value": "3de597e3237d5c7e7cc66ecb58b9ea2af149afa1", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797291, "uuid": "22f72b1d-a826-4a66-be81-8e8829831429", "comment": "Malware payload", "value": "1348eb7c86c46137669fa82558d06bde4581f99c2cf73983436c6d95b4a7f8d6c61e45d7cb36330c5b58f73be8d54bef", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797291, "uuid": "2526e0bc-4965-4d73-91ee-8a9c38b2f8f2", "value": "T1BAA2E847B740D332C8814B314A1FD7E49F75AC589F77211636AAB35C2E72AE016BB9E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797291, "uuid": "c0795c42-5cc8-428d-a985-90b99c0de5e4", "value": "384:zY6bsWacfMey3M5UC0qEXddGSo78p+vV5F5gd/aj:zAxcUeWMmCgFzd/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772797291, "uuid": "8dac71bc-d0b7-4dae-85b2-d3cd5d89323d", "value": 22528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772797291, "uuid": "5bc9bd52-c8ec-461f-b4d0-03618904bb50", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797291, "uuid": "8db44506-bedb-4dcf-a771-4817812fff6f", "value": "1d984d4b2b508b56a77c9a567fb7a50c858e672d56e8cf7677a1fca5c98c95d1.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2f87e56-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810322, "uuid": "babfd802-7a61-4edf-84c7-b9a9f1a3de15", "comment": "Malware payload (GCleaner)", "value": "ad1883952b362fa4434c75d83d7d4081", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810322, "uuid": "4d4e6daa-d779-4719-a044-a22326035f59", "comment": "Malware payload (GCleaner)", "value": "1db55be06c39f251ebf8c94aeeb43e40afe176154ec71e9c303801c87cbabb4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810322, "uuid": "afcf8f32-4a5d-4776-89a1-0190e5e5ecf1", "comment": "Malware payload (GCleaner)", "value": "344aa52c19c30b7d4238473d8619de179996dcd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810322, "uuid": "a06adbdf-355b-4504-b3d6-476b7876a3ec", "comment": "Malware payload (GCleaner)", "value": "2f30d8d4b0c4ebd0290a72037f90530a04f55dbe71f4b33c181327ed0b5f4ec4a321094ee12ba56a74f44631e131e8ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810322, "uuid": "529dad6d-6444-4156-9a0d-b4b4f107c021", "value": "T192059E22A2F185F7C1EB2A7CAC5F669C9839FE313928588B6BD51DC84F3774534211A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810322, "uuid": "1eac2605-6706-4ec0-af04-9ef7e9a09acd", "value": "fe4280c06246cc873fe89746dadec91e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810322, "uuid": "b24951e2-f042-48c1-bcac-a29c4709cc2c", "value": "24576:HlluEBpPj6o4CPbE9taCbGIWZ+7uBTvvDb:Hlwa1Vu/uBrvDb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810322, "uuid": "d0544776-1888-4800-8ac6-b50021780252", "value": 847360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810322, "uuid": "0995f3eb-68ad-4e23-8778-33a39f0262ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810322, "uuid": "39a3c5a2-d927-420a-9a2f-5562e61ee350", "value": "1db55be06c39f251ebf8c94aeeb43e40afe176154ec71e9c303801c87cbabb4e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9ff1c51-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1772810844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810844, "uuid": "2dd76b2f-f5dd-4765-a565-794199470abc", "comment": "Malware payload (njrat)", "value": "a2ba09e44d7c9d1e79bb0afcfa70cc51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810844, "uuid": "1b3a1969-851d-489e-97fa-ae355f1500fe", "comment": "Malware payload (njrat)", "value": "1dc8912eb645787109698f975846095ff31f9d5078f5ddfc9483cf44aa312520", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810844, "uuid": "c2640d5d-e1a3-46a6-91f5-e1a1bea67795", "comment": "Malware payload (njrat)", "value": "d3944a0946e8c2b56bf72c3a539dd1a95e55ffc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810844, "uuid": "d1080efc-ea0e-4211-9e06-ebaa99870b03", "comment": "Malware payload (njrat)", "value": "b906223a1f1ed8f528aa176766c104811eed2c1b9739cb4a81ec3910cdad58ad37eb6b78b3ca45b6758d956686df84ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810844, "uuid": "02131145-b740-483d-86fd-9d3e32b9c57a", "value": "T17324086DAED7F641C1454936B87353804A7D5E7AA0CFB6568EE33FED5AB3C9420030A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810844, "uuid": "d9b64f63-51b7-4bc9-95a5-b929946c55df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810844, "uuid": "260c673c-e033-4fd8-b5ce-81cfc3d75a10", "value": "3072:fg84KxhkTcGNKd0VQoXcINbHm+aa4NpVq8BxFRzaqF+o2GQJ7/JzqVfGvc:8gVGRLsUbHaagVqwlL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810844, "uuid": "0d8a7349-42d0-4bc4-a6e0-aa2a4fa0b2aa", "value": 221184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810844, "uuid": "190bd4d2-e45a-4aaa-b3b7-555baeefad97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810844, "uuid": "3f2057bb-dbfe-4a55-b9c6-041fc698e431", "value": "1dc8912eb645787109698f975846095ff31f9d5078f5ddfc9483cf44aa312520", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a157ce0-1972-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811381, "uuid": "be866de4-8071-4a1a-817b-b83c12131dda", "comment": "Malware payload", "value": "8561d43ac49e66be78afd688f68d0048", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811381, "uuid": "743b4162-edb0-46d7-b12c-ffd1aa8c376d", "comment": "Malware payload", "value": "1dcab56a0998fc7228c2ec8ef6a4e9721522a9fa94a2665ed12d63d721db5b23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811381, "uuid": "ade1e183-7da9-44d5-96cd-75b088f0c021", "comment": "Malware payload", "value": "4c6a30b5cc364794adfc784ccace3b3554aaf0b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811381, "uuid": "825fd352-cd30-45a8-8cab-4dca2ffa2f37", "comment": "Malware payload", "value": "442b1eb4ecc27ac590e3aa4274fa7325264fa5071b33a48101ead1475413f5cca3fe021be15b16c83901e30fcdb00427", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811381, "uuid": "2f1471f5-4f67-483a-a27a-5bb5b2b943f3", "value": "T17A8412027AC2C047CA9609B00CB1FB73E6A97D5C69568743B792BF0CF672655A84D3B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811381, "uuid": "5fc36743-ccc5-4054-badc-2aedf0d8f88a", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811381, "uuid": "e80d58a1-38d3-4463-a684-3e7b7665abd4", "value": "6144:nwq3NpGrARcVC0Fw5NQqVkCrpgF2d33IxSLoMn36/3ACxtcEmb:nzSicVXoNSCrp0OxsGyx98", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811381, "uuid": "67eed766-35de-4d49-96ac-a3bc604ee597", "value": 404685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811381, "uuid": "84a695a9-ac4b-4dee-ba11-8f68412eee1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811381, "uuid": "08bba1a3-eb1c-42e2-8e0c-68cb43e3fb9e", "value": "1dcab56a0998fc7228c2ec8ef6a4e9721522a9fa94a2665ed12d63d721db5b23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "734fa074-196a-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772808041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808041, "uuid": "459e6349-dfcb-4ac8-ae59-ab2725de1095", "comment": "Malware payload (PhantomStealer)", "value": "3a629ddbd1c0e0ece98be283937871d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808041, "uuid": "87fc08d4-0b70-4495-809c-703be8e49628", "comment": "Malware payload (PhantomStealer)", "value": "1dd2b1c2480081818d532883b7710b654aa652aee0d6d4d8d4486d8430410572", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808041, "uuid": "38ed7659-debb-4fcd-8aa1-bf8bec5e8b9f", "comment": "Malware payload (PhantomStealer)", "value": "fa02e68d4876814ec1e70848d027e481f4725456", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808041, "uuid": "a4516171-40d0-42c5-a650-eccc7a8a2dc4", "comment": "Malware payload (PhantomStealer)", "value": "559c185a80ec86462a1cbda1a7f8e8a058dc89c59418720978d5f1fac3e932584ef6bac090d819446a8a95ac52fd0b69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808041, "uuid": "9ce79956-6fe7-4282-a5f7-474b168aeff3", "value": "T189752220136DCE63C9AA1BF94931C33547F18D9EA622E3668EDE7CE77D967C14C44282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808041, "uuid": "7783d4e9-cfe3-4600-b032-c48b13f41f0a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808041, "uuid": "d3eb8cfb-1c14-4fb3-975e-d7549dd5f7bb", "value": "49152:gzHvu7i0IYONZ99s9ivnlqHJaHC5BLLckYYhCBQc32:hVENZX0gnyGgBLwkJc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808041, "uuid": "2a1536e1-141a-40cd-ad9a-1db794b9d37c", "value": 1622528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808041, "uuid": "4a095d6a-801b-4b18-83b6-e50674206999", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808041, "uuid": "fa373aa1-afd7-4195-9877-1eae6cb79d1e", "value": "1dd2b1c2480081818d532883b7710b654aa652aee0d6d4d8d4486d8430410572", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f11b9d2-1974-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772812222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812222, "uuid": "0bdcfd4a-31dd-4b81-a7ca-4bd991ccc50d", "comment": "Malware payload (Mirai)", "value": "5f14ddc6cc66c69ebaa6561afb03b439", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812222, "uuid": "b37acd26-8726-4797-9648-85d8dc24b808", "comment": "Malware payload (Mirai)", "value": "1dee67789e64a36c32b8f3e7f45d899aef5b9f71214e08954759887658177674", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812222, "uuid": "addb801f-9548-440f-89db-52133c9b3bef", "comment": "Malware payload (Mirai)", "value": "0b3dca65c1989c28e47b1cb532fa46202f973fd9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812222, "uuid": "2e21804e-610b-4d20-8584-6aca39f90614", "comment": "Malware payload (Mirai)", "value": "d3375323723cf7f6262e00435c3ce8d31c0a645d5198ac4ed21eb1b6a4b9f40ed1a6d6e2f0875a25852eceeff7a7f756", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812222, "uuid": "1b65a20f-0ddb-47f7-b7bf-84b8204130d0", "value": "T12EA37DC9B283E8F3E81704B0603AE7779B72D46A2219EA86C378DD31FCD1541D527A9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812222, "uuid": "413b5233-d54b-4a0a-b422-bbbceca2d61d", "value": "3072:fix33tTBcahQfaQsPZptxfyZZ00WYIFpvAclU:fS33t1cahQfaQQZp/fbHpvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772812222, "uuid": "23fa564b-f3b9-4fd1-811d-92396e2acf6a", "value": 104552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772812222, "uuid": "4e9f9e8c-453f-4e28-a410-4df1e50a6c4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812222, "uuid": "e074da24-4712-48c2-9520-64fcd9f098d4", "value": "debug.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8903ff37-192e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772782308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782308, "uuid": "c8df8639-54ad-4ccd-9a62-10596a8b5cd8", "comment": "Malware payload", "value": "85d6ff388254ac0066d2d3742b1ecd6f", "object_relation": "md5", "Tag": [ { "name": "api-devx-help", "colour": "#8AD189", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782308, "uuid": "01fd98de-975b-4d86-9434-fec9cfe177d8", "comment": "Malware payload", "value": "1e12f9db9842a221dc8ccbc885190cb5553e3e4ddaea16721f00da4264052896", "object_relation": "sha256", "Tag": [ { "name": "api-devx-help", "colour": "#8AD189", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782308, "uuid": "91b8fbb1-9ace-445d-9ffa-ec66bf3204e5", "comment": "Malware payload", "value": "80859e31d7da425b8a7367568e7dfc9141dc60d7", "object_relation": "sha1", "Tag": [ { "name": "api-devx-help", "colour": "#8AD189", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782308, "uuid": "06fcf353-4f8b-4412-82de-f9769f5380fa", "comment": "Malware payload", "value": "8af0a21ca2b372f3aaa293f2c5c82a6486fe8c97da26f524ee9920f17dae27002075a726d910b2fc23f137ee518a610e", "object_relation": "sha3-384", "Tag": [ { "name": "api-devx-help", "colour": "#8AD189", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782308, "uuid": "fcdc0ff8-b7c9-4e67-8ed6-8528f435acb7", "value": "T1D0F733AE62C46F231DCA831E4976BB9CA121C325E1E4A4796DF82F4356E0B075F3D16C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782308, "uuid": "a854056c-e066-4117-8a35-c2e9d9a7f11e", "value": "1572864:XBh+bST8j1cEiWoYFzZholtSEmxnkG2Su8nR9ZwLlAMu/Ya8Q:XMr1cfFYFtholtSNb5nlMu/1b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772782308, "uuid": "543509ba-e63e-4dfe-9cb7-fd0ea3b651e5", "value": 73297630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772782308, "uuid": "2b9e8263-fa65-448f-b52b-54360f60e54a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782308, "uuid": "5cb3e897-ab04-451e-8212-33da3dbb0313", "value": "3ff24b2ac0669ad9869b4fb323d97cef51a60fb969871c221986f43b27006324.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "218dd76c-196b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808334, "uuid": "cf254917-1ea2-4393-b13b-015f2535b2b0", "comment": "Malware payload", "value": "05502d2ef09218b7a20a951958a608ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808334, "uuid": "50fae7d2-455e-4c02-8ad1-8496c4f72cfa", "comment": "Malware payload", "value": "1e4c6ae2e0191791ae885f6b4a2042cb27b6da479600abcefd4226c2ba953582", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808334, "uuid": "e53b69aa-c1e9-44d9-b1b8-e8a0ff898d36", "comment": "Malware payload", "value": "b3c14f30d36c7276d1d2649719f17f71cac5958f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808334, "uuid": "2484c9bc-9c8c-47c8-8945-25fd1a0c4e25", "comment": "Malware payload", "value": "e73975d1bb2641f5526afe139332807ce879e949b21661cc34a17a76dec644df154b24aa39d4ca4c50daef54895b6630", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808334, "uuid": "b93b7acf-9ad9-4b7d-bd39-db3a455610ee", "value": "T1C9756B476F9480ACE4B6D1F1C852564FE5773C22D732CE9F89987A4E0E731A08E6D6B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808334, "uuid": "b4ec4ead-0bb6-47d3-afe4-d8628f6cb2af", "value": "6a1932979a704343d32e1c7a0f9a3b50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808334, "uuid": "e83537cc-5676-4222-a8e7-7f0e8b947a97", "value": "24576:PVcM4QCxv79ivZedIzVli/IJKEHNGmJe+CuVSt+ap8kEB8dc:d1oBYxeOJUtuVSM48kEi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808334, "uuid": "3379e3ed-138e-40d0-a581-2f59d52bf4e9", "value": 1662720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808334, "uuid": "a65405b0-d74c-4687-8748-28b938eba9b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808334, "uuid": "f8b0dffd-0c76-496f-a193-8f7da5ee46aa", "value": "WallpaperSites.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9c2855e-1983-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819004, "uuid": "a8a7c066-9f5c-4066-8dab-c5a4ea3aac50", "comment": "Malware payload (Mirai)", "value": "c033c862455890cb8a3891b1897e96f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819004, "uuid": "dd89b82c-4d15-4289-b4b0-f8f918a9e50e", "comment": "Malware payload (Mirai)", "value": "1e5cb8fa383faf84647bf000896ab497c7f4026d7fb7a1c1310345997a30fef9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819004, "uuid": "1996c60c-67c0-46de-bd85-e314f552739f", "comment": "Malware payload (Mirai)", "value": "61c280adae89a669e43504fad623bcaab1498caa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819004, "uuid": "3af9a287-a4c0-4221-83fa-54b67f7ce757", "comment": "Malware payload (Mirai)", "value": "28a420451a9d3bd4e3b302c1af4c8d2d2001926d1fd56d1078a9825f60dc60cf4d8a1b5eb68fbe7f654b67581270b32f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819004, "uuid": "3cccd8c7-48ad-47af-83b7-8c7db2745f65", "value": "T1248328C1BA4BC4F5D90748304067F33FCB31E6398061D25EEFAA9E65DD73642662628D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819004, "uuid": "6e19446c-2047-4a52-aa9f-f73744991c00", "value": "1536:N+O3W1dz9BCSKJYHUeWAcaHWSQCYjxCAoN5F+hN9:N+J1d9JKjeWHL/jxC9XI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819004, "uuid": "0bff594a-92d9-425e-bf87-112d9477169c", "value": 87696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819004, "uuid": "859ea0b8-44c8-44d3-aa9a-3029c5746cdd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819004, "uuid": "a018d019-b011-4d0c-8451-b68f44c6b8cf", "value": "jawirbot.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bae738b2-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (DDoSAgent)", "timestamp": 1772809020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809020, "uuid": "e4544947-9398-4d55-bcfc-f61db48c613c", "comment": "Malware payload (DDoSAgent)", "value": "4704a1f07bad932369a0b7f191512085", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809020, "uuid": "8189f094-6805-44e2-b808-2d31f1dde795", "comment": "Malware payload (DDoSAgent)", "value": "1e7d362fdc84b221b948355dcc09464b3de670011190029aab249d458a17c0c0", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809020, "uuid": "488ae7c5-369e-4a68-8037-a28f8cbad825", "comment": "Malware payload (DDoSAgent)", "value": "99c55d37c7985cb99c312363c891c210fb1fb829", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809020, "uuid": "f8c394c8-a5b3-4f33-8d94-c9db7ca3e444", "comment": "Malware payload (DDoSAgent)", "value": "62887121b2cc995203e4d9236fb5bb6527d6aa8ace848fc81cf4de016209c0246d5e8bb3546f91fde060803e9bd148b7", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809020, "uuid": "2062ce5e-281d-47ee-9f32-1fb8519762d7", "value": "T154573953BA19EB1EDA28223448B1CAA463791C9580D6A507B741F319F9F307E4E6FCF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809020, "uuid": "ab86c0a3-1a3a-47d9-ba3c-94731f90a82b", "value": "98304:+aqgWz38FqcZ+SjEjrsHxxrv6BZYyD2qDSK6kODox61dhxwk+gdOgxtpu+pTwDjD:+aq738ZZ+2SK06xrGCRYrj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809020, "uuid": "3947f6db-3d4b-4eae-92c3-1f71dff84fbd", "value": 29425879, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809020, "uuid": "a9d0474f-37ad-4bca-b84f-4471134de36e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809020, "uuid": "c727bf75-3567-4b35-8b91-b2edd4d16c3a", "value": "apex.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90eff89a-1969-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807661, "uuid": "2cf100a6-bf51-4ab0-8c8f-8b54bea0e1df", "comment": "Malware payload", "value": "90012d963d10db12cbedcf81133ac47c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807661, "uuid": "ea4dce86-e68e-478b-be44-d533e4642155", "comment": "Malware payload", "value": "1e8902ebdbdc158b751d2c6b3925267ff59b279a1b3ea1d9d44c1540cfa2e948", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807661, "uuid": "26bb8576-a19e-471d-98f5-22caec8ce0c8", "comment": "Malware payload", "value": "461646fe9ec00c441adf1f542e1bdb9b1f4516d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807661, "uuid": "89256665-a40d-4528-850e-683eed9220a0", "comment": "Malware payload", "value": "76302efcea9aa02dbe8ddacc6627108cfd8321514898a912c05e7fe335abd9456d094394a5a5532cce60c7ef7a21a544", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807661, "uuid": "dbb7bb04-ad07-450e-a949-771385ada519", "value": "T1D8F34B03F6D644F8D467D1B4A69BA733B5B1F854537429AF0B90CA362E0DA30B22DF46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807661, "uuid": "464b5109-26fc-48c6-b6ab-41c05de413e2", "value": "c411c22bbc58519d23851b4202b63f4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807661, "uuid": "f93deeb8-6ff9-4ca9-b00a-974107393ea6", "value": "3072:85iAt+/UB9uIjXAiDbLiqlnDTM4hbAGL3jX:pAt+/UBQLuLk8bAGLj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807661, "uuid": "3ec56c83-ddf9-4d46-a171-b9911f73d716", "value": 159744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807661, "uuid": "8ce79985-194a-4bcb-97e4-7ab34adbec78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807661, "uuid": "91a23256-f40a-4a87-9f37-e7cdad9fbf4c", "value": "1e8902ebdbdc158b751d2c6b3925267ff59b279a1b3ea1d9d44c1540cfa2e948", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "778cd067-1969-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807619, "uuid": "9537a3c1-db90-476e-8ea6-aef127b3952f", "comment": "Malware payload", "value": "50c10e7aa56aab840f743fe4df11c49b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807619, "uuid": "5b745fc5-74c9-472c-8012-a08a8cada47b", "comment": "Malware payload", "value": "1e8a28346b249d0090153a21f0097475be7c106d6f7fe01bf00af05335563640", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807619, "uuid": "c5e1c96f-a2a3-4660-b3eb-58edc6726638", "comment": "Malware payload", "value": "b15900948f01764967842abf89b67b5404b63bba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807619, "uuid": "cc218148-49f9-420b-8980-f8a853a57d83", "comment": "Malware payload", "value": "ef29649c521b27780f0328bd8d170f8fed9d35faf5aa390382b7699f7e1ae28894e51910c85a8639e960d84081a41ba5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807619, "uuid": "54cf3118-3397-4da6-afe8-1c5eb2068ca6", "value": "T1ADD6338C2AE011EEEDB3903CEED16264E59C78761336CEDB97E447565C632904D3AB23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807619, "uuid": "7032a982-367b-4a29-a213-76bc8c3ff0bc", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807619, "uuid": "2669d000-f09a-470a-82fd-be9d7844925f", "value": "393216:UpUHoFcExzM0Ex3BIxmXMCHWUj5cuI3/PkuUSq:UpUIFtMBqxmXMb8OH/sCq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807619, "uuid": "90a342f3-f9f0-4a2c-9132-53263143dff1", "value": 12758548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807619, "uuid": "11b98f91-3f92-44a8-b253-f09cb6c6f7e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807619, "uuid": "7943d1a0-85bd-4e32-b794-aeaa17e13a16", "value": "1e8a28346b249d0090153a21f0097475be7c106d6f7fe01bf00af05335563640", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "671c642e-196b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808450, "uuid": "9c9a0490-bf2c-4774-bdcb-b644a3dad7bc", "comment": "Malware payload", "value": "1a68d3114aa78cb45623104bfaf197e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808450, "uuid": "77ea76fb-4679-4e8f-bf9e-20010699c8f1", "comment": "Malware payload", "value": "1eab549aeec3b69b8244fcc4719cebc68285958b798db1cdf8c8f7e08102a9a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808450, "uuid": "03487f73-6e4b-4b83-ad1b-d495a8a3eb04", "comment": "Malware payload", "value": "47535f3d04a61dacc8c176dcd72363c44a52f4bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808450, "uuid": "60e80bcc-93c4-4a74-8595-965015f769a4", "comment": "Malware payload", "value": "cc1e75747f08fc4f675837c08bc7577b2cec85a6d6b587299e004e244d14ffbaa15bf0a9685f250913c79687761ad568", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808450, "uuid": "513ff85e-c5ed-422c-9a91-231bcaa9f567", "value": "T13F25D00523E95B68F0BE9B799574246087F2F907E732DA9E7C8C41DE1A32B81C652733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808450, "uuid": "44badc61-bd09-4bdb-9ce9-4059e45ac4f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808450, "uuid": "cbecf833-ae69-4f46-9518-26cba112b087", "value": "12288:sOmK9o2tVX5rVBo83tUsm+u6cgJxPLX4DA1K0XGeglq7ehF4r8V5F7AJzYmLgI:OK9oarVBo6tgNExj4DAXng07ehQzQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808450, "uuid": "4fa8d64f-f44a-4cbb-b0fc-f95c62878c55", "value": 1049088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808450, "uuid": "74499a37-beb3-40d5-9d12-2eedd27d92f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808450, "uuid": "08a8763b-46aa-4c80-974d-ef497e886cee", "value": "1eab549aeec3b69b8244fcc4719cebc68285958b798db1cdf8c8f7e08102a9a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99e67f9a-1952-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772797798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797798, "uuid": "69f35efe-524b-4077-8cc1-753b07e8d324", "comment": "Malware payload (AgentTesla)", "value": "82632742363f974d4e733bc5b0602fd5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797798, "uuid": "149729a9-5234-432d-ba7b-650dc3464a05", "comment": "Malware payload (AgentTesla)", "value": "1ecc3c1fb0c32c448deb5d4b5f6058d9a24b985770c0584e8afa56c44e57e7a0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797798, "uuid": "6506e836-85a8-42c3-86e6-3f6804bfd67e", "comment": "Malware payload (AgentTesla)", "value": "01035ccb0400847e939c1338133ee34ff826cf67", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797798, "uuid": "fe0bcaa8-c964-4bd0-b3ee-9923254fa868", "comment": "Malware payload (AgentTesla)", "value": "6f5646f89b3f4ba8294b0542eb5947a8fdf3d3dad3af1260567868be44569044b4d0bd07f565775ac432f14ce59bceb2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797798, "uuid": "337e966e-8021-4b60-b89a-b2b660484d6b", "value": "T156657E906EF4A9C018180F38C2F3D10B35B18DD8CE8F5ECC4A49BA96B5AB759D39549F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797798, "uuid": "2aadbd45-9323-4de8-beac-bbb1079cc720", "value": "12288:mPpX8fnUhRLdYJJ/Jx9NDaaLdnzhRTwRrollbP+usm2gu80CTdreK+Qs/yzDLaqa:uGk81Jx3DGsllb2INTdrYmsriDYRXeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772797798, "uuid": "f960b2a5-e213-4cbe-aa5c-bce21f6c410a", "value": 1413932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772797798, "uuid": "b10d79a7-9b21-4227-acf8-f5759e5d1c80", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797798, "uuid": "4925cdb1-6049-4996-8fd3-3e8cd88d2dcc", "value": "82632742363f974d4e733bc5b0602fd5.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1ff21c9-1969-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1772807771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807771, "uuid": "be47dc66-9118-4487-b267-b8046ed6acb1", "comment": "Malware payload (SnakeKeylogger)", "value": "69ec9d3a64e78cff10ed60f70c8bc4b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807771, "uuid": "01e8321c-4cda-4143-a1cc-a24608a06b17", "comment": "Malware payload (SnakeKeylogger)", "value": "1ef4b8f572edbd8872dfc7df6bbf8bb44118369740c7d3da57a653eb729afbce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807771, "uuid": "c9199c18-7589-4e65-8e05-068ca072239e", "comment": "Malware payload (SnakeKeylogger)", "value": "9d8189af5efb3c611284eb045bddc27f38a09f87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807771, "uuid": "c39dcf51-8e04-4caf-aaaf-e9cf5baf4f47", "comment": "Malware payload (SnakeKeylogger)", "value": "1f42973d7768571ceb924c227e1100cc682cd594ae303b0bd706e5d1c3920432e462fad745b6d331eea96bce2eee61ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807771, "uuid": "ec241d17-d7a9-4cd3-a9bb-2bf8907b5e8e", "value": "T1FDF31364F958F6FAE143ADB75E89DCBEDEE6D05693101F0B04410B6814803E5A9BCF3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807771, "uuid": "1a9b2392-22dd-4727-aa1b-5c9a616e4b21", "value": "60559adcf3698c3eb3c69577ebf28413", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807771, "uuid": "e3f4195a-f110-4a41-a87e-575d6cc0205f", "value": "3072:nrY0FLg5SmNberoWXeSlAXZaQYMX4+R0+KBVqVm8qSIeDqQUWYbPGK:rY0KwMTWIcQYMXjR0+gV0IeDdYb+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807771, "uuid": "d54b5d2a-ea0a-45df-ab3a-38bdb66588bf", "value": 169984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807771, "uuid": "7bb88185-239b-474e-9d7b-5bf4eec5c620", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807771, "uuid": "853a01de-d24c-4329-b94b-a282fdb8e90a", "value": "1ef4b8f572edbd8872dfc7df6bbf8bb44118369740c7d3da57a653eb729afbce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4da4e6f5-1929-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772780061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772780061, "uuid": "12e0664b-deed-4974-be2a-b8bb08470f80", "comment": "Malware payload", "value": "8f2df797bdc62956e53d3b6ce7222dc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772780061, "uuid": "69f5739d-0166-44c3-8afe-d8879322c0f8", "comment": "Malware payload", "value": "1f009b2b05fb231e8b864ac5a588d955438c28a8191fd1cae87a0c4bd0b49c9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772780061, "uuid": "06602ec6-b72a-4a10-8b66-ea04bb873407", "comment": "Malware payload", "value": "3423ec146ac6f1edc807230d242eb1cc31841d19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772780061, "uuid": "dbeabdb3-1098-4d8c-8b67-3a421ace02ee", "comment": "Malware payload", "value": "099a8ba4d1ccf5a74e0ed4962df0dd78591c4f958fbc9c0d703d79d19fb3a7d1a6e07c2f2cf3ecae5db7974d13c5473a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772780061, "uuid": "4b1ad0cc-3ba9-485e-ac45-e02d479df63d", "value": "T117051C7E59A2916AEA4A40FC35454B6249B1B33B03B41FF701A691302717DB2EEC73F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772780061, "uuid": "a20e38c3-2076-409e-9505-72023f53d23a", "value": "12288:tXC3lQZAJPAFLnpr4Xf8Y5MSpHUKHY2ybk/O29D+CU0sD1PcUWs2nFUNSh1Wmv3:etJPARpr4Xf8Y5MSpHNTYj0NnFsu3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772780061, "uuid": "88f88f8c-8fff-44b0-b4cb-a6401c0c8ebc", "value": 808996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772780061, "uuid": "3c0d78d5-7472-458d-afe2-863971229deb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772780061, "uuid": "676e6b61-c1f3-4a81-9468-caaa60c53a8f", "value": "1f009b2b05fb231e8b864ac5a588d955438c28a8191fd1cae87a0c4bd0b49c9e.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7dd9da5-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808586, "uuid": "9cf0193c-0930-4019-b0c0-faebac267289", "comment": "Malware payload (GCleaner)", "value": "15ea8f2b6514a30046848eabea8f486f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808586, "uuid": "d10f77fd-dd88-4e3c-bf88-50dedbea1f79", "comment": "Malware payload (GCleaner)", "value": "1f5a276f36a9793da0e84b9e18891fbd6f050069c906b1368dc4f810990286f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808586, "uuid": "b4ff8e07-8e8c-4d39-8216-a37dbeb65527", "comment": "Malware payload (GCleaner)", "value": "9df18cb968632bd9851985788e64ce4b9e91bf6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808586, "uuid": "83dc1650-4d7b-4915-bd5e-50ac2f3b557d", "comment": "Malware payload (GCleaner)", "value": "3030eaa85f25d507689338ae41f6b0260a6b8bf0fc37615b74dd663c3df9c4edddc3cc65d36b8bb7eabe482f17cfb6c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808586, "uuid": "f1c4b395-8241-49b8-9d3d-e20291a4480a", "value": "T1FE26E0E762C10CA1D43BCAB49A6695EC573DAD8422154F4D2EECDBD804B8393EB3F152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808586, "uuid": "5cf3b571-ddfb-409e-acf6-7231cd111f2a", "value": "099b2b7fa2a0044e2ca25418be2f8a70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808586, "uuid": "32ed66e4-0219-4485-986c-0c351aeba5da", "value": "49152:tto5h7kxgk1aU+gT4kjHzyrXzs81GLf9ArX2ZUE6KKv11w8MGh/RBh1iZ1BqROW6:tteyaU5TFSsmgaXE6KvYXRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808586, "uuid": "ecc8c2d9-a433-4a35-8883-5e0c272c7ca3", "value": 4682240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808586, "uuid": "24d54139-b5c9-45fe-b188-ba5b3be8e674", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808586, "uuid": "7c9601ac-6c7f-482d-b92b-0a455f28bc41", "value": "1f5a276f36a9793da0e84b9e18891fbd6f050069c906b1368dc4f810990286f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc341ab3-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811277, "uuid": "45558685-ea1f-45f9-881e-ea826308b810", "comment": "Malware payload", "value": "ea1d4b7cae665a0f58ad1c00eeb0ab11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811277, "uuid": "6f806288-5d9f-4499-bb9a-8397ebd1a3b2", "comment": "Malware payload", "value": "1f865dbcdbcadc63d6991c1534342a0c639c67894e545c9e31092faedd2ae1c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811277, "uuid": "4abdabc5-ea90-48fb-8d41-664fb97f8637", "comment": "Malware payload", "value": "7797f5c47496ccab5c6e5f6babb3b8de98ee0681", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811277, "uuid": "bfe38a3e-137a-4f18-b84a-100e06228b9d", "comment": "Malware payload", "value": "1a00e4543b074eb513c760732d93f199853ab02aedbbb94a7430703a26e5bea5b3856499332d70f304c89c2bf50633ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811277, "uuid": "9fafb20f-cefb-4152-8d02-dd480f471364", "value": "T108258D66B6F09037C2761E389D7B669CB8267E013D74B8496BD42DCC4B39641FC2D2A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811277, "uuid": "95428788-1b90-4b0d-9b53-796a1dee1236", "value": "1b5561a94cb01af2569d6f2ff45e087c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811277, "uuid": "6ec60680-0f0e-492a-b19c-fb682ad0024e", "value": "12288:xXXYiviV8rqIPazxvzRNRhBydf6o2uzIrOG5ka+7l/A3IqkDHHT16a9T0RC0:tFTPaZNNIN6ndr+7iKB6a9TsC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811277, "uuid": "68fc8db9-ae7d-4c0a-977e-8d8f9eb42cb0", "value": 976896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811277, "uuid": "374ef5d0-497c-4ae4-b589-e3acb60a2b15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811277, "uuid": "59c746b7-8936-419e-9d2b-a0006c32e430", "value": "1f865dbcdbcadc63d6991c1534342a0c639c67894e545c9e31092faedd2ae1c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6dfb374-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772809121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809121, "uuid": "8253483b-5a68-4e75-bd85-b9bc42ee2ac2", "comment": "Malware payload (GCleaner)", "value": "f25a83cc3ba315ad6bde1ba927da294c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809121, "uuid": "ad2ddbde-bc2f-42e9-b4b2-516d96107822", "comment": "Malware payload (GCleaner)", "value": "1f8cf92ffe3efbc84194d939bb82c45c046db62b8bc6fca24ad696b247f59db5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809121, "uuid": "68b74001-77c6-4232-8525-73c423640e4d", "comment": "Malware payload (GCleaner)", "value": "24737e66179f8868ddf0025f89ec2fa24e7f0a1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809121, "uuid": "e1a58daf-312e-4722-99aa-40d2f2627d6b", "comment": "Malware payload (GCleaner)", "value": "6360ac79e3dc9cbab4b13cac83389a146ace1d219aaffd50247b0911048d769600678a04d2b2c59e591272661b31be4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809121, "uuid": "14d616ad-4455-4218-98fd-05b4fae9dae4", "value": "T13F46E082E78119AFCE10A7FA9D5537D768837F88A0D190CC75C899C8493D7477C28EAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809121, "uuid": "ceafa4d4-46dc-46f4-ab64-34021dbb94f5", "value": "345624d13ffc2b7f296b9d2972b1c0a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809121, "uuid": "8bd1a6ef-2b49-4b6a-94cd-3792effe7003", "value": "49152:SiZHBokSHkPu/HV2C3WdiLZKTXxDnN9MhVL3AME6Gq81o8APu7HD6:SiZhokA/12OKTXxDf0LF781o8iqD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809121, "uuid": "8c2d91cd-0636-413c-9130-ee23023db60d", "value": 5388288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809121, "uuid": "3ea0b8e9-4281-48e8-ad4e-7a1c9f7e2cdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809121, "uuid": "bafe2ebf-aae5-4057-a447-911890dfa168", "value": "1f8cf92ffe3efbc84194d939bb82c45c046db62b8bc6fca24ad696b247f59db5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93e5ce31-1942-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772790916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772790916, "uuid": "af997055-1d2c-4279-9d2d-93efac8303eb", "comment": "Malware payload", "value": "0f46a3a157dff5d5ee9de24938d67a4d", "object_relation": "md5", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "jasjdpoekkqwda-com", "colour": "#F78A49", "exportable": true, "hide_tag": false }, { "name": "modeactivate-dev", "colour": "#EB9FC8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772790916, "uuid": "7aebf23e-837e-4968-98c4-aca018aa6e57", "comment": "Malware payload", "value": "1f9316491eb729a1362f5f02d88ec1a2ca5877c1ac496d517ff602c6ae350a5b", "object_relation": "sha256", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "jasjdpoekkqwda-com", "colour": "#F78A49", "exportable": true, "hide_tag": false }, { "name": "modeactivate-dev", "colour": "#EB9FC8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772790916, "uuid": "8e7df2bd-09bf-4c73-8167-68659b5e54b6", "comment": "Malware payload", "value": "5906166916129a74a8f327a7d6464cfb989a5ac7", "object_relation": "sha1", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "jasjdpoekkqwda-com", "colour": "#F78A49", "exportable": true, "hide_tag": false }, { "name": "modeactivate-dev", "colour": "#EB9FC8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772790916, "uuid": "04796a76-2215-4089-a735-ba02e5721cad", "comment": "Malware payload", "value": "1d0381f77f4b95cc198d579f92dc61c9dbc0e595e6022c395d603170e98557150084c3dabe10f3955a32bb1a7e43bc61", "object_relation": "sha3-384", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "jasjdpoekkqwda-com", "colour": "#F78A49", "exportable": true, "hide_tag": false }, { "name": "modeactivate-dev", "colour": "#EB9FC8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772790916, "uuid": "c870d034-2d09-47e7-b725-3b8aa51ce933", "value": "T16F413018E2659879504A178EC8B61C48954F4CAF4B015F44B64C78E93F36D3DC7AF39E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772790916, "uuid": "d06eef5f-3885-4a1b-9127-9d95f1c84122", "value": "48:UjSfV4tGOiBGqQq04KPAKKeoMKbFiKyEMEQgOEyCPP:UjSf8GO/bcLFiK1ziEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772790916, "uuid": "fa67ede0-465c-4352-838c-a84a23318c21", "value": 2269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772790916, "uuid": "7150a31d-73b3-4f6a-a9cb-fa463494df6f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772790916, "uuid": "9b1b25ef-db3b-4e69-a357-7ac8e2411e65", "value": "1f9316491eb729a1362f5f02d88ec1a2ca5877c1ac496d517ff602c6ae350a5b.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8257309-197a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772815136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815136, "uuid": "bd92f6c9-3040-40c8-a745-5337695013b7", "comment": "Malware payload (Mirai)", "value": "57571ccece550d7208d5792d8adef874", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815136, "uuid": "7156b405-5e9d-44cc-a509-581ca6f24f73", "comment": "Malware payload (Mirai)", "value": "1fc349afacada277ac57b86a84a0cf3f9abab538bb3d7094bc7b6322530fdedc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815136, "uuid": "54b80e2f-28f7-449c-916c-13a26cad906d", "comment": "Malware payload (Mirai)", "value": "2fff6d1a9ebf7a30e7c18a2ee7ffe397331af31a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815136, "uuid": "11db291c-5e11-492a-9ae7-a06d6ebaf260", "comment": "Malware payload (Mirai)", "value": "acc95803cbeb54dfefccdc0a558f9a9529a184be20f95ef48d4bfe9c2a950b86094045c3373c4b8c3d6bd1b279704be4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815136, "uuid": "8a70bb8b-700e-4fdc-80a2-d93bf02307eb", "value": "T105116DA86320C31278A2463964E12BC993CA6FF7A484CEC8B131CF15C14559C3EE5BE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815136, "uuid": "735ea58a-a9ad-4cf3-9e40-3e169553d30f", "value": "24:+HwhHw0e7HTHGRB7HmHtq7HvHaX7HBjHBWBTJ17HwcHUV5:+HwhHw0EHTHGvHmHtwHvHaLHBjHBWBFM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772815136, "uuid": "258ad92f-b819-4377-9e0e-ca92af9bda41", "value": 1026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772815136, "uuid": "5173ad5e-bcc3-49ce-84f0-6f7b3c4b543a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815136, "uuid": "e7ef1edc-8ab3-45a6-9402-336750f805c6", "value": "realtek", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c85eef03-195b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772801741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801741, "uuid": "2b33be44-1685-49ea-acc4-a12dba3fc4d5", "comment": "Malware payload", "value": "842b54c83a4e16dda0e76b9af5b6e762", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FrostStealer", "colour": "#039E85", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801741, "uuid": "1210d884-989f-4c3c-86a5-1788add2c760", "comment": "Malware payload", "value": "1fe016374f7213b8e982ef7cc67c5b770d7aa22f1b01d0397a72317752dfaf6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FrostStealer", "colour": "#039E85", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801741, "uuid": "7e76c244-0b6f-4ff4-900b-9b98eb8bdc8c", "comment": "Malware payload", "value": "a54d81c3fb29be2a46b1e0e66b75f2ca4cc09c22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FrostStealer", "colour": "#039E85", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801741, "uuid": "51720b33-7bbd-4c6b-908f-449c963dcb8e", "comment": "Malware payload", "value": "fd9e3ea02ce1903a5b94bc3a67ea38a9a032e7729be5c44a0b820d89c181eecbc37b77975ba86804a822451947d6e922", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FrostStealer", "colour": "#039E85", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801741, "uuid": "38a0f08c-868e-4b23-a5d2-55eb7c587e09", "value": "T19628E01663E112A6D577D138C79BA203EB72B40723309BDF729C03652F63AE45E7A760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801741, "uuid": "2ae3333f-97a3-41af-a011-96a1eefb3447", "value": "9eba512b03d8cac8a6c4424e25e9f06e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801741, "uuid": "2df30d1e-b130-439b-a6c2-f9d892d096ae", "value": "1572864:lVDG5MiP2aVxUXfQfOInRaVJc3ge1S5GDudIaexVj:lVDG5NVybuQc3ge1SvdOXj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772801741, "uuid": "410fac99-bf20-4bbf-aea0-9cd55d550189", "value": 95887279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772801741, "uuid": "a85478e3-d327-4b0a-9a56-46c967be57a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801741, "uuid": "af1bcfdf-8a64-45a9-b06a-02339ca1b450", "value": "GunslolView.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f3992f8-196e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809618, "uuid": "d17c1d79-6c15-4709-90f2-a8c874f59703", "comment": "Malware payload", "value": "ffd3eaa04dedcad1e084e919ef9a7123", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809618, "uuid": "c79e173e-2ce6-4c34-bbbd-86f7046de6d2", "comment": "Malware payload", "value": "1fed3f893d7a3cab80cda40da9f6f403708419d2ac2059ac5ee6a50424c2a3ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809618, "uuid": "02b25ea3-8f51-4bac-8404-f00973e05b18", "comment": "Malware payload", "value": "da12b152f16e6552182769bd010278ad0984e2f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809618, "uuid": "7df9c596-d51e-4bfa-88fe-42b4f9a20779", "comment": "Malware payload", "value": "f6ef378cbba3e3ece451284c0994ae0fd23088b43a19cb085fd6c6d896bee4d0173f613d655a5af4e6e85c0778af7b4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809618, "uuid": "cfe12213-d334-428f-9a69-2a2eafc85140", "value": "T125152310F5E0D037E16A17325C8B53B20EE5ED6AC6D2B25B8389789C7DBA7005B67B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809618, "uuid": "f6a87f20-98c2-47c5-adf2-a67bb063e3ed", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809618, "uuid": "84b34bba-3387-4aa3-9bb2-8ef8fa775860", "value": "24576:13dIYP+p/x7pViylCTsiJlsOSpMYWzAb76VAtuuWSgH7t:13mKwTB5iJNzAc0WSgbt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809618, "uuid": "d70a8138-4c6c-4bab-aba4-0e2c5a0ae983", "value": 879232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809618, "uuid": "425c9f45-4a28-4b3e-94d8-5ef21564834e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809618, "uuid": "3e6aa5d2-8d00-4784-9600-645ffb9e9750", "value": "1fed3f893d7a3cab80cda40da9f6f403708419d2ac2059ac5ee6a50424c2a3ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ed3b8bd-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811094, "uuid": "9dbe3f63-7b53-4135-98bb-c3e2c1c80b65", "comment": "Malware payload", "value": "7665cd19edad518808d09054e87afd2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811094, "uuid": "cecfb4d4-5105-4fcf-9ca6-9984a6b3f1b4", "comment": "Malware payload", "value": "20319983f849f6cf7be8fae73950649dbb6593cca2282d005091eeaf8b13cc27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811094, "uuid": "c68e1daa-120e-4ff6-9755-921a6b3a2296", "comment": "Malware payload", "value": "e7649262e9261f8688e5552fa55d41022bb0cfc2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811094, "uuid": "85572d31-a9a8-41b0-858d-5a6dd137a676", "comment": "Malware payload", "value": "b77c9c33eb66349deec1324a48b710f8c093a4a3a2f600e64227b403602fed4788425313c488004b24e63e862f2909ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811094, "uuid": "6457d7fe-b269-4984-8b77-69c8e9307be2", "value": "T10F7522982B56CA16C9664BB55A31F2702BBE3EDFB900D3079FC8ADDFB566B015D00342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811094, "uuid": "22f378ae-e38b-4eff-ac3e-1a2193002e19", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811094, "uuid": "87daf671-ab22-4064-8260-30008a2f548e", "value": "24576:vbCkk+oNQbYSwcdOiyaiPqptwxhRIOwmPpDSg2IDLikkdQTdIVwNU4KN4j:v+RNZSVdy1NPpTyFwIV9424j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811094, "uuid": "364c6b78-8251-4823-a433-efafed7e19ec", "value": 1555456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811094, "uuid": "ebe720d7-cf7a-4746-afff-98cb71e11f3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811094, "uuid": "41b6a457-8143-409b-9ddc-26b00ab5c263", "value": "20319983f849f6cf7be8fae73950649dbb6593cca2282d005091eeaf8b13cc27", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39f93c51-1971-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1772810951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810951, "uuid": "479f9bbe-2311-4ee7-9783-7aa96e1cc940", "comment": "Malware payload (GuLoader)", "value": "803dd50ad2177c15197031d2ab6d13df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810951, "uuid": "dc2d68c7-5918-4e40-8ed6-a27c1cc8dfeb", "comment": "Malware payload (GuLoader)", "value": "20c650ba6fe0158bf49bf298711fb95f5915dba704169c2443bf921f4852e9fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810951, "uuid": "bdfab632-7064-479f-aaaa-f1a32d76a573", "comment": "Malware payload (GuLoader)", "value": "eb97230b96bb4a332e7e4f3e5f6e0ad66d051eaa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810951, "uuid": "b318392e-24f3-4c7a-a62a-eb81eeaf8ac1", "comment": "Malware payload (GuLoader)", "value": "fe6739080082f72ef8d5987562940d97a70f9411f16e241e71042ac8ba0ccfe3bf3892d29789bcab893da106638e05ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810951, "uuid": "76c02c96-ee33-4b49-93dd-f727f3d12783", "value": "T10AB4231253B88967C88D2EF05ABA049BEA78C25205A4F7174751DFD6BDF37D0890EBD0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810951, "uuid": "5c0816a4-5af5-4cca-aafc-e2ed5f913fa2", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810951, "uuid": "2362ab1f-decd-4b46-af4d-917ff52b8ed5", "value": "12288:G1yDJcBnQPVdN7/WONtPNMxELugStr5LQhj+:G1yDJc4rzqxEetrgj+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810951, "uuid": "fc8c145b-0f9e-4692-b4c5-25dd7cf36be4", "value": 535904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810951, "uuid": "566dd0ed-1426-4ad9-b034-435a3f6107ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810951, "uuid": "03d4e27d-9c93-46ef-9cea-92b4d204e5ea", "value": "20c650ba6fe0158bf49bf298711fb95f5915dba704169c2443bf921f4852e9fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d94c953-1974-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772812192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812192, "uuid": "4c9599ed-878c-4c01-b62c-a5bd0e3565d9", "comment": "Malware payload (Mirai)", "value": "23a183211ce13caec85094b71b2a0b24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812192, "uuid": "deceea88-365f-49ca-9f8c-7b521f079e2f", "comment": "Malware payload (Mirai)", "value": "20fa2340667b07792ea3820c15f42212030b15e2f27b504ff7503cea863a8391", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812192, "uuid": "d4dc7591-dbf6-4eeb-822a-1d0abef728ed", "comment": "Malware payload (Mirai)", "value": "c6e522fef1c2aaaab2b24fa3a177337e72e7c5fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812192, "uuid": "fb23325d-077f-4698-9e95-b28a3be756b2", "comment": "Malware payload (Mirai)", "value": "707c80607527ea0206b357c581317192f96a8e548607fb13d4014023821eb6cf4bae10d2be5bf4fc8201899194258a8d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812192, "uuid": "63ce7261-d6b7-4fe6-a7b7-4e4312902d3f", "value": "T1A3A36AC5F683C4F6EC1311B5143BB3339772E539503ADA93D3A9EA33AC922519A5A31C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812192, "uuid": "7f78b750-2345-49ae-8a93-295b36f89bad", "value": "1536:qWouPd9qZlyR5hHxiNdVTqUl8KdcZE+vxSzkr:OuPrqZ4ZxCjqxIcPYK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772812192, "uuid": "652c10fb-b4c7-48da-b7d6-9b9804cc6084", "value": 101548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772812192, "uuid": "fefb24c9-0f63-4e2c-b1f0-24ad484fc4f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812192, "uuid": "8a5a93f2-efaa-4b87-8385-3dfb5f6821aa", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68dca96b-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819191, "uuid": "87e72226-9341-446e-aa8c-c556d65f10de", "comment": "Malware payload (Mirai)", "value": "aec05b622998c8b4c59f7892e46b34ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819191, "uuid": "a274a4f4-51ad-4b81-a242-af866d18ae82", "comment": "Malware payload (Mirai)", "value": "21418433d4c93a8eeefa2479a2fde7706b7a85dd21bce3f855767909d9dba632", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819191, "uuid": "039e38db-f27e-4622-8e53-eb2b19358683", "comment": "Malware payload (Mirai)", "value": "9b2a50eb48e1689265c797dac77e86eb75882cee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819191, "uuid": "de99d095-16de-4934-8f8c-b2cf8c6987a1", "comment": "Malware payload (Mirai)", "value": "4e37a4fdba8f4eb7daf3e26757805f77da725af6d8a6c8832ab49c0fc3f05f1e288d1731ab5182226714b796e42c0d15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819191, "uuid": "0c9a60b4-ef2c-4f0b-a2f7-4f05098841f5", "value": "T1E2B2D740B942C91BC4C55172BB8F51EDBB16532CE3FB3302DE265FC926AFAA64779840", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819191, "uuid": "b254321c-06bc-4815-9e6a-49983a9aaec7", "value": "384:9hd0HGG+AKZRVJeFUBh21bVPBDvdKxIEcxZY6oc6BEiOWDUiGdFx4e0Tb:9hqHGG+TZfJeFy21bVP22BJoRbOWRFv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819191, "uuid": "d0a0e8c0-19f2-4cfd-af92-c3ab855e53f5", "value": 23536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819191, "uuid": "ec1d6ff1-d71c-43d2-92ff-f179a11f8428", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819191, "uuid": "3c9e78d6-e2e5-4163-a13f-bd04ac4d553f", "value": "violetarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3213c57b-1946-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772792470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772792470, "uuid": "f12ab43e-2663-4b06-ac19-f126339e6ad4", "comment": "Malware payload (Smoke Loader)", "value": "ad627456a723f79d77ec50e3ddffd133", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772792470, "uuid": "bfe7f1f1-573e-45ce-bba8-911f73b9357b", "comment": "Malware payload (Smoke Loader)", "value": "215e8de734ec872836c1b451178b7f54e4f3c366bd5b48e9e9cea3a9d1b9c16a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772792470, "uuid": "03de73e7-08fe-4e27-8093-e0ed44da1787", "comment": "Malware payload (Smoke Loader)", "value": "47e88a207a05a83bec17bafdcfae71eb1e5391d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772792470, "uuid": "35012c11-3120-4e7a-a832-d49f62446630", "comment": "Malware payload (Smoke Loader)", "value": "df7ae9275616cb49ed7074241f18d0cd03ec7368e889e3c3cbd5026057b3cab27eb5087a8511ff06e80bd3e4f900f683", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772792470, "uuid": "6d57634e-906b-45c7-9fd8-56096c295f99", "value": "T13BC529537E91C9A8E19EE339A9A22182BA74BC4C0B3137D71F412B751E773C0593A72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772792470, "uuid": "e2134d81-5ee7-4935-b46b-c1962bf8f1e7", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772792470, "uuid": "72bff37c-8322-4a4a-95b7-fb3643d88875", "value": "24576:rtZzem/y+4BCYe+B85HYA+1+/XkmPSSSaqhelet29m9cQXWrb:rtRem6+JY3B89YA4+/XkSnaq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772792470, "uuid": "bfa592d3-e331-4f9d-b975-28a3311f9628", "value": 2707968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772792470, "uuid": "36893bcc-0a31-4fad-9358-b58473517f2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772792470, "uuid": "2d969ed2-dd22-4a57-9487-2d9225d3f6bf", "value": "215e8de734ec872836c1b451178b7f54e4f3c366bd5b48e9e9cea3a9d1b9c16a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13966449-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772811317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811317, "uuid": "47d70fa1-7783-430d-977e-090bee9ce4b2", "comment": "Malware payload (Formbook)", "value": "2aa41e684b747969da47764890d4a1ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811317, "uuid": "e34cfa6c-5189-4d7f-b708-5522e153de7b", "comment": "Malware payload (Formbook)", "value": "2175b1210756dfc0ba7e02003350de625bb832e4b7bc1e6d1ae945d87593ffa8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811317, "uuid": "7cf9cc93-fb0c-41a3-980f-d60bdc39d7f9", "comment": "Malware payload (Formbook)", "value": "faf8115c06900d21262a9e644eb574cd66f233e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811317, "uuid": "4a82562a-fb43-4b8f-a06f-08c758943691", "comment": "Malware payload (Formbook)", "value": "3451232fbe82298e81d8d7fd24e5b550acd6df3869e1c4f6acb9efe98f963ee20d98946a90dffa0a59963cb4dce3a3c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811317, "uuid": "1dd33551-99d9-4a4a-808c-9b104d43c1bd", "value": "T1698412216264DC97DAE205300577AAFFEAAB4DE89061A3471F443FA73C31AB6540F793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811317, "uuid": "e00cc31f-724f-4eea-8a53-37450a5d2c6b", "value": "9a16e282eba7cc710070c0586c947693", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811317, "uuid": "4a02024e-102b-4068-bcd3-18c788eb6756", "value": "6144:1fYBQgD3HSlhoMfJvL4AScFzwXlYsWbrz3kNpX6gbFC+0WW0h8V6DxzP+XNF/Z1h:aQkSlLJecaVtWWjFrJg6BmZqs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811317, "uuid": "b04c5303-a5b7-45dc-9bba-8c96da369fff", "value": 388400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811317, "uuid": "51294e16-c99c-427b-8e28-88ef4ebde21d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811317, "uuid": "54b0bf8d-85d1-4dc5-bd71-4666822cbabf", "value": "2175b1210756dfc0ba7e02003350de625bb832e4b7bc1e6d1ae945d87593ffa8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05615a14-1946-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1772792395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772792395, "uuid": "1d2cec7a-e1e8-46ed-b3d5-14bf07830950", "comment": "Malware payload (LummaStealer)", "value": "8d3221aaa4e43dec4d25b67adfa48823", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772792395, "uuid": "663cf882-5d6e-4d2b-96c5-1a5f3b842d9c", "comment": "Malware payload (LummaStealer)", "value": "21fd32c7e7fa106466bcd80bfc22263be9b415a583daf4f3f9a698f7d1aa9f46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772792395, "uuid": "430d67f8-f1c5-473a-b463-29d6daa79391", "comment": "Malware payload (LummaStealer)", "value": "afd50825bfaf0cbaf45f4e8dafe0ea8b6de52552", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772792395, "uuid": "0fe3e871-7615-4920-a12a-1f316d2e9eb6", "comment": "Malware payload (LummaStealer)", "value": "2c039560bb9a4151311c8fb006e20ec600916a6b5e818c5093e3b8425787423ece247778cee54268b90bd783c69d8ed9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772792395, "uuid": "93284cfb-ce7d-440d-8401-dfc278ab8a9f", "value": "T18606E171AEEE2123E5CE32B084947741AFB5F8D997C10196F9E83B564C3544A3F3B826", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772792395, "uuid": "8a30aa93-915b-48f2-ab9f-a21d60cd6d1c", "value": "98304:362OQrAiKQGBc3dMZ+1+SDCJB15Sr+uDT1O5O1q1SW8qrp:q2OYGBi+BJB15eDUmSr8qr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772792395, "uuid": "c28270ba-d7aa-4ba3-95c2-981931e51d45", "value": 4017152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772792395, "uuid": "6ddd0058-29fa-409d-a13a-b21fb1a0246e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772792395, "uuid": "5fc3a780-31ef-413c-a4cb-9a6dc7a8a273", "value": "21fd32c7e7fa106466bcd80bfc22263be9b415a583daf4f3f9a698f7d1aa9f46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a76ca2f2-1972-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811565, "uuid": "1d80d4f1-ffc2-43e5-aa21-c82b2062a6f1", "comment": "Malware payload", "value": "0b668c6eb859c11b40ca1e3a2598fdc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811565, "uuid": "e398e068-ff5b-4808-81c2-76be3fcfda58", "comment": "Malware payload", "value": "2208c2e697533a9bc14697830eec988f9c95fd90bd56b03d7ab78e45a15dad8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811565, "uuid": "8e18143b-df72-494a-81d0-1baeecfd6cb0", "comment": "Malware payload", "value": "2a77fe211a43021a00ac7050a634c849b9e53510", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811565, "uuid": "613ef31b-65b5-43ab-a270-4a4b9ba0ae6e", "comment": "Malware payload", "value": "c35ee1d0d4b85ae65341cafa7301903be6e4fc38ce3bc0f14bcfe3da3cfb733a7cf9c1a08e77b604739fd8a1fe17dff5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811565, "uuid": "061eb0ad-838e-4a6c-8a31-ef661de9f38b", "value": "T18194E812E6507426F99749B03D79A256742D2D362A40EC0BF78D9F4A3B71683B0F932F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811565, "uuid": "6f7e5aad-7eb6-41e2-a0ed-87722b998fd8", "value": "ada24baf6095c39810b12ea76fa114d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811565, "uuid": "34ad628a-0490-4c32-b50b-731f92f87c85", "value": "12288:ubqbz+OurJvIxBrW0Et6QKv9+IlkvL6rRmzRyXSy:u8v99+Ih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811565, "uuid": "c756a2b3-9f8a-468f-9eda-9eec05751f4e", "value": 417792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811565, "uuid": "9a72c79c-44f3-4e68-acc5-3e26a4048aa8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811565, "uuid": "4c7ce08d-f95b-4305-8c7e-fb096c8058f5", "value": "2208c2e697533a9bc14697830eec988f9c95fd90bd56b03d7ab78e45a15dad8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1d08dfa-1969-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1772807797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807797, "uuid": "34e380a2-4454-47ae-a6b1-e09051ae7404", "comment": "Malware payload (SnakeKeylogger)", "value": "12c611cbb592ead587a308a2add0f42a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807797, "uuid": "1a19b0a3-fac1-4f8b-bd5a-d46ba7f0bbf9", "comment": "Malware payload (SnakeKeylogger)", "value": "222f7e11de06bf254381e704d4f100646e109cf4b1633acc8c982c39ba58a4d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807797, "uuid": "97cd8265-0bc0-4e67-987c-be9ab45e5430", "comment": "Malware payload (SnakeKeylogger)", "value": "b2bedd8d592b05536b2d398dfaca579dacc1fb40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807797, "uuid": "1a6af3fa-88bb-4f7b-b472-7ec063e74daa", "comment": "Malware payload (SnakeKeylogger)", "value": "5dcb788e817dd5a512ff61f8f00a4aa30886b6ae2fd8d64467b437b59941afcc513f9597f7600510cc1d83f098046f32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807797, "uuid": "02daa11d-3337-45ac-ad1a-16f9fcae58c1", "value": "T1ED35124E7779AEA1CB1C0F77D893654882E5C456C272F34A04D95DF20DAABC8C64FA83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807797, "uuid": "fd3e0dad-dbf4-4a6f-91bf-ff11d0dca7b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807797, "uuid": "b375f67f-8261-41e8-aa07-328503dd10b3", "value": "24576:09dUpFS1u8p/iTnLmrL6QGKqgxbgVxL4hg6DHHX6ey33Varh9CJ4Sh2:2aLS1u4aaLegGPkg6r36ey33YXCth", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807797, "uuid": "37298c8b-c5dd-4ee4-8768-b1d6b553f7d7", "value": 1103872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807797, "uuid": "4c022449-d250-4c5f-8c21-01f215de1de9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807797, "uuid": "7e5c4eeb-885e-4067-8a87-6ca545310c81", "value": "222f7e11de06bf254381e704d4f100646e109cf4b1633acc8c982c39ba58a4d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81b35ce3-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1772808924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808924, "uuid": "bfb3aa7b-4cc3-49c3-bcc2-a08d1e131793", "comment": "Malware payload (GuLoader)", "value": "458a218ed3ea4b86e96b6aff45067cc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808924, "uuid": "1179d959-b637-4bd6-8b05-e8d104c53094", "comment": "Malware payload (GuLoader)", "value": "2252c8e8cbf72fb0185c8ea1dbde6551898307e8fbbefb031f26ceff869c60ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808924, "uuid": "e799445f-efc8-4d48-9527-b0fa82fbdca4", "comment": "Malware payload (GuLoader)", "value": "fcdd4c75fd9fda49d7f4b341a9c2887856ed93ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808924, "uuid": "5de0b431-a4b6-4d5b-90da-6b637ccb3371", "comment": "Malware payload (GuLoader)", "value": "80dd495a833de4b69d13891394f332b06571b761d06b7fb473bdc2c077cf39d66cffadb237b3bae26d4bd2594eddb949", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808924, "uuid": "4a90649f-4c4b-4b6f-b1ce-279d5464aaef", "value": "T112452310B6E0CAF2F5EB0F304AF983E5CEA6ED81555452069F093E5BBC375F1640A647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808924, "uuid": "37f7a303-608f-4bcf-94e8-7fa086411f05", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808924, "uuid": "cc21c771-80f6-45a2-81a9-462adc07ef69", "value": "24576:TPd0EGusLgaADxjugwJ0AohkQasxHLBhBaznGLN05TWa8Qtoqu8qp:phSAa0Y0HL0zGLNeVtFG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808924, "uuid": "b1e4af7f-2d1b-4741-a825-a6eecef2f0a4", "value": 1173224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808924, "uuid": "0916ae97-3760-4513-a7f2-e34cab46522c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808924, "uuid": "971f622a-a7a9-4ebc-a5ad-920c64acec83", "value": "2252c8e8cbf72fb0185c8ea1dbde6551898307e8fbbefb031f26ceff869c60ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e29cdabe-196b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808657, "uuid": "8402127b-8bf8-4a52-9bfd-b47e3b180130", "comment": "Malware payload", "value": "1db57b053ffcf1ee4e918cfd53c4d39c", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808657, "uuid": "2858f1e7-4b6e-454f-ae24-03583f49e3e3", "comment": "Malware payload", "value": "22dc7b5460c050320680cd2164360acfc4f63964978bec1a82f66451dbcd0c82", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808657, "uuid": "864111c2-822e-4483-8b84-9d43b7bfc921", "comment": "Malware payload", "value": "828ba3b0d1d8cfb10820b9a310a3dfe2dfbd158a", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808657, "uuid": "692d3b1d-e5eb-479b-87f4-05eeb6c4b6ad", "comment": "Malware payload", "value": "391cf0c4fcbcd0205b8f78600a45f65b65974900881a29b16f8bcd8892b60a8c0d997bc67e806a630eb7c7775f093225", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808657, "uuid": "146b018b-2cdd-4483-bd9b-574f75ba384f", "value": "T1F8A5338B6994CD03DA23933900624633E055B0AB5D6F7F6F8EE5421FB9F74E23A16748", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808657, "uuid": "089f8c65-0e83-4bbb-bbaf-83e2b4f7b410", "value": "49152:6R/+91nDk36I9wizBREQ/SgzsaUVWfdHnu16lHUY0tggx:n91DXWFAa3fFue0YQ3x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808657, "uuid": "05bcbbd0-f6f6-400e-9a3e-d0851003260e", "value": 2244958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808657, "uuid": "a7efa73c-ef63-43a4-b84a-067a969f484c", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808657, "uuid": "abbb70b1-6d58-409d-89c1-7bafb335be95", "value": "groaxbaba.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a76a7e0a-1929-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772780211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772780211, "uuid": "7c4fdc3e-fbc0-41c2-b42f-1b773205af52", "comment": "Malware payload", "value": "ca8ccf8cacd0afb5a82cacf18df507ad", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772780211, "uuid": "0dbddafd-d2e3-49eb-8a76-1856e24b79b2", "comment": "Malware payload", "value": "235b25b7d9cf6f6a7ef4ab6740404f7a9656b8b7c3242f48d9a4e0076ccb196e", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772780211, "uuid": "e20fe4c8-54dd-4a60-b779-88c8d8eefe06", "comment": "Malware payload", "value": "d111ed2c478c3cae11cd813480e2d496f18e89d8", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772780211, "uuid": "5e03e0dc-2fef-482a-abca-56b1e8a78e28", "comment": "Malware payload", "value": "3dbc0dd13005c28f01e13a4caf1574b485a0062b3d07144716ff63e7f27d91a4fd059ae04be576b02577f87a03fb27e8", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772780211, "uuid": "6d626c74-70b5-46e6-b849-e2d713ec6b76", "value": "T1FC24BE142C05B95847B8445AEDAECA32DBD76613C4217C063A9F34A12FE732897B3DBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772780211, "uuid": "079d2c7e-6050-4918-b57c-aa9de2a0a3f4", "value": "3072:kRvl6/4zpywzjGXbv8bjLk5CJS2h5o++kY10u/vV5qGOcoy2PK:AS4zlOrN8JzT+F10unXqK4y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772780211, "uuid": "d0a49bd7-5b22-48c4-9c72-02d5e0a2ae5b", "value": 218215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772780211, "uuid": "5ed5fb1c-7644-488e-b9f9-bced87486cb6", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772780211, "uuid": "d832976f-0075-491b-b461-71922c7f7b95", "value": "Protected (2).py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8c67fcd-193d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772788938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788938, "uuid": "7c569ce1-d8ed-4d9a-ada2-7ccbd6fa465f", "comment": "Malware payload (Mirai)", "value": "07d58afc18a9c0e054233da4425445c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788938, "uuid": "642219e1-aba9-4682-bc92-f0c0a491144d", "comment": "Malware payload (Mirai)", "value": "239945186e89ccc7255beffce0d329061a3d2e472a2183aa4edeb04be5045cbb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788938, "uuid": "a6d7f669-218f-4f24-8332-ce4511cab93d", "comment": "Malware payload (Mirai)", "value": "b0a9f3e5f76c9196c8e014768c1c82d3f0de130b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788938, "uuid": "c9acd16f-1209-4ab9-ab5e-1a575244bfe0", "comment": "Malware payload (Mirai)", "value": "c7cb86c94802d1f50b945e008e241707b5fca23c22c6fea7721e385bef128adbae07a6b236961969eb3319e886e7bc78", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788938, "uuid": "9f0f524c-cdc5-479f-a2bd-4f6ba47ce1ff", "value": "T1CB6302703719EC3A22A09D72FEFC8656566E09B1E2BB51331D60DAA93445D89248F3A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788938, "uuid": "82928d03-c179-4108-809e-aaadd1961693", "value": "1536:xee5+Hx/E/1RMXspkac4fxCMLOLDzLJsP:xL5+R/O1dkiwMLO/zLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772788938, "uuid": "9e503a6e-7b2b-477e-9584-352a912df401", "value": 67192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772788938, "uuid": "e7f0edc0-53cb-481e-86d4-e13201d5c9e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788938, "uuid": "efdde0d0-1ef3-4653-a232-a354a4e06863", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b47069b-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1772811303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811303, "uuid": "e0eb4021-755b-4d1c-8258-4b5496b0e6e5", "comment": "Malware payload (DarkTortilla)", "value": "a4d4373d575da8723950a3a627253c38", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811303, "uuid": "2f9508cd-37d4-4c72-8a93-27a5caa2c243", "comment": "Malware payload (DarkTortilla)", "value": "23c50a813e364b3dc9a7dd6a496e463fb8e0f3de3d590401305b32cc61741849", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811303, "uuid": "2beb5b53-2b28-4228-8246-800a53d3c1fe", "comment": "Malware payload (DarkTortilla)", "value": "2b24bd164d232df610f29bffa0d6e9e0d339e00e", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811303, "uuid": "3b79cbdc-0ed1-46e3-b468-2890cdda3fde", "comment": "Malware payload (DarkTortilla)", "value": "5d7db8e43cd4ab96916c7f018b3011837749570d18f583f5c30a065e6589a46342ddf138247edce6de4753512726d72a", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811303, "uuid": "18b18492-774a-4639-8881-4ca4c20592e3", "value": "T13E35E11A0DC36A64C1A98F38D27504E863F0C65B5252F3AFAEDD42F4DE57B8ED902493", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811303, "uuid": "252caf84-4022-4f5b-8e87-b5355fe0a382", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811303, "uuid": "b84b5255-c97f-4d97-959a-b6f59692a976", "value": "12288:rn0rM3IrmN0Nw1HBY7sOft8VHrqR4SKGjyYe4xlryvQ3Nn+dJad90zoJlq+:r13saJ1a7bfJRe4xl+vQVbd90z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811303, "uuid": "c9d80d69-1d99-45a6-8b44-751ef4883321", "value": 1133568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811303, "uuid": "3bc8b3b8-ef79-4a30-9556-80e138521dbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811303, "uuid": "93cba949-3971-4399-9e32-c1944a8a5450", "value": "23c50a813e364b3dc9a7dd6a496e463fb8e0f3de3d590401305b32cc61741849", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e7b646e-1969-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772807630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807630, "uuid": "9d03a1da-acd5-4795-b00d-91ac0166fd57", "comment": "Malware payload (Formbook)", "value": "70aa389f7f478d6632d95e7c9fd31a80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807630, "uuid": "1ce69b11-a8a3-4669-9017-2c0969bab07a", "comment": "Malware payload (Formbook)", "value": "242dedca69c062e566588f42ecdc7e7efc9f37d06eb5793af59bb956c53c72b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807630, "uuid": "ff43a936-7838-452c-b0b3-fdafba95580d", "comment": "Malware payload (Formbook)", "value": "a22c38b7797cb3fbf3c7b879328662ebed6307c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807630, "uuid": "a27a3096-f12f-48ce-bc4f-96dd3fc5150e", "comment": "Malware payload (Formbook)", "value": "7ab595ce5baaa26a7e59ec5e4757840654cdcfe40b0828cc3fe253fa7779f718e613e9e236bee08adfe76b90a4365a42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807630, "uuid": "c704d80e-01ee-4403-8e51-c844e57091b9", "value": "T1BC35121DF7786F11C71C4BB7C8136501A2E3C066D633F34A99CAA9E50E36789CA8E953", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807630, "uuid": "256af8a0-c232-44da-9b74-1d01778852dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807630, "uuid": "17beeb2e-b481-48f8-8afb-f5843fc1c573", "value": "24576:eswtVsPzThH6Ne4r5mle99Y8KIymCVnW7pbjQYQMVKS:rsVsQNeXlbvmCVnW7JFbV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807630, "uuid": "cf0fb827-a92e-4e0e-bfb0-876bae3dc6af", "value": 1098240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807630, "uuid": "130ba1cb-3410-45fa-a1fa-9db49164458b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807630, "uuid": "c874af5a-c9c1-4f8e-aafa-900e2459cc2b", "value": "242dedca69c062e566588f42ecdc7e7efc9f37d06eb5793af59bb956c53c72b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49f14c72-196a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807972, "uuid": "627bdc0c-2267-4b8c-8378-b87f242fe358", "comment": "Malware payload", "value": "8f5465c495554e91524240c6de4aea7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807972, "uuid": "84d7d7a4-34cc-48df-9367-396499d7bb3b", "comment": "Malware payload", "value": "244164b09f351a3a6cc61d957423962ccc6d14aeac94068068cb49265c05f918", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807972, "uuid": "c0902d1d-1afb-456d-9a53-169af348fe7a", "comment": "Malware payload", "value": "81b37fcdc3f8f2ad4671fe4f743badbb908f6004", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807972, "uuid": "5649bbc6-b553-4b1b-885e-5be5423d4f24", "comment": "Malware payload", "value": "180f17fa12adcc6d2e2e858372955ba2a9ff5601332a10cb89d7d6e965de060dc1dce7a2ca40986307a2b963bc7a3942", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807972, "uuid": "8d396aec-e74d-4d57-baae-2776748c54c3", "value": "T106151202B350C82FC4A307718976F2696774DD50AE921B4723C9BF6B3D72792D90A36E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807972, "uuid": "a352d215-0cc1-4d7e-9fc5-5fa02cd9fa5d", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807972, "uuid": "7ff33f42-b5af-4e34-8385-bc41b94e2ead", "value": "12288:fRpRwOvZXDEuJWXGEk5G0kf+5u47dm6+CHSy7+8892YTQ/Ue1Txon6dB9mf0+5Cs:fzO4zEsWmG0aauYyQ89PMUmTz1+5V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807972, "uuid": "d1ca94eb-4a7d-47b8-822d-4a9ed3e3726f", "value": 940968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807972, "uuid": "07b39757-4ebb-40a2-abeb-68701eda4f0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807972, "uuid": "8527cade-fae6-403f-9eb2-7e9313f06dc7", "value": "244164b09f351a3a6cc61d957423962ccc6d14aeac94068068cb49265c05f918", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa7a4d31-1983-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819005, "uuid": "a30e9dc6-62e5-46eb-862a-5302ad95fcf0", "comment": "Malware payload (Mirai)", "value": "6e427110113f65ab8aa3cd81bacbee09", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819005, "uuid": "d74d80a0-4177-496e-b8dd-f13f31529873", "comment": "Malware payload (Mirai)", "value": "248474467abab21e8d2bb6421bc36318ed8858dabcea0d89a521d9127f47dd6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819005, "uuid": "a0275344-e13d-4d3b-868c-647a4cac094d", "comment": "Malware payload (Mirai)", "value": "74609c9da104180137a6f40f8b30132cf76d0d43", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819005, "uuid": "3325f159-3d2c-4687-8c9b-aacbeb542ada", "comment": "Malware payload (Mirai)", "value": "0d7af0bc15e4ec99c7d9cd9be272113be2c1dcf466c57283e05e84af158d9f306edeb2309674eeb051bcd8a3e013e71f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819005, "uuid": "6e5f0006-806c-4ae1-87c4-ea47b1bcf8a9", "value": "T196936D02B70C0E43D1675DF02A3F27D1D3EFA6E121F4FA88791E9A8591B2D361586EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819005, "uuid": "fe7ec438-9612-4bda-933a-efb3599c13bf", "value": "1536:J0kTGvVuQTzBrwJi9Ma5xuUugrdCzG6dp4qKLHh/G2MivyC/r5jugk4tJm:J9O5T/fCi+4qKvMxCRjm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819005, "uuid": "db71adc5-96a2-4b90-a697-cfd98550a3a0", "value": 92048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819005, "uuid": "5a3b4dba-415d-4844-9f3e-4f5c80c912bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819005, "uuid": "973d7548-3144-47a7-9621-a2905886da83", "value": "jawirbot.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d85b54d9-1949-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772794037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794037, "uuid": "3c7823df-7021-466e-acd1-614246d78d82", "comment": "Malware payload (Vidar)", "value": "6e17b665c5e7e4ad3bde127b2cdbf54a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-OpenClaw", "colour": "#525D1F", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794037, "uuid": "21f8a6e0-0437-4607-b5ce-19dc01971a62", "comment": "Malware payload (Vidar)", "value": "249058ce8dc6e74cff9fb84d4d32c82e371265b40d02bb70b7955dceea008139", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-OpenClaw", "colour": "#525D1F", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794037, "uuid": "36ce2afa-f02f-445d-b216-e808c4395404", "comment": "Malware payload (Vidar)", "value": "a26b3a264022d2228e39d78b6720f9e80c984265", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-OpenClaw", "colour": "#525D1F", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794037, "uuid": "68a57762-d454-41a3-986c-7974bb8e6c73", "comment": "Malware payload (Vidar)", "value": "1f99199fa88733b15b6e9ff5aac9e24930f86cd5e646ec9755d4a24efe06b6715cf8cfeda73505376fb8d8d02683db14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-OpenClaw", "colour": "#525D1F", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772794037, "uuid": "38aa02ec-5713-48b6-b37f-cf002bb371f0", "value": "T199282202BA5B2968C15EC8B0D2474A934F3130DB123AA5BF50E941743FAF7B49B3E795", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772794037, "uuid": "74a4fd22-d44c-4aa9-9993-1a45f2a58555", "value": "0e25cac53c037625c8c4fabe299d447d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772794037, "uuid": "325f069b-ac30-474f-9ec5-b52a2373218a", "value": "1572864:qFGEyIUeSLAs2d2MhBGUhXRS4XlGn0fXt8wrmjWVhEZWxQOPX745pSs97FtrZFfK:+pyIY32VhEUhBS4XW0fXtwqhN+H5pJ9b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772794037, "uuid": "f4082c19-20aa-4c5f-a8b7-d7b8bb64c716", "value": 94364160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772794037, "uuid": "6488260f-0019-4797-8dd9-771cc2fffad2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772794037, "uuid": "57f77ce7-d346-43fd-82d5-dfc4e4006552", "value": "249058ce8dc6e74cff9fb84d4d32c82e371265b40d02bb70b7955dceea008139(1)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0527aa83-1959-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772800555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772800555, "uuid": "a5123eba-0bd3-45b0-9306-ecbcc63fa73c", "comment": "Malware payload (NetSupport)", "value": "61e605628915d2cdc3e0d35d53efe2b0", "object_relation": "md5", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "PenguinsLocusts-com", "colour": "#8F752A", "exportable": true, "hide_tag": false }, { "name": "redbegonias-com", "colour": "#73EAA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772800555, "uuid": "ebb17578-0184-40d5-8351-be5933a4981b", "comment": "Malware payload (NetSupport)", "value": "24acf01252890d6616f00e222560f2d2f2796aeb8b26c916222b35c071454c8c", "object_relation": "sha256", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "PenguinsLocusts-com", "colour": "#8F752A", "exportable": true, "hide_tag": false }, { "name": "redbegonias-com", "colour": "#73EAA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772800555, "uuid": "fd9b09ec-de61-44cd-8350-29df92f27e90", "comment": "Malware payload (NetSupport)", "value": "80bd31ab49d3111d33eff8a2f2d4c880472c1f58", "object_relation": "sha1", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "PenguinsLocusts-com", "colour": "#8F752A", "exportable": true, "hide_tag": false }, { "name": "redbegonias-com", "colour": "#73EAA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772800555, "uuid": "8f6c9875-d19a-4339-91d2-012bbdd5e0e2", "comment": "Malware payload (NetSupport)", "value": "50224495fe78b978dea2691f539b986cc1e21106df22a3e84877910293e9769f09d3d6df3f00cccde763122df8c2e952", "object_relation": "sha3-384", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "PenguinsLocusts-com", "colour": "#8F752A", "exportable": true, "hide_tag": false }, { "name": "redbegonias-com", "colour": "#73EAA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772800555, "uuid": "adedb051-95bb-4dbd-a0db-f61588f0932a", "value": "T1C7D533F56ADE60B1D81CDE3E2F9D53281ED0FC558DE432EF95E61F49820072DA03629A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772800555, "uuid": "3af818c5-715c-4e0c-a095-f05446cd6a3d", "value": "49152:r0AEWQiHzNTEjKW4ZYnir6iOUj/UP/ErtHEUoN/nNWbvU/wIT9no4N3wrHL2xi6G:r0HWQUZ4WbrG8UHErLohEbc/w69noY3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772800555, "uuid": "b91ac061-c67c-4199-ac69-7030dc211967", "value": 2985970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772800555, "uuid": "d77104e0-44b6-4dcc-b124-1a4042584973", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772800555, "uuid": "abb4e631-6c77-4edb-8d21-f5e5c299160e", "value": "24acf01252890d6616f00e222560f2d2f2796aeb8b26c916222b35c071454c8c.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0516ca0c-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810863, "uuid": "36206442-6c0a-43ab-8020-eaef3d69a792", "comment": "Malware payload", "value": "9d3c4925a3fcead7c74aaf9ed001af94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810863, "uuid": "8e670774-f08c-40f5-9687-6e9f8d935f53", "comment": "Malware payload", "value": "24de848413379c2fdfd7e2b9c54c5529d8cca71b853e1700e5307896e952353e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810863, "uuid": "dffbdbbb-3a75-466d-abdb-94cc1ff330c9", "comment": "Malware payload", "value": "8d2b9e9f16d38bd6823e2d1535313062fa02101d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810863, "uuid": "e96dbcce-2d1e-4f9e-98cb-171d456ce161", "comment": "Malware payload", "value": "c4b86a3159f636e169bda082189044425dfc5ca4e50bcda979824a58008a0ea0048d55935a5ad51fc2c7503fc710b0e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810863, "uuid": "a68fbb95-f0b8-433f-8cd1-b014d3996973", "value": "T1DAC4230857A14423DA130E751D7B592AEFE6EF526428678357008F9C7E237A2E4AC3DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810863, "uuid": "a78e052b-7b59-4357-8254-f61e57dec922", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810863, "uuid": "5935db80-55f5-4db4-8c8b-8ab83962f6c2", "value": "12288:21yDJT9L6c3vydE9Kp9n2ymJd05EWRwFYkZ2ENPha0E:21yDJIc9Af2ZJdWzkZ2EPHE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810863, "uuid": "60244fa3-41f8-4e10-b12f-9dc12a948e94", "value": 583352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810863, "uuid": "6c025583-e0b2-4ab2-987e-d36ee77a274a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810863, "uuid": "1e6891f2-5f74-446a-a5a5-09384ced10d2", "value": "24de848413379c2fdfd7e2b9c54c5529d8cca71b853e1700e5307896e952353e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f625f50-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772808974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808974, "uuid": "840b6fc8-4efc-493a-9ff0-ea352cab0e42", "comment": "Malware payload (RemcosRAT)", "value": "5a6d62ea3a2e2058a66a03ad2dc8ef89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808974, "uuid": "d1f9f485-bd88-40a8-a7de-384ef03b55dd", "comment": "Malware payload (RemcosRAT)", "value": "250c53b26a89388b4d85e6fe3751c900a4def99755b4e4605fa5cbaee1489257", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808974, "uuid": "52289ff0-83b7-4c92-8213-89ed83781c2e", "comment": "Malware payload (RemcosRAT)", "value": "0af2b662e0a317fef201ff8e4d0977ad45c3ef8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808974, "uuid": "6f707279-0d57-4899-83a0-fb57a0e16ed1", "comment": "Malware payload (RemcosRAT)", "value": "542e18a65f2224877fbaf40372dba99636232db371ca21f930fee10f4f3cd1430200fbe3e122911813f881d25947d68f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808974, "uuid": "5471dbae-d4bb-4548-81b9-2d79c570a51d", "value": "T1FF84F24BEB1BA910C2858873C9F149FBEB706D53A495083E3352BF1A8D3568ACD1917F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808974, "uuid": "a0c4fac6-53ec-4a2a-9a7f-1fa1da9869fe", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808974, "uuid": "0c8c26be-5cf9-49f1-bbf0-70fda0ac8a79", "value": "6144:7NDlOLZLClTgENs/+OIWHaMiWeqIf83XdDKMuCJX9nZb:7k8TgENs21DVkZHxJnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808974, "uuid": "4cf99494-9acb-48a1-922d-2ff8b0b73de7", "value": 395872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808974, "uuid": "e7f1e743-d1cd-43f0-aef3-935fa5bab2f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808974, "uuid": "59e9c658-7d26-4e09-9645-2a012ec077b0", "value": "250c53b26a89388b4d85e6fe3751c900a4def99755b4e4605fa5cbaee1489257", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73c528da-1985-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772819638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819638, "uuid": "a70f51fa-2011-4ac4-92d5-60033cacb220", "comment": "Malware payload", "value": "12f8ffd83a1f4be008f640b46f119625", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819638, "uuid": "07c6bfe8-a46b-4ff3-ba26-87b6316a43f6", "comment": "Malware payload", "value": "254d43c932647cea4d9ae0979ee9c20d59361b07f3defdadf4bf9caa9f2f9c69", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819638, "uuid": "535c014a-37de-474d-860c-6f6c6162baf9", "comment": "Malware payload", "value": "e44bc641ef24371b5129750e2c4ef4034f12e988", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819638, "uuid": "85d4f478-a11d-4578-befc-c4ae91983c1f", "comment": "Malware payload", "value": "6ee9fc42921ad136c59f3290174daf8cc3ba3420d52b0c8b71fb9134fbb1c587ee1b77f8160703536837536cca14300b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819638, "uuid": "dbc90484-e3d3-4bea-80e2-0eff3b99b3c2", "value": "T1C80197077123A2B0570F00318B8BB1E0B11A391FA4118E2C3E89A5387F22489BAF66C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819638, "uuid": "07eb8c00-a273-45eb-bb0e-6d65a35e67f6", "value": "12:AzCtih/3HMl2RHj9OEww6smNbBzNRB1fbdDkzlMUm9SksuIq1+jrMyms8Magzq83:AzCtipM+dwDtzbDRkzlM+kNIq1+rms8u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819638, "uuid": "86fe17a3-125b-4b06-96a6-385ebc606c7c", "value": 724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819638, "uuid": "0caed6d2-92f7-42f1-9453-5d4042f14bb2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819638, "uuid": "b9f0d932-2006-4034-8889-f962f6a6440d", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8947c390-196d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809367, "uuid": "1492fbf5-4188-4fb2-b8e4-14ac77fd1f18", "comment": "Malware payload", "value": "6233f318d3c065071db4acf309f4d70d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809367, "uuid": "9a3dc531-045c-403e-9533-2be2ea264220", "comment": "Malware payload", "value": "255e4827ae35c0dd2490699e7d0f9056c6aa35e43f63ed7d9ad9e25f4b7742b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809367, "uuid": "ee180712-a75c-4554-a89e-c107b5acc814", "comment": "Malware payload", "value": "d8679049f57e579508ccf1b96c31b82d9e2b337c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809367, "uuid": "7828c60e-cd0d-4a69-999e-8fe88bf87d0b", "comment": "Malware payload", "value": "9dbce79042ce49045d4e66676a9576284e9d3bd531df66606bb644b6ce623ee5388c0cfb09abdd20fb068d92db21b348", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809367, "uuid": "73de2ee0-fb59-4442-ac3b-b62a42a1762f", "value": "T11045D05527E84A58F4FE9F39257824540BF9BC679A3AD72D2A4840FD0C72F41EA21B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809367, "uuid": "64ed8200-4370-4772-a6a4-f6638493bf6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809367, "uuid": "7a648550-a03f-474f-93cb-86faaf161b16", "value": "12288:SpJyryKMR5ZKGszIMjy1j89CFnLT/N0HPNI0iAxxrKXBxoo1C7z1K0XGeglq7ehr:j+hpLT/4PPH7caoc71Xng07ehTwxZ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809367, "uuid": "199ddcc2-9181-4eea-8fb2-1a8f50ca143d", "value": 1188864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809367, "uuid": "2ef60a43-3543-48e4-b41a-a7fdc2baad41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809367, "uuid": "2154dc0a-2a77-49ed-997d-5e9c6e48e778", "value": "255e4827ae35c0dd2490699e7d0f9056c6aa35e43f63ed7d9ad9e25f4b7742b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9058fc1d-1975-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772812814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812814, "uuid": "b783d1dd-d907-42a0-9e21-48293ca72846", "comment": "Malware payload", "value": "dccb7c68a468d8d314735e82e1400ef2", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812814, "uuid": "cf3f751e-fe05-42d4-ba31-def3390ffac0", "comment": "Malware payload", "value": "257323ac48e09c2300074e6aa19e196705861266e6711a1eabcd5b2e8cefcbce", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812814, "uuid": "143b745b-b3a2-4d01-b7e4-6cfbe0b791c6", "comment": "Malware payload", "value": "5bbb2742040765d7dda813c7b096b491ded01358", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812814, "uuid": "d2d8f3f2-fc3c-4be6-9110-ab128c336f39", "comment": "Malware payload", "value": "3cc8979bb1e86d9f0ede2d2f99ef1afd7123b27192fda9b5007fe1e36bdc7c8b38ec8247e37ee06b0859918daf5f7d86", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812814, "uuid": "0b353f3a-1658-4c9f-9ba3-1cdc189f609d", "value": "T13A464CC4AAC886C4FC136C7576A0E0E4458D56E7BDC9E412E41F6EB5BEB20E1D4327B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812814, "uuid": "e35829c1-3c03-4a7f-be40-fc2397b6001f", "value": "98304:GatwRzzE4M66PCsFidNNImzeVhZvWZqPGKpKoJyiACk+9VkW1D+oLQOKHIiMuATe:Ga+4KNumSVaQPGKpKIyiACkCVk8MOjih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772812814, "uuid": "d88b130c-1454-417f-badd-e794af81a0a8", "value": 5871616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772812814, "uuid": "ef62ea1f-7d62-46e3-9f13-3008e2332b5c", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812814, "uuid": "de9e0d7e-1342-416a-8b38-6a78d6a475da", "value": "nPedido_de_Comp.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5562b244-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772811427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811427, "uuid": "b97b109b-8b4d-4152-8950-2947c6d7a6c6", "comment": "Malware payload (AgentTesla)", "value": "75c00d3d849035817bc0ae90daf2f202", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811427, "uuid": "71f67314-a21f-42c1-92a5-599a0fe69015", "comment": "Malware payload (AgentTesla)", "value": "259c9097a874797d7c06c733a96b81325ec2621a793b08883fb86583c1da4938", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811427, "uuid": "9a9db1d6-9fc6-4a37-8f35-225eb191ce7e", "comment": "Malware payload (AgentTesla)", "value": "0d23f9b04b268c8a6cd438ff1b49255df70c9fb4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811427, "uuid": "fb18957a-3dab-4133-b2f9-e44cfe2fa17e", "comment": "Malware payload (AgentTesla)", "value": "8d8b570c6b451c906982e199db68e10c334d50d4a565dcd5de8f5515fc15d00fbf33851735b23cd14745bccfe053d59f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811427, "uuid": "67212507-d117-4a43-b1d6-669e6a12e4ff", "value": "T19D35AE0273D1C062FFAB92734B56F6115BBC79260123A62F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811427, "uuid": "e9ada7cb-fc47-448f-900e-36f88f261bab", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811427, "uuid": "2883edc8-3b62-4f6b-80fe-45a1ab7b4064", "value": "24576:C5EmXFtKaL4/oFe5T9yyXYfP1ijXdaFU6KG/4h/x:CPVt/LZeJbInQRaF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811427, "uuid": "50a792cf-4ffc-4120-82c0-23eb0e2ed7fd", "value": 1096192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811427, "uuid": "e9be4378-4e2f-48be-9f40-e2453287c15e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811427, "uuid": "31fb5c46-f21e-4723-8f77-8d8a18dc104c", "value": "259c9097a874797d7c06c733a96b81325ec2621a793b08883fb86583c1da4938", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e47870c-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1772810690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810690, "uuid": "53947907-5cc6-4c31-997d-384881f41b2f", "comment": "Malware payload (a310Logger)", "value": "d1287aa8b662b5e863bc66146cc43082", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810690, "uuid": "5bfbc0c5-14c4-4c81-b2fd-6a990e693727", "comment": "Malware payload (a310Logger)", "value": "259e187f28ee2f16b1d7ca85c2d5df072926abcac5f6f6412db64739f75e6a45", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810690, "uuid": "97aea933-f3d8-4d74-bdf0-7843f0911113", "comment": "Malware payload (a310Logger)", "value": "edd49b3405c07c65b0d830e4fadd61dbca264695", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810690, "uuid": "a801654d-8e99-4a4f-b10e-a806df7781f1", "comment": "Malware payload (a310Logger)", "value": "62c9d1844391e33584e3f0197cfd962d8d57486a92aa7bcdb97419bdf6a887825b955fef927c6689d83566e44ff7cc84", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810690, "uuid": "c55e1729-f70c-43d5-a1d3-b4e5deac1efe", "value": "T1C355CF027381C066FFAB91334B5AF6215BBC79660123E62F13981D7ABD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810690, "uuid": "dbe2be7a-c0c6-4b77-88cf-fddeaa81972f", "value": "c1ce208b1192bfcf652c179f34f034d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810690, "uuid": "097d8f14-f971-4986-8bbf-eb59ff770116", "value": "24576:b5EmXFtKaL4/oFe5T9yyXYfP1MAXDzbRk0DmztpXFnfpT21opMT+:bPVt/LZeJbInGizbRFmzXFnfIO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810690, "uuid": "233965be-8af0-4e95-a81f-1bb18bf1c88c", "value": 1360896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810690, "uuid": "28a7efde-9ca8-4665-b89c-b8baae9fa118", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810690, "uuid": "1ee556cb-3793-4f36-8b6b-4af5d6d22c06", "value": "caf1a2035a70c0706188075c8096067059e8fd0d68247f6b0901c3f6299c1c57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c46492e-196e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809667, "uuid": "487cb4b5-8d15-452b-a6d6-dfc3759b40d3", "comment": "Malware payload", "value": "0c86f54e4aeb0b0daa8f5d8b2bc129bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809667, "uuid": "a0c71eb2-8c51-4d4c-ad51-bcd53a02f49b", "comment": "Malware payload", "value": "25a4cad43620bed0d9f072a240efa436a1bde1f2012c7c46cc434afc9bfc562c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809667, "uuid": "ec084790-a34b-4e30-a68a-3bd38207e6e3", "comment": "Malware payload", "value": "84d1692dfef41980df0edec3aef5698d518f2711", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809667, "uuid": "228bbab8-527d-4f25-a469-16dbf53366f4", "comment": "Malware payload", "value": "c34a0b971ed2329ab812f0160df79b30dd7729ccf42e5ebc8263847aa38c490115f75716f37f8687cc738862479acd76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809667, "uuid": "a5754ed3-102d-4a4a-86e5-11d96a259a3b", "value": "T13155125C229DCE03C4EA4BB91A62F13563B42CDEA426C3074EE5BDEB74757F408C169A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809667, "uuid": "145de31c-ee82-4dac-9cb8-532f0b5c6036", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809667, "uuid": "2f0b848a-6000-4494-9387-e72ffe7302e4", "value": "24576:C/lv3Ni9R6Ruyge3iY57+rwat6tSv/eCzIflDyzbCkU5:C/N3OR6EdY5Xat6tSeffdjkU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809667, "uuid": "43c117eb-7803-4ba6-a195-97010bd4ea26", "value": 1288192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809667, "uuid": "2a98b509-7538-48f4-b673-2b91f39ec390", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809667, "uuid": "88fe5d84-3f2b-4a95-8a97-08a71c8fbc3c", "value": "25a4cad43620bed0d9f072a240efa436a1bde1f2012c7c46cc434afc9bfc562c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2352a211-196b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808336, "uuid": "25f8add6-797d-4af0-9139-f068769c194f", "comment": "Malware payload", "value": "49132bd89cb433e2b43642438f06004a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808336, "uuid": "063339b9-55b5-42e9-b0c7-a5bf83fb74af", "comment": "Malware payload", "value": "25a6a285e6daea738af9a9130ef2d83cce8b123fe3836adcec25c7ec663b8122", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808336, "uuid": "af4a6456-8e1c-48a3-a3ba-fd7a2cee4fb6", "comment": "Malware payload", "value": "bbee278408c59b74e7cc75269d7fa7c62a6df116", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808336, "uuid": "7d31bf11-faec-4ab6-bb45-39f67eb84ac7", "comment": "Malware payload", "value": "5c68d388656ce8377c43152b66242dff66d993342dd65a96c6ee524ec6c6e50eb0a378f0b73afd86415023ac27c8c42a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808336, "uuid": "6845d1f0-6ca5-49b5-aedc-2f4f757bfcba", "value": "T1BA25DF1523E95B68F4BEAB799274156087F2F903E732DA9E7C8C41DE0A32B41C652733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808336, "uuid": "4ce7dab2-0368-4fdd-bded-5e8a8739c663", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808336, "uuid": "d790ca8f-e55f-46a8-b479-5540e1ed669d", "value": "24576:VK9oarVBo6tgNExj4DsXng07ehp3xlADcwvI:gccayE2gGehpBlADRI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808336, "uuid": "64d68aba-0d3a-4fee-a955-d367b58f7385", "value": 1049088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808336, "uuid": "f9de3189-3ba9-4b86-9e78-36296e7ad94c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808336, "uuid": "fc5f8540-2126-428d-976f-ea4de516783c", "value": "25a6a285e6daea738af9a9130ef2d83cce8b123fe3836adcec25c7ec663b8122", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e6a2ccb-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811013, "uuid": "5c25640a-3ee1-4c87-9899-8eeb4168c3a4", "comment": "Malware payload", "value": "a1347ffb64867bc36b6e0ff875596610", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811013, "uuid": "54b7933c-5a5c-4552-80ac-81290dbb8921", "comment": "Malware payload", "value": "25aff3a127f8ebeab3836fe96da24f33cdb3cb3c895cbea3457739ec4f0c6c75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811013, "uuid": "ae576209-70de-4973-afeb-8a70410581ad", "comment": "Malware payload", "value": "8e59ef1d14662fd7d8f5ef53e6bfa99dc1fcb612", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811013, "uuid": "94c35bcf-ff46-4a61-8c4f-63886730ea69", "comment": "Malware payload", "value": "4c4e5d4a555c7d8d8ca4c6e209f05cbd69e44cd080b58b2712a80fdfb2d0c9957471678f7ec94fee05f947ed3be693d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811013, "uuid": "f6285f70-8567-4669-8261-749f98430d9d", "value": "T19425E0052D826B05C56D1B38C066D4B863F0ED4B9297D75F7EC82EFBBA73785CA02492", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811013, "uuid": "20a0a161-5d58-4d86-b163-00156cd2bd12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811013, "uuid": "e384050a-52ce-45d2-b321-42883d4a658d", "value": "12288:ku3S2Xpghk3IrmN0Nw1HBY7sOft8VHfF8MY6Im/rW+HM1BBmNWfjfznJKEmkV:tMk3saJ1a7bf/F6IV+sTBmUfrznt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811013, "uuid": "6836a654-9bfc-4c9a-83a5-a4a8aa9c1d70", "value": 1004032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811013, "uuid": "4e163a81-d561-4dd0-9f53-951cafa9261e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811013, "uuid": "4f60729c-a788-4c1d-8e48-286f97904e08", "value": "25aff3a127f8ebeab3836fe96da24f33cdb3cb3c895cbea3457739ec4f0c6c75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "697ca19e-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1772810602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810602, "uuid": "fc3f8e06-fcf8-44b1-b082-6bab36ed17c2", "comment": "Malware payload (SnakeKeylogger)", "value": "a5d1f66fc7f632f3ccf15f45e3af7fae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810602, "uuid": "87918892-d792-4dd1-9144-f51b839553a9", "comment": "Malware payload (SnakeKeylogger)", "value": "25b5d87ca8be1bb9c42f128f46187a14f4a9701c3375d7395ded821d217dc50b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810602, "uuid": "273e36b2-8e1f-434e-b3bd-22be56eae640", "comment": "Malware payload (SnakeKeylogger)", "value": "da6b48b38c85eefed46ed9d283c3c70954bc72f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810602, "uuid": "88655f66-8225-475d-8123-4fa7b58d81ef", "comment": "Malware payload (SnakeKeylogger)", "value": "3cf9241f9ff7a80b2227430d0a73431f2dd80ac6f3b0b3b8ae8922be98c09da37df4f52d232b5144da97c2cce532d348", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810602, "uuid": "33b32327-6dd4-478e-8d5a-d217d79477dc", "value": "T17C2512A42215DE03CD5183B15AB0F6B91B7C2EEEB901D30A9FE97EEBB666F114D04143", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810602, "uuid": "e307fd01-341c-4e7a-9014-dc95432d1e99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810602, "uuid": "ee245b0d-6c4e-4bfb-b7d5-389043d8433f", "value": "12288:g3j2AR6xichB+Q0f6wo/7rF2IZyGPBmoxPVfeSNMCGo0kq9NHizLNZE5GbFbzFYy:Wj2a0BB+Y0G1VrMLNHMNZgInFP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810602, "uuid": "e060f36a-bb87-4667-8763-46f7868f897c", "value": 1020424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810602, "uuid": "7ee4c2e4-edd7-42c5-b714-f53f3a9b7501", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810602, "uuid": "9b70cd3a-92a9-4029-aa7a-985e48c2fa5f", "value": "25b5d87ca8be1bb9c42f128f46187a14f4a9701c3375d7395ded821d217dc50b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80573ac9-1984-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772819230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819230, "uuid": "8dfac892-4aaf-4169-b7ea-59244fb054b6", "comment": "Malware payload", "value": "61cfead1f7edd7c46d22eee50c78e5df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819230, "uuid": "b185355b-c3e6-445e-a00e-3855c1e219d1", "comment": "Malware payload", "value": "25c275bf1f30227120f5de93afa7a4f107151eac8f205c5bfb0228f7aa40aa42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819230, "uuid": "b32aa005-7a11-4bc4-8db3-a8f1678b3c34", "comment": "Malware payload", "value": "595cbcbdd15a91b5c75658beee4680c195d575dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819230, "uuid": "d2f00b9d-6992-44ae-983f-5e1e159091f2", "comment": "Malware payload", "value": "b8fcb930933c802a089f70c303be0688c6b63a0d57b3278bbd08a5a955375dc6345fbed268e1fea921e7f59543674478", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819230, "uuid": "2d468537-8db2-46d4-9134-bf589614164c", "value": "T125C22A74BEB74D6BC485B171B1EB8318B2F6534E28F55E2E3C621ECCEF449142212A79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819230, "uuid": "8ca101aa-df62-4480-b6bb-aeeb6af3a5b7", "value": "384:fVGYJBJ8sJu049kJ1zjpXn8FU+f/NlhyKC4:d9J2049yz9MO+3pyj4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819230, "uuid": "00844f74-88d1-4769-aed2-11cc3a7fe754", "value": 27160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819230, "uuid": "8603698c-4e2e-4066-b568-6731c175e708", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819230, "uuid": "0bfd8889-fef1-4068-b9a6-edb6966b8273", "value": "violetspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8611a233-196b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808502, "uuid": "e6715cd3-ae4b-4203-93d7-33b32638a17b", "comment": "Malware payload", "value": "e7c1f41e6214fd47cff351329d65bec6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808502, "uuid": "d07db936-1820-46fb-b15f-57af9ca412fc", "comment": "Malware payload", "value": "25c83c2808f1b19bee06ed3e25cbc65a054b9916b647d5360c1a969467e4a291", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808502, "uuid": "585d1a4a-ef51-4920-a244-ec5e511a1e6c", "comment": "Malware payload", "value": "1b9ba30e5409daea560df0f5266e1fee233c502f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808502, "uuid": "f00c5aca-7b64-445b-84ba-0623a1eb3993", "comment": "Malware payload", "value": "0ffa3c1f658f8ac4278b24824b2edeb0ee813dac92a0b24e7acdc3b428eabd7b1db39fa340a7ecddbb6937feedc2178d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808502, "uuid": "952757b8-286b-4004-8591-62be47320f3a", "value": "T1D8930749FD406B10D8D635FAFF4F024973934B6CE3FA7201AA245B2523CAA6B0F76516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808502, "uuid": "2f047e08-12c1-437e-9c40-b2857e10913b", "value": "1536:wqnZy8D4zgUdtS0tFbvacgzafVAweBuqKlUI9HiWNRIbT2gZ1Ykn:68NUv5nTacgzafVAwe4BNRIbT2gXb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808502, "uuid": "cb037210-d212-427c-84c8-549c3e9a0e11", "value": 93252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808502, "uuid": "bbc15be4-2ff0-4b03-9183-ca89b3edb268", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808502, "uuid": "34324810-ef30-4412-826c-138c5b50d9e3", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3593a5f-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1772809491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809491, "uuid": "6704d1ed-e160-47e9-8cd2-aa167c4c11e5", "comment": "Malware payload (CoinMiner)", "value": "43ae0fce42dccf0e5fdc4ce1595f0d87", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809491, "uuid": "60d49dbb-135e-4470-911a-401735221513", "comment": "Malware payload (CoinMiner)", "value": "25f27ceda292165749c5ae267f86e42cff40d501635959c3fe8a9d6116b4f3fb", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809491, "uuid": "935a284a-3c4b-4858-b30b-75882527e251", "comment": "Malware payload (CoinMiner)", "value": "4bad73a71a200b5ad1b55144dcc74c3e6dcc57b0", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809491, "uuid": "5b0c0320-6169-492d-a332-a1e2822456a8", "comment": "Malware payload (CoinMiner)", "value": "6379374eaaf171c06a0756f86b298ae5965ebf300e225967910a4cc052b14f3bb342c9a41bab1a5610b8a3a973e46910", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809491, "uuid": "5adde85a-3f68-49a4-b4dc-d004f0026f27", "value": "T155363302B7CA9035D9C11875006A1FFA2AB5DD6A1320F6CB85A0372E5DBA3D55E3C2FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809491, "uuid": "cc1c7e6f-0717-4283-b776-bfc995b8cf66", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809491, "uuid": "432fd200-4d56-4bfe-ba9f-9a5922fc5c7c", "value": "98304:695gK2d/ChcToJIIYzX1mqqWDM+9In3ILDVS7BaQl:69iK2IIoJLyX1mxzYt0Ba6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809491, "uuid": "90ea8bd3-aaee-444d-9798-84e18e7241ab", "value": 4898872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809491, "uuid": "17d6f8dc-dfa2-4303-8efb-d48d0c19fa63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809491, "uuid": "2a50217b-7ccc-48ce-8923-7e752cfa64c8", "value": "25f27ceda292165749c5ae267f86e42cff40d501635959c3fe8a9d6116b4f3fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "363332bd-1968-11f1-a769-42010a9c0008", "comment": "Malware payload (Kaiji)", "timestamp": 1772807080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807080, "uuid": "b824fc59-f68b-435d-88cc-256a09234377", "comment": "Malware payload (Kaiji)", "value": "00547b53069a9584a48d1df44cb6415f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807080, "uuid": "36ce2b2c-a291-40a2-99a1-08fc3cc10a86", "comment": "Malware payload (Kaiji)", "value": "2622c5614943fd702979ba3086e864e2052dbcc5f115d5168e40dad21bd4335d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807080, "uuid": "a7eee0bd-d94d-4779-96d5-e026522a84c0", "comment": "Malware payload (Kaiji)", "value": "a85805ccb8a9be14fe8f971d68011c2f3e3c35dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807080, "uuid": "c83acd6a-6a7c-4218-8e6e-576b0516cd2a", "comment": "Malware payload (Kaiji)", "value": "527832b8863e53b45afa318e3eb408c063a8e72d4186fecbea0ee5203d8626047fda05fb9e95fa58ee23e13a7e224c98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807080, "uuid": "44edecc1-1fc5-4971-a6d1-ff8b1beb10ee", "value": "T166361A57B8D28A42C0E4367AACBDC1C433671EB99B9B12675D04FE3D3ABE1990E35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807080, "uuid": "cdfb3000-9703-4141-a16b-e17ee8d58516", "value": "49152:PJzG9XxZPF773LVPN9GnMbaVZGNJru8cYWPAXq7nLYvVmrzmpxUIU1F1:hzG9Xn53LtN9pbu0Jru8cYWPAXqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807080, "uuid": "ad7f051d-e699-48ec-a6dc-ba127f400586", "value": 5308416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807080, "uuid": "a8954eda-eb91-40a6-aa29-d6bfdbc726b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807080, "uuid": "a3924de7-0951-42ec-b693-8de2326f7f31", "value": "linux_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bba0e36e-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772810740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810740, "uuid": "d6006d58-4c5a-4de6-be18-2dee0b59bc62", "comment": "Malware payload (Formbook)", "value": "048df09a01e5b84fba8503e01d3f8ea0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810740, "uuid": "71e58380-e0b8-48e4-b912-64c70b48c4ac", "comment": "Malware payload (Formbook)", "value": "26a6fed7f63fea5d4873d19b279324ba7b665f394aff4d17d26cfe3532fba486", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810740, "uuid": "f0a1070e-b267-4490-9d35-248c9d076eef", "comment": "Malware payload (Formbook)", "value": "54ca0209ba849d5475ce0ec04ab1ca93b0fccf97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810740, "uuid": "d4d26a9d-b51f-42f5-83f2-6a479baad228", "comment": "Malware payload (Formbook)", "value": "a039d0e85f7f76dbfcf00df9feb6ff486319c67faaf5c0771922b979f761244229829cb5ddcb7be91e49cdae6bce8102", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810740, "uuid": "146bcb84-92ef-4dff-aea6-a90a75f481a5", "value": "T11A2512AC6A1AD817E4A557790671F67407BD6EFBF410D2038FDDECEBB8A2E815C04182", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810740, "uuid": "edd17370-6df7-4074-b86e-8630f0a58cdb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810740, "uuid": "409a3909-92d1-4436-82c6-7e2cdcca27ef", "value": "24576:TLjcPsHVQQW0thpxYPhx4d4AkGOW48Sf2A5xSU:TLjB1LpPahx3JGYJ1b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810740, "uuid": "537ac174-389a-43c6-8c27-b0d43c86812f", "value": 1051136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810740, "uuid": "63ac0f05-6ccf-4b29-b124-cd7bbde13cd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810740, "uuid": "3e7c6524-d27d-4124-8196-f36b4fc7bbb1", "value": "26a6fed7f63fea5d4873d19b279324ba7b665f394aff4d17d26cfe3532fba486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3edb62b6-196a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807953, "uuid": "8e5c40b9-870a-45e7-97c3-c70e9d02fe07", "comment": "Malware payload", "value": "05f501bbbdd2afa139c942daf29360de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807953, "uuid": "2d0f1bf1-d48b-4c52-8660-1adcf455b689", "comment": "Malware payload", "value": "26d3b855732bbab0728b355c12e73ccb7bc66bc8c3671526b84df1be701c71bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807953, "uuid": "67c62936-1f9e-4ee6-b458-3ca4c6316249", "comment": "Malware payload", "value": "60734dc81ec21666d928f045f47a11eeb3cd6755", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807953, "uuid": "dff5cbe9-bcc2-406d-9176-99925e8c9266", "comment": "Malware payload", "value": "776b2d83787fbdcdfbdc238f3657bb2487ee7a0753878432b0e3e10af02da1f6b3b5203a683ec7269674cb2bf4a76db1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807953, "uuid": "b6283443-418b-49b8-9e86-72422e33806e", "value": "T15F1512605746649FE0A30C74A8F27775F694AE16376DC3837AD0B9887D3A3468F243C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807953, "uuid": "e3d74df5-e13a-43a9-b8ad-9e59bcaaad21", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807953, "uuid": "9b7ef6cf-6002-4d8e-aa9e-ddb421a3a8a3", "value": "24576:mHO/MdQRFoPwPkrSsWdBz6kqd43jbz1HVkMIwSqLbBYNGq:mHO/uvwcrSsWdBGzKb0wSqp9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807953, "uuid": "3c460117-0fba-457c-8337-46847482162f", "value": 882624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807953, "uuid": "7aed0ffa-d978-45d7-8f91-6c1b7e653bce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807953, "uuid": "3f6ed383-08c8-4ca3-9dc6-c8640e734d42", "value": "26d3b855732bbab0728b355c12e73ccb7bc66bc8c3671526b84df1be701c71bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bf3fafa-1973-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811814, "uuid": "c2b2af5b-2896-41d5-9a96-c5a156e129ca", "comment": "Malware payload", "value": "27211d001ed7ade204580462c6292cf7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811814, "uuid": "e1de103e-366b-43a7-86fe-a2bf5204d3fe", "comment": "Malware payload", "value": "27786fbbb9dadb182448743dc7e8df4be46bab0ce2911d67ef030905282ab34e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811814, "uuid": "9acecc5d-7b53-465f-9d0a-aab0d5f8c249", "comment": "Malware payload", "value": "e31ace075063b50f33b7b30251b17bd916db2956", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811814, "uuid": "4efe4903-e595-48b3-8ba7-8b0a6c54eea7", "comment": "Malware payload", "value": "2bf022aa77a209dede414b320dd6bc2a009a62e4dc2390cfd53954159380402ec1f1cba942db488231e70bbc30dc490a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811814, "uuid": "90d6ad7b-0c71-439f-9713-51e91b10c14f", "value": "T1B845BF0273C1D062FFAB92334F56F6215BBC79260123A62F13981DB9B9705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811814, "uuid": "6a05c956-c6f4-490d-9dab-4f696c0960fc", "value": "c1ce208b1192bfcf652c179f34f034d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811814, "uuid": "0400addd-229d-49f1-942c-9d890b572126", "value": "24576:W5EmXFtKaL4/oFe5T9yyXYfP1MAXDzlPn54UMVC+Z4fTJ+:WPVt/LZeJbInGizlSUuu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811814, "uuid": "13976926-5f98-49b1-80c5-180b7d1e2d36", "value": 1250304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811814, "uuid": "2941e21f-3bc5-43f4-a718-5957da7e3eb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811814, "uuid": "69155c87-9bc5-4e29-b46f-614ae5f6a8a9", "value": "5cbb8eb4846c4a900a1843a047d4fb07359be8a7d18a668aca2db0dc693d46a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a183f81-1969-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1772807516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807516, "uuid": "bc6b141c-7bdf-41c4-9dca-01459a938911", "comment": "Malware payload (SnakeKeylogger)", "value": "83a3c13a4caa45d4391852a0694bd526", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807516, "uuid": "1335b8cf-3c7d-4efc-b7c5-1e812275814e", "comment": "Malware payload (SnakeKeylogger)", "value": "279606dc53234325b3c63298ab2d8a0d146f8dacd4ea18c6b6166ea0dc08f70f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807516, "uuid": "06367970-b767-40f7-868f-295baf355df3", "comment": "Malware payload (SnakeKeylogger)", "value": "664e8dce0ff42ef87c357fd3d00af692bdec8bf7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807516, "uuid": "aabbb4be-f5fb-4261-898d-e599e2da8b24", "comment": "Malware payload (SnakeKeylogger)", "value": "817f9a58c657e6888c198f35ea2cc3927c0a3fa1c532a7d0b4ca39c0873dffe539812027a0c74339cd5a5d8b6301ceee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807516, "uuid": "306a33eb-7fe4-42fd-9e86-198d2b474702", "value": "T111552380721ECD46D86427FA4A32E37523B4ADBA6501E3968ECFBDEF79527124C04B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807516, "uuid": "587f3f73-b730-4ffc-ab3c-5039c1fa6a14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807516, "uuid": "4944efc5-6a01-4f78-b4ef-a790dac445e5", "value": "24576:WguQsVjgtNWrt8/xbv0l48uaxHuzKzR3qBxMRQjYac49I1r3F7ML6KPVictiK:PuB/rmxkluHAhq8+jY89g57OXPQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807516, "uuid": "07a97996-a15f-4c70-bafb-cc6172fe257a", "value": 1337856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807516, "uuid": "24fc0db2-1ac8-4d36-b157-c7cda73b7e7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807516, "uuid": "9bae9cd2-d3a8-46e0-a348-ef14a2653159", "value": "279606dc53234325b3c63298ab2d8a0d146f8dacd4ea18c6b6166ea0dc08f70f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc379a2e-193d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772788944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788944, "uuid": "f2ae075e-304f-4ff7-887d-2585bfe97c83", "comment": "Malware payload (Mirai)", "value": "7d465735bfe001f436ae0589e5e44424", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788944, "uuid": "fa0edb99-e30b-4eae-8ba2-08c7a9e07460", "comment": "Malware payload (Mirai)", "value": "27da0af2582b5ebc21961f174e6187f587160382c1d596a6a5db9bc424bb4cb2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788944, "uuid": "c0a044db-8063-43c1-8b90-25adc6dfcd3b", "comment": "Malware payload (Mirai)", "value": "6baf533503c242d95f8392ce403d5dd1434c56da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788944, "uuid": "8a761584-9072-4b53-b4eb-f1beb6921732", "comment": "Malware payload (Mirai)", "value": "5ef01fda381f91998869cc380ab597aec2a7321e8d90a0b282d7aea4fd290d3b9ecd8141e10cc982cc72f07adcf5d39f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788944, "uuid": "95067761-b0ec-425c-84c6-33610d5f2837", "value": "T1FB03E1D09497445AA174207A0D26E1045F32F628EA1DD4DDEBD0663BE81FFB17728B4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788944, "uuid": "f65c2685-c255-4c0a-9e93-cb8ec7c2ce63", "value": "768:X/39j9W3iSztmectrFYNKGichO3lOYIbHyQ6PTLDsSTnbcuyD7UHQRjQi:Fj9gzx7ctBYNKncU3IbHyQ63Qsnouy8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772788944, "uuid": "b6fd658d-68a1-4da8-a57b-d13876557633", "value": 39620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772788944, "uuid": "7b318d83-73a3-468d-8eea-fd1718acf6e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788944, "uuid": "25703834-ebbd-4414-81f5-09d6b1304a39", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99bd5929-1971-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772811112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811112, "uuid": "af7794cb-b889-4add-9efd-e585c18971d8", "comment": "Malware payload (GCleaner)", "value": "6a5f039433013dff5e1e21d482ef0247", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811112, "uuid": "c6c2464e-51ab-4fa5-82a2-70ccc55ae6be", "comment": "Malware payload (GCleaner)", "value": "28146bf315c0cb31f792bd5636c53fe70ace7e909aa3f6885a59cf085bd25f18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811112, "uuid": "995d8cfa-a32e-42a0-84cc-f2e9fcbe75cb", "comment": "Malware payload (GCleaner)", "value": "5ef4bcb4c5dcec855747cd2b821bdb462c9840db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811112, "uuid": "fc2129c8-5920-4058-8b33-2356b33d73f3", "comment": "Malware payload (GCleaner)", "value": "68c5d0f92677a98cc779c42ae73360b7276bc74deb3f4ff4c2a960ee2ec730791513ab4bb1778e7ca7d0fa7b1e91ee7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811112, "uuid": "da8121db-7fff-405e-80eb-47278c7c83c6", "value": "T1A2F49E26BEA19433D0631B785D6B9E6F582ABD002D3479CD6BE42DCCDB3D781342A253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811112, "uuid": "a3fb8183-149f-4779-9059-51c10d20644c", "value": "5343399a39928268750ade4858cbd1d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811112, "uuid": "d4775ecb-25f1-40ab-a61e-6e2068cb37ae", "value": "12288:i2d0/V6Chk61Wd0Mv6jE/h/7kiv1nLcl4VORW/GUF5h2:v6N31WB6YJgihocyy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811112, "uuid": "e460e64f-f543-4edd-9c6b-dc9d998db823", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811112, "uuid": "9624573a-08c4-4658-8c25-74f5520287e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811112, "uuid": "78514921-f142-43ac-b296-4d11bacec2f1", "value": "28146bf315c0cb31f792bd5636c53fe70ace7e909aa3f6885a59cf085bd25f18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd5ef44c-197a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772815145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815145, "uuid": "f721eda7-8d3b-4eb0-97a3-21944c5d94de", "comment": "Malware payload (Mirai)", "value": "2d0d0c9dd8f41f42329d525b05c29226", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815145, "uuid": "573f2e04-e81b-40ea-8ae1-a131f8cdc2f2", "comment": "Malware payload (Mirai)", "value": "28768fed528dab06fb800aaf02e62f519a88614004952e170b2de858b0d06e92", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815145, "uuid": "5a678af9-ae7f-4cce-b3e7-cb89667cceba", "comment": "Malware payload (Mirai)", "value": "cb6cef3e89c894becd0a34f8a2f2127e48cf2120", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815145, "uuid": "1753fa7a-6bda-4ec1-95df-2af3c5f4ee1d", "comment": "Malware payload (Mirai)", "value": "5e3e50edb9338029bb579b93688a4ab3a5668404fca3f773f8a06988ca8a65a55f70d92de23770130400c9c81af950ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815145, "uuid": "3af6c76a-77f4-4ebb-8e5f-43f6d6bcb873", "value": "T18DC3ADC3FA8714A1C46206F007C71BAD6F93A221CE5FE4E7AC1DB63B5A7A4DB1516381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815145, "uuid": "b2e53fe9-ead2-4ce3-8ee6-138efe6c0080", "value": "1536:CrMjtT/2h9gC/LjVCnXEglWuoPJEjuAclMkWFcpxs59NgRCEF/LW9:CrWT/i94XEKn+SuAcFWFcMgbq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772815145, "uuid": "5a5cbf01-e85d-44ca-9144-bf8c8fe69e21", "value": 124676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772815145, "uuid": "8a04cf2e-4b53-411a-b84f-7aeaac7833e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815145, "uuid": "cc67a5ce-a379-4532-a408-0a5b55725b93", "value": "titanjr.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d28d7bc-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772809185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809185, "uuid": "63b05cbe-58f7-4a93-be0b-30d767386f4b", "comment": "Malware payload (Mirai)", "value": "239d6caf9385d357295b3db9a4a8ee46", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809185, "uuid": "b60b7a3b-a89f-4aa0-b3b9-476bb739cd20", "comment": "Malware payload (Mirai)", "value": "28aba57aca34aff76d73a19845da3797a7c5ccec474bc3620e53ddbc175a737b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809185, "uuid": "b910ae4c-53e2-4e40-a0e6-b9dba4d1ef76", "comment": "Malware payload (Mirai)", "value": "28b4a4f3c08a38968f7dec419db05cc3a1b299f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809185, "uuid": "7b07eaa4-4243-4f9e-9dc0-39b05f0c60cf", "comment": "Malware payload (Mirai)", "value": "044671369ea6283b345321322c9c2faab6675a1fe12f2efbb2351315521b56f491ea139cd8a4b64347c25bc149ebd223", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809185, "uuid": "0e1ea5ac-2ca4-4b5b-8eb9-edcfea21b47d", "value": "T186B30945FC505B17C6C652BBFB4E428D7B2A1768D3FE720399256F30378B96A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809185, "uuid": "a581cc49-8ada-47b7-bb4e-d31eb52d386f", "value": "1536:jUK9yqnU8vGRz4VA4j6T9y28Ty6O5FtZpqQcZlCtwywXvqcVuafhPeA45Zvn:QixnUHz4Z+5ypkn3E8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809185, "uuid": "1e835007-ff64-4fa6-93b0-c6b4bad1317d", "value": 117280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809185, "uuid": "e22ecba1-9ace-45af-8fe3-10e60a1b1da8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809185, "uuid": "36424385-92dd-4886-9013-6021cadc9a07", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb5a5af3-192d-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1772782043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782043, "uuid": "9c67628d-f82c-4aee-b530-66a7e80edc88", "comment": "Malware payload (Gafgyt)", "value": "348b4e4314a2a25d5f6381905a7e99f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782043, "uuid": "d594ff90-40f5-4ecb-a9d1-6c41b4f1a536", "comment": "Malware payload (Gafgyt)", "value": "28bc04d07c184e0f86b16dc23d1e627d24f3d0a6d1098b819b35d9a0ef4af4ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782043, "uuid": "18ad536e-ad10-4c51-91cd-ab2566cc0502", "comment": "Malware payload (Gafgyt)", "value": "04590b334a98ccf61e6cd54cb491b1d613f3ea9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782043, "uuid": "e9fc631a-7da1-4d6b-826c-e6063832172d", "comment": "Malware payload (Gafgyt)", "value": "16a23d532501479a7b11207ad744ed28a0cff8678ea15a84b444d63eab64f8a7600680abdcd0d1630cf550b0850eff01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782043, "uuid": "4e491fe5-9c0a-4509-8f61-393e7438ed2f", "value": "T15BE31A45FC509B26C6D322BBFB4E438D772A17A8D3EE320399255F21378A95B0E77241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782043, "uuid": "dd38817a-13f0-4a1c-b151-35efa89c22f2", "value": "1536:Ig7d+/+VafoNsiejzw4Ng5jRclHAZpo/AD21ATkdhNVfCOMVPZxqXiHzlB6wyw06:IA+WVafoYjcValHLA0A8hvQYSNksT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772782043, "uuid": "04ce0400-c8ab-4f6d-8e65-9a508f6bf5db", "value": 150208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772782043, "uuid": "23c81b35-3740-48e1-ab9c-565f353fe58d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782043, "uuid": "a5207e9d-01e3-494c-b0a3-a0c76f48a587", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2658e1c5-190c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772767539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772767539, "uuid": "667d21d9-9fa3-492a-811e-0fb5b70777af", "comment": "Malware payload (Mirai)", "value": "917e4ecaf26683cfa36fda7899ce8e67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772767539, "uuid": "9fc69cc8-32a4-4da6-8fae-c2ec19a0259d", "comment": "Malware payload (Mirai)", "value": "2967f78d71dc4c0f29f1a4b8c2dd40cb0a2db03ed09e4fb0c577e7f5ea0299ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772767539, "uuid": "0887c762-a5be-4e4e-b372-ce4cc9b8ea28", "comment": "Malware payload (Mirai)", "value": "60b68a253ba34a293624796f26ddb3cd408855b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772767539, "uuid": "2b195f44-1bd0-4093-acfa-89e973729762", "comment": "Malware payload (Mirai)", "value": "64158b52f42ed76fd0a9f0b19b39169d5f8a711ad48a812491dacdd445c56f9484fba2de86b5ec42f5bfc7da3a8e54a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772767539, "uuid": "c68865f8-76b1-4e7c-8a20-92007079135f", "value": "T192F3B50E6E198F7CF79987344BB79E32965833872AE1C582E16CD7105E6024F641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772767539, "uuid": "0c9ad5f6-1690-480f-be41-43c808c83423", "value": "3072:MOATXjpCgqDJHDexBJKfjPV4kuMu8hJBQX/uw9EfszRpSP/Q4vkTTzTT4BFZDiwZ:MOATXjpCgqDJHDexBJKfjPV4kuMu8hJH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772767539, "uuid": "a84369b2-0760-4603-9ff0-fc62fcfaa4ba", "value": 171724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772767539, "uuid": "f538aff6-de14-44c7-9836-95d982e8f23d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772767539, "uuid": "159c5cb8-7e43-46c3-8f10-e277e143f6a2", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "698b9256-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819192, "uuid": "ec03650b-2666-41e8-a5aa-40b18a15ced2", "comment": "Malware payload (Mirai)", "value": "aee1b68078b601ad580484083d6b6a3c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819192, "uuid": "f85c0be1-f433-4d5c-afc4-91d52c49618a", "comment": "Malware payload (Mirai)", "value": "296f42a79501db9f6a058f51bd851c307be3ed545af3099296e3ebdb853e54ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819192, "uuid": "ee37b754-2ec1-4624-81c3-87f96c10f324", "comment": "Malware payload (Mirai)", "value": "0e4423491d320512c66cf2f71bb3c90e043d0dae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819192, "uuid": "4813e097-8fa6-4260-a488-0a372a133c8f", "comment": "Malware payload (Mirai)", "value": "735c56fbce75cec3ebbcc0e73361c4daf3f4db9cac8ffed1ed78191229f1e95968ac255b435f3155702ded004cb8728e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819192, "uuid": "14140880-f569-4582-8f78-dcf6cd8a7b41", "value": "T1A9B207B2F446DEB8F40FE33E855B4805B272F75102967A31B7332E37987928464B6E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819192, "uuid": "b36ba752-0ca5-4869-9a65-6cb3abdf0913", "value": "384:J4ID1H9pw23lKD1cM3Kvbei9WLjToh0xsp1XIq8HAxQtB:J4I5Dt9vbei9WsixsPXIq8qQB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819192, "uuid": "59304d85-ea90-453a-98b2-4943a8eec146", "value": 23948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819192, "uuid": "5647c1c0-4002-4996-80cc-afc421fe6fa6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819192, "uuid": "07a78087-25e5-4164-b0be-bc5d588b0413", "value": "violetm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36410047-1971-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810945, "uuid": "da28a24a-70d6-4d84-8f09-87897377ab97", "comment": "Malware payload (GCleaner)", "value": "0210dbf6176927da4aba29a7a5d30c09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810945, "uuid": "93b3f7f2-aacf-45df-b436-d8e8075ae458", "comment": "Malware payload (GCleaner)", "value": "29d3d20c025f4ff914307c5c8eb2bced6da2cc74fdbc84d4cd735d6521c8aa3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810945, "uuid": "028a3fcc-9b94-4ae3-bc93-c2c80a2ee014", "comment": "Malware payload (GCleaner)", "value": "029185bf89c04e9f3c23a366e81966201098c821", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810945, "uuid": "a44baa49-96d4-46e3-956e-136b6e15ee3b", "comment": "Malware payload (GCleaner)", "value": "8242bac33fc0360f14778474e6b53328fdb2c7ec838a794eee1f1ae731cc7ab90393c90aac258bbe1d30efe652333ecb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810945, "uuid": "60a82d36-a109-4040-9783-c9fb4180157a", "value": "T1FB059E22B1A14537F1633A7C9D5B925D982AFE312934EC452BD87EC91FF9781383A243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810945, "uuid": "188f54d6-eddb-486d-be51-75899d2aa549", "value": "5343399a39928268750ade4858cbd1d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810945, "uuid": "a2e9af77-a868-4156-894b-e29bd3ed4ac8", "value": "12288:f2d0/V6Chk61Wd0Mv6jE/h/SktBRQXSLGlUEifm9F2I:K6N31WB6YJZtBsveti2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810945, "uuid": "10deda99-37c8-4e86-83fb-7acc898fd174", "value": 814080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810945, "uuid": "dc781551-1ce6-46cb-9c73-ed10241c809a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810945, "uuid": "d5c0bf50-ffa5-4ded-86e8-3698f00fa8cb", "value": "29d3d20c025f4ff914307c5c8eb2bced6da2cc74fdbc84d4cd735d6521c8aa3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d96d5029-1951-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772797475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797475, "uuid": "99af21db-632a-408c-897e-71f0d5ff4f71", "comment": "Malware payload", "value": "c454027b25b92e06d085101fc54cf490", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "moonzonet-com", "colour": "#AC8277", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797475, "uuid": "67bc52bf-2897-4548-be4b-25115a6ad0e3", "comment": "Malware payload", "value": "2a20d78642d3c155f5820606bf5bfd66f0c1f7264b79bf96fa80ee2f13debde2", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "moonzonet-com", "colour": "#AC8277", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797475, "uuid": "1742fa18-9eff-4ce1-b1ab-196c10804f93", "comment": "Malware payload", "value": "1d6b7096cd90b85459a5ca39a2ef56bee13f8c5f", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "moonzonet-com", "colour": "#AC8277", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797475, "uuid": "f2ed5c72-cd7e-4eb1-9da2-664a6076d6da", "comment": "Malware payload", "value": "e8bdba2f07b9dc0e7dcf2cde8a46c4ae51407fb1088a1d16f2a155ec1b35c01073024af0799e02ea3785b168459b86ad", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "moonzonet-com", "colour": "#AC8277", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797475, "uuid": "472bf3e4-78a3-421d-98b7-42ea62167d94", "value": "T13CD0C99BF16A903917450FC5C305B81DC94701DB38C6C586D039CA8B703243A37C6A73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797475, "uuid": "8cd8d0d8-f8e3-4ae1-a341-39142d2fb61e", "value": "6:3JZFSgHYwLqBDudZLFNEuuwLqBDarFTXQEcIIVEwLqBDoPWdpIv:3JZFpY+qwFg+qkFNIS+qMe8v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772797475, "uuid": "365ced70-88f9-4f6a-b7b2-bb8102ba37c0", "value": 213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772797475, "uuid": "a5266744-c321-4b77-997d-eb3ee1607134", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797475, "uuid": "b4a48732-15b8-4db5-828f-d5975b2ec1a8", "value": "2a20d78642d3c155f5820606bf5bfd66f0c1f7264b79bf96fa80ee2f13debde2.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d70b98f6-194f-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772796612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796612, "uuid": "fb7fe364-89a0-4308-83d3-a8b40d5193e2", "comment": "Malware payload (Smoke Loader)", "value": "aaa50ed470ef2f3cabd4d5e78edb5835", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796612, "uuid": "3e2b3311-c4c5-48d3-afec-bfd701559927", "comment": "Malware payload (Smoke Loader)", "value": "2a214c6d9f8cd7caf626cd85ea6b6905eef0a0966019c29838d166122550a6de", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796612, "uuid": "4819ed7f-957a-4bab-8127-bfab4421c871", "comment": "Malware payload (Smoke Loader)", "value": "40b7e555b3cae127d3d3e0f31de57d5aaaae3f0e", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796612, "uuid": "6a204900-11a4-429a-90f9-c2d186d6ce8c", "comment": "Malware payload (Smoke Loader)", "value": "c44985c26b26a20f9c0f67e054584bf667987fdfbc2d828ce97839c53683cb3504701828da08d8f71e16e9486eb23a33", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796612, "uuid": "2b5ceb8f-5213-4100-bb37-1e82bde840e9", "value": "T163854A0ABCD108E5D0AA977289B762A23B75FC190B3223D32E90B67C3E727E05D75754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796612, "uuid": "24653705-17e7-4379-ac02-460c0f651ebc", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796612, "uuid": "52b10b7c-488e-4f95-8ac4-28cc222f09b5", "value": "24576:V/2+ancs/XxbwJ0DpHFb4GN9cXZK6rtPR800Gm:V/Docs/XxbwJ0bbR9cXZK6f80", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772796612, "uuid": "0e570165-5114-47eb-9e74-4004e710de7f", "value": 1856000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772796612, "uuid": "6363d573-799b-490c-aa76-ad959443e17e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796612, "uuid": "08768455-2fd7-4800-aa17-7af165b7ea39", "value": "source code of carbanak backdoor discovered.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36314a37-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772811375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811375, "uuid": "4cf9cb21-7710-4a9d-bdb4-f307aff189c5", "comment": "Malware payload (AgentTesla)", "value": "ed66a2421f42b193933d0521e2d02051", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811375, "uuid": "7185452d-11ee-4efc-9b7d-be7f2cc5057c", "comment": "Malware payload (AgentTesla)", "value": "2a2fb0c60155a69114f6e3a372e8bd19b321c78fedcc5a6c39f53a4f86d8f572", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811375, "uuid": "238310e3-df85-4be2-be31-d46af4a2dc13", "comment": "Malware payload (AgentTesla)", "value": "d3e4e0186543585870603c4927cf9063b2536616", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811375, "uuid": "0790dbba-7b81-4cbe-8653-292c7289e872", "comment": "Malware payload (AgentTesla)", "value": "5b3c474e996dcec489aca3887e047729c3c77bfe1f72d245a7d60f9e0e35cf59e9652d999cf6ee2e630639dde13717d1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811375, "uuid": "bb0bca17-b5a2-4e19-a5df-78903e9d1183", "value": "T1614533248A75B82BD7D74B7249A7AADBEB92FC1C4011915F27102F1C776FB438D08BA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811375, "uuid": "ed999b14-ba1d-443f-b23c-1b9b3e2796b3", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811375, "uuid": "7b099feb-6ab4-4562-bf0d-db20fa0bdf51", "value": "24576:WHk1cX0b1gdAZP7kc7zNtCTPTCfklOos2x:F1cEb1gdANkcbYTCf6zs2x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811375, "uuid": "b2ef1dc3-a310-44e9-bb7e-ba83843ef4f6", "value": 1179504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811375, "uuid": "b5f9e9fb-cbbb-4732-8f0c-a83e3641e093", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811375, "uuid": "425449f9-1d48-4a1e-8caf-0da4802fc98d", "value": "2a2fb0c60155a69114f6e3a372e8bd19b321c78fedcc5a6c39f53a4f86d8f572", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fcadde9-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819256, "uuid": "def3ca71-a3b6-48bf-9d1b-78d67e1c90c0", "comment": "Malware payload (Mirai)", "value": "e6f6845f67078dae17a032fc05dbaf88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819256, "uuid": "bb66f43a-e82d-4224-8d4c-9333a80e8aba", "comment": "Malware payload (Mirai)", "value": "2a67099dc581ad83885f6604b97268cf514793b65b9dabafab00eb5a93bb71b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819256, "uuid": "ed549e23-75bc-4d8d-8dc8-fff9298bb0ba", "comment": "Malware payload (Mirai)", "value": "ed0f125ea90191d7778f1c3c8e0eb01942fe1606", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819256, "uuid": "9e42d6e3-7125-4f85-a8c6-e3b6aee60eb8", "comment": "Malware payload (Mirai)", "value": "166ac46f6482150b3c2940d22ceed065f2ba367bb6be8bc3d963dac762e8f538d0d771fdb83e3edbdbe9100effb7932d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819256, "uuid": "067fc842-84dd-47e4-b2ff-ab0874baadb7", "value": "T10A343A45EA418A13C4D617BAF6AF414A3332A7A4D3DB7206C9246FB43B8775F0D67A02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819256, "uuid": "f16f485e-1cd2-4b24-82e5-3d9ff7e67d98", "value": "6144:CFNEAy4vjt2abaq40Ba9cnYGUomzmqjM/9n6zOyUR:SSa7t2abaq40QaYcdqg/oyyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819256, "uuid": "a3b7ec00-67dc-403d-92f5-8b3b11790736", "value": 236201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819256, "uuid": "c2322f1e-7b9b-491b-ad32-359a32d0bec9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819256, "uuid": "b0a49dae-2f40-4c05-963b-07469c4a05fd", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe34b776-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772809133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809133, "uuid": "6002a07a-7e7f-4bbc-9d3e-6df4607ecd51", "comment": "Malware payload (Formbook)", "value": "eb7ba3dd15563dcd18b05f0dc9dc852a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809133, "uuid": "e692653f-0a61-42ee-a071-71068b396236", "comment": "Malware payload (Formbook)", "value": "2a698fec192f93a373116fcd7e3ea6587a232aaeb079f342d461b348d1274158", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809133, "uuid": "c6b7abab-33a5-4563-81e6-3cda28d00481", "comment": "Malware payload (Formbook)", "value": "220b9fc4b6401c5cd5ee4dd5717a53c663d2cd08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809133, "uuid": "06593553-68c7-436b-9eb2-d00362fbed9d", "comment": "Malware payload (Formbook)", "value": "b6bc931643f17ead69d4d415471bf8455f8a4522c082996bcfd887122d6e03751bea6c64523a2b78288f382bf49dddb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809133, "uuid": "5a3ffb2d-e69d-4198-8158-76d967e83a30", "value": "T1165512142729DD02D0AA4FF55971E2B08FF46E8AE912D343CFE7ADE7B8363901D45682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809133, "uuid": "10588925-b308-46c1-9218-a7690a43bc7e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809133, "uuid": "adda4740-7f9e-4da0-bf01-c244efa97d2b", "value": "24576:Dqu2VxNjXw6ntt9Q3LHU501r2sk71t/X7B3JpJp2wzUjbWUFmI9+PW7tGv:DeVbrxnttILHU5cdij3/JpzUTmIcG0v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809133, "uuid": "f6ee8d5c-7e84-42c6-b52a-d873e717c236", "value": 1345536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809133, "uuid": "bea7bfd7-889a-4a0b-89c8-666ba4ed816f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809133, "uuid": "b12286b2-8016-478b-b3a4-6d9fc34ca385", "value": "2a698fec192f93a373116fcd7e3ea6587a232aaeb079f342d461b348d1274158", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1415c1ce-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772809599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809599, "uuid": "6157e03d-d855-4517-aa83-9f354a693346", "comment": "Malware payload (GCleaner)", "value": "3e1fd764670bcd2f568e38064f0a1e62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809599, "uuid": "d728bd58-2a60-4d33-8014-fa77da5a7410", "comment": "Malware payload (GCleaner)", "value": "2a7a06f5de094c4ffb4fa67b3f42fd2233bc1af690eecad2e82d8a60f72b72bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809599, "uuid": "b6276ae2-6de7-43ab-a7cb-bc8eed515f28", "comment": "Malware payload (GCleaner)", "value": "c1df4b6aac76eb24958b8c817f0848d8aaceb2c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809599, "uuid": "691b62ff-0c4c-4b39-bca4-24b14305a175", "comment": "Malware payload (GCleaner)", "value": "0a1f850d76c5928fe9a8e140d29720f8b4faa2cd865380779f5c811a1ccf6f2e0c0f179fa485fa1409f0b25f687ce3f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809599, "uuid": "3fcc12ac-50f2-4105-9748-918e0c5484e1", "value": "T1B4E49E22E6F08437D1326DF8DD5B92B59825BD913D6878462AE81CCC9FB838D352D393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809599, "uuid": "d3e90a91-e770-4a4b-9dd2-1325af7fd7c4", "value": "345624d13ffc2b7f296b9d2972b1c0a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809599, "uuid": "9804ce7b-d5d3-4aec-a43a-436f1f9b915f", "value": "12288:A48VY65TrPsgNDHZ8nqReafokTUxBHrAor8cgHUhWU1n+3rW:Z+7PfJZ8qBfokyBHrfl+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809599, "uuid": "969e514b-4bb9-4caa-86e1-ec62c2199975", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809599, "uuid": "30522149-2e38-4867-8ac1-7160ee2b51dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809599, "uuid": "6e7c1402-15c0-4f2f-b43c-258a35519f62", "value": "2a7a06f5de094c4ffb4fa67b3f42fd2233bc1af690eecad2e82d8a60f72b72bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "392e991d-196b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808373, "uuid": "b10c670d-77ea-434f-97c5-16f581f406ed", "comment": "Malware payload", "value": "aa86c4995590def9f283c3770d986ebc", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808373, "uuid": "f6a73d70-f8d6-4faf-a142-fe0913b5e5be", "comment": "Malware payload", "value": "2abf9d6ed195f9d061f4948972e0bdb67741b5d19f9ab60eb55dadd79c529698", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808373, "uuid": "adebbb83-2c6c-4141-b88c-806b3dc26d92", "comment": "Malware payload", "value": "16959c37b33657fd1edca5d6aa59b7c8dadf27a5", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808373, "uuid": "e2802c31-2926-4e37-81d6-4d3ce4f0f9b0", "comment": "Malware payload", "value": "87a174f742a57c7964382bdaa435c1dfd91408059482c13a73528ddf13ac1038e5f295fea8eafd04165d3e0612b79334", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808373, "uuid": "3821106d-387b-4bdf-a079-aac480302d51", "value": "T1EEC57A07B89465B5C5EAD2318AB682D17B31BC890B3127C72A50B7BA2F737D44F39394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808373, "uuid": "f10bfbed-2050-4ed4-bf0a-0cadca2ff1e6", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808373, "uuid": "f034ecb0-e75c-491a-8f9b-0d67045f2ad7", "value": "49152:JWiq3Krb/TmvO90dL3BmAFd4A64nsfJWXovqGgtAR6AwLD1s4sO2b5SGW4+LOlQz:I3XovqURl3T5/5QL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808373, "uuid": "734cc7c3-10a0-4baf-9138-de9c28181667", "value": 2511360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808373, "uuid": "16f1a967-9e33-4963-98f2-4eebc3cfcad4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808373, "uuid": "2df5d573-acd5-4c2e-a2fa-6e53d6b6738b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83fced1e-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819236, "uuid": "33bb8a44-325f-499c-9430-73a99910c359", "comment": "Malware payload (Mirai)", "value": "ed1bb069b0bd52698b8c9ae9a397b310", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819236, "uuid": "bd5083c1-81a3-47fc-b565-e7b177d56d96", "comment": "Malware payload (Mirai)", "value": "2b41fb20d104908f7c4a008e8539930e77ceed5bd431993b2f4407228a3fc115", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819236, "uuid": "348db669-601e-4314-bc8d-d3d862fa1e04", "comment": "Malware payload (Mirai)", "value": "f86c962c9ca916b74b88411bf57de8b0dbd377a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819236, "uuid": "b7d2be39-f474-4853-b350-b8abb63c8992", "comment": "Malware payload (Mirai)", "value": "cfa6ec8c47276d12957e6731cb380ea78ed9cac9c17e69d541c0d8d975a974ef2cfed37b010a369d5ff2ca922e892457", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819236, "uuid": "9b3112ad-051c-46cd-8c3b-c2e3d8dc73bc", "value": "T1B9E35C8AF402DE7DFC0BD5BE84670D09F931E3A131831729569BFDA3A8321964D17E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819236, "uuid": "da201dee-7b13-4e61-9569-8a4352c0d0e3", "value": "3072:IWXww0qbt+Z2ACoePMg0D5pR8CZ+mq1+vumP1d9:H08t+Z2loeoD2Fmq1wP1d9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819236, "uuid": "959c6739-34a1-4e0d-b969-03ea6a386ce4", "value": 149648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819236, "uuid": "f5e7c8d9-4a82-49a9-ba3c-e9daf6fd7742", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819236, "uuid": "6ff4be40-7520-40c1-8b9d-84a99618ca01", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d8de60c-1966-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772806314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806314, "uuid": "8cf0e833-4834-4a27-bcd0-176d5028ef45", "comment": "Malware payload", "value": "2cf29f8c095b36607cab9acde5148067", "object_relation": "md5", "Tag": [ { "name": "172-94-9-250", "colour": "#CFC547", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806314, "uuid": "7c2e036d-ea06-4a64-a4b8-164ba219db56", "comment": "Malware payload", "value": "2b528e876b772217e575288ce2757183feb05735731efeaa70904fbededeed1f", "object_relation": "sha256", "Tag": [ { "name": "172-94-9-250", "colour": "#CFC547", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806314, "uuid": "422ae1c4-3fd4-4107-afae-d01871d84b28", "comment": "Malware payload", "value": "688bd521ade5de6b0ab5c32f3446e8ffaaea8991", "object_relation": "sha1", "Tag": [ { "name": "172-94-9-250", "colour": "#CFC547", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806314, "uuid": "c78b909a-f26c-43e2-a1d3-afd49ab09bee", "comment": "Malware payload", "value": "4b41c0f1004a7b4745dfd69a484c2aac0b3d3c523cfb0dede3806d60be8b66ea09b192bc025f6b53514a7fa1a7abcae8", "object_relation": "sha3-384", "Tag": [ { "name": "172-94-9-250", "colour": "#CFC547", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806314, "uuid": "31fd0a60-fe92-4715-bd3c-c7c3f3320167", "value": "T1D162E14E710C04394507C4D84EE625658EFD3C859B14787735B4A54928BCEB94EBA3F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806314, "uuid": "51a7eeb6-8f8e-42e6-aa55-e38c4bdd1223", "value": "384:n8qL1CI3m0RkadW0h3ghR7+WxmWkbTIKZ:8qL1CedkadW0h3ghJxmWkbTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772806314, "uuid": "6e82db22-d939-42b7-8600-f923019fbef6", "value": 15635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772806314, "uuid": "af61ccf8-2150-42b8-91ba-d4996b20314d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806314, "uuid": "4d5f55c5-be00-4ade-a166-95720c1f563b", "value": "xxx59361.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8805b544-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819243, "uuid": "57e11edf-8585-4a60-91b0-da5f2fdbcf10", "comment": "Malware payload (Mirai)", "value": "523987c5cb89a11f9cd984ffac3787c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819243, "uuid": "24acc1fd-a462-46e0-8c1e-68e9d6dfbd50", "comment": "Malware payload (Mirai)", "value": "2bc52739f60e5752d95fef1e0e142ab7256c62de6a11a7678182c87ed2f3ad63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819243, "uuid": "02812e12-912a-428e-bfbc-70f509c79aa3", "comment": "Malware payload (Mirai)", "value": "ad4a51f650778f15e77a4807e3528158b31720f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819243, "uuid": "10ff14ef-b468-4bb4-97de-745ae9f41c15", "comment": "Malware payload (Mirai)", "value": "1196ae0ed192e35e16b321265f87fe22f75cc913d9497943bde8647093584c24df6ec6fd505558f3562df6342ae5e316", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819243, "uuid": "ecd4c8d2-9d91-4bef-9b60-aa4e84098513", "value": "T177730942BD829F13C1D222F6F7EE01993715BB68D6EB3242D821BF9137868DB0D67611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819243, "uuid": "860f4a1c-fb0b-4b0d-a5f4-66ee27cabf25", "value": "1536:URNLmkaXxzxXrCk48tOAKjEMyosYP1s/FRm:URNLKrCPxJyHlRm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819243, "uuid": "75cd439f-90c9-4231-b056-64f35bb28c3d", "value": 74484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819243, "uuid": "2be5ab0f-d70b-44f2-ade6-e5d8d9c331e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819243, "uuid": "1fbfb72a-5319-433f-9927-24584add6a13", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db8b5d6b-1950-11f1-a769-42010a9c0008", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1772797049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797049, "uuid": "ec7d63f7-ac3c-4742-aeab-b6434c35a050", "comment": "Malware payload (Socks5Systemz)", "value": "35dd72fccdcbff478cccc5fa0e1deeab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797049, "uuid": "977aefd0-9093-485d-b659-71808723ae6d", "comment": "Malware payload (Socks5Systemz)", "value": "2c2caad15e5af13e6290b84f03b10f43b21ffc3dfdda0581fa24caa3450484f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797049, "uuid": "22e8a5be-7c82-435d-acb8-109eac1e480c", "comment": "Malware payload (Socks5Systemz)", "value": "490e352202fccf4bed5afb7d1beb3a51002cc02e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797049, "uuid": "c039c4ae-4bf7-4146-bc65-f5d86d7ee633", "comment": "Malware payload (Socks5Systemz)", "value": "09ca970c4f57cd44036d253b6af010f26c0847bd20f88ad90f730985c75d0b55f4f40bc915c8a646b2d8d9eedc37faf3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797049, "uuid": "7904513a-beef-44a3-aeaa-ebdf0a166d44", "value": "T1C60633A086218479D01181B59CC6515CE6BF3D7CE2BD98CA7AFCA66F5B02BE71DC3324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797049, "uuid": "6390218c-808a-481b-9acc-01447be0e9a8", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797049, "uuid": "d7baf6e1-8eaa-4535-ac28-40a9b9eb3bdd", "value": "98304:NcXYwkTa67D6mrbW/wbQ2SU3s7j5PrzG/REO/4:5TaSDjrbKOxoNOg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772797049, "uuid": "94591ab1-30e9-40ea-8b1b-8275ff12db2f", "value": 4016795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772797049, "uuid": "3ce0366f-a6a2-463e-a5ca-373f8861d946", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797049, "uuid": "3cbd1029-60ec-4a26-b45f-d55e83a9b66a", "value": "35dd72fccdcbff478cccc5fa0e1deeab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59f9fc60-1969-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1772807569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807569, "uuid": "8448336d-b3e3-428f-9db4-cf2e44968ad3", "comment": "Malware payload (SnakeKeylogger)", "value": "373d61ea18647878b8b0bdc57ff665dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807569, "uuid": "de044e02-f779-48b8-a442-787e9367bd2a", "comment": "Malware payload (SnakeKeylogger)", "value": "2c428a260e28ffeea365c4013637f9a902d2e9b295482fc7a9c8fffeb78a3f45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807569, "uuid": "88abfc3d-6cdb-4023-960b-3d42dde90d6c", "comment": "Malware payload (SnakeKeylogger)", "value": "fbf4b5ca1ca1c15a9584fa97858389502e7bb233", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807569, "uuid": "ee79b7c6-c14a-415a-87e1-3e2c841a12a1", "comment": "Malware payload (SnakeKeylogger)", "value": "27ed47f53f712b49d7099702c20589c00611be2aeab79540801847ed730c73a070afad0098c7067535d9401533baacb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807569, "uuid": "db05205f-ea2e-49fc-aaf2-eaa66f9ea181", "value": "T179942301B6519137E7B29B3205335B574EB69D2022E0830FC7A0BB9ABD32657C53BBE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807569, "uuid": "e0840d89-abbd-467b-87ea-b229a84224b7", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807569, "uuid": "2841c72d-3909-4317-8b31-d2ca051a3301", "value": "6144:6bfopLxCQPZ+PoRjhNLu9ExBtxadZ/AgJ/OYWpNjdedR8cOJbTJghgfKEo7t0b5q:6b6xNh9LuCtx49s3pTedoBHo7ub79+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807569, "uuid": "3f5d07f3-e5e6-4f6b-ab8f-768126e5f845", "value": 417920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807569, "uuid": "b7edb254-0116-4883-a9eb-98369dccb5c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807569, "uuid": "da6a359e-9e5c-4772-bab2-2f09881d3955", "value": "2c428a260e28ffeea365c4013637f9a902d2e9b295482fc7a9c8fffeb78a3f45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c378b2a-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810069, "uuid": "10c0e2ed-88bc-4c3c-b7a3-96e738d3d75a", "comment": "Malware payload (GCleaner)", "value": "ad900b756e3021756dfecaeba021d0da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810069, "uuid": "31131608-a3cd-4145-917f-7d423707c4a2", "comment": "Malware payload (GCleaner)", "value": "2c9f5c8908f00e337b272a8174341e0ab5f619345d51ffe46360e4c5f286f8af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810069, "uuid": "d69c74f5-5b18-446b-a47a-6e7ae04b739e", "comment": "Malware payload (GCleaner)", "value": "194150029fe832c54fb396889a56bdaab7039fdf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810069, "uuid": "5e7853db-8247-4f7b-989c-25fee1db3099", "comment": "Malware payload (GCleaner)", "value": "8b24001b07f4d3481043935c5d66bebdfa1721c98363bd21e89fca4a25750e1b7c5bebfb99363b076e319a2ddac1c1a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810069, "uuid": "36cf6176-8bac-4fd3-91fb-383fd553ab46", "value": "T13FF48E37EEA08C37D163693CDC1B6657D825BE906E2C694A3BE91CCCDF297813425293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810069, "uuid": "e5f28288-e52e-414f-86f9-1111d23b1c02", "value": "c475b6e242f56325f64c2b76233f720b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810069, "uuid": "52eeb93b-e77e-4254-b7ea-4e10e67cde97", "value": "12288:beM9gzhW/BsjB7V+bRO88pvnHU7/j7mC0COhHBrvHDnjnvU:6K3/q7gR8G/j7mC0Cwh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810069, "uuid": "e2fcdc9e-aa0b-414f-bdd4-3bc5c166343f", "value": 736256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810069, "uuid": "715464f2-48fd-47e8-ab76-6ef2ab4dd06f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810069, "uuid": "f8b71220-4d99-4846-a6d1-4f4e6c441e65", "value": "2c9f5c8908f00e337b272a8174341e0ab5f619345d51ffe46360e4c5f286f8af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7eada52-196e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809928, "uuid": "4e8d119d-f80d-4036-b6be-09d7072f0b93", "comment": "Malware payload", "value": "7e38ad41e76c95095070ab0cc88bc2a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809928, "uuid": "947c7631-a633-47b3-836e-cbc8e9c09d86", "comment": "Malware payload", "value": "2cfa6c6e8069781cac1cee634e4fd346c714b7ebe244c92c8ca02d0b240e0f5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809928, "uuid": "76b88b95-0c19-4ccb-83cb-10ab140cb851", "comment": "Malware payload", "value": "d1f6377458ae72a1f087325b5739e024f3f95064", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809928, "uuid": "9f760792-d199-42dd-a6ad-3afffc1fd516", "comment": "Malware payload", "value": "81f0c6157c4ec08c9c8f51853b5447bfc389692cb080d4b0310af7f6e7206e1ba1bc78b901681041ecc22602006babe8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809928, "uuid": "de22b40a-bcfa-474f-b3fb-539042799fd4", "value": "T1C645235C275AFF03D5934BB81D21D1B487B89FD8E412E2434FE66CE7B82E36549882C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809928, "uuid": "fcb2cc8a-5028-47ff-ba0e-5ffab175bb3e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809928, "uuid": "b1451180-40d1-44cd-9e0e-6f3191eeb7ac", "value": "24576:A/tws/S2LoUw9unn8mvq5QRFKWxdrOe95th0n8tfLD1hclcKd:A/5IwkQ6WzrnT08tfF6q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809928, "uuid": "14bbbc96-2342-4d23-8e9d-f592d205fe4f", "value": 1239040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809928, "uuid": "a06bd49d-9396-4fe7-b1bb-d8458c4276a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809928, "uuid": "44a15a15-3acd-4734-9d59-3e07251ad338", "value": "2cfa6c6e8069781cac1cee634e4fd346c714b7ebe244c92c8ca02d0b240e0f5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cc35140-192c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772781267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781267, "uuid": "d4f7a36f-fd7e-4d0e-a983-8e59d6fafb29", "comment": "Malware payload (Mirai)", "value": "995eadb4c672b09f2acf57654f18c05b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781267, "uuid": "9ec19296-3370-4a0b-be9e-a3870e8f83e5", "comment": "Malware payload (Mirai)", "value": "2cfdca173c2cf8cc5a12827385f6bb6d69ba5b690084784806aa868989686d3b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781267, "uuid": "8ec09729-7603-4ac3-85fa-5afbe44b662f", "comment": "Malware payload (Mirai)", "value": "ad3e8b5d0c72a4a1e093cef20d5eea566e2d3fde", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781267, "uuid": "087b519a-fe14-40f3-bea8-9f199319bd67", "comment": "Malware payload (Mirai)", "value": "74d3849e6f3da84262ba7ed01a8f4593f749ceb95d6916c2ac474c3baa958077de6a5fa7603b8575827e583ff4d3db75", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772781267, "uuid": "b6f94398-1f73-4748-b537-b91be55f840c", "value": "T1E2F30946F8818F15D5D256BEFF0E128E33231B78E3DE72029D245B347B8A86B0E7A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772781267, "uuid": "1c70a812-eaf4-45a9-98a5-a1b59f042685", "value": "3072:uhdez2TTkhbUqwClsfg3aOAz+M6+xJnJRNnCshypTBH:uQ2QxRsf6aOy+MVnjEayplH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772781267, "uuid": "a2ac46d0-bb1a-474c-8fd0-40e473817c3c", "value": 160796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772781267, "uuid": "a145400a-9b86-48c4-9a91-93d012f5514e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772781267, "uuid": "7bc1e5cd-fe11-4918-8197-3b6e144c1d82", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89a7199b-1969-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1772807649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807649, "uuid": "fd1e7fd8-778e-4c3f-b291-00ca7ae94200", "comment": "Malware payload (SnakeKeylogger)", "value": "c5a78318e683283b1a4eb7d847f4018e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807649, "uuid": "848b7fd1-1b49-40de-8eb6-9a1f60b9bd2b", "comment": "Malware payload (SnakeKeylogger)", "value": "2d01c3f31e4492fb29868a71df7f644a3b9cdebbdea08c70971c48216176853e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807649, "uuid": "caf28433-857a-4b96-bef1-73d59c965298", "comment": "Malware payload (SnakeKeylogger)", "value": "d5909725bb1f7f52d675d681261fc56c434c0426", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807649, "uuid": "a6f80a3e-bc29-4df4-b7f2-dd6a8d28cd19", "comment": "Malware payload (SnakeKeylogger)", "value": "078faf41a45b6980e4405a19bb67035f637ad0eeec840f7e52e3c2e0e808d2cf7fab8bc5fea91ed47df354cfe0bf37d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807649, "uuid": "bb9e4bef-16c3-4836-bfa2-d14d93f24e77", "value": "T130F3128B5113EB9AE86B5EB0F96C633DC1F13E870A5E0683C39E75127C344FC10A2A19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807649, "uuid": "52cd3460-ccb5-4864-a431-9b44bbb010b7", "value": "60559adcf3698c3eb3c69577ebf28413", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807649, "uuid": "8d12cb79-5799-4445-84c1-92fe4ee1cc4f", "value": "3072:yngLAcQCydu0Dakny5DVsWZgdAnekJnenaIxtPqkzyfxHXhT6GsOL:nfQCUu0DakmRd6OtenHMkghsPo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807649, "uuid": "3caf39e9-dbfb-4c65-9866-341abb5ab703", "value": 169984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807649, "uuid": "c11900b9-9b59-4c41-bb3b-1f4c90c44e88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807649, "uuid": "2f7f9e17-b723-49ec-a17f-8eb75ebf5752", "value": "2d01c3f31e4492fb29868a71df7f644a3b9cdebbdea08c70971c48216176853e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3d732b0-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772809948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809948, "uuid": "dd387bfb-683c-49f8-b3e6-e159b71e5740", "comment": "Malware payload (PhantomStealer)", "value": "035dfd4d5cb12a6a174d0a7397e64b9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809948, "uuid": "e1d7437e-637b-4ec6-a17f-0d242a3ae717", "comment": "Malware payload (PhantomStealer)", "value": "2d25183399313fb16386572a5da861ae441a78f488c2c5f8ba771849b36816df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809948, "uuid": "8f7f7ca2-14ed-47dc-baa3-c919ec932a14", "comment": "Malware payload (PhantomStealer)", "value": "171523d6ca08d08ab25735b2692af7b551cd5673", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809948, "uuid": "4b2545bc-cfa6-4d8d-9b8f-62d1eb16c2c0", "comment": "Malware payload (PhantomStealer)", "value": "55665b474f1c5f14fd0262773cf01f55818f7fb5c0a6af24a84828bbbf9eb3bfbd1d0a1f3431357ccd219a28cb6b493a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809948, "uuid": "985e591e-ccf8-4e09-8041-f4e099e613a2", "value": "T1BE652348B2AEDE03C4AA0AB41A50F67433741E8DB51BC2535FE6BCE7783A3E45945387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809948, "uuid": "def53768-1848-4592-af03-e5d1a32c6647", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809948, "uuid": "254bb0a2-0768-4fe8-aa0d-601131ddca15", "value": "24576:2/G6TkKRY+FsWvh1xwRJ0xvnHbBeMEnIZm0FMs7BStd/L/wfLWPO+g9eYe9SiLlA:2/GsK+Flvhn6J0xv7gmY5b/L/wTLx9U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809948, "uuid": "ceb843af-86c0-4d73-8f9a-3e3708088b27", "value": 1548800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809948, "uuid": "aeed338f-c3bf-4deb-9dd5-191b044a5031", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809948, "uuid": "c2bfb048-6071-4924-a167-659d0a29a5ed", "value": "2d25183399313fb16386572a5da861ae441a78f488c2c5f8ba771849b36816df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a41c055-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1772819193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819193, "uuid": "02c0966f-6f62-4770-b60d-d9b8c9d97e40", "comment": "Malware payload (Gafgyt)", "value": "801e0812d1e3d4242a92e89c938892cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819193, "uuid": "e0f1319d-ff77-4f2c-972a-6f90276ddf83", "comment": "Malware payload (Gafgyt)", "value": "2d45e9558705c9a7e6ced29e5989a8958b9c689874169cd879d0170485d36c06", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819193, "uuid": "dbfa3485-f171-47e0-bfff-2a94528e775d", "comment": "Malware payload (Gafgyt)", "value": "b5bbafe09ec3570bf7ebfb921e206132234965af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819193, "uuid": "10d4b680-b898-41d3-a8c2-b31e33dcc7ef", "comment": "Malware payload (Gafgyt)", "value": "cb85d22084ce9541c6d22771b087bbc7ec15e5fc89efc883ac50add901ee403e5c55f919d8641a404f1f8668661f5e1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819193, "uuid": "56095f04-a2cb-4b94-9027-f7c74e64f397", "value": "T17FA24C928CA40E14E65D7AF0B1214F367723FA68DB072FBA1A1745549093E8CFA5837F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819193, "uuid": "ffbf4075-bbd6-4312-b94b-f937297a2d28", "value": "384:6SYHWhYQ5gmwHuOUM5lXg73+EU3sUmIqog+R/xqBHImFsEe:6S8KYQ5RwOSSLpUeog+RxU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819193, "uuid": "6fe7553f-4a91-489c-b567-9580a243bb88", "value": 21480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819193, "uuid": "f679af30-3c62-4436-a772-44540c3b8012", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819193, "uuid": "95597f87-f864-41d0-801e-c6de5220edcb", "value": "violetsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10a1760e-1982-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772818184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818184, "uuid": "1ab6a208-f0af-4fda-be74-a807e539c45a", "comment": "Malware payload", "value": "209b5ac518dbf3faabbaac295ecd8e01", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818184, "uuid": "df1a8930-9fe6-4750-afd4-8ad536b427ab", "comment": "Malware payload", "value": "2d839c9e682c3061140b88ecea85adf03e2b341e7db2c60b2c274fbb88bf667e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818184, "uuid": "4a958fc6-2961-4333-b78c-15ff07933b0e", "comment": "Malware payload", "value": "d3cbf03435b944e20dbc6e2ff09ccc640d1907cd", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818184, "uuid": "a6052dfc-30a8-4f98-9c4e-a9671d7cbdd2", "comment": "Malware payload", "value": "8cc38d6f18c4b669c5e3053f7c01fd6a2ca6b1be668e577bc912db1707ebdc6369828fd06f91615aad220a26ff82e0d3", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818184, "uuid": "98f53104-c29d-4743-833d-446a135ce075", "value": "T1E9862323E28EA33EE46A593549729A10543FAE61541B8CB3C6EC7D4CCF395A01D2EF47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818184, "uuid": "20f9576e-b07b-49d9-aefb-04a610980810", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818184, "uuid": "ba6765e2-1b6c-440d-9e4d-89f12132e404", "value": "196608:rDbPuzokdemm0hWrUatDQzZUVeUx3AeEKF19pKScaJ:rDbuvrhQVKUV/uKF19p9J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772818184, "uuid": "9e2f70ce-6a77-4755-8226-5f88baa12c3b", "value": 7904769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772818184, "uuid": "0f37c89c-c239-42d1-8e4f-7e1c34e35108", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818184, "uuid": "ab4a91df-09b9-46c7-8f0b-2587b38514a6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9269cf00-1968-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772807234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807234, "uuid": "0d57ad44-14ca-4db1-9218-330e4d1d7af8", "comment": "Malware payload (Mirai)", "value": "129ed011cfa9904fa52ad150b6950824", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807234, "uuid": "bafa9d91-06b7-434b-b2d3-a917d433dc92", "comment": "Malware payload (Mirai)", "value": "2dcd703a5aae615d2311be8729842009e2bc09fc514373ad9eea879b28983bdb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807234, "uuid": "995de2f3-eac7-444a-b7e2-45e8fa28c4a1", "comment": "Malware payload (Mirai)", "value": "872df6ab8532fe3d1b1245fc147bb4927b92d4a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807234, "uuid": "b996ff76-3a8b-4a2f-bd7f-35003a06431d", "comment": "Malware payload (Mirai)", "value": "3889bc63174f0acff6e30462668fa6639312b507befdb735334a972076455ffa952a3d878d3f03ad11aa0ae0c6b60e00", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807234, "uuid": "9ec97cf5-6636-4d2b-9920-dd86514f73d5", "value": "T193141B85DA417F63C0C66BB9F6DFC24133B39B14E7A723059528AFB03B867994F26106", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807234, "uuid": "2bda5196-a929-4d6f-b2f4-2c292f1fa482", "value": "6144:frMHGxaaVAlBXXGq/Noj1dbBciM/RFqfaXxmk2WdZyJl:fIHGxaaGlBX/FopPcr/rqsxmkDdZyJl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807234, "uuid": "370cfa60-8212-463a-9722-c74c06fbe7f0", "value": 197198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807234, "uuid": "80207193-25f7-40b3-8667-165cf87d430d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807234, "uuid": "2ffaf4e2-6bcb-4a5f-89fe-6fe1dc9697fa", "value": "m-6.8-k.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5705ee83-1950-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772796827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796827, "uuid": "290552c0-adbd-4795-aa27-a20b11f0a33e", "comment": "Malware payload", "value": "453a4b09014e457346f4aa06d7e456de", "object_relation": "md5", "Tag": [ { "name": "94-158-245-153", "colour": "#0E67A3", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ink-approval-com", "colour": "#8059F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796827, "uuid": "c2a36d7a-c652-4d00-8d3d-23b6b32473bb", "comment": "Malware payload", "value": "2ef95cd2ef6b59eddc3283a77e818442ff330a860199c61a7e16c0bd5b24091b", "object_relation": "sha256", "Tag": [ { "name": "94-158-245-153", "colour": "#0E67A3", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ink-approval-com", "colour": "#8059F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796827, "uuid": "ea5ecbf6-c755-4562-a5f4-e9fcca586273", "comment": "Malware payload", "value": "b1a13a8bb1e3f763aacfe7f6090b2456496eeb97", "object_relation": "sha1", "Tag": [ { "name": "94-158-245-153", "colour": "#0E67A3", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ink-approval-com", "colour": "#8059F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796827, "uuid": "d54f8c70-865f-4237-b6f3-48879ccc8343", "comment": "Malware payload", "value": "e52967c8e432ef1f4dbff013eb6adcfc0e15cf2b7e101f551e67987b072814a9f9518b96674734aae218501b1ce682fa", "object_relation": "sha3-384", "Tag": [ { "name": "94-158-245-153", "colour": "#0E67A3", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ink-approval-com", "colour": "#8059F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796827, "uuid": "9235d79b-8cb4-4236-bdfd-b1483fb3f974", "value": "T1A1E12BFA81C861028F4757967B92BE8D765ADCB04363FC9E7D21618EC201B1ED821D77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796827, "uuid": "2f065926-d9d1-4fe4-b75f-0014033048a3", "value": "192:4UBmYXJjRm35n34+e3JC9n5o0HwJC8MkEGMJPvo96K8Xcca:4UBmkhS3re3JCJG0HwJC8vEvA9TgcV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772796827, "uuid": "9d34fc35-f3ed-4981-ba39-3556e8fc45b0", "value": 7075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772796827, "uuid": "bc4b7425-aa9d-463c-83a4-05ce98aeda86", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796827, "uuid": "7b7eeaf6-9edf-4109-a293-969e423572a1", "value": "evidencelumber.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaae1170-196a-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808241, "uuid": "bb02ac73-5116-4e0f-9b75-fb717fb2f8aa", "comment": "Malware payload (GCleaner)", "value": "3db28b9de21ee47617d78a050b40a550", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808241, "uuid": "1d76b377-cbaa-4282-8197-76188b81b756", "comment": "Malware payload (GCleaner)", "value": "2f37a16f1b50df0851d34e6075a36055ba8ab1bc7245944ad586247e3451852b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808241, "uuid": "7c6b4779-1f5c-48bb-9159-b671c323833a", "comment": "Malware payload (GCleaner)", "value": "834ea45cf88e2f576373a1600493688b7f5dff31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808241, "uuid": "208707ea-db41-4a10-9914-189f41e67e98", "comment": "Malware payload (GCleaner)", "value": "d5a564589deced522c208cdd396496281cf42d552f7654bb93531b55b5e5a635710436aee46b9205b3b7289ddb932c89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808241, "uuid": "941fec81-e717-49bd-b49e-d8b693e1c79c", "value": "T17706F19812E74D7FC7296FF81CD131B4992FBF009CE89E8997A58C195E5E8F03098DA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808241, "uuid": "be8b18b8-ab83-4728-8488-3b8ba192e50d", "value": "336c69b6e8562d1c5231f219b62d7473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808241, "uuid": "83b385a9-1309-4486-864f-4d58cbdb1bac", "value": "98304:X9zuuYXYvlekegQEByWCvtRnfNGmErIaYzo:XUXcQt1WC/fN0i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808241, "uuid": "b9b6c722-9b43-4bd0-9773-948f5a4f60c8", "value": 3919360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808241, "uuid": "cac2c459-f65a-466d-a032-9273a6bd2c8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808241, "uuid": "62e8ae50-df1c-4b4a-9f7e-47eb98977fc7", "value": "2f37a16f1b50df0851d34e6075a36055ba8ab1bc7245944ad586247e3451852b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfc7a3bc-196d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809512, "uuid": "5ac96c4b-ecf7-4de3-bdf8-9e9fbb132e37", "comment": "Malware payload", "value": "7687bcff0459b9da2ce1ded5c127d07b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809512, "uuid": "bfadf190-b4aa-4894-a40e-e74c2ad8842f", "comment": "Malware payload", "value": "2f562924165559feab82e3cf0fbec9c7691a7db7c4964a9020e6c4bd6e6628a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809512, "uuid": "ce775e7e-4e69-4406-90db-f53f4ab962f0", "comment": "Malware payload", "value": "bb42db70f90d6122093d36f6d1fd125943adc5d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809512, "uuid": "fd0d7e3d-7926-46b1-94fb-47464d356248", "comment": "Malware payload", "value": "449690dd0c6ad080e014386226144636d964363173bcd601f1c09fadf403a3eb15e810e5c1d20c1fb4a9a0c9e0af0237", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809512, "uuid": "61c7ed63-94e0-427a-9a30-b7b155e2921c", "value": "T1CA2522381A65EE03C1D50BB85C71E27947B88ECD6562D6034FD5BCEB78BA7A068843C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809512, "uuid": "1a0b759d-bfb5-4014-b9c3-6217a9be1a6a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809512, "uuid": "57643d47-5794-47c2-977d-0d525af76f79", "value": "24576:l/GibrIp30C+entWJ6W6aTH5QAbptdXySQ3Bu:l/vAEIccW6az5QA3pyS4B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809512, "uuid": "1cf3bba0-f816-4338-b172-3662f70e13dc", "value": 1032192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809512, "uuid": "b5a5735f-1538-4262-85f9-1ea89b10966f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809512, "uuid": "8ad0494d-7eba-4b23-9f92-b64c14307645", "value": "2f562924165559feab82e3cf0fbec9c7691a7db7c4964a9020e6c4bd6e6628a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e2f15a4-194c-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1772795121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795121, "uuid": "cfbad896-220c-450e-b68f-c8f102fa3425", "comment": "Malware payload (CountLoader)", "value": "32d854912f58bbd965031a5a7eed28f2", "object_relation": "md5", "Tag": [ { "name": "37-221-66-127", "colour": "#F2F866", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "explorer-vg", "colour": "#86C1A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795121, "uuid": "64c96f3e-322e-43bc-b7ac-c06c793ce738", "comment": "Malware payload (CountLoader)", "value": "2f56a2d6896008f4b85b1ffa1beb9ec044a4ca70794db3fe2dccf8a5912a03fc", "object_relation": "sha256", "Tag": [ { "name": "37-221-66-127", "colour": "#F2F866", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "explorer-vg", "colour": "#86C1A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795121, "uuid": "df0b2278-ba64-49d8-b9fb-e9eada741636", "comment": "Malware payload (CountLoader)", "value": "e94e5603d784eb25ff706e07bb496b9a8bfe0f05", "object_relation": "sha1", "Tag": [ { "name": "37-221-66-127", "colour": "#F2F866", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "explorer-vg", "colour": "#86C1A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795121, "uuid": "e151675e-8f9d-4796-8d3e-485e78e3f526", "comment": "Malware payload (CountLoader)", "value": "f9061439c4c3b2be7c57d5753b472e3d125af68073f20b66e64799311559de11e1354cb66c31c7fa18be2c22b1a4fe5c", "object_relation": "sha3-384", "Tag": [ { "name": "37-221-66-127", "colour": "#F2F866", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "explorer-vg", "colour": "#86C1A0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795121, "uuid": "8c90077e-c3c7-4f5f-b1b8-3ccedfc03d28", "value": "T11EE523ADBEE9545DF0980378CBB2060257237C779AE64EDF301872205FB22852D76B5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795121, "uuid": "e9075289-33ab-4054-b92c-0870c56a63a4", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795121, "uuid": "6c059140-1764-4505-a044-e1bf6512c54a", "value": "49152:np/0auwTKqDdbeaT8gXbzBwyx9i/jfRPeuoW:npAwVBQMbFwcYj52U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772795121, "uuid": "4b16d535-ead8-4b5d-9874-baa8663c0090", "value": 3152894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772795121, "uuid": "f7f387d1-fc1b-4e6d-a94b-a7e3b00bfd1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795121, "uuid": "223763ef-1dda-404a-8c2c-86e2af16fefc", "value": "Setup_Installer_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d03a100-193a-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772787254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772787254, "uuid": "7fe20a05-ef49-4875-972f-b13937c92d70", "comment": "Malware payload (Formbook)", "value": "8a3541629d3a562f18082b4d79eda869", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772787254, "uuid": "b585e686-647c-47f1-bc71-a8723892046f", "comment": "Malware payload (Formbook)", "value": "2f8632acd66d9798cfbc6efac4e900c1ec6ec5600e11f58fcb2da0286c016887", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772787254, "uuid": "0e957d20-bd99-41cb-b6e9-d62db08f58b3", "comment": "Malware payload (Formbook)", "value": "839ec03ca4e2e928987e99c193c0cebd0754408c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772787254, "uuid": "df511b27-a457-4014-b579-f989af9d8329", "comment": "Malware payload (Formbook)", "value": "06d1c3b4d7c95ac1cebc639dddf4baaf2b5e4494a82635fa07c01cd729d103c2afb68aad41ad8622cabd70bb1e2ec8b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772787254, "uuid": "7b635cf0-c8a7-487b-84d2-79572571efd7", "value": "T1B354231225356897E06918FAC0676CD1E51FC3BEBDB266C6322E495AE47A00C1E07F7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772787254, "uuid": "031d9543-ad8e-4de5-98d7-eeafb611ce2c", "value": "6144:J1edRiAhijqxDJrkR4w3UcmIwuXaw0rfUkX:JcTxhVxNg4w3OIzKvrrX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772787254, "uuid": "80c8e4ad-d82c-4566-9a24-75ea8a2daaa8", "value": 293380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772787254, "uuid": "7cf2974c-5d53-401c-81bd-bee3e161b34b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772787254, "uuid": "f6f9009c-62c8-4003-84c8-cd634f2a0160", "value": "SecuriteInfo.com.Win32.MalwareX-gen.68616644", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89816b3b-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819245, "uuid": "f6153204-f98e-4efe-849d-f7b76ef6c02b", "comment": "Malware payload (Mirai)", "value": "11bdbe144af165893691c7c2eb4167c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819245, "uuid": "df8c525a-5338-4c2b-a243-65ed5f35bb55", "comment": "Malware payload (Mirai)", "value": "2f8c0b7c42ba3387afaaf6d1dccb749d5a23065e2d239213dd30b1ddd77e14ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819245, "uuid": "1a0551ab-4fbd-4042-aeeb-e5da2f2da280", "comment": "Malware payload (Mirai)", "value": "d37dd334ca064302e54ebf31902e9a1e2e442212", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819245, "uuid": "e8e7390c-c157-49f5-bc92-9b5afa6e5d7f", "comment": "Malware payload (Mirai)", "value": "e5c627fc29e1ae9073dd8aad32407b6026bb7157a9011850e647450417ac609c2dcf4ae245ee4abe1508ab163cf180ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819245, "uuid": "e764d2ad-fc7e-4c50-8e9d-1284ef61a0f2", "value": "T1C7242A93F905DEF7F40EA77604D30B257232FB610A531A32B21779699E3A2C4246BF46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819245, "uuid": "af3c32e6-8d8d-406c-b0bf-9e070943186c", "value": "6144:coiP/vwnyxRXh7VJu8upxLQCeZe4NWevDOjFc+Sctha9byTuC:SPwkumCeBvDOjFc+Sctha9byTuC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819245, "uuid": "e1beb7ed-cd21-42f7-8d0b-8c7f9ca49a7f", "value": 229748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819245, "uuid": "9fc15b52-e656-45d8-ae6e-6c521a8911a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819245, "uuid": "d81f79a4-b2a2-4071-8d25-17b12e986efc", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "178c892b-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1772809176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809176, "uuid": "a9887e9d-1f04-4cd1-a0b1-4286a5f95593", "comment": "Malware payload (SnakeKeylogger)", "value": "1cd744ddafa95131b6b6718e0c823d4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809176, "uuid": "2c61db43-d0db-4e77-b620-1ea355421545", "comment": "Malware payload (SnakeKeylogger)", "value": "2fa3ce0a1eb7d35983af0fad9bc133bce29a296fb0a246cb9942e3bf913ffc80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809176, "uuid": "bf5ab01e-d82b-4f5a-81f1-4507e3314fbb", "comment": "Malware payload (SnakeKeylogger)", "value": "f24a79d29ac38b4ff28ae2bf65c5487fe394a5c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809176, "uuid": "dccf9b02-58cd-4662-822c-bdb5899b1b96", "comment": "Malware payload (SnakeKeylogger)", "value": "e8ce7497ee1cb1f6a0f226aa4a4ddc4c202fea4cc004817ffaf8ffa0af14818006c28e18fa081708160a050f3bd62a9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809176, "uuid": "bbac693a-94f7-4de3-be96-7f6d24f73aaf", "value": "T1885512442379D902D0B60FF40AB1E2B58FF95E8AA922C3539FFAADD7B9363501D41247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809176, "uuid": "efcb7e63-93a8-4afa-8eaa-8907dd3d4628", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809176, "uuid": "11d067eb-a40d-4c01-a457-1caf10bf3abd", "value": "24576:Cqu2V3lnO2nEGAlwsvmfak9hmz6GfKs/g48JqECAfbMZa0fTu0z0UejY7XM:CeV3lnOmRAHv1k9hdGSshEtfbmRfTu0G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809176, "uuid": "4aefaa98-5c64-4d5b-93cb-65ffbe16100c", "value": 1314824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809176, "uuid": "5ce5986f-7c81-4da2-babc-5a0188eaac92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809176, "uuid": "13f0574b-56d7-4d4d-b592-af0fdbddd057", "value": "2fa3ce0a1eb7d35983af0fad9bc133bce29a296fb0a246cb9942e3bf913ffc80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "136a0252-1956-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772799290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772799290, "uuid": "23ec7cfa-4467-4774-9928-2f6d7d60f27f", "comment": "Malware payload", "value": "4af488ba4abe900683477bb2a1065ca6", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772799290, "uuid": "d4d7415e-f824-4927-87e9-06c4774642b0", "comment": "Malware payload", "value": "303a09eb23736481748f307d4945bc332a76f45a2fa5fc137fcfdc009b4cc289", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772799290, "uuid": "01396016-480d-4aff-a3e3-a9b770358086", "comment": "Malware payload", "value": "fd76103e4a371e9b3a04bbe9adb20055ee2a25f9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772799290, "uuid": "35c37316-8c04-46cd-83a8-1d21724a42ef", "comment": "Malware payload", "value": "3748794ebc3064c8030b672d257943d6bcc2f5a9b13387fe920b89f1de6614b6466dbd0070b46b8f22a2f0f31cc278dd", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772799290, "uuid": "1db22b2e-16c3-41eb-afe7-8e4ab1f0315f", "value": "T104C5236642E801ABD576077659A2F27396B97C644B2360DF32D5FD2BBE323C22431B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772799290, "uuid": "1c309df7-e58d-4538-a95f-0793325e272e", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772799290, "uuid": "4b1480dc-818f-409d-952d-b464b6ee3b01", "value": "49152:i3peTk2HGvmGrjbYnOcHjo1Is+E00m5EcC2kpleD:i3YTJHTy2OmZVE00mycCtE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772799290, "uuid": "85ff0b32-c2a0-4869-bb59-610a10226c4f", "value": 2647856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772799290, "uuid": "f15ec90e-df12-491e-9439-925a1ff1b467", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772799290, "uuid": "1ee53a38-986e-4cc8-87b4-76a5c42cb5ea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "035c85d6-1973-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811719, "uuid": "ffaaeaa7-2479-46e8-a325-652908b9b64f", "comment": "Malware payload", "value": "b609d88dc6a7fa489af9f6784919c833", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811719, "uuid": "b7746c9c-1cb8-4542-86e6-fbf2ceab8c26", "comment": "Malware payload", "value": "305a37e5c5db5879c66a8516b8366b15fdff7e968ebf307864098d6fb6953fb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811719, "uuid": "b1e6112f-9006-4d85-8b02-0a428f482694", "comment": "Malware payload", "value": "4abae6be98c093f8bfcfc86fb342478b597146e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811719, "uuid": "fe0bb22d-281d-4791-8400-aea7abe18537", "comment": "Malware payload", "value": "490bc9548fb785b47823a7ee84bd8cbc0075fe07a58702a68ed34f45f6bdb5423ad3c97a1f7704eb98667b041b005d33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811719, "uuid": "73b70800-6eba-427e-8651-f10dccb2d45c", "value": "T13725230920BCD002DAE612F445276365EDF72E569060AB8327343F7F7EF69B1C41A6A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811719, "uuid": "2368fbcc-613a-48b5-9bae-b89ce1d76340", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811719, "uuid": "06db83b0-203b-45a6-a0a0-eff73b3b6df6", "value": "24576:gXaVX4O/PXPWtiVM5sfWx2j7IRUCAm504gmfZoeYCQ5:i6hPOQAspj8t04gmmL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811719, "uuid": "d800fe36-d2f0-42ff-bb83-fc2880f6a46f", "value": 987560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811719, "uuid": "cacf03d0-cc2d-4771-bbca-ded7ba7a28a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811719, "uuid": "bfb0fdf0-40df-402a-82fd-54871fc6c052", "value": "305a37e5c5db5879c66a8516b8366b15fdff7e968ebf307864098d6fb6953fb3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9f8b4bf-196c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808992, "uuid": "265f0246-6ddf-4012-adfd-335c6f602a45", "comment": "Malware payload", "value": "d89b02b9069a753ab5093a6ce407fde6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808992, "uuid": "98f3afeb-c41c-4a1b-bbe0-57e5ffc396a8", "comment": "Malware payload", "value": "3067ab57df2d64d01ba4bfd933095e1949e982382926ee073ad0786f00548db0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808992, "uuid": "3340aed4-ad4c-4664-9c19-cbc06edd41e1", "comment": "Malware payload", "value": "23a51ec5cd6762eac4bfabb58ec9f0165265100e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808992, "uuid": "9f49b993-a2e4-470c-9ebf-e08db6afed91", "comment": "Malware payload", "value": "f1a8dbac79ac4e8210574dd0cf9ed4bdf5e2ccd3e037553513cf71ee592a81fc2ad767dc20ad60ed75367c311fb33315", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808992, "uuid": "47f36b07-9607-485b-8e41-136ab66ca865", "value": "T17315232119D1DA83DEA61630343A46B36AFFED375E68434E1365FB4D2EB36430A0B352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808992, "uuid": "0ac056be-36ee-4551-b8fd-179ab20763b1", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808992, "uuid": "7472f9e6-02a7-4b7e-96a7-681a141e5f80", "value": "24576:gN84ClJtLYRZX+5kVMMvjSxifGkFL1bbxJDQVuoqjyFa/nJNGrka:An6URZB/9fh5VonKUahQrka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808992, "uuid": "7ed617bd-ce29-49e8-a2cd-681619f0079d", "value": 884591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808992, "uuid": "fadbe081-cb5d-4043-995a-0c15d96e78e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808992, "uuid": "2c79b29d-37fe-4499-a0ad-2323cb756076", "value": "3067ab57df2d64d01ba4bfd933095e1949e982382926ee073ad0786f00548db0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9f6eb16-196c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809072, "uuid": "2830dd1e-c296-442d-87e2-84a4d08c5f61", "comment": "Malware payload", "value": "d7f9b9a0fc34553552a08a83d3e49d60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809072, "uuid": "9125c9db-2f53-4230-a4ce-6da2e10504c5", "comment": "Malware payload", "value": "31113f22d502f729d5fe022e54d1fc0101056a25c622c4b537f5fd1b98b599c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809072, "uuid": "7a4a38f4-16b5-4627-b7bf-9f896ed666ff", "comment": "Malware payload", "value": "13908b2f0dc7aac2b99def438958e4b04d041391", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809072, "uuid": "10273534-287c-42b8-8a00-4f9e3f5b3803", "comment": "Malware payload", "value": "9189b3395ad93af4f71f2d6f2a74679240b629b69e4fce8f89c9c5d4c207ebfa1a9acf0ac54edffdbdccc590bbbdaa27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809072, "uuid": "10bea9c1-286a-4660-8360-e3807b0310f8", "value": "T197841248B675D063D8658A712C1BABF30A64EE162928432F37807ADD3D7079DFE0D399", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809072, "uuid": "f8715065-ddd6-49f2-9ce8-b4bd1b703dde", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809072, "uuid": "12a7fc1c-d8a4-4bcf-a586-007159498233", "value": "6144:A4t6LsyAWYRsw3HWstpqvp2Ocmrx27o62C6Prv7FV3gQmS7l836PcjbeQ8AFQTH8:AkdW+Ttovp24Co62PTvfJUjbhqH3sb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809072, "uuid": "4d64975d-adde-4a8a-be5c-63b23a383226", "value": 385912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809072, "uuid": "1907c14b-e353-4d55-94bb-b47b2963e5e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809072, "uuid": "4c768dc5-7dab-4702-ad87-7d0f705b025a", "value": "31113f22d502f729d5fe022e54d1fc0101056a25c622c4b537f5fd1b98b599c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89883ac8-1982-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772818386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818386, "uuid": "42294c90-9e73-4e4d-b968-4ba567909c07", "comment": "Malware payload (Mirai)", "value": "2688b64303ffad23b3a276656a5746c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818386, "uuid": "a0f309b5-fb04-4a02-979c-1d30e086e4bb", "comment": "Malware payload (Mirai)", "value": "31429fffba08d2eebbf70e6ef2efc8a4560c981a91056c750d2a72ac99edd543", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818386, "uuid": "dfb541c7-d667-4839-b5af-535ba80ebd49", "comment": "Malware payload (Mirai)", "value": "e703c02b50fbc552a25cc4dcfd39423f921f3fdc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818386, "uuid": "1c835a45-f5c2-4cdf-9fd6-3354fb0c805e", "comment": "Malware payload (Mirai)", "value": "c5582d74f2a88280fa79b160a8452442fd9c96534d25d9200a17375d2b2dfea932d1e5a030149aa4a743a448b219b120", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818386, "uuid": "803b69cd-c965-4716-9043-cb7e5815c446", "value": "T1AD041A05BF150EFBD89BCC3B45F9270529CC581A22EA6B36B934C858B54B25F1AE3D70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818386, "uuid": "41df03bc-c69c-44c0-ac1d-b6a587c14dd5", "value": "3072:J60NEpL/RdBtJN9xFZ9hkOmG5RdelJgtTwn2APPMuEzvQ6WJ9G2/7ZiYlTBVmJTT:J3CTRdrD5GFnrPUNsNzZt06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772818386, "uuid": "89b49206-daee-4f4c-a3d0-6e9e108fca73", "value": 179916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772818386, "uuid": "ab8af38e-2082-4fab-8ced-d947a2eb1b9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818386, "uuid": "aa04b79c-aa6f-4264-b5ac-6898604d7181", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d29e01d4-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1772809060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809060, "uuid": "636598b2-d303-4af3-b4f9-265f5b505e35", "comment": "Malware payload (GuLoader)", "value": "7578c0ec048e56a8cedcb4a67b4d44b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809060, "uuid": "b8be4256-3cec-45a0-8680-b730bb607101", "comment": "Malware payload (GuLoader)", "value": "31a6b7c0fff43f956bd590b85502b6da248574fb02f692aa4f9fdc4cb88d5197", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809060, "uuid": "6dab1a00-85d7-41d0-bb92-4ba7cf893761", "comment": "Malware payload (GuLoader)", "value": "4d0d717a851d011bc44c8a36b08411b8d031b878", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809060, "uuid": "29d73488-59d8-439f-a7bf-17d2e18a2190", "comment": "Malware payload (GuLoader)", "value": "9a97bc817fd569b3d8e5b57bc4fa27a81592fafaf1b281edd8754bec41a2a56839d5b39671597500cb343c4f2dcdedc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809060, "uuid": "0bef86dc-dd0a-41e4-be45-71fe182ebffe", "value": "T1386412453B20C0B7E5A21EB02D6A3E974EB2CB051828A75B27607FDD7D327569D0E387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809060, "uuid": "7720cc65-c296-46b5-8d7d-a7a9a820b362", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809060, "uuid": "f7061af2-f703-4906-9d35-c59f77c7e4a4", "value": "6144:k4t6LsyAWYRsw3HWstdrAjMAUKtsFWEm4hQ3W0Qx5TDdjJtcl6O:kkdW+TtF9Ktu1h0Qnyl7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809060, "uuid": "2546245f-7f39-4dda-92eb-46ac7d6c8806", "value": 324840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809060, "uuid": "f09d0faf-c75d-499f-993a-cebb39a51de1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809060, "uuid": "b80390d7-7716-4198-a18b-2a935edbb58c", "value": "31a6b7c0fff43f956bd590b85502b6da248574fb02f692aa4f9fdc4cb88d5197", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "509b2436-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808412, "uuid": "eb2b16fb-baf2-4db0-8d96-de5c0693c4a0", "comment": "Malware payload (GCleaner)", "value": "8301a3ad053bcfbc35b975b8c68ab2ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808412, "uuid": "9eaa637a-361c-40b4-aed6-af102f4139c6", "comment": "Malware payload (GCleaner)", "value": "31b10e25d4a9385c3f7d512dae95370bf3a63a86f799574c43e464b8df291969", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808412, "uuid": "07983b12-7b65-426f-8b42-a000c3d28ead", "comment": "Malware payload (GCleaner)", "value": "40dbc90d6f20d5c02b418a0adf94a4c27559d44b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808412, "uuid": "cf209455-01a6-4c04-878a-fd4b20d42637", "comment": "Malware payload (GCleaner)", "value": "a72cf2cc0838f175e722b04ae585f93256289aeffeccda8eeeb44fe45e18d49396d0611a5765ca860e2c51cf34b0e62c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808412, "uuid": "ace8d763-eafe-4bc8-a6c8-f75a890cc82d", "value": "T10236DF0B63A89474C99477BD48AE6FCC4D4BE6543831998E2B514ECF9E1814FECAC1F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808412, "uuid": "6db4813a-350b-46e7-8b7d-12d9556562f4", "value": "336c69b6e8562d1c5231f219b62d7473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808412, "uuid": "d94caddd-b7d1-4b81-8e0d-0cc2bd8d9be4", "value": "98304:19zuU+sNE1mWDSrla12o84EON0KYHs0tM:1z+dwWWMyONIY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808412, "uuid": "98ed91bf-1abc-4cd1-8caa-4eb57c08682c", "value": 5024256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808412, "uuid": "00050371-e5ca-42a6-a854-2d382945ce4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808412, "uuid": "d8705827-8f3b-436d-9de1-b89a826a201a", "value": "31b10e25d4a9385c3f7d512dae95370bf3a63a86f799574c43e464b8df291969", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccb5b2ab-195b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772801749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801749, "uuid": "a0bdea94-8746-421b-a813-5ca59c270838", "comment": "Malware payload", "value": "4cbd2d697fe52b159d4adb4629c0c803", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WikipediaJsWorm", "colour": "#A0BBD5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801749, "uuid": "cc814d5b-5f89-4838-afba-2ae5e878788e", "comment": "Malware payload", "value": "31c242f2e14fed9774288162a41ea430a6b39bf2909b3e583353a6fc0f3e6bb2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WikipediaJsWorm", "colour": "#A0BBD5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801749, "uuid": "3e947881-3828-4722-8705-3a47c0be11a2", "comment": "Malware payload", "value": "fd657992146306c2e1a9ee3a3b64f958e848176a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WikipediaJsWorm", "colour": "#A0BBD5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801749, "uuid": "5beeeeb4-ceeb-4a48-8753-908fca877c93", "comment": "Malware payload", "value": "b74ebf2ac0a5ca5b27ba2cfbac6204fbee621e56400a38f2457081bb7b8c20883693d01420337f76e445cfc8bb5af14d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WikipediaJsWorm", "colour": "#A0BBD5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801749, "uuid": "22acdf87-b4fa-4b6b-8bed-31623ddb496f", "value": "T13DE2DBAC72239C6DDC63256BF19E735EE2601F13F5ACA0507A4C10486FE4C9ED14AAED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801749, "uuid": "cdbaa944-11c7-4b33-9d80-7adb12ea19aa", "value": "768:r/yCus7+KRzihuh0/zU/yCus7+KRzihuh0/zS2:bn17+KROxzGn17+KROxzN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772801749, "uuid": "66ff4f24-2220-463f-921a-fb2943b191fd", "value": 31981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772801749, "uuid": "26556b9d-6fb2-4881-8c7b-06db92359022", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801749, "uuid": "b07f10d9-5948-4601-bd0f-d2e28b80b4b1", "value": "31c242f2e14fed9774288162a41ea430a6b39bf2909b3e583353a6fc0f3e6bb2.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffba5300-197a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772815149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815149, "uuid": "56f4f1d7-4104-4a42-92c9-ce61116c866e", "comment": "Malware payload (Mirai)", "value": "e102509e16d9e46a059112bea113a5e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815149, "uuid": "ecab36dc-0cd8-4efe-a23d-ae1e6be2fa49", "comment": "Malware payload (Mirai)", "value": "31e527a5040594573feaac114ac5f81c8ef46ba2c984f90f4c0c024775b2eea0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815149, "uuid": "c90a31c2-702f-4c1a-9648-cef01b2afe06", "comment": "Malware payload (Mirai)", "value": "0113a383f2eb768fcb43bace752e35e09a626ac3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815149, "uuid": "50dcaa96-5b7a-400b-854a-e21d2e764a8e", "comment": "Malware payload (Mirai)", "value": "55c171760144adf43f6ab8f2e76a28f8aced8b4e20957a0ad9850cb889add88f16d63b430b2e01f28330dff95e7a881b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815149, "uuid": "8eb0b0b5-da24-48c6-8457-4f06f29b1a5c", "value": "T158E30A45F8815B12D5D111BAFE1E128E37131BB8E2DE72029D246F747B8A9BF0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815149, "uuid": "3bb356e4-37f3-4a49-b262-154322af91d6", "value": "3072:Ox/+cJUUoEq9XouuIjoanHidsJLLtSysBkoya:S+4H49XHuIkaHids1ZsBkoya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772815149, "uuid": "763f049e-6e14-4e46-b18e-95070e1bc120", "value": 146268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772815149, "uuid": "fa148ee4-542a-4974-899a-7a4df03eb9c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815149, "uuid": "0b6cd715-a699-42bc-87c9-b9b96020d807", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a5ef35a-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772809637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809637, "uuid": "484c91a3-5a29-4a44-948b-86d5bcee2032", "comment": "Malware payload (AgentTesla)", "value": "3fb8410ee52692b5289649edba7a6660", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809637, "uuid": "5719221b-284c-40aa-ab2a-ee9ca9654076", "comment": "Malware payload (AgentTesla)", "value": "31f03e7a7e6a55cd725d80020ebf7fa35b77a85e131d328445467b40206314c9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809637, "uuid": "f8907c32-caa5-4e7e-a71e-4e24f7bcd29c", "comment": "Malware payload (AgentTesla)", "value": "e319a3d6faea4449afa14fafc8af6cec59e01385", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809637, "uuid": "2880f174-ec14-4e7d-bd3a-b16fc2591a0a", "comment": "Malware payload (AgentTesla)", "value": "86da4cf4b36fb18d27b29eca3bbfddddc6952e8052436110047675336d1fef8401bacd8ef4eea3b9a18e67431d21890d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809637, "uuid": "db703cda-a9b6-4d29-953d-91f64ff0397f", "value": "T18E94F157FB27A860C2864476D9F088FBD7705C63E066083E33527F1A5C3A59ACD191BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809637, "uuid": "87ea150a-f6d2-4a22-a60c-7eafd6897b84", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809637, "uuid": "e24dec5c-b229-4ed7-ae8a-a0a739653861", "value": "6144:LNDlOLZLClTgENjEtqTH9SVTRyhSCBBXjXS9ZYxs3NbOM:Lk8TgENjfTdEyh7lXuoM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809637, "uuid": "6cec62ca-d80d-4217-9a98-6eb1c41d85b9", "value": 413312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809637, "uuid": "0a8f77b1-6971-409e-98f1-4bfba97a8d77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809637, "uuid": "7fac71d0-1c0b-4bc4-812d-f69e13175634", "value": "31f03e7a7e6a55cd725d80020ebf7fa35b77a85e131d328445467b40206314c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9320348-1968-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807407, "uuid": "afef205b-947c-499c-8f64-2ad199e1efbb", "comment": "Malware payload", "value": "1e939b008d9b7257f29613fef5e7a12f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807407, "uuid": "19ff0489-40d5-4236-8d32-7e5cf29f75df", "comment": "Malware payload", "value": "31f7ed8a31c353eedc8fc2e6d3b3c1595cc6b586d97b0d3d4692e0807e52d6f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807407, "uuid": "a0b7c79e-9aca-40de-9a72-8554c76817ed", "comment": "Malware payload", "value": "753a087b0c63eb6747621090d5d6b2ef269289b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807407, "uuid": "9eae11b5-50ec-4cf3-ab7a-09aa340fd317", "comment": "Malware payload", "value": "e57626799f84353b267ee1bd68eacb83dde2638ab05b62fe1698f92b635cd05d2017263376bb37b4b27e78168a44c261", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807407, "uuid": "1f08c284-e899-4465-9ef4-ac6a0f205ba6", "value": "T1532633A697D3C644D043D0311A6352E5EEAD1CE1C5F4137B06CEDE99AAEA2F01E3C94E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807407, "uuid": "742561d7-08e4-4ce4-8a9d-be184a368f37", "value": "459038dd913bd7fa2746dd2acf101131", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807407, "uuid": "02921e6c-57c7-45a1-ac43-981041845410", "value": "98304:V5kOFk2dA35uySfdGe9lhkZxhYDpMeQpxnFZVN+xBdYyLFAqTtvm:V5kOFJApu5dGe9PkZ8MeQpp+xtFftO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807407, "uuid": "bf5b17ea-65df-4752-97fb-9b06701f4b28", "value": 4612096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807407, "uuid": "2ae034d3-1d56-45c6-832f-7a1d5a71f3dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807407, "uuid": "6db067d7-0cf4-45dc-ad3c-597056aa3668", "value": "SecuriteInfo.com.Trojan.PWS.Stealer.44341.10719.25421", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f529be6f-1972-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811695, "uuid": "852e8232-d82a-4ec8-8370-dafc34ad8c3b", "comment": "Malware payload", "value": "f4c849118459cfef69795a64c71e7f88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811695, "uuid": "b5e07630-f183-47f9-b879-b70984aabdc0", "comment": "Malware payload", "value": "3246fdc5c32e6b265880c004ebee3d7aa2d9bcb0c01874c03616e2b736f9e825", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811695, "uuid": "60c3a37e-25ae-4cc1-b34c-9ef26e29a335", "comment": "Malware payload", "value": "636034e634a92fd176726fdac88053413fadd88b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811695, "uuid": "3010ff8a-5a35-4c1d-81ad-8beb6a273590", "comment": "Malware payload", "value": "a63b98f9b772176fe650bf699788c876d87b45cc0c0fad6a3faa96483aefa0b3a31a25cdf5115660bb9faa767e163dd9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811695, "uuid": "e42ce044-50f1-4df4-90f2-d90313f0d474", "value": "T1DD35D00A0EC36B94D1984F78D2A604E827F0D65B5212E36F6FDD52F4DEA3F4AC907462", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811695, "uuid": "2a81bc94-244c-47b9-90af-ab85b8665b4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811695, "uuid": "49ee23ca-eeeb-4f85-98f1-ae7524b8e0a8", "value": "12288:dG5/0OmtTYokGOuXJxNB3+MLi6xsvf5vknREwIi0+FlN6YMSK31xo/R21KObAS4e:05sooNOYwMWgkWEd9qlNc3oo1KObD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811695, "uuid": "52f912ae-af95-4449-918a-e192c6d48aa8", "value": 1157120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811695, "uuid": "c3415f27-a381-4666-9f6d-729f4c00f42c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811695, "uuid": "33ccefd5-6449-4fa1-be54-2976b84f757a", "value": "3246fdc5c32e6b265880c004ebee3d7aa2d9bcb0c01874c03616e2b736f9e825", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a78513c-196a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808080, "uuid": "4f94d43b-9d62-423b-a648-62ff259ea45d", "comment": "Malware payload", "value": "b6b2ac4d2724542e71717f43fc8c63d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808080, "uuid": "de7fde67-3fd5-41cb-b9b4-059bba770753", "comment": "Malware payload", "value": "3277c24c43e3d510767b68bd850d82a29c50088807a58cda091ed91d96832ee5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808080, "uuid": "fdca07d4-a603-4bbd-a748-6463e46d7fc3", "comment": "Malware payload", "value": "371c80242202731d831d06dac55c3e0ae5e906d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808080, "uuid": "911829f7-e98e-4ecb-bbec-9966379b1935", "comment": "Malware payload", "value": "48ac063a52ade80dec50760e395ef00aade4a69a6704f739336d5dc22b46390c156e5265c5e41b4a5409ed7d01cf285f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808080, "uuid": "ebbf21fc-6933-4201-ab9e-59800189dfd0", "value": "T13035E00723D44E68E5BD9B7991BA04E147FFBB479B32DB1CA80951EB0D22B41DE01B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808080, "uuid": "cb14b378-2f1a-4aa5-a467-0ba87407491c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808080, "uuid": "517f4356-06f5-44aa-8f47-ba42ebdbad47", "value": "24576:ssfZNC8ZHKJCX0fI8mVS7zXng07ehUT3mYle:7ZWWgI8mcHgGehUd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808080, "uuid": "7d44cb7c-a81e-4e83-b57c-f978d501b1a2", "value": 1139712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808080, "uuid": "bf63b939-b678-485d-b896-9f1ced4d4b0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808080, "uuid": "6a993a0c-1f1a-4bdb-ab0b-fd57b8d95bb4", "value": "3277c24c43e3d510767b68bd850d82a29c50088807a58cda091ed91d96832ee5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "191a079f-1959-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772800588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772800588, "uuid": "3f9c114d-3c64-49f5-a9ce-e71e46597fbc", "comment": "Malware payload", "value": "34a010186d65142d6936bf00c1b78344", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Trojen", "colour": "#2193A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772800588, "uuid": "5f72b96c-db3a-4e0c-b8f0-2bef1eae73c9", "comment": "Malware payload", "value": "327a404f2ff2562d7e7f49e9fca68bb814128eef47dfea688680de3da91b04cd", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Trojen", "colour": "#2193A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772800588, "uuid": "975d8c06-d640-402c-85c9-c695eb2f0d4b", "comment": "Malware payload", "value": "ddc36c561fb8a2d2b4dd000cf158061eb1129634", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Trojen", "colour": "#2193A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772800588, "uuid": "fbd19f48-f076-4686-963f-25184b9cb573", "comment": "Malware payload", "value": "3a2df1447846f265087272616f3297ab14356003b55ece5e0c85a6d180d4d29b12e9fc56bc2306a5ba977f063744b902", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Trojen", "colour": "#2193A7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772800588, "uuid": "a30f5609-1fb9-4000-9192-1b697726a883", "value": "T13B863348A0B5CAE7ECF2C5480D2FC64D7693C9D463A24FB6D6DEB1ACA19DC14A4B3113", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772800588, "uuid": "cde90bff-7299-4ca4-bc1f-a3391e751b5f", "value": "196608:eu13KQLN5sjPV0EpN2hgKOljlvDLifVR/0oR3IAd2:LJLGVLb2hQljlvMVRYAs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772800588, "uuid": "03f3ec55-ceca-4e98-b0c5-fba9c0a47f8e", "value": 7903134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772800588, "uuid": "c11cb12c-b8b1-4756-9399-03e48bca48b6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772800588, "uuid": "e03454bd-40cb-4de4-a559-e838c00d66f2", "value": "src_1.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b37cb2c2-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811155, "uuid": "6090eea1-8f39-43e3-8e04-3d25d900d6e8", "comment": "Malware payload", "value": "f281898667b92e6686914737de37ee92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811155, "uuid": "1afa7888-4a35-41b4-99b4-9e6ca2394c92", "comment": "Malware payload", "value": "32c0cef6e680e6fb7e01bdd189b0674cf336804eebe09fbbeb7f05ff14b52f91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811155, "uuid": "edc4bf58-0147-4980-82e1-446f90e30897", "comment": "Malware payload", "value": "7800e4eea050e74c5836395de42ff18965ef8fe0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811155, "uuid": "7e0fe372-9100-4799-ae32-cd54f16d1f8b", "comment": "Malware payload", "value": "4b0dd89d08d8286467f2c072244df801c2ca22164da15b0b9cb5776b1cf79afc5de57e84ea1ac1abf2f7a26a29f21771", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811155, "uuid": "75bcabc9-734e-49fd-8005-ae06e88ca367", "value": "T17CA401237391F3BBE555C73B70AE93174F34A4265712292B3390F76A69F3132A74620A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811155, "uuid": "b3eb218f-b34d-4eef-935a-e825e1196913", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811155, "uuid": "1348b161-a4f3-47c9-8f77-bdf6c151bb6e", "value": "6144:16dE91NycbxZeQodWG498o6i60BqHIHTpbw5FD61i1MIQzVqjtcpWH8Wj:1ZZeQoj46KBHHWPD641MYjtcpWcWj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811155, "uuid": "2c404065-ca14-4f0d-92b0-4c13420f5f75", "value": 477240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811155, "uuid": "491d397a-9e69-43ec-b397-2ae97c98ad89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811155, "uuid": "63e589e7-52c5-468d-b096-a51e8b27f359", "value": "32c0cef6e680e6fb7e01bdd189b0674cf336804eebe09fbbeb7f05ff14b52f91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68bd778b-1969-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772807594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807594, "uuid": "e5915063-f252-4454-ba82-f2f42807c5ff", "comment": "Malware payload (AgentTesla)", "value": "d1616ef271b5ce924f5f360b23e84a71", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807594, "uuid": "b6ecd540-ddcb-4cff-a51d-dff8dd68dec6", "comment": "Malware payload (AgentTesla)", "value": "330aa9b600d16462d89f74f06fa2f8b1933a0f62a3221e1043720fdbc34c57f4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807594, "uuid": "d8f8c209-7804-4797-82fd-cb61b7790e8f", "comment": "Malware payload (AgentTesla)", "value": "c00dd4a692e4f4fcf0617df421a8f207901d6d05", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807594, "uuid": "00bab05c-e262-4d4b-a3af-78a3b66a1521", "comment": "Malware payload (AgentTesla)", "value": "0b9a3b743b4adae176106f9f7dba008faa637da723eba70a539f122b798882d3bdf4ed708171f9eec2833203a5f4e000", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807594, "uuid": "4b1e7d3c-da31-4c6a-ad9c-9e4be19fdb49", "value": "T1D8452324235DCD87D46C97F50425F37293B88E6A6521E38A8FED7EEF7419B42A818343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807594, "uuid": "081f7498-404f-49a1-86ee-5745cc8f41d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807594, "uuid": "81939230-67ff-4e1d-af00-37e993caccb6", "value": "24576:HguQKHuotDYMoLrTY9tzfkNUd3exBfeKMhke4m4Vict2:Au/7tDmrT+twed94m4Qc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807594, "uuid": "f3f8030c-9cde-4bba-8737-dacf6a856730", "value": 1241088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807594, "uuid": "23297d02-66ed-41b5-8300-d7deb790cfe4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807594, "uuid": "3216d769-cdb8-498f-9167-eec6a6f266b7", "value": "330aa9b600d16462d89f74f06fa2f8b1933a0f62a3221e1043720fdbc34c57f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99354d6e-1995-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772826573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826573, "uuid": "0368fd4b-9a55-4c92-b45b-6e2369004c50", "comment": "Malware payload", "value": "fec9dcfeaf091e839a7c23cfebe90baf", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826573, "uuid": "48b3255d-064f-40ce-8ac4-870139634773", "comment": "Malware payload", "value": "3344af492cb1cf92cc283b9b642428e77d8843a203d825761296c1500dd62653", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826573, "uuid": "82297e3e-b387-4ac4-bfdd-eb447e1759f0", "comment": "Malware payload", "value": "2c1b871d826506048ab525c25e9dd4f22e2c55b8", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826573, "uuid": "6abd4b06-111d-4700-8419-a6233ef88e1e", "comment": "Malware payload", "value": "8e1f3bffa3d2cb911a2a50c1165ee0c9ce6c3079f85bccea8d6460e73580ed3717ab9156ab449b4d770f6352c4d289f4", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772826573, "uuid": "bf649410-f7b1-4649-ba29-50666f658fca", "value": "T1D0352303FAD0EE9BE5034B3668D46101201ABC589B5D9117BBC5B32D7C7A23B9AFB54C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772826573, "uuid": "fd78cdb7-9418-4e74-9e81-7e6620ea7737", "value": "24576:lOaY0IJR8lffiwySgo7eR4zJsxliOwHBuV6Du:lOjZGiwyS3e2klZQMG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772826573, "uuid": "8cfdbd1b-0c07-41fd-a646-3bb08e4c1b8d", "value": 1068544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772826573, "uuid": "bf5a0746-0099-4fb3-acec-a622727a1c31", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772826573, "uuid": "80cfcb8e-b712-4048-bcf5-2288d4d111c6", "value": "SecuriteInfo.com.Trojan-Downloader.Office.Doc.32201.20163", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee5b913c-196a-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772808248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808248, "uuid": "01b7024c-a849-4f84-b99a-ea8e05e3fc9c", "comment": "Malware payload (Formbook)", "value": "0232659e4b87ceab745d8db18f07a4ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808248, "uuid": "31fef04c-59a0-4092-b2ec-dbb3f77eb3aa", "comment": "Malware payload (Formbook)", "value": "338b32fc3495b5f09e41a50a7b96085dd5203b51faddb5e2da08436378d5ed03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808248, "uuid": "5e6bcd20-59af-4d25-8c73-205a69fe7b74", "comment": "Malware payload (Formbook)", "value": "4a1234543490bc0652689c0a29ea5093a78be89c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808248, "uuid": "6ad18c18-16a7-412d-b906-d929b4f08de9", "comment": "Malware payload (Formbook)", "value": "b5367e90964a7be3d425ad2f928da4b30922a532ea5ad2a703d5792549c18fe5149b02a2e41eb49c483b0d7718b5d7bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808248, "uuid": "15633b2a-2ad5-4cae-b333-0e6f91a440da", "value": "T11D05AF1DE5E260D1ED2188F20F5E97D08D1B7313A7A5189723B806044B978FB6F6EB27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808248, "uuid": "ac7c82cf-fedb-4a82-8bf0-f8b10cee0fdd", "value": "79b51b0b8fa06ebea3a256fd7f7ce2c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808248, "uuid": "a9ee0b79-4ebc-48bf-8094-39ac1876bcfb", "value": "24576:TayxlisvcLe2UetcJZQl2v3GOOYDVHvkMjJzuk:TakcLHU4eZy2v36YflCk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808248, "uuid": "b4b6186c-eb2c-49e7-960f-0efcfd00f7d4", "value": 869888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808248, "uuid": "71ae219d-49e0-436c-970f-c4297ba7a9ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808248, "uuid": "de372b9f-9833-4db9-bc9d-9e8e9cb24297", "value": "338b32fc3495b5f09e41a50a7b96085dd5203b51faddb5e2da08436378d5ed03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10bceb84-192a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772780388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772780388, "uuid": "3e72973d-a03a-47e5-b190-ca5fbc4e810e", "comment": "Malware payload", "value": "c5e3aeb72def4e422b48103a18d8f2d1", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772780388, "uuid": "5b9a315c-d216-42f7-a0cb-399b79ade8a0", "comment": "Malware payload", "value": "33a29949d535a03dcfbd68e1bf31fd8525b7d8823e3e32785a66c65724d9c93b", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772780388, "uuid": "2858bb7c-de71-4ac4-a04a-de7efbe9218b", "comment": "Malware payload", "value": "81a4db4baa1e7c9606badc2001def090e86ff71e", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772780388, "uuid": "1eaad21e-e559-49f8-9467-1567dacfbb0f", "comment": "Malware payload", "value": "fc3cb878428bccaae0fbb18372bba24c275d71af36e6095bf57038a54cac5b7bccadc7b0a4b07bda7ca7f932836774cc", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772780388, "uuid": "9fc3496a-3ab6-4ea7-82d7-ce69a05914d8", "value": "T16E23CF11A3E64248F1F76B709EFF1406196AFD0DAD31DA0C0118E55CAAF6E5A4C66F33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772780388, "uuid": "a48e1a42-9cb5-47aa-8964-2a3d1dd7a0dc", "value": "768:MxiGBRsW2XC9gJRBpL3nfJdCq4ygc+gr9LskxqFFUsvW/i/Vk5rBTZAYj0n4op2:giGB12pft3fJdCqKgr1sAqFbWGV2rBTt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772780388, "uuid": "7bb2d2db-5503-4326-9bca-2436076a6041", "value": 47244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772780388, "uuid": "75e490c2-3098-4e35-bfd3-7928bf73c362", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772780388, "uuid": "4059fd39-99af-4ad0-8064-28f66e4df37a", "value": "33a29949d535a03dcfbd68e1bf31fd8525b7d8823e3e32785a66c65724d9c93b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "614f4123-1964-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772805434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805434, "uuid": "b185fa32-4992-4cae-b301-85b56beb65af", "comment": "Malware payload", "value": "7711c81c6d11f1416b61a03738795827", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805434, "uuid": "cf7796d0-dc2c-4d1d-9462-201b8530d741", "comment": "Malware payload", "value": "33c19114562bec2cee74599723c483ca21085e686d79eeee399ba2e28bcac0b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805434, "uuid": "134491e8-6ec0-4f5e-952e-cffad73d499b", "comment": "Malware payload", "value": "a2243ed14f8ee371a25245212cb0c7a0a6140b3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805434, "uuid": "9b401cbe-0466-4e2d-ba4e-5c43412b74fd", "comment": "Malware payload", "value": "54fe8ba221de4359f9145f1697febab73e9fe5461ca867d016d281c31bee6f58da346f5b19451f713646b370d5b0887a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805434, "uuid": "13851093-ab11-4e32-b349-8f53151516d7", "value": "T17C32C517A7BBAE1BC4D037770193072162E95F916024472FBD0D1C8E6E9B3412E3EBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805434, "uuid": "ae2678d3-193b-4603-85cc-7f208764ef8f", "value": "192:xvrOR1CQOsz1NxfAzMH9iG0GhWaDpU/O7Q89AGSybcqeif:xvrbCzfaM2GwIU/kwGSbUf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772805434, "uuid": "80fd83cc-f973-4c6d-ad2a-f98bc9796eb3", "value": 11024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772805434, "uuid": "b68befda-7a56-4e37-bf76-959855485295", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805434, "uuid": "be3b3767-a402-4a68-a8eb-0a0d9d3deb2e", "value": "iran.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab8b2a45-196c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808995, "uuid": "7677bd21-3474-47ea-bd34-5406a4fc5b50", "comment": "Malware payload", "value": "8dac95002f0871c96666ca690a84096c", "object_relation": "md5", "Tag": [ { "name": "res2erch-sl0ut-com", "colour": "#6451A1", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808995, "uuid": "80f9b8a5-77c4-4314-a13b-a8a29faa3b9f", "comment": "Malware payload", "value": "33e1637f9543bf61fa835bc150c4bc9383c3ad054fec55b46e6ab6254cd31756", "object_relation": "sha256", "Tag": [ { "name": "res2erch-sl0ut-com", "colour": "#6451A1", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808995, "uuid": "12c03003-cbb0-49ee-9aec-df31f00d89b9", "comment": "Malware payload", "value": "9e55feb7627e3d7e6b2c1b04b969a1bac72f1766", "object_relation": "sha1", "Tag": [ { "name": "res2erch-sl0ut-com", "colour": "#6451A1", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808995, "uuid": "a1ccab26-cb5b-4fde-b7f9-55c84d08e22e", "comment": "Malware payload", "value": "c851875867db5a3b18ce5a2216cb7306b6be8beb0ae6e16586977454c1e4d5f9a3e79b15a0b3b668d6e1aa5e46faa692", "object_relation": "sha3-384", "Tag": [ { "name": "res2erch-sl0ut-com", "colour": "#6451A1", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808995, "uuid": "b750968f-b16d-45b1-a20f-f806c0d7522c", "value": "T1F40165EF343224731F9346E64C5391934D76C23F5BD05D9868D1AB3409AD050622122E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808995, "uuid": "c6343a22-6646-450e-a2cb-7c311802c4fa", "value": "12:Sh897dG3BCFr+Bnx8jiFHYfDlKpFeixnLQmT/adGXhG1ugykYP9RcADB73O9y:/xdGxCFnm1EDlgNjTidGXhGIBFVR989y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808995, "uuid": "f16f802c-ab49-4554-bc66-853e845ddcb4", "value": 744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808995, "uuid": "01737fc9-cb37-4363-8987-123d3918f584", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808995, "uuid": "6cb3fd90-96a7-4ea5-95db-db79f0e4e632", "value": "33e1637f9543bf61fa835bc150c4bc9383c3ad054fec55b46e6ab6254cd31756", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "925debee-196a-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808093, "uuid": "99daa12b-0e28-449d-972a-bee910f79986", "comment": "Malware payload (GCleaner)", "value": "58922d11363b8d6fb551e03ca1ac0610", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808093, "uuid": "7a7153a6-7afa-4422-9eec-c62396575389", "comment": "Malware payload (GCleaner)", "value": "345e91abb5513824367a1ce0a12718958541937455f6a2e28ac6d225673fe1d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808093, "uuid": "4b51c25b-a3aa-45c6-a1d8-bcc26155d488", "comment": "Malware payload (GCleaner)", "value": "63a879d255fef90580522e87d33449fb07262c29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808093, "uuid": "42a364b2-791b-426a-a24d-8a8c44023dde", "comment": "Malware payload (GCleaner)", "value": "aa6179f649d4dbff6a06c6bdb35e06deadf585747af3f5f74a5fbdfbe132b499d5258472637f65c6b5c0f8b2ba621a19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808093, "uuid": "e770b363-312d-4bd2-aa68-1287f2ad24d3", "value": "T19B46E02767650824E0F9DF36CC6D82159FF7EAE01A341C79575E0BC8FAB190FA61029E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808093, "uuid": "1e0083fb-c689-407d-aa53-7adaecac9aa8", "value": "336c69b6e8562d1c5231f219b62d7473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808093, "uuid": "a7782dc4-9a0f-487f-aff5-135c65f01dad", "value": "49152:39t9u3D4mIC2ItXf2wD6hb6o2t4WQcuLaI8Y74dRV/eTLWfLgts/5Z7Zz+SWRD6a:39zuzFnXf2wM22VcnITsnXfhDp+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808093, "uuid": "8d87506c-05df-48d7-a078-2a5af756a4fe", "value": 5805056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808093, "uuid": "f6a92ed4-5b9f-4c9d-ac36-6ae3a67582c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808093, "uuid": "f5965dcd-313e-4291-88c0-77392087d2cb", "value": "345e91abb5513824367a1ce0a12718958541937455f6a2e28ac6d225673fe1d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43255708-1982-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772818268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818268, "uuid": "cfd46977-c4ea-466f-97de-6760f8d79ce5", "comment": "Malware payload (Mirai)", "value": "19bc85789a5ad880d2d7deee467d36c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818268, "uuid": "7803aa9a-dee9-4a3d-8968-ee5319a51dd7", "comment": "Malware payload (Mirai)", "value": "346a587cfea8edd725938e6179f7e1581eeb397249b9a75cef398284dea40bdf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818268, "uuid": "fc1bc2ed-d061-4918-bd09-d1df333f6047", "comment": "Malware payload (Mirai)", "value": "6586521f91df44bdd7ccd15c689de6be18d8319e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818268, "uuid": "6f5bda1e-cfbb-4832-936b-5d526222aff3", "comment": "Malware payload (Mirai)", "value": "b803e087fcbeea52168709ebc6d4a9072687763d37e17048c63c6fc957f088612f8ad0efff675ca9b458b587e08efb1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818268, "uuid": "90a06d74-79dd-4edb-9156-5658e6bcb2ef", "value": "T16493E551BC82562BC5E023BAA67E668D336477E4C2CF722BC8214B257BC561F0C63F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818268, "uuid": "a900a7af-d060-4261-a96b-d200a96bfa68", "value": "1536:Cd+t0rbCuNhS7CVha4m2WiLMBZO+WC27nVDuw8GSr8kn:8+tsCurVDN+ouw8L1n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772818268, "uuid": "c258c029-0bcb-46b7-b132-4e6575359985", "value": 95720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772818268, "uuid": "d0248647-49f6-4174-afea-54337dab7f7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818268, "uuid": "6a519c8a-4ebe-4ef7-9167-0324a8859ff8", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb2dec5b-1983-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819007, "uuid": "5000641f-519e-4f05-9435-bb2e8da5c972", "comment": "Malware payload (Mirai)", "value": "536c713801b9128020709e6f6a5b3b84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819007, "uuid": "1bcf3f90-00a9-49cf-8a48-ba47fad33a26", "comment": "Malware payload (Mirai)", "value": "34798d8838a176625c6789be353be30a943d5b0efb636c00a2818bbdaab6f07d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819007, "uuid": "c5b1b5d4-81c3-4263-9819-b18c27e12e9b", "comment": "Malware payload (Mirai)", "value": "68346ae10b2fe329da6771d4a3515f3a56347b88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819007, "uuid": "165bffda-912e-4b43-ab04-ece181231933", "comment": "Malware payload (Mirai)", "value": "56d3389dbc994843536786305b6c58336aff929fba3c6bfe82d4735470dd2f4fbfd71e443dd077ee5f6271aa1748b2b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819007, "uuid": "17c11d59-80e9-4b38-8336-fae08579660d", "value": "T12EB318D3F810DEAAF44EDB3B416305067230E7964F921A3B266B3557E87A1D42077F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819007, "uuid": "ddaf564f-baa5-4430-aa7f-2eb694318fc7", "value": "1536:8RHOqNMW1lqbgBsxq3rDTvBZM8W3nof6+T7U3LDxq7qUEwudc4TpFyn7KXx:8HN1lIqsQXTvBZkg7YLlwudc8Dyn7KB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819007, "uuid": "77778375-c750-4bd9-9510-e7cf6796ab4d", "value": 114056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819007, "uuid": "093a554f-e02c-43db-a8e7-b79ed7a312e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819007, "uuid": "a81f3251-dd24-4db7-9073-af0da9118ad4", "value": "debug.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0763c7e-1970-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810801, "uuid": "59894943-c990-4bc7-bea1-cfebf59439c4", "comment": "Malware payload", "value": "e0648d44983a0e697a72082e268a0c65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810801, "uuid": "0f68c57c-cf45-4561-ab22-042d84539071", "comment": "Malware payload", "value": "347b9df9429b4f9c84a32c172f7621a74ced365ec9f8c5a5fb8775e265b59ce6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810801, "uuid": "16da8c32-650e-49bb-9819-50b91cb837c0", "comment": "Malware payload", "value": "f3cc033db923f710146bb62d5632a0de91d578ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810801, "uuid": "e973e710-2ac5-4531-928b-c2ab94536f96", "comment": "Malware payload", "value": "d918297305e39d9717de85e517cf760afad222c620fb311669f3e68bbcaaac457893c715ed3adce4750a24cd1a64fa59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810801, "uuid": "cb10e9e5-0000-4ecf-92a8-5c963e6dd0f3", "value": "T1E4C422012AEA4857D8C22DF406F7173BFA74CA0226585F27F7A0EB98BCE2BD19415716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810801, "uuid": "a52f1c90-0e03-473e-af6f-442cecc1ea27", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810801, "uuid": "4335adbf-8db9-489d-a767-4418fcb85292", "value": "12288:Z1yDJyQL686PexZWlZ5ziO2eFu6BH2g8CtKmrwjWimn29ukbCBA51lcWb3wgQW:Z1yDJy06RPPZ5ziOggH2g8CtKLjWcfbN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810801, "uuid": "e0b788aa-f32c-4234-aae4-876efc83e8f0", "value": 578144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810801, "uuid": "1aff4076-5892-43d0-99fa-ed5375442fde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810801, "uuid": "e89b0490-6b57-4c21-aae2-df1beefe654a", "value": "347b9df9429b4f9c84a32c172f7621a74ced365ec9f8c5a5fb8775e265b59ce6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22b557e6-196d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809194, "uuid": "a08b711a-e69d-47c2-86f7-67d18353bab8", "comment": "Malware payload", "value": "c0e21a7b45f383823984c0c5a75d2026", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809194, "uuid": "ee473a0e-8494-45cb-9d95-1937af02ecce", "comment": "Malware payload", "value": "3486a642f30032d26dc0118267c172b7e6a43ca181a1ad679820c1b19c4fb11a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809194, "uuid": "cdc4567d-4089-4646-86e0-b1df728fabdb", "comment": "Malware payload", "value": "a4c7b0ddc91b269dd7bc4b39602d1a42a7bd705a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809194, "uuid": "d8627fa3-41ee-4ca8-80d5-56be56a3c1ee", "comment": "Malware payload", "value": "c741e0e4058f5a40a7ad998192cb3d2c293e56abc35904cbe24ac0a187992492957ab556866596c467161cc22c1e5d05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809194, "uuid": "5b1a1c61-84cc-4426-808e-41585f6f3a18", "value": "T16045BF027391C062FFAB92734B56F6115BBC7A260123A61F13981DB9FE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809194, "uuid": "2b485980-365f-4d7d-a195-8bf5f222c294", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809194, "uuid": "bb849a78-4c17-4b8a-82de-e6703a3261c3", "value": "24576:x5EmXFtKaL4/oFe5T9yyXYfP1ijXdaAXab7pxlaVF7Z2Xn:xPVt/LZeJbInQRaAkx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809194, "uuid": "88bf5e8a-6c35-4dbc-abe6-14ac80bbc343", "value": 1246208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809194, "uuid": "15119d15-a764-4e85-916b-3bf5eb3bf26a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809194, "uuid": "864571c0-2c7b-438e-a0f4-a3e7a11e2d97", "value": "3486a642f30032d26dc0118267c172b7e6a43ca181a1ad679820c1b19c4fb11a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fa8cd77-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1772810693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810693, "uuid": "e67223e4-5924-458f-920c-c072f15c7c16", "comment": "Malware payload (SnakeKeylogger)", "value": "dc878a6d7540b8a35a60b1aa1031ecd1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810693, "uuid": "447f445a-c52e-42f2-af36-085fe73a16e3", "comment": "Malware payload (SnakeKeylogger)", "value": "34dd4dc792c3b591e8e360f81b78d37163f87d1fc10130d10a139f1ee7fa7372", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810693, "uuid": "48abef84-a6ad-4801-ba53-07321e4e3643", "comment": "Malware payload (SnakeKeylogger)", "value": "d9ee8b82ebfce5735cd21d5a04614e50283d945b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810693, "uuid": "a3cb9d7d-a032-4452-b7d7-ac0445c0c0bf", "comment": "Malware payload (SnakeKeylogger)", "value": "ec1be865eca4b354ab3b6c18ed11e9c79f013b4b11a266c6572d26548634f8b13419a66f61c12d9ee68d4366c7ff6bd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810693, "uuid": "c78f1ef4-5901-4a51-b53a-07395ab07a52", "value": "T1F325129C2B45D913C8625B341772F7B51BB81EC9ED20D20A9FEDFDE7B8A2E615C04092", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810693, "uuid": "1dc67923-a6ee-4b14-8445-9f62bd230eef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810693, "uuid": "841efa6f-8b15-4e8b-95eb-91c7cafb76e3", "value": "24576:nbjuucDFhg9WulxTQzrL4NqTI4VVjxf+th0vjUdZTZVc:nbjohqnTA8qXVVMtGF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810693, "uuid": "94a16882-ddee-4c6c-bf65-ad2c5502d6c0", "value": 1041928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810693, "uuid": "b8432ccc-8dbe-452e-9233-65bc92eec35a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810693, "uuid": "9054b4c0-c654-476f-aa09-c1607143eaef", "value": "34dd4dc792c3b591e8e360f81b78d37163f87d1fc10130d10a139f1ee7fa7372", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d840564-1971-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772811118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811118, "uuid": "372b3beb-0b31-4ca7-8b9f-9e575dd01273", "comment": "Malware payload (AsyncRAT)", "value": "28d4923b1bfbdd460d19618a991f7d31", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811118, "uuid": "bcf86d08-00be-411c-b97d-a83ca332286e", "comment": "Malware payload (AsyncRAT)", "value": "3521caed0b797e91e5b7799797d1bc8a19faedcecca7ae2d3f069aa042937169", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811118, "uuid": "92edce22-ebdf-402c-bba5-d3308bd4f05a", "comment": "Malware payload (AsyncRAT)", "value": "4150e1e815d9603f4da49c689bdd2bb0a7140968", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811118, "uuid": "35d6e3aa-b040-4a9e-aba8-16f6fff7758a", "comment": "Malware payload (AsyncRAT)", "value": "2385a07e94f0a5f1c235452785c24c7686880b04ef5e5e5b2210971c54302dbb70c6835b6d927bdf067a592743dca69f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811118, "uuid": "5f038975-2f1b-4b12-91c2-e606fdd3fc89", "value": "T165F55B416BE4CE1AE1BF2775A4F201005BB1F849A772D74B5698EA7D2C637006D063BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811118, "uuid": "cd930176-f094-4ef0-9e09-a361b84e1ceb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811118, "uuid": "b9968f62-3ee9-43cd-a47f-ae3bd4222b6e", "value": "49152:GQFfDE45ivXP3+xbzRMAzU0LdBdo+6WuDayPor/NxJ:Gc5wXf+xxT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811118, "uuid": "f6de2626-6ed1-4c18-83a7-6c2ba8f3da4d", "value": 3486208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811118, "uuid": "d3de9dc3-dbec-432b-a358-88b3221edadb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811118, "uuid": "78d73c18-c9f7-456d-a6f9-d3e5cbb03571", "value": "3521caed0b797e91e5b7799797d1bc8a19faedcecca7ae2d3f069aa042937169", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa51331a-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772809422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809422, "uuid": "da2ebc38-d5cf-4385-9608-585e18b27ee2", "comment": "Malware payload (GCleaner)", "value": "c245739ca8d15616c3b35329f911bb18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809422, "uuid": "f81206d0-0cc7-4f91-9b70-a7ff801c459f", "comment": "Malware payload (GCleaner)", "value": "3522ac99882fe7f3ad3eba288457d6cbf89692033b04b8b3aa777e8ecf2dd573", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809422, "uuid": "1ba352da-59cf-41e5-887b-e84067724975", "comment": "Malware payload (GCleaner)", "value": "a2be6617dc469296c31f3d038656d3142e909023", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809422, "uuid": "e25c0f5f-930c-453f-93c5-3327000fb46e", "comment": "Malware payload (GCleaner)", "value": "674a5c00cdf34ca667c66a7d5b1be2a820b30a3e3e1ce5ce652dd7338052ac18233f1e355451df943fe12e017e2dcbb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809422, "uuid": "82844bfc-db7c-4367-8717-44cc3253c59e", "value": "T162F49E21F2E88436E5F36A38DD5772A598657EACE938644A3BE41CCC9F383D13425393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809422, "uuid": "94a157cd-d4b1-44b0-9427-99913af3b2ec", "value": "345624d13ffc2b7f296b9d2972b1c0a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809422, "uuid": "d0eeb369-5920-4c15-9d7a-4566a2a51b93", "value": "12288:M48VY65TrPsgNDHZ8nqReaSokce8okeiiCBkM/xw:N+7PfJZ8qBSokioXex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809422, "uuid": "d0dda8c3-a86b-4968-bf2c-29387b04d1c5", "value": 728576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809422, "uuid": "d7cf864c-f97f-4e45-a2c6-8bef686ea9c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809422, "uuid": "48deccd4-dffa-4c80-8546-930a0e69a04e", "value": "3522ac99882fe7f3ad3eba288457d6cbf89692033b04b8b3aa777e8ecf2dd573", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "310d1995-196c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808789, "uuid": "2adec67c-eddb-46b7-963a-d393a3a862f1", "comment": "Malware payload", "value": "7b0d33244517ca7ebd2e64fc9c1b14bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808789, "uuid": "4ccd0dde-a218-4273-a2a3-21f264836191", "comment": "Malware payload", "value": "352bf05172895a399a20cedd368099f233e0fd033fc8788614fb9c0ceecf6a3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808789, "uuid": "5f212c5e-8434-4b95-924d-7016411c2c73", "comment": "Malware payload", "value": "41a8cdcf79aec69636be393b553d89f2ddccc32e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808789, "uuid": "bdbede15-86bb-4987-800e-aa35d41f5ed4", "comment": "Malware payload", "value": "7c5e995c4fa2487335c7614bc1cce492c6355b70d9bd4041763f3a37dc2f10ad61a24320c1844d502b652fddc5e4ffdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808789, "uuid": "94e8a650-188a-424f-8d6e-c11180101c47", "value": "T1172502593729EE03C4A65FF00A72E7B01BB49E9D9502D3439EE6BDDBB43A7451E00293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808789, "uuid": "8f455e36-b226-4671-a3e5-02bcceb1c4bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808789, "uuid": "ca1e567f-5728-49a0-9697-3904e75499b8", "value": "24576:7qu2VVSZd4tS/TP0CHUCiH2XVvEviX2Bh1:7eVVSZmtSbPzVXVvEviO3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808789, "uuid": "b2cf757b-67a4-4892-85a3-544d8a027dae", "value": 1013248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808789, "uuid": "51b01eea-ab4e-4f47-a84c-11a88188c4ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808789, "uuid": "8476437a-9d2d-407e-af3b-8fd46e572b49", "value": "352bf05172895a399a20cedd368099f233e0fd033fc8788614fb9c0ceecf6a3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbdd7b72-194c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772795305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795305, "uuid": "bf4c2400-2837-4b8e-a448-6cb3117eacdc", "comment": "Malware payload", "value": "cd78347abbcc1f7a871b3a6933c6e286", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795305, "uuid": "21fc7d58-7b94-43ec-ae78-7edc40d33e99", "comment": "Malware payload", "value": "35ba3aa9b07db5c5c539bfccb6ac2331c039b21b769d75baef84ba2dac0d70a9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795305, "uuid": "4b430863-4112-48c8-bb39-767649da889d", "comment": "Malware payload", "value": "dead1aa6245d5d30ee4c57d9681f2127322deb2e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795305, "uuid": "b44599cf-05d5-4606-b735-e015c0fc6645", "comment": "Malware payload", "value": "52b0fb2b2a43d4bfc52ae2d5299648b4ebb7bc299ed3302a5298dd2020b70d3cb3405310c3f39a6f499fdb8c3932e5c0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795305, "uuid": "d1cdcb2b-352f-4e9c-aedb-1faf90946a78", "value": "T18DF68C13AAD08274F6EB52FA86F93729897D9D011338C2CB55C828985F31AE13E3D757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795305, "uuid": "f8d82ad7-15c7-4851-b6bf-5ebebf05d92f", "value": "0bf4447fda89303e8c2644bb6df92eb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795305, "uuid": "79a422be-3c14-4e59-96d2-19df1163e22a", "value": "196608:NQke5A05AXFN3delxDtPAFGfcn+hr7eeHD8hytsPcGaQvi5q7iQTdENPgk8G5ySy:NYA0aFsDXcn+B7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772795305, "uuid": "e1d589e1-a7bc-4173-93aa-48609ecc67e2", "value": 15816968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772795305, "uuid": "cdce9b06-7eec-4275-8448-5d80ce17f701", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795305, "uuid": "c70f918f-97a1-4463-91bb-fb34a6461efb", "value": "wke.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2e3f482-196b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808685, "uuid": "ff5312b3-dea9-4ffd-b617-5a2429233db1", "comment": "Malware payload", "value": "93b762df0d83da055994fef01fc94849", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808685, "uuid": "7f678538-dd8e-4de7-8d87-14228ca1c90b", "comment": "Malware payload", "value": "35e00c98706ccf0289ac7767adbf059b5ba4a0a97ff42f02bf0c9543bfcc549f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808685, "uuid": "f967cc31-57f1-467b-9135-6ce3e9e5a7e6", "comment": "Malware payload", "value": "d95692b5ac2a3610280f6a826cde5073d273263e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808685, "uuid": "15a0fd80-50df-4608-979b-35e942624749", "comment": "Malware payload", "value": "9b82fc4a38183bbcd1d241bad36976160219a31f119f6b504576bbf9afaa681e688245298f71647829daf86be29ec676", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808685, "uuid": "622d88ac-2550-42e1-ad05-55675b1eb4e9", "value": "T19D35D04527F84958F4BE9F39287465144BF9BC27AA3AD72D2A5840BD1C72F40EA21F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808685, "uuid": "d5151d9a-396d-458e-b42d-027fb33bf534", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808685, "uuid": "dd9e15d8-3e15-42b8-a1e9-7f289b64eaf8", "value": "12288:WKPzZyKMf5+cGszIMjy1j89CFnLT/N0HPNI0iAxxrKXBxoo1C7HDx/l+POuHizHz:LlhpLT/4PPH7caoc7jaP3HizHbdnM5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808685, "uuid": "085f7184-2340-4f4b-bce0-c7e801f87598", "value": 1118720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808685, "uuid": "7e9d4589-58f5-4e84-a180-2c55ca7b220d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808685, "uuid": "437f773e-0ca4-4e2f-96de-08839fa916ea", "value": "35e00c98706ccf0289ac7767adbf059b5ba4a0a97ff42f02bf0c9543bfcc549f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81200fc8-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819231, "uuid": "fe9b1eb3-7ac7-4cd1-9321-b202d5a1704b", "comment": "Malware payload (Mirai)", "value": "440246dd418fbff880c2c495d7e64826", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819231, "uuid": "718bd461-cc62-4ce1-a646-568a5c1c0548", "comment": "Malware payload (Mirai)", "value": "35f312ba2ebb404bfce5211f6cad35a1ed8c0c839becf5b27fbac8cbd1316242", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819231, "uuid": "c5080663-54cf-4563-9255-9973058e2cd8", "comment": "Malware payload (Mirai)", "value": "2cc84d8179427502947aa5aad72aeff3ae4af6e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819231, "uuid": "0566ebda-2e47-425a-85c9-efe82d129f16", "comment": "Malware payload (Mirai)", "value": "96b6bba86f49d0fcea9fec32f75bcffd50afb166d484eb6de36fedb45a863c248154aa46145fb0750c52c4691e836b0e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819231, "uuid": "e70fd7d5-2f11-4d7f-a940-9ee4b219bb6d", "value": "T137A31759F8829A02C5C515BAFE0E518D7313176CE3EE33168E348B74378A6AB0F7B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819231, "uuid": "303f7025-715b-42a3-ae9f-c72a907a593e", "value": "1536:/hnqk7enkk4Xk4oN8YgIq9haEMOrgMvit28SAxrDc7ae5E2VvyWe7ya:InkzoN8Kq9haE58SAxrgee5pp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819231, "uuid": "8317e690-5521-4f70-8af2-994706a35f25", "value": 103740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819231, "uuid": "80cd4380-c81e-4980-bbc5-e61674981757", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819231, "uuid": "7760eb34-c0cc-4ae9-acbb-628f81d98628", "value": "violetarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "813b0a8b-1941-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772790455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772790455, "uuid": "e83dba8a-ab5b-4e4f-8456-51d5f24ac4a1", "comment": "Malware payload", "value": "3764a1f3fa64ebea4863f14a8fc8f27b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772790455, "uuid": "6e89835d-d840-49b5-997e-6320a6b32284", "comment": "Malware payload", "value": "3619fbcb12d39bbc5009f473a25dcfc95b543f67cbdb88ab203bc4259903eab1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772790455, "uuid": "400e755f-eb81-4142-a0ac-e7a561f67c65", "comment": "Malware payload", "value": "753950d33a5e9c05e7b8a10a8e0d67c90fc6aa37", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772790455, "uuid": "f7b168d0-6d56-48a7-b379-67543cc30080", "comment": "Malware payload", "value": "bdc2daa5af9b6370efb0090127c4504d071a888a51011d0ffd509b99b9e7d6ccd7472a5b9456aa610bec8f17078c5a2c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772790455, "uuid": "a7240a47-5379-4423-b2f9-c4d0b72e4ee7", "value": "T11E924CB512896C79FBD1CE399F3C6F4DADE882C42124A3ACBA0F39215A1166DCB0535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772790455, "uuid": "2b221203-02eb-4852-bf82-08b65f39229e", "value": "384:6BcuQpWx+BL0SWL0gOzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:6B8i+BL0SI0ZzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772790455, "uuid": "8cbb7f7a-1181-4add-a60b-5d38b3cc27bd", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772790455, "uuid": "a8503d82-c279-4bf5-8140-0463a6824dfa", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772790455, "uuid": "158dd234-1a4c-4572-b9ef-c6925f22f293", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a23bfa0-1976-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772813126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772813126, "uuid": "816a23f5-bcd5-487d-bc03-bb8b455a2ec9", "comment": "Malware payload (Mirai)", "value": "1edf2acff82311b33951a4c4171f8ca9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772813126, "uuid": "ae3688c7-7fca-4940-8158-711aed7ae4d1", "comment": "Malware payload (Mirai)", "value": "361b1792d72c314a9079073c512401dd3f902826e438d1df89ba570c5c85893a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772813126, "uuid": "44d4e027-920e-41ff-9a7d-5f9dbf852cef", "comment": "Malware payload (Mirai)", "value": "5982608772352aad877e27d945d82eb2ae4f1709", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772813126, "uuid": "cd75b8e8-4e7e-432b-837c-d651fa51f65e", "comment": "Malware payload (Mirai)", "value": "15d7c2ed80f3f656c714a4f1b4fc8d93165fd37859d65c5dbf2572c7562bf06494015664241a67b26b034fd8b2499208", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772813126, "uuid": "e08cf20c-4c8b-49d6-b6a7-a3c331f3d06b", "value": "T1BC735C0375C080FCC88AC07597AFA236C473B57E1279B14B27D4EE16BE8EE511F69A85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772813126, "uuid": "fecb6573-af4f-4a89-b17e-60957f97d5c4", "value": "1536:1cFaOaaaITnRuGB/Msb8iy1r1Qvn+E+x91XS9v2kMRz:0a3ATnRbysby1r12n+R91XSAN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772813126, "uuid": "b809b73e-9f95-47aa-a10f-4b50b0c35e99", "value": 78720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772813126, "uuid": "4f287d15-9301-48b7-b0cf-e342e141167c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772813126, "uuid": "e7c3a96a-771c-4cd0-849a-097ef7cc10d1", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe7bfb20-1936-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772785941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772785941, "uuid": "e0b8e19e-9dc4-4b1b-95ad-358d9d452cb8", "comment": "Malware payload (AsyncRAT)", "value": "644fe240d4b97d1a48fa0eb8cc35cefd", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772785941, "uuid": "2af1273f-0f59-45a4-8caa-bb8da8c0dbb6", "comment": "Malware payload (AsyncRAT)", "value": "3647a92d3475a23b6996e9c90d849bb6d14c510ea84e98c0251b229aac8cda28", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772785941, "uuid": "e6c0c774-3596-4f22-856b-11e964bff785", "comment": "Malware payload (AsyncRAT)", "value": "e75bfb30e246d7a2def3b736a4c9e64d5a0faf6b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772785941, "uuid": "13259ca5-ab2c-4a0e-adc7-dbd12e3bc157", "comment": "Malware payload (AsyncRAT)", "value": "a99d053c11d8c956508ec5b928b4177e74df978fa663c4e984155ce6c6f41c117eaff1616f2fd1fa99ef93e488f13f9e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772785941, "uuid": "c0b33b00-5ef5-419a-bdfd-212cfd7ab249", "value": "T1B3F24B0573E58665E1FD1B7D5C3686044372FA478D22DBAE2EC450AE2A237C8CF25BE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772785941, "uuid": "dfc3e88e-892c-4435-9532-f92ba37eda91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772785941, "uuid": "8344107b-508b-4164-9e16-c37537b2c753", "value": "384:EMTh/ik19HKliohulE1bdcWOebX093bayseHQxnC7O+WmlIuufGfrfCHLWWCEQ+:Eih/r3HKlJhR1hV4RbJwB+WWOdQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772785941, "uuid": "5d58ca52-b43f-48c9-8ca0-815ca77a7271", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772785941, "uuid": "85d8ae7e-d091-43b9-bbb6-f150f76695ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772785941, "uuid": "3b1a4d53-7621-4b0e-b1e6-db30a6d73e42", "value": "MalwareRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88d2175c-1982-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772818385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818385, "uuid": "0db7f005-cb64-4556-bdfc-7d573cb51aa9", "comment": "Malware payload (Mirai)", "value": "0932d467be6354d8f8c522766bc810b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818385, "uuid": "bec83c31-a231-4fcd-b6cd-75d21dddaa35", "comment": "Malware payload (Mirai)", "value": "36723c70b4d3629c334f811a3721e5a5522747d4697e6fa8865a38ae8420664e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818385, "uuid": "b86ad707-40cd-4dbd-aa66-7ae3b1fa9701", "comment": "Malware payload (Mirai)", "value": "6c98e9c23d594170f6bd7d2633e44954a440bc1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818385, "uuid": "e11566ba-611e-4f80-9e37-ff38bee77ae9", "comment": "Malware payload (Mirai)", "value": "6025067980c0976ef1f729ef56d9416ffbaa7a9c4eacea7c3a9b5b792064f26292c8e4949fcf08645133ef555f0fd9a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818385, "uuid": "61082ae9-d32b-4203-81c0-2c900f70359b", "value": "T12BD33851B8829A27C5E523BFFA6E028D331563E4D2DE72178C215F217BC691F0DB7A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818385, "uuid": "a300360e-a4a3-440b-ae47-f33cf87f7d86", "value": "3072:JuVeGJFWOgt9ctajH1I7sb41o+YLyXzXgvA:JuVwt9cUH1I7sbMeLmLgvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772818385, "uuid": "0cd21390-654e-4443-8fa8-36b568401425", "value": 140756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772818385, "uuid": "0f0f8fc1-4abc-4195-8a16-4cecaaaf86cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818385, "uuid": "c550e6c3-137d-47d0-b0c4-137f4430c2d7", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2679990d-196d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809201, "uuid": "13cc7b5d-f104-47de-86e8-3d3359ad85e7", "comment": "Malware payload", "value": "80729bc797dbee640483bb60614baddf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809201, "uuid": "c3b044f2-9bbe-4495-9deb-8e04df6510d4", "comment": "Malware payload", "value": "3689c44195a68a995e863026ba622bd3c1e6e6698075dee0c9292c56b9225a99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809201, "uuid": "f15f141d-2e1a-4463-9fc7-44d4fdb16ed8", "comment": "Malware payload", "value": "22758e13e939d93b984f0e04b51aa9148771c65d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809201, "uuid": "dcaceb7c-3cfc-4ba9-9c24-67b98727362a", "comment": "Malware payload", "value": "2f354078a79a965a4670f9010bad6fdc283524adc9fd35c2150a57b35179314972c754a0b9c9a85fa07ceff92832f5ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809201, "uuid": "acc29095-7f2e-43ca-acaf-be878d338d2a", "value": "T1608512142726D903C4A74FF45E72E3B40FB85E9AA501D313CFE6ACEBB939B5119812D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809201, "uuid": "049ebb1e-2bd3-4771-a014-a2a7610b322b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809201, "uuid": "c940ff69-838c-4018-832b-9295db5eb4b4", "value": "49152:/eV+RbtHsSVYUecsWMcd3wLR3d0c7Lvi0Wi7Ys:nMSVBecsrU3wLR32gi0Wics", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809201, "uuid": "d4da276b-03e1-45ae-9a5d-85da2feef3d3", "value": 1767936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809201, "uuid": "0b58652f-2f54-4f6f-b1dc-2d7f3f80c1b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809201, "uuid": "75de420d-7060-4e0b-a390-5df03177360b", "value": "3689c44195a68a995e863026ba622bd3c1e6e6698075dee0c9292c56b9225a99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fef4a18-196f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810076, "uuid": "d4345c3a-9fac-4f2c-9b91-a81b22a4a0a1", "comment": "Malware payload", "value": "8b66fbffaddc3679edb1d7dd165e5fd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810076, "uuid": "508a2817-c686-4e96-985b-83dc1a4a8820", "comment": "Malware payload", "value": "3693c668323b247512315b36c10efc426c98151cf3707946c03c8eb13d7ac88e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810076, "uuid": "291d2b2a-669e-4fd2-bbdf-b980a7abf597", "comment": "Malware payload", "value": "da722c291af20606dac1ad532eaad1a6cc520318", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810076, "uuid": "33cd2b5a-88ba-4ccc-9df3-775cd121e844", "comment": "Malware payload", "value": "28f8844cf84d1a568cf4bd61e06bbc50c48a6fb700a8cc892256572da624899a12a753f8cb412dedd81c1726a745dac6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810076, "uuid": "684141ef-f6f3-4253-bec8-3b0e75689184", "value": "T16AE4231173D2C893D36A077042F2EAABAA7D7D3CA19562075379963E78738B34B14DD0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810076, "uuid": "142164c2-f7a1-4ee3-b043-4023315fd695", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810076, "uuid": "15be0b33-5342-443d-b77f-28e0220a0dd2", "value": "12288:uHadNN8JD18aLqYmXCM2bHAu6C3iUm1FdxcmLDRJDmrP7RNDT2lLclo:iadNW3XFp1bVDi1Fd+mRJDmrzbcYG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810076, "uuid": "e8ca89df-2ea9-4701-baa7-bd4f1623d121", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810076, "uuid": "e73d8149-3c0f-483c-adbb-5bb75949e7ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810076, "uuid": "52b2c6cb-d45e-4ba3-8d70-7f18201ee3b0", "value": "3693c668323b247512315b36c10efc426c98151cf3707946c03c8eb13d7ac88e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fa17098-196d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809162, "uuid": "ee58496d-621b-4705-bd6f-29edec839f37", "comment": "Malware payload", "value": "e98e200684f4a4c4b28ab71f229f9e63", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809162, "uuid": "808ef1eb-ad22-4ba9-80b1-cfc8c0daee14", "comment": "Malware payload", "value": "36a47272f3b70411cd1430d467454feb4413250605b62b98a23cdbd931a696b6", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809162, "uuid": "cf96e3cd-2a60-4e83-9c14-e3404f289c4f", "comment": "Malware payload", "value": "1ad574cce8c25c02c88cdcf150738bb471a7e0f8", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809162, "uuid": "a4f4bacc-3ed9-4cd7-88b7-633843920b67", "comment": "Malware payload", "value": "48ca69a8e123c1faa43133d0611dbbf5284837d4a25bfddfe0bcf23e693e94abc44b6704a5fced40879c07828f3f1580", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809162, "uuid": "32212a4d-b313-46de-82aa-71fd3e4f707c", "value": "T14871C85F4EDCD89EC807423B05718A8AFB36818D8A4DDF1FA26421945CD19473F49BDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809162, "uuid": "4478f751-b157-414d-991e-6c79db5dba06", "value": "96:si+sSpkkEZw9P7FU2TwhF2BVcH0kMSOX2RzoWKMiAtTi:RkEZkFhTwh4BqrMZ2RzoWKMltO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809162, "uuid": "03555607-e650-4c00-95be-97c0a859f5d5", "value": 3536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809162, "uuid": "071d063b-b0c8-48f1-a5c0-afb3a24b3a01", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809162, "uuid": "cbd0f2da-c961-415b-9f2a-f2f993184ee4", "value": "voidrealms-1.8.9.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f51ecab-1949-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772793942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772793942, "uuid": "b3620dde-285b-44d8-9939-fcb393991e0b", "comment": "Malware payload (Vidar)", "value": "c530585ed6a172161ef6349fa671710c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-OpenClaw", "colour": "#525D1F", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772793942, "uuid": "8f6d69fe-c7db-4dd4-be3a-c1262a175c92", "comment": "Malware payload (Vidar)", "value": "36c4bb55b7e4c072e0cbc344d85b3530aca8f0237cc4669aecdd4dd8f67ab43a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-OpenClaw", "colour": "#525D1F", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772793942, "uuid": "4ccd98da-c660-4773-85d3-e266a50ab2cb", "comment": "Malware payload (Vidar)", "value": "3a25221e8efa0191288dc483899beadbbe8534f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-OpenClaw", "colour": "#525D1F", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772793942, "uuid": "73be1ed2-cf03-441a-9bb3-b55ae79007e3", "comment": "Malware payload (Vidar)", "value": "830672bfb358e456ab7c64387ce60b034d74ca962a1d51eef3f32863a317b1bfd953ef8a597bb3cf863d035dc87dcddc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-OpenClaw", "colour": "#525D1F", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772793942, "uuid": "62b2bb14-10e5-4dfe-98f2-05c5386fab9a", "value": "T1F4282342BA8B1964C05EC8B4D2474A934F3130DB163BA5BF50E942683FAB3B49B3F755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772793942, "uuid": "780eece4-9e41-4222-bd73-e3ba84a6df10", "value": "e61251d70770a939fcd72f2941900a06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772793942, "uuid": "2cc3c7e1-968c-4576-9e0b-4b25b1b9e743", "value": "1572864:6+EyfxBpoYRS4XSJB4Gn0fXt8wrWhNEx3PX745pSs97tFfBJtUe9LAs7B9k:6ByfxBiGS4XOl0fXtcPd5pJ95FfdF3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772793942, "uuid": "4c127292-b6f9-421b-84c1-7cb874f5e65a", "value": 99634176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772793942, "uuid": "cdfcb41d-a38a-429f-94cd-42f81a8d6593", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772793942, "uuid": "a6934d35-588d-47c0-9575-556247dc1233", "value": "36c4bb55b7e4c072e0cbc344d85b3530aca8f0237cc4669aecdd4dd8f67ab43a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be820583-196a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808167, "uuid": "8fcb2d05-1a3d-412e-a39b-769f2b9e119d", "comment": "Malware payload", "value": "730547e213a4b8684936cc9453865886", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808167, "uuid": "855c035e-b5bf-4038-b2e7-f5878835227b", "comment": "Malware payload", "value": "3709e6f489626cd6300e0a4f3506d12d4aea80973bfa8673608b1fa20d2fd71a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808167, "uuid": "dc28ff9b-1383-47f0-b33a-383143e43411", "comment": "Malware payload", "value": "22be3ec9cdd4faaef7144a44f1df62b0faeec94d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808167, "uuid": "52880a01-013d-4376-a648-43462aa95c53", "comment": "Malware payload", "value": "1f86c538a11a8753253df42bc8b551755f56dab979b88bf41053eb6f6043e6992f352705a5ce2c8dbf4918168606ab7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808167, "uuid": "f39afdc8-73bf-419e-a7cc-02d15f40d786", "value": "T17F252321E3E4E542D4E00A365A36A7F2CEEB9D40485413875B187FAB7E336B2127B717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808167, "uuid": "15c407f1-dcb3-48d4-a0b6-ef5b61196f0f", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808167, "uuid": "cd7a8d90-52fb-4acf-a788-006e36fc93df", "value": "24576:mfLGzbYdRAuw8rjKRS+Le3vbtZWrlk5b8KIJ4LUwv/GOFlmuxqfyt:EkY8F8rKlL2znWBk5b85aXv+kmzM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808167, "uuid": "845e0c2c-204b-4992-881b-0ee244d376b6", "value": 1055464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808167, "uuid": "04165931-eda7-4d65-95cd-8f7897b9ead0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808167, "uuid": "2de63c6d-cf43-4e18-8ba4-eeb37bc040fc", "value": "3709e6f489626cd6300e0a4f3506d12d4aea80973bfa8673608b1fa20d2fd71a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b30ae8f2-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (DDoSAgent)", "timestamp": 1772809007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809007, "uuid": "f4930fd3-8d62-44dd-ad6e-9cea7ba56cc4", "comment": "Malware payload (DDoSAgent)", "value": "2b9283f8505ba8fa1b955234af5e651e", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809007, "uuid": "0737fc01-e20e-4f86-aff1-a9d9b83613a2", "comment": "Malware payload (DDoSAgent)", "value": "371ded4f85e45cd412cb364146208381bcd8047b9618b09a1a668f467e013996", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809007, "uuid": "7c6c844a-aa3b-4492-a24b-d9489e1fa420", "comment": "Malware payload (DDoSAgent)", "value": "9ed3242251105a30d104d2fda5afc3e21cd1a74b", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809007, "uuid": "95428848-76de-4922-8fc2-a170dac87829", "comment": "Malware payload (DDoSAgent)", "value": "39b1b2d664e46fe75c223173eeaed1e68f58b362df02deaf06ca1b46c7561e571aeacffd1a8fae2cdb42277f02ce7b16", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809007, "uuid": "284e30fc-9aac-4ba9-863d-152646f0ef46", "value": "T177575B07E8A544E4C8A9D531C662A223BF717C894B2163D32F60F7386F76FD06A7A750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809007, "uuid": "abc11df4-76c9-4273-8d13-3961528b835f", "value": "98304:okmMRs2VRBp4avM+SPauph61LTz7ZStPy2jhxKH/3TiCR5ikD6kODTjEkxn60dNB:osVRBpBM+Sjy1P3kXMuCU06xjnniDI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809007, "uuid": "11de33c3-306a-4529-a451-cd97c321037a", "value": 27775268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809007, "uuid": "bd7b03f4-fcf0-4cec-9e8e-f1e6ea406dd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809007, "uuid": "a8ff545d-c20e-477a-b355-76583c147969", "value": "apex.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cd01345-1967-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772806661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806661, "uuid": "844f2d4e-065a-419c-ae60-cc3550046cf1", "comment": "Malware payload", "value": "0bd1d615616cd67b08ca5971bf53452e", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806661, "uuid": "45c04460-593a-4cbb-aed1-7c5d39296c31", "comment": "Malware payload", "value": "3752880d4b55d6472e906dd22bd18a0a05295bc81f5009c16fe0f2e8674fe15f", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806661, "uuid": "a2249ab0-87e5-404d-979b-3f2137c7fbf3", "comment": "Malware payload", "value": "dafc34a05d95f908987ed843788575d101351afa", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806661, "uuid": "444d4bff-37e4-4fe5-b0d7-0c6e118fd429", "comment": "Malware payload", "value": "7ab67c70dda16526df5cc1ccc2f602e9d80933f4257e43ae11d46cf66bf8725385a15e93fc2c769c1d168005ce06ca49", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806661, "uuid": "e5e338c8-1285-402c-8f71-d0020222a713", "value": "T13E46AE15B3C515A5E123CE39C715A333D2B2BD620BB6E18B4A96F6090F77A508F3EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806661, "uuid": "6128b40c-fd4a-496c-885e-17e92b9886cd", "value": "2907406e0aabfe26fe4f317d0be652ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806661, "uuid": "51700cae-f9e2-4aea-9c2a-f94981460e8f", "value": "98304:K/paz5KlofbO4EDiypE7rdqZowh3RvxsOmkrLssM242LXohD+TGRM2+ocgEs9+e:KMAlibOPeyp4ooARp3sJB8osKKYcQ0e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772806661, "uuid": "fc43165e-2a20-4eb7-8a51-cbadf020b6c0", "value": 5548032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772806661, "uuid": "659de901-8072-4b3e-a1b7-d3e28389c8a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806661, "uuid": "a8454370-e47d-4b27-99ef-a656096372ec", "value": "libpsl-5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55d07174-1904-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772764183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764183, "uuid": "118ff863-fe94-4cc2-872c-42b93a84000e", "comment": "Malware payload (Mirai)", "value": "a45831942181d111b5cd41c9e4e37ade", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764183, "uuid": "3544720a-31d7-480b-b9f6-5528e0478b00", "comment": "Malware payload (Mirai)", "value": "375b90f092061faa5842a013514d17dca2f9d1f326c73aaece02759875ae1fe0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764183, "uuid": "24499c2a-afdd-41c8-a152-911429d1fedb", "comment": "Malware payload (Mirai)", "value": "3236232d6612ea5c503770b42ef8c6c0b1a313fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764183, "uuid": "d2f154a6-9c63-4ed5-bcee-5fe2da8d6a30", "comment": "Malware payload (Mirai)", "value": "faf129afb71743c7549ac38c47361256dc240d0f6eab9966a628d5b466c085d7c501184adb041f2ed62584e06bedc9e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772764183, "uuid": "258249aa-7834-46f8-9670-69fb0ae88e67", "value": "T184343B45EA418A13C4D117BAF5AF418A3332A7A5D3DB7306D9246FB43B877AF0D63602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772764183, "uuid": "c75883d4-88c6-4837-b5aa-ddd6cc5873f9", "value": "6144:Ego/jNgGzHzakeqacEp1d4n1trkbf9ihM/9+AU:EDhgSHzakeqacE3W1e0G/4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772764183, "uuid": "99c0e3ac-8a5e-4252-8afb-53379e363510", "value": 230976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772764183, "uuid": "3b36bff1-a348-436f-b847-6e73a53750c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772764183, "uuid": "fb1b017f-263c-4f14-9351-f1aabee19164", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b3e8bce-196d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809343, "uuid": "431967fe-9642-44b6-9610-c16165789dc4", "comment": "Malware payload", "value": "86c3cbc0aedce8c3a1193fde23704f11", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809343, "uuid": "1a38e4ee-9a71-4b06-839f-dea34e754e26", "comment": "Malware payload", "value": "377f255d9ea926842f42af8f7703b8377ef778323106ca39097c302314f23372", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809343, "uuid": "05cc1995-9967-4a05-8089-5e005d8b5fcc", "comment": "Malware payload", "value": "ee4c20e4cc5fc411dfedbd6400f68a8385993e55", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809343, "uuid": "8cf8c246-4571-48f0-a50d-ed68ce5edeeb", "comment": "Malware payload", "value": "5bacc0ea06d61efc2dec5b1b750e1943efc37dd6fa3949e58411d057ec3bee79d7b099b7662773c570b5e983c85a24fa", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809343, "uuid": "be49bdea-2337-424c-accc-f8c2b90ce71e", "value": "T1C6C57B07BC90A5B5C5EAD2318A6682917B71BC890B3127C72F50B7BA2F737D44E39394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809343, "uuid": "e4bfa213-fc8c-46c0-9fc1-d10de845267d", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809343, "uuid": "4f065ab0-8981-407d-9409-e8ad819c469e", "value": "49152:NzQymMu37rb/T2vO90dL3BmAFd4A64nsfJHgtAVbmmQD1JHqc9sshg209c+:NNu3LVKJqSsW09H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809343, "uuid": "7b9d45bd-8fdc-4fe5-98b4-5923e4407d63", "value": 2531328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809343, "uuid": "0d98aa8d-9b05-4fc6-8075-cfee1566c7ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809343, "uuid": "1024b002-2838-4356-8b37-fae82ccdade9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "125e21c6-1968-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772807020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807020, "uuid": "9157c40f-cbd5-49e8-8de9-486543bf52e2", "comment": "Malware payload (Mirai)", "value": "49671900301801f070d200430627c2e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807020, "uuid": "c10b492c-1666-4b81-8a17-91d94967f7a8", "comment": "Malware payload (Mirai)", "value": "3793fed9a61871510488ecb27bdd6b822b04c19a792cd5c88b6464d991fa82a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807020, "uuid": "a0516e38-6694-4237-b850-c1c15c3d644e", "comment": "Malware payload (Mirai)", "value": "7cd466e7533e34e148c53b06436717ac89d5f2f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807020, "uuid": "30c6421e-cd91-419c-8c37-f335b8805e56", "comment": "Malware payload (Mirai)", "value": "0906a8eeeb239cc0d40aafde90c7856960582a53d0e7780dfe5fece13925405317d295a02df6b4f3148c828c8d14732b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807020, "uuid": "b0c79b2e-4a86-46b2-a5aa-99489917e498", "value": "T18A930749FD406B10D8D635FAFF4F024973934B6CE3FA7201AA245B2523CAA6B0F76516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807020, "uuid": "34a836e4-6b09-4719-a7ca-d9a28ee47576", "value": "1536:wqnZK8D4zgUdtS0tFbvacgzafVAweBuqKlUI9HiWNRIbT2gZ1Yvn:C8NUv5nTacgzafVAwe4BNRIbT2gXo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807020, "uuid": "7e2180ef-287a-4bf1-8c86-e481d2e29b86", "value": 93252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807020, "uuid": "a1927e23-60ff-4236-89d1-df7332c024de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807020, "uuid": "33c69e26-560f-42ff-9a04-0b64a5d54f04", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "864e5f24-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819240, "uuid": "d41116c1-d3f3-4d79-8340-acf5cc855878", "comment": "Malware payload (Mirai)", "value": "c0c09c31405cc599ed25680fa70e8a1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819240, "uuid": "c9eea0ae-1b31-4204-bc0c-d933ce4ceba0", "comment": "Malware payload (Mirai)", "value": "379d8463f451c4ef78d84e0707d98b3a8b22274089096c64b2a17d550dd1b05e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819240, "uuid": "ed4973f4-6b7f-4086-974e-38ed7da4bace", "comment": "Malware payload (Mirai)", "value": "9678ff43678826d10d3bc5c68145822d65766784", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819240, "uuid": "5a40013e-904d-4800-ac97-e2c26176588b", "comment": "Malware payload (Mirai)", "value": "2f25edf6a55b4ce2b87cef1ec7032c07ccbbae525ffba3c5c750e218bc2dac6535c890f6bf1881b0088eace588ab4d0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819240, "uuid": "ef158f44-2d59-4b48-b9c6-da004cfb3c43", "value": "T173342B05E6408B57C1D23BBAFA8B425933339B58E3EB73059924AFB437C679D5E36102", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819240, "uuid": "bb721cf3-2367-49df-9fe4-19c924c5a89e", "value": "6144:g2v4iUqEr7ADaJorKF1jt/nb81Vx+GiTlDgM/R802m6d2yYZlege:bTEr7ADaJbF1jdA1VxrADV/32m6dZYZi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819240, "uuid": "19c30024-30e3-4164-b425-4aa581094628", "value": 243059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819240, "uuid": "c27482f1-0224-4c82-ac57-b45e6b92993b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819240, "uuid": "95d880de-f542-4736-92ca-2ae137fe34e8", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "057666c4-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1772809145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809145, "uuid": "db624ef3-16aa-4d75-b204-737f808dfe38", "comment": "Malware payload (GuLoader)", "value": "eceaa017d7c45b81dbfe192b71de63ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809145, "uuid": "e30fa6f4-71a0-4020-abd6-32b239d202ef", "comment": "Malware payload (GuLoader)", "value": "37aa05adb1f5408e886287c8b1ea074315a42ece0d47cbfe6678c26b6c396deb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809145, "uuid": "f9e39f75-1ec6-47c3-9a12-ee8bb0e34c33", "comment": "Malware payload (GuLoader)", "value": "d6ddeb437483e8e4efe73bb6d6aca345b351406c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809145, "uuid": "559e1dfb-6b21-431c-b290-62f935d3ead9", "comment": "Malware payload (GuLoader)", "value": "5f0f14b7869310571af69c24bc555d2cb05d6e9ecbe5b8762ba13e18f9f8c50ecf9e0f426387e01215d8c1911a2032db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809145, "uuid": "3255cace-65c9-43dc-8ced-650259378ff0", "value": "T19394E147EB1BA820C24544B3D8F589FAE7709D62A556047E3382FF1E98365CF8E1827D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809145, "uuid": "0464407d-d7cf-4a63-beb1-80719f84e6f4", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809145, "uuid": "45d9bf7b-3566-4a1f-bbaf-b030c1d746e9", "value": "6144:dNDlOLZLClTgEN/HqnXYPXBNSBsiGAgynWxGiQBhTqwwM8Lt:dk8TgEN/HOExESAhkjg+wwM8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809145, "uuid": "d0f43ffd-923f-4286-86fb-a89e5103b575", "value": 427648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809145, "uuid": "cfe4f473-a9b2-4535-989f-acca01421438", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809145, "uuid": "0a9913a2-cc05-4de2-976a-6ff9ceb71acd", "value": "37aa05adb1f5408e886287c8b1ea074315a42ece0d47cbfe6678c26b6c396deb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "753d77fa-1951-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772797307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797307, "uuid": "e01c0148-1d03-4c84-8f61-3e16f3087a5a", "comment": "Malware payload", "value": "5d01fefbd4dcc4ed8e43e4de8fcd221c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797307, "uuid": "0b3357bc-2f62-441a-866a-8b176894ab06", "comment": "Malware payload", "value": "37b86c4a87633aba320b23ef7ecb94b84d175025aa235ebdb2eb0c27b4180931", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797307, "uuid": "c38694c0-86cf-46c9-af80-04045b6eb786", "comment": "Malware payload", "value": "ce7c84dc03fbd188df3b66c9d6416aec45e9efa7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797307, "uuid": "c068ab50-20bc-4c06-ad79-fb0cfc0e63d4", "comment": "Malware payload", "value": "bb9e478a8e43c4c2191fb6c2862faf02f7d6bb4290e2e2853cc778054a84b849031a55d01161e0b2c4920f7ee17e0284", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797307, "uuid": "32e0508b-3a8c-41b1-a585-30764eced987", "value": "T18241E79733FA367A829624B7442ED40AD6354F900C065C10BA8D0E0B6C8D79C3FBAF28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797307, "uuid": "b494b8f5-1a4c-4066-8065-40306dda1836", "value": "48:7jOgo7b5jag3L8GbE4+EvPbjrXecbtlaw6QRnpoQp8Owg/RG4WQeBE5AnL:7jqjHG4PPrXecbuNQFKSRG4uq5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772797307, "uuid": "40307fbb-2223-4e9f-a812-af1e37230533", "value": 2177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772797307, "uuid": "2a8c8a9d-7db0-40ee-9f6e-942294e69240", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797307, "uuid": "ee8b53e1-c6b5-4f8e-b122-55093c310fd0", "value": "37b86c4a87633aba320b23ef7ecb94b84d175025aa235ebdb2eb0c27b4180931.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "affd4561-196c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809002, "uuid": "7b62cbd5-ea43-4458-9fdc-d54015021da1", "comment": "Malware payload", "value": "96a4ff15f2ab4d2a61ad43e66214d294", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "res2erch-sl0ut-com", "colour": "#6451A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809002, "uuid": "16ff355e-96fc-40be-8ffa-0a5d88ec42d9", "comment": "Malware payload", "value": "385ad1da674183e937ef2ddf10efaacffda197b1112226d16ef6f8e38acd4fb7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "res2erch-sl0ut-com", "colour": "#6451A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809002, "uuid": "706fd543-8360-4961-b34a-a220e488caf2", "comment": "Malware payload", "value": "ba89884a964ac31b050a8ecffa68645d96a280bf", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "res2erch-sl0ut-com", "colour": "#6451A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809002, "uuid": "88a024fe-7675-47ef-b66c-2131f1304108", "comment": "Malware payload", "value": "2cce5d0cba5dcd603b51f25000ad04c7188c43626b51c3fe06eee1f1e0b00e2716b98f543b757b4c2edcdc138358daa2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "res2erch-sl0ut-com", "colour": "#6451A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809002, "uuid": "8c6a63b6-a306-4c17-8789-7b39dcaa3960", "value": "T13643C8077961273FE65DC70AE19409BC976AC35D422BF17DC2DDD02F180DE8EA632AA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809002, "uuid": "1b731110-104c-47c1-9294-8d3edd040f45", "value": "384:/8KO1MznZHOZa1Gqot68NZ8pxtO+3pByOT1DnmGyc3ZZethlLpfqz+DfTTb3oLnC:COOq58H8XtO8fpT3ZY1LBqPix", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809002, "uuid": "ec77fd2d-5c3a-46cb-9470-2f77170d8c62", "value": 57639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809002, "uuid": "c718adb7-b04c-42ff-b6b5-f6345e17b0b8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809002, "uuid": "fae2ca49-2312-4779-a53e-b843ae9dc84c", "value": "385ad1da674183e937ef2ddf10efaacffda197b1112226d16ef6f8e38acd4fb7.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b5b43e6-1976-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772813101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772813101, "uuid": "84ea8d06-6b05-48fb-b213-77add34c7c43", "comment": "Malware payload (Mirai)", "value": "ba99cce81b3dbdf8d2d2e9e57e573959", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772813101, "uuid": "9f35c476-e3b6-4715-bf9f-0d816d0edd56", "comment": "Malware payload (Mirai)", "value": "38952573242f93f1035bf87d1f36ebe6b90e16f1f01437c4864de4fb9a6fab5d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772813101, "uuid": "cdb1a92e-6465-4bfc-a670-934db4b2cae1", "comment": "Malware payload (Mirai)", "value": "fb472e5d4df38e2eabc3701508ac80c9070068f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772813101, "uuid": "d17b7272-e28e-46f5-89ed-d89381f795fd", "comment": "Malware payload (Mirai)", "value": "d465f17cc6397d1eb5a2ff01d58481b7c24c6b4fa86b556a705fd5a1c9ede3e94f52b28263bcc5322b0bb25765198743", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772813101, "uuid": "cbcc0095-c43b-458b-8005-de83ce4476eb", "value": "T18603E177226ED734C8A1B43401972AB1E416351F6E0E176A4CC839BED8F6E1EBD21658", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772813101, "uuid": "5a9599d7-7063-46a8-9564-9495e0cd7b99", "value": "768:gzj6d1mS9npcxOF1FNcyRl/5Fo12oKAdn1apfLTdTGM7Kwfs8ObfCEAx0rVk:Fd1mepcxOMyRVI12/Adn1iTGMu7jCtyk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772813101, "uuid": "73de2d8c-e043-48ce-9dd6-92f4098974d2", "value": 41324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772813101, "uuid": "6b5bf1e9-7c09-4b43-a4d0-47024d0ccbe6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772813101, "uuid": "6206a117-7aa2-4154-9a6f-88497f8503a7", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aad3a2c8-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772810711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810711, "uuid": "872396bc-9d82-4179-be8f-4d1fc4bbf446", "comment": "Malware payload (PhantomStealer)", "value": "28b8d95853485623014f60a41dd1fa0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810711, "uuid": "6c72e9d5-fd1c-48be-b48a-144f1ccc49cc", "comment": "Malware payload (PhantomStealer)", "value": "38a7ef3260f432d67e3328304936494f67ec110b2bd086ef4cea6f9edde669d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810711, "uuid": "1553562b-af6c-435e-8a1c-28258e73f416", "comment": "Malware payload (PhantomStealer)", "value": "942bedab51ca7690d8ffe55610bc33f2454eefc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810711, "uuid": "c178884b-af65-4791-886b-5c41c32dc4b0", "comment": "Malware payload (PhantomStealer)", "value": "2deee6929c1301813aa86cd26b8bbce832f40adb9ba74a11a7a5b4670d3c0ce7e226a443847301880c8862435391c082", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810711, "uuid": "fc7e8c99-54f9-470d-ad08-957b5521a7a1", "value": "T1C965225C1A46C803E5456B3806B1F678037C6EEEA911E21B8FFCADEFFA65E555C042C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810711, "uuid": "72e8b02d-c4e3-4934-b0db-9afa3d91117d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810711, "uuid": "631a1921-d50c-469c-8307-f6b3c943932d", "value": "24576:DEjwWOp2WC9x0SkH3f+bIVKsnHs9ICNcz3qnEIWbmam2qZaJQ:DEjwIWlFXf+0VKsnMWeK3kWb6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810711, "uuid": "d87a739b-70b0-4db5-bcb6-4d26d1c877b7", "value": 1538048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810711, "uuid": "fbe8b1e3-7aaf-4498-8414-acb74bd69dee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810711, "uuid": "3b6df799-fe27-4216-98c0-2d7ff2e51bf6", "value": "38a7ef3260f432d67e3328304936494f67ec110b2bd086ef4cea6f9edde669d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5cc475a-194c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772795348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795348, "uuid": "0e0a99f0-ed84-45e3-9d54-00b3e52e89a5", "comment": "Malware payload", "value": "c43de198b7985ec194ce8ec01f27ae28", "object_relation": "md5", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795348, "uuid": "aea1a107-1ced-4d01-b509-3a898c322a46", "comment": "Malware payload", "value": "38be16184e096d283bdfdffce1323201a1049494b86206146b1a149cf04daf6a", "object_relation": "sha256", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795348, "uuid": "e09f74c0-9555-41b2-a1ba-3d4d6fb28853", "comment": "Malware payload", "value": "9013bdfff469deb1b4e84670b3b835aefeff3c7e", "object_relation": "sha1", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795348, "uuid": "518c2a37-0195-4781-9bc0-1e98f669f27d", "comment": "Malware payload", "value": "1eb87ccb340d8ee8745b17c71bfe8c5fc1e40d7a4cb391c98bf5dec174dcdce1ab423660631eb49ebbd453a8c77e7104", "object_relation": "sha3-384", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795348, "uuid": "7fa5d06f-efb3-466e-97c1-10ac8a04204f", "value": "T196473351CE7DF620D78451B1C613A836F2846A5BB1F867EF12123864CCE69B9B600DEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795348, "uuid": "697f913c-04d2-4a24-b48d-f4371c081037", "value": "786432:Mh3vc2PTXPfYVZ8/hA52rZ06rtp2GgGBm5oqozDeRQdE:kvhX34Z8ZAaZbRHv+ojE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772795348, "uuid": "65ebbbce-4f8d-48f7-9d84-80db4fb082bb", "value": 26164392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772795348, "uuid": "153808f5-aae9-474c-88bd-571a6cb53f6d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795348, "uuid": "cf2bba2a-6651-4d96-86e4-de7a5dc35e86", "value": "Main Setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ff89323-1900-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772762536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772762536, "uuid": "ca59c66b-4476-492b-b8e5-dd57875e4b81", "comment": "Malware payload (Mirai)", "value": "a2b58c193298cdd45bb91256c1438591", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772762536, "uuid": "600716c1-8246-469d-b3d0-d943d9672645", "comment": "Malware payload (Mirai)", "value": "39d68839e8a19b23d13e68bae166b5ae36596fe9831decaf68d5f1d1e2f1588d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772762536, "uuid": "960d4ebc-f0bd-4dcc-a6da-006bb0f6ca19", "comment": "Malware payload (Mirai)", "value": "046c59ca3c30bdc9340b2a92869cc1a310b9bcb0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772762536, "uuid": "a6b9d459-a6c6-47c0-a11e-f6716ca63b32", "comment": "Malware payload (Mirai)", "value": "14d5be75d1ae869514f138fb9ed8761dad11e03fd78fbbf75b2cfd1d3650d2a2fe1df5f3ba39fed1dc6832407026881f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772762536, "uuid": "732b10e9-2847-4eaf-8c2d-f35aca7407bd", "value": "T1C6D35C0673180E17D5A349B02A3F1BE083FEE5D121F0BA89691F9B6A8676D371485FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772762536, "uuid": "00043fc5-a9cd-436b-828d-e0311f802870", "value": "3072:CV0zui1ZhMHJCIqWrpP7OUK3y0uMg9FkiH:LP1Yiwd7OUKC0uMg3kiH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772762536, "uuid": "152240e1-7c3d-435f-83e2-699f26c391e7", "value": 134336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772762536, "uuid": "56e2cd3c-a9c7-4e6a-8319-3a05199b292d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772762536, "uuid": "8f42a1b2-e895-4f92-8ed7-3f18aa7ebce8", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5daca8c4-1961-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1772804139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772804139, "uuid": "13c80dfa-5369-409c-9ef0-d7cc0c0fb145", "comment": "Malware payload (MassLogger)", "value": "51325df3d9168860c21f65bf50dc1642", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772804139, "uuid": "5119e283-a415-4c8a-9e81-e20ddda2499d", "comment": "Malware payload (MassLogger)", "value": "3a3a4110dcc3baba9e0ae00b5a47a77ab0e3d639e547419478130b2a0469cefa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772804139, "uuid": "7c4b543e-f533-47fc-b5bc-59cc5c0040e3", "comment": "Malware payload (MassLogger)", "value": "a6cfa3ed776fdd2660ae5b6949636fe192a9145a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772804139, "uuid": "94ddee85-bbea-473b-8ea3-dfc403cec2a1", "comment": "Malware payload (MassLogger)", "value": "aabc10c1ea285597d0c0b710fe5fd685b5c2656591f9f8c4a140f15ae46a4b7c053d5a8aade5f3470aa092900c40243e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772804139, "uuid": "e243c62c-d520-41e8-9d70-3eea15984be1", "value": "T122259E027391C062FFAB91334F5AF6115BBC79260123A61F13981DBABE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772804139, "uuid": "adfb8681-9906-4d3f-ad14-5a81f7fca03b", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772804139, "uuid": "e0912818-a97c-4f1a-857c-51369e3e4f99", "value": "24576:K5EmXFtKaL4/oFe5T9yyXYfP1ijXdaDhFlAa:KPVt/LZeJbInQRaDhF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772804139, "uuid": "857fabff-8fd5-48da-9010-e7604c329bcb", "value": 1033728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772804139, "uuid": "d79ce58f-5dee-425b-895b-748ffc3b4e57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772804139, "uuid": "9f178f30-ae82-4bc0-8c95-057c4bdb4691", "value": "3a3a4110dcc3baba9e0ae00b5a47a77ab0e3d639e547419478130b2a0469cefa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e32568a1-196a-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808229, "uuid": "86aaaba6-2d04-4432-a55b-744550ffdd49", "comment": "Malware payload (GCleaner)", "value": "63c6c285bd2f654c6f56250b82fe405f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808229, "uuid": "bdd061c6-319a-460a-9c7c-74dd33378dd3", "comment": "Malware payload (GCleaner)", "value": "3a4b89c22dd10c4c399a241332eba906e7f517d31bd83feaef83fd9345182f12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808229, "uuid": "97ed9ef1-774b-4156-b94e-ae5708062de0", "comment": "Malware payload (GCleaner)", "value": "c12a4a37abd064c5acbf77d234479ca30ae2421b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808229, "uuid": "1a4076cd-0ff3-4c51-ba21-76931009497a", "comment": "Malware payload (GCleaner)", "value": "1a08a78978e4378f56592f1e9084883acc9a42248052d14f062a82ff03599324ec4d4dfcf68221f170aa9b8147b3d3c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808229, "uuid": "3b32c63f-d2af-4584-acba-9e2b8db07305", "value": "T18016E17B618C8D75C72F317EB196615E74CC38BAB4284431E6D0BEDD54688E3B03626E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808229, "uuid": "47b23b53-fb3c-4025-8d9c-9c054786ee62", "value": "336c69b6e8562d1c5231f219b62d7473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808229, "uuid": "c03c373c-d636-479d-a28c-2fb48cbff485", "value": "98304:Z9zuGEY4VAwKvvLQSkX9CCq1UoQWOCj0hLuRv:ZKOESkXQ9UoQWOC4hL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808229, "uuid": "cb3923fa-f5bf-4387-a4f1-5f8fbf3618c4", "value": 4269056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808229, "uuid": "c1de780d-1bae-4fd4-a9f1-411c89167e65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808229, "uuid": "b37ee876-11b0-402c-bfca-75ea858ed8a3", "value": "3a4b89c22dd10c4c399a241332eba906e7f517d31bd83feaef83fd9345182f12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef07d4e0-196b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808678, "uuid": "b143ee0a-a09f-4cfd-a2a1-da666d5a0249", "comment": "Malware payload", "value": "5b4ce823248157e64ebe9b0bedc6e7d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808678, "uuid": "e749c51d-b788-4c01-8b2b-1076cf7e97e4", "comment": "Malware payload", "value": "3a62c1ae1eb80997af627ee0a4a669d055a8a759c8b25a391a43d4122171bb90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808678, "uuid": "99c41754-509a-477c-9ae5-f07c9e1f670a", "comment": "Malware payload", "value": "0f5301c41ba97e36ac02bf3085c8762013269cd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808678, "uuid": "2133eea8-0e6b-400a-96c8-92532857c80b", "comment": "Malware payload", "value": "0415f7dfe99420fdadb76a56be95c1b3b81a720b92580fefd78b51eab2f45fc5696dd235b69e6786158c6f825e95a263", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808678, "uuid": "b11f0f30-9863-4493-9f56-dd76ef9dd8c8", "value": "T103351245371ADC03D4B28FF11A71D7B056B8AF9DA801E393CEEAADDFF4696412C41292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808678, "uuid": "cdf55dab-4c4a-4f5b-88b4-ff161a3b09eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808678, "uuid": "ed4881d9-f026-46dc-a31f-fbfec26393d1", "value": "24576:DZqu2V2/xEbowG1df0Ab6RrnZeOm08MM6IuND/KngTGs:9eV2/xEpidxbaZVQMvVif", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808678, "uuid": "3f92e41f-62d9-41b6-8a2c-bf5b4b626c12", "value": 1086464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808678, "uuid": "c1a1a25b-a232-4869-9d2b-fb32003bf660", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808678, "uuid": "dc888a25-405c-4074-aced-238ded13fd37", "value": "3a62c1ae1eb80997af627ee0a4a669d055a8a759c8b25a391a43d4122171bb90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57fcad60-1968-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807136, "uuid": "2e9a41d7-0aaf-4609-83df-9cb87ac62b99", "comment": "Malware payload", "value": "f0fb5ec669ca4f7870454372857bbdd2", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807136, "uuid": "f025a497-d2d3-459c-b5ed-8bfb89a02408", "comment": "Malware payload", "value": "3a85ba5c84ce4adf7eb3ceeb49fd5ae331bc8b9936dd6432bd07d7a17f07e71f", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807136, "uuid": "382400a2-fe3c-4e57-8594-0c3e3ce21868", "comment": "Malware payload", "value": "a2a7be8335056f077ff2f9b0fe64929c1dc9c930", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807136, "uuid": "7333c699-5ade-47b0-aac9-d5388a57684e", "comment": "Malware payload", "value": "ba760397b8e926342f3846349b1be6ab7c87fce908e31a335980b374be2cba7757dec31080a0347c7e44b154259724c9", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807136, "uuid": "cc629bf3-b30e-42ad-85f3-a96051d80fdc", "value": "T18C85AD15E3A811A8D86BD734CA669333D67078420730E58F0699D64A2F73FD29BFB712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807136, "uuid": "8b4a9df9-b25d-4ebb-89ab-38d672665690", "value": "7b1a4dc12ce22c7907a2498889d735f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807136, "uuid": "c00d09f7-23a5-4f4d-8dab-0cc6dcab17a3", "value": "49152:iu8RY3Z5Q5Hj9uR66jU4CR2OoWqz1qtbuGFs:GoAtXS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807136, "uuid": "eed04c2e-8d68-49b9-944b-13a96c11d6ba", "value": 1843712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807136, "uuid": "538c3d4b-497d-44cd-a04a-83a4d634eca4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807136, "uuid": "5ef0c791-1e79-4615-b13e-5b08020e9abc", "value": "libpsl-5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc107b3e-193c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772788406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788406, "uuid": "04ec9e2e-64ec-4a3d-aea3-085fc72a9957", "comment": "Malware payload", "value": "e71af071ddb9d4c8a8937c13912d1874", "object_relation": "md5", "Tag": [ { "name": "157-20-182-49", "colour": "#B32581", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788406, "uuid": "a76cffff-4c3c-489e-8047-53494a1ef936", "comment": "Malware payload", "value": "3a8a3df66049bc95248c68da8e3161131db317460d64a589a0a632093ba6bb97", "object_relation": "sha256", "Tag": [ { "name": "157-20-182-49", "colour": "#B32581", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788406, "uuid": "a4080cf0-c7e2-4e0a-aebc-492a9dcc9e8e", "comment": "Malware payload", "value": "eee6cd69974b3096c8eba3c8de76e2cab1e7f0dc", "object_relation": "sha1", "Tag": [ { "name": "157-20-182-49", "colour": "#B32581", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788406, "uuid": "d0736933-4892-4cf5-b1ad-5fb5e3fdf3c3", "comment": "Malware payload", "value": "d64be3697c9b8276226d460510737ccdaf9ded8bf7fe28b7868b64e08f02a48a47ecda4339d3b1dc36fe1cb11fd87005", "object_relation": "sha3-384", "Tag": [ { "name": "157-20-182-49", "colour": "#B32581", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788406, "uuid": "96290941-03b9-4e44-a7b1-653680913e6c", "value": "T153365B17EC9155E6C0EAE23089629652BA31BC497B3123D72F90F7382F73BD05AB9714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788406, "uuid": "0fa5bbe5-abaf-4cf3-845c-cb01a3ee5990", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788406, "uuid": "9ede800d-cdfa-412c-9a24-fff7f4de797d", "value": "49152:uyYaoPhVkzMM/FH2jhD4Ck0F4AnO/NF9HAU8DuOTzDfpYwKeK9KEaer05E:ugSQFCO/9suaYDeE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772788406, "uuid": "cb58d625-9572-4eb1-9042-6644ba71d1bd", "value": 4960192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772788406, "uuid": "17d0d989-ac73-4175-b371-c9ed995b10dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788406, "uuid": "dcbd06fa-08ea-45ce-924a-ec80a4d2f466", "value": "3a8a3df66049bc95248c68da8e3161131db317460d64a589a0a632093ba6bb97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "640cbd63-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772808875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808875, "uuid": "6db6ad89-4a1c-4fdf-80ec-d950b944a7b6", "comment": "Malware payload (PhantomStealer)", "value": "0e2bf97b3b911fba98e3a79dfed600ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808875, "uuid": "0a92b997-ca40-420a-bffb-79c39f77f748", "comment": "Malware payload (PhantomStealer)", "value": "3a980e79d7f3daa71a99bb7d7307af048844a6d2b3ff9f9aaf11124afb44498e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808875, "uuid": "8bacebbb-c846-4b9e-ade0-67dc228c8b76", "comment": "Malware payload (PhantomStealer)", "value": "aa203fc64e13c7bddd5c6ac078b42da7bdd9a88b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808875, "uuid": "b7dff47d-7fb7-4c7c-ace7-e22c601d6caf", "comment": "Malware payload (PhantomStealer)", "value": "ce1614126a0f98d7a6f9893002629ac9843dcce8e7ffab29a532326d3828fb6738608e1887411431e34eb4cc7c690a04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808875, "uuid": "ff9b8cd4-54dc-4a21-973c-8ebdf4548e58", "value": "T1898512151766DC02D0F60FF44A72D3745BF92E8AA912C3138FE6ACDBB93B3816945293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808875, "uuid": "44cb8b15-7723-49b0-bdd0-4c8b4ee1536c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808875, "uuid": "4d4f38cf-6d9d-4e24-97d7-8c5110ceb79a", "value": "49152:2eVu9gbrCHD4wvSaxxCLd7yS3tXes5Znhfsm:u9RDP3M4u9x3hfb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808875, "uuid": "aaf4d35c-7391-4265-8c00-5ebf72b9f89b", "value": 1789440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808875, "uuid": "08f06d0f-37b2-4336-b62b-79d86164a2fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808875, "uuid": "9af745f3-68dc-41e1-ada4-996287cc0d8e", "value": "3a980e79d7f3daa71a99bb7d7307af048844a6d2b3ff9f9aaf11124afb44498e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88b4cf34-1972-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811513, "uuid": "a5ee6073-10a7-4078-8050-7b371e2a9847", "comment": "Malware payload", "value": "dbb9eb309d03dbe0fcfa870f43b14e2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811513, "uuid": "b1b0e6ed-82a9-4770-b11c-2725de70f748", "comment": "Malware payload", "value": "3ab27b0f9d1e943f4f6064f2dff199cd85c84141dfbc24ac4df755f5e580ac0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811513, "uuid": "c2749d42-aaf8-4374-a1e4-b88626780148", "comment": "Malware payload", "value": "d96b050cadf1b371adb6dac872554f698659af77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811513, "uuid": "da33c25e-2c1c-4ebc-8f3e-db4a03ddcaca", "comment": "Malware payload", "value": "ced72059485f34970bddac22fab7ce1d6584345ba478e2325a39b10bc0eacdd9a206fa53510abb1bf4ae30cbfb56dc10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811513, "uuid": "e5ca2df9-8969-4c8e-b374-5d7b8bed132a", "value": "T115A4C616E660B42AF88709703D79B657792D3C362640DD0BBB899F9A3A71583B0F431F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811513, "uuid": "40faee02-d23e-402a-ac3f-a4e71bbbb5e2", "value": "57df06b815c700f6bb4e7f79b8bb3c33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811513, "uuid": "8d52916b-c4b9-48df-83b2-4c7547ce07ac", "value": "12288:Cc5ymGOdJJ9HCZRRmbpix7qPP63X1lY6NAlO:sOzJUuqlWlO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811513, "uuid": "7da3a9c6-dd31-4d3d-9e59-074d11ef8c00", "value": 491520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811513, "uuid": "b0c51454-4869-4eb3-bcf7-e9b79431d09c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811513, "uuid": "3ac3c965-5a98-481f-88fd-6480096e022c", "value": "3ab27b0f9d1e943f4f6064f2dff199cd85c84141dfbc24ac4df755f5e580ac0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d92d1986-1970-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810789, "uuid": "22430766-273a-49aa-a98e-37e9ade487e6", "comment": "Malware payload", "value": "30242a0c1147da42c36779136958a594", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810789, "uuid": "0fb0804c-9399-4791-aa37-bcbd4bf7d847", "comment": "Malware payload", "value": "3ae3210709fea96cfea9bfd16c0f0bb8f36c49f669744908c4162f824acdb91d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810789, "uuid": "1322b8fb-c3db-4885-af2a-c6d6c56dd108", "comment": "Malware payload", "value": "72df88caa9bc5e87fdaa4df299ffd852ca47dbc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810789, "uuid": "b319c07c-194e-4c5e-ad88-0039f0467f87", "comment": "Malware payload", "value": "4238147c98f92f4cd391decaf9f5af7bc5edb85a57165c8317c6fdded494c725d6684834dcdf1a7bf8d072d6ab1aa1a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810789, "uuid": "0025dffe-6599-4544-9112-95ef03865a02", "value": "T1ABB42306A7A844B7C8971D73036B524ADAF89C2308243A63A7109F5D3D3F76AD51F3A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810789, "uuid": "06d2e218-f186-4313-ab43-b05d006a99cf", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810789, "uuid": "29efb9bf-1dc7-4446-af46-b1491cca8094", "value": "12288:O1yDJwoagFYdPVUwYYR8qiATzMS7dOHHITpJJ7A5CqWp:O1yDJwoExVU2RiATJ7IHH8bFYk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810789, "uuid": "98c3f194-b27a-4041-b9d6-f38873484f78", "value": 536408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810789, "uuid": "b9ece460-ce6e-48f7-bd3f-6f4ed5d119f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810789, "uuid": "1cb22ed8-e747-4a93-abfb-9f2c1814ee52", "value": "3ae3210709fea96cfea9bfd16c0f0bb8f36c49f669744908c4162f824acdb91d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e6f5072-1992-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1772825106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772825106, "uuid": "4ee8e56d-721e-4962-9960-ce963c63f8f6", "comment": "Malware payload (njrat)", "value": "54b55ebd4f7d751ed8aef582696eb049", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772825106, "uuid": "01ace84e-d2ef-4ec0-82d6-f1ab30ec9ac7", "comment": "Malware payload (njrat)", "value": "3b16e21fa47d1ec4b6d7239b4b5c654661d516929374ea4de9153e9ccd012001", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772825106, "uuid": "2ece8f08-a8d0-49ea-ac22-4b82f382ead2", "comment": "Malware payload (njrat)", "value": "1ed38e5308d3d7620c8a3cfec5c5e43f4175d192", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772825106, "uuid": "94070df3-aa18-4b1c-8ae7-c5470abed302", "comment": "Malware payload (njrat)", "value": "f81db75a6d3d4eade11e6945bea5dc6ba0d33bee033cb070c0466aabd5527267191edd0609397934fbfe2582400a0a98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772825106, "uuid": "60ab0405-fa3a-422c-a141-9d423724a755", "value": "T176236D4037E8C136E2BD8BB4ADF3A2418679D6671903CB596CC414EA2B13BC597136FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772825106, "uuid": "e07b1250-ad82-44d0-b42b-007d7bfb31a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772825106, "uuid": "8cac67ba-55c6-42fd-bba6-a3bac9c85cf3", "value": "768:BOEuILWCKi+DiP1JKk81yI/4isl8YbAgeBv4M/vEgK/JrZVc6KN:BOtm9wjwBzbnRM/nkJrZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772825106, "uuid": "c537fb8e-2df6-4605-a37e-401d9cde30e1", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772825106, "uuid": "3d70b7de-3fa8-4c07-a4b0-5fe797d73199", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772825106, "uuid": "fb6da4e6-820d-47fe-a811-ce5386a14e2f", "value": "3b16e21fa47d1ec4b6d7239b4b5c654661d516929374e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c724619c-1969-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807752, "uuid": "f9d78ed4-7b17-4c80-a789-512d8f5fb14b", "comment": "Malware payload", "value": "545ba2e32245d542fd77c2a26b293d1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807752, "uuid": "afe4f041-dcff-47d9-bb04-596543afaf20", "comment": "Malware payload", "value": "3b284233b05f48d7a22247ff1da9351f9c2ba4d7cf188e8e55080dbe9171ac15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807752, "uuid": "87ab6c02-dc4d-4ce2-be6b-04b456392ada", "comment": "Malware payload", "value": "93a99536082d5bba98bee7c7ec6f774075736a48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807752, "uuid": "7de69d8f-e5fa-4341-8e85-4702bd86a163", "comment": "Malware payload", "value": "8f346211a8ab177a03396d3805dbfe55bd88a291d6eda24496400f42fef9e47ec33d0d92fdc3bdc830e63606da53e2b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807752, "uuid": "bade9e5d-b515-4dd3-94c8-f45831b23004", "value": "T1DE3512ADBA15AE52CA4C5B77C003A00D85F3C113FAA2F3B94ADD58F50F6A768C44D963", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807752, "uuid": "7ce8c1af-3534-43c1-acdf-761735888268", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807752, "uuid": "7fef3c62-2e4b-4595-a129-fcfcc6669148", "value": "24576:Rkijw0dx/SUV43Et6LTZyVT5cX4ileHZDwP701:Pjw0XzRMLTZfX4CQDcw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807752, "uuid": "1e8611d6-a0a3-48d1-828e-f98bb357054e", "value": 1113608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807752, "uuid": "be7e7d1b-693f-4984-9f03-cc7b275a385f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807752, "uuid": "90adf358-7ff4-4939-8321-46ee094931af", "value": "3b284233b05f48d7a22247ff1da9351f9c2ba4d7cf188e8e55080dbe9171ac15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06d98421-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819026, "uuid": "6edae141-9c53-4fac-8f58-bf9a5e84f411", "comment": "Malware payload (Mirai)", "value": "1466315b9a8f25ef6479ba6c77915467", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819026, "uuid": "d47bc62f-9471-4f67-a4ef-91858532443c", "comment": "Malware payload (Mirai)", "value": "3b30f6ba290fd6e8bfd7385358de98ff45704c428c1653dd97853382223a659f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819026, "uuid": "ccfabb15-6cc3-4410-b613-74f232d8e7b7", "comment": "Malware payload (Mirai)", "value": "5f3068b7ba505c2689be042a4e078f1b53ca0033", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819026, "uuid": "bf5de007-d354-49e6-a4d2-1ab17831d33f", "comment": "Malware payload (Mirai)", "value": "318cfb956da0ac0fc36f4f07de524a1efc8a1d6e900fe72b36bad0b4a15cc7b0a13884c1de53b7e21bec98d695c1538a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819026, "uuid": "204fffbb-4fbb-41b3-9a1b-f11fba423e95", "value": "T19DE35B97BE831490CCA386F012C3075E2BB342605F7E64E3BC5E556EE976DCA162A7C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819026, "uuid": "2d502b50-b06c-4bcb-95d3-c1dbd6c80bfe", "value": "1536:gQZVV7c6QffviGuekMl1WjmUugBYOl815e18bx3meRigKNE5ueBiC/LW2:Y6OzuBMl1i79BYO6e18vigOKueBiCq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819026, "uuid": "4f50287b-f521-4809-9d8d-4cf11930be32", "value": 149264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819026, "uuid": "d19709f9-f8b0-45ad-b07e-3b2a6b7b908b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819026, "uuid": "c7810115-6cf0-4788-b3f3-51af37f62858", "value": "debug.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27af6b47-1904-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772764106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764106, "uuid": "96a541d8-04cb-4c05-a248-1b19337fcb92", "comment": "Malware payload (Mirai)", "value": "334be5764140c0ee6485abc163ff4c5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764106, "uuid": "2873d94b-e613-488e-9963-d59d949b406e", "comment": "Malware payload (Mirai)", "value": "3b348dffeb399e4887968bcc4563a1ca1c1139238df72fb7e90e4c321097b4dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764106, "uuid": "69212a18-87bb-4eeb-89c3-3fc2ce163d5d", "comment": "Malware payload (Mirai)", "value": "ce3b28c1e70b5af92354f02f02e3f128f4c7f627", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764106, "uuid": "666aed86-3248-4e32-adac-19f0a417f064", "comment": "Malware payload (Mirai)", "value": "15d23568349034db19b9cd53ef372e50550ece45a85a8047b2ab09eb7460a17a0d5c3ed7c724c2c1ceb06a2ffb2a8384", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772764106, "uuid": "8dc8568c-cee6-4cd4-a8ae-c9371c9f2da4", "value": "T1FCD31A41F9504F23C6D622BBFB5E428D372917A8D2EF72039D256F64378696B0E37602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772764106, "uuid": "9a69da47-6824-4db3-8698-e217ac10868a", "value": "1536:hFN2l4G58dxS6HauEl2wgAcW0AEGL4V5ilT6IJEJ4XVbOl1qTo9IYfJ+ILl8+wyQ:hFN2Ps3EutW0C46lZJEJ0yHaYh+9oG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772764106, "uuid": "76ccebb3-bafa-48cf-b9a9-c188ce245727", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772764106, "uuid": "584134f5-8687-4590-b080-319a9c944141", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772764106, "uuid": "92fabe37-185e-4f51-a499-6a795e69664b", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab9066b4-194b-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772794821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794821, "uuid": "257a255e-7619-4124-bff3-8f16c3256e9c", "comment": "Malware payload (RemcosRAT)", "value": "66cf8e08cbcd52e8df13fe5cc498212f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794821, "uuid": "5c314ac6-22bb-420f-b01b-0741b23d1f41", "comment": "Malware payload (RemcosRAT)", "value": "3b5c621c788afbe5c6d56b18385175bb15cb3a3cc8389160e5ad3bd385389b82", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794821, "uuid": "394f6875-73f3-4f31-b5d0-ccc710e03e52", "comment": "Malware payload (RemcosRAT)", "value": "8de816727595143ccfec4430a8638b11247d1155", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794821, "uuid": "9ab708da-8773-43c1-a59d-025d84097228", "comment": "Malware payload (RemcosRAT)", "value": "08b7f6d927693784470d1ea68965a36c1a703c2624eedae8762ad74f19976860b37298a8b48a479af1674dd4d17339f2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772794821, "uuid": "6eecaf2a-0284-48f5-9f69-61d967ecdb85", "value": "T1CAE5BF0C49D4439FC4196B0E70FDD23DA2E247CB25B83F5EA7BF6D497A9E484A10A16C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772794821, "uuid": "3861935e-6439-470d-8a86-f6a3b6fef299", "value": "24576:6v9x3NyyaMpTR9DpIuYPcQSsek3n0SO65MuQY6yXf/eC8+5+KkX1JOR0jMeXdoHW:6vIQmtv1zuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772794821, "uuid": "3f9fa89f-fc78-47fd-8882-6fc1935e276f", "value": 3120028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772794821, "uuid": "a71aa588-5fb3-4bc6-b921-b3f12498f020", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772794821, "uuid": "1faf515d-0994-4396-bc12-453fb7ee326f", "value": "ProofOfPayment.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fa36923-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810505, "uuid": "e60db95d-9872-4243-8f02-7adb7a7fc032", "comment": "Malware payload (GCleaner)", "value": "e7a2f019b1dd85b43e966bbd8582d99e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810505, "uuid": "f1c68bb1-e31d-4f5f-82b9-f4001e756bdb", "comment": "Malware payload (GCleaner)", "value": "3b8a372205f5ea6adde1c6d6ce647230f23f569ec6774bdc5eddb911a9240c53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810505, "uuid": "8b5c9af2-c61c-4a21-b1ae-17f459fac73c", "comment": "Malware payload (GCleaner)", "value": "91d0963c629800f2bddc9a6c76e22ae4215a3736", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810505, "uuid": "35202e5e-f747-461a-a76e-beefd764bb55", "comment": "Malware payload (GCleaner)", "value": "d0a16f79f55085cdc59061379314f9409a3b6f3aeaff7cacdafe5def6fee20bf01bff22d3a90983cc25c52b9728c6084", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810505, "uuid": "acec13e8-8524-4d37-ba64-b48aa8304b75", "value": "T175059E22B2F18CF3D16766389F5F725C5829BE10396964462AD4DECC4E39781F82A34F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810505, "uuid": "9c712119-d795-4029-91df-46313999757e", "value": "5343399a39928268750ade4858cbd1d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810505, "uuid": "0588ffb3-625f-4930-90a0-4ab015a0f4b1", "value": "12288:C2d0/V6Chk61Wd0Mv6jE/h/skoa97bUC8/nqD2:P6N31WB6YJPB97bU5/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810505, "uuid": "cf327f85-ca4e-4146-a37f-93feb6a879e3", "value": 826368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810505, "uuid": "4bd9d8be-827e-457e-be74-aebba2e9b77a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810505, "uuid": "13db8a3c-05b7-47b7-b668-857e4a74afb4", "value": "3b8a372205f5ea6adde1c6d6ce647230f23f569ec6774bdc5eddb911a9240c53", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "764f1e6f-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819213, "uuid": "a3238aa8-f949-4b8d-aace-ec90757c01d6", "comment": "Malware payload (Mirai)", "value": "ac07fea70ac5182f091c822877ce7f30", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819213, "uuid": "34b1083a-1fea-425a-9618-bf0283c6bc90", "comment": "Malware payload (Mirai)", "value": "3b9a075cfeac91b279daf407fe49f03741750f7d39dac7a09ad9457c87621071", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819213, "uuid": "99cb0d4a-7817-475c-9938-30f127d92ac8", "comment": "Malware payload (Mirai)", "value": "03f91e21e4a2dc5cab2dc0a6e2b8552d2352a7da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819213, "uuid": "db38d83c-775e-40c5-8903-94105502e28e", "comment": "Malware payload (Mirai)", "value": "8783641ef87d08028ff255e2aa7fe9ab168ef3b44514e495687ee5e5f70b0bff24376883c1e3afd191eba8906916c44a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819213, "uuid": "90360d73-7465-4d30-8660-3dd0f518f2e2", "value": "T1E1936C02B30D0B57E2571FB0293F27D9839ED6D052F0A58A261F9F8593B1B322947ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819213, "uuid": "42c4814f-535b-4e64-9459-31a66fc6c073", "value": "1536:F6sZZv4PQnIBppBpQCgayBhuhAXRye1qVdW5ipjEpcUgm/KbaAy8TWe7hb:xEQIBppBD2huyRt2d/pj/UAm6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819213, "uuid": "bbe84547-8f79-4961-aa4b-f4548b952717", "value": 93032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819213, "uuid": "0df10931-0e71-43c1-b174-ca06afe4f7a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819213, "uuid": "1b23e8ca-2c32-4ff2-bada-8cf0b06a2eb4", "value": "violetppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b934f50a-1971-11f1-a769-42010a9c0008", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1772811165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811165, "uuid": "93583fb5-1ff3-4b70-ad89-df44310f294c", "comment": "Malware payload (ScarfaceStealer)", "value": "af030a1b93eee4d0992d04f7ae7c5a4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811165, "uuid": "516f0dfc-d4c6-47d2-8c07-7100efe9b02a", "comment": "Malware payload (ScarfaceStealer)", "value": "3bb845fc71fd512777b68e66a1fed3a601af04df9bce4f9415b9316e25bb2a05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811165, "uuid": "14bc29cb-e170-42dc-99c6-b926dc2fe610", "comment": "Malware payload (ScarfaceStealer)", "value": "34ba707954344b47f944abeb12947e56c03ce5b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811165, "uuid": "1a7f02df-0ef0-4a74-a1bc-1559a143dcfa", "comment": "Malware payload (ScarfaceStealer)", "value": "74dad96d9ee41e029e69eb0c5edac66f17261d1ea4804e0617849f9827a9bc3094e1d54cbf68af4cfa7fb3db8d35c3f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811165, "uuid": "e5d1d7c2-7126-43cc-b024-cab6f27dea0a", "value": "T114F7594262EA04C4F9F7DA359AE65217D673BC166F3081CF325C172A1F736E08976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811165, "uuid": "46a27a87-dc4a-49e3-a81f-37d6c3e42b10", "value": "772ec87d3452991a9933a3ba0d9963a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811165, "uuid": "311b02b2-6874-4ea3-9e8a-e46fc58625e3", "value": "393216:1n1XQgPR2k3m5C507G9ITEc5eAlkLbQurxMWhAsIyNOPS0B4AycWsCYaxFzwW/tL:11XR7AsxYqt2oRGj5rs3wb8/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811165, "uuid": "361a718b-ef80-4ec0-af81-a28baaa4abe4", "value": 71521280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811165, "uuid": "9d7c6a3f-87fd-41b4-be90-411f2c4f1620", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811165, "uuid": "1e01dcf5-2694-4e02-97e3-07aa4c445416", "value": "3bb845fc71fd512777b68e66a1fed3a601af04df9bce4f9415b9316e25bb2a05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69870206-1951-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772797287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797287, "uuid": "2644a29f-f9d1-4428-ba73-7aca750e1763", "comment": "Malware payload", "value": "01fafc32682a5a5a78e9b320570c093c", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797287, "uuid": "f38d8784-1767-49d8-be14-4fb82b0b5112", "comment": "Malware payload", "value": "3bc461557b49469631359401c244ca25f76f3305e26c96f485fe4749aa23f6a2", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797287, "uuid": "4d2c832a-555e-49a7-b4f2-aa308cd939c6", "comment": "Malware payload", "value": "410d45ade900e795cd5a9d55451c460aafbeb033", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797287, "uuid": "103edc0a-b819-41fc-bf57-b9febca0de7d", "comment": "Malware payload", "value": "61470c687dbc4ce00a6c1a2952a27e8b2eaa8573bfdf7a6aa5feb4b294272f2f72b16122e12b118340d4b2caf520945f", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797287, "uuid": "b058260a-5f72-43dc-bb6c-790d5580d4ae", "value": "T194C412B719D1BE7EE15C02F36917B0B8B2268C42C17879A2195317DC4E9B41E0B2A5FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797287, "uuid": "eb4c6859-a86d-451f-9a12-944a3e095a38", "value": "12288:Hktl/NXlQBkUK1Dvgdecm9Rcw4w8hnf88of7/H6dKFcFUdKWO:ix6k71D46cbLbw7SdRWO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772797287, "uuid": "6554f855-345d-4721-ac07-ebbf7476b731", "value": 551120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772797287, "uuid": "dbac87a9-0afe-4c66-88ad-6d95bb64a69b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797287, "uuid": "c3ee75b5-61cb-4ee2-81d3-0591e01b7b60", "value": "Invoice E-way bill.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88a1a516-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808506, "uuid": "e2c74ce3-7761-4ecf-8a6b-f588981f2dcd", "comment": "Malware payload (GCleaner)", "value": "8adb50c00684b3148565eb0ed552f571", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808506, "uuid": "71daa504-a15c-4560-ac51-1e260272dc0e", "comment": "Malware payload (GCleaner)", "value": "3bedde554291e12285abb97a4fe6ccd4dcf7286cbb9105e59cb02c8b2616af47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808506, "uuid": "e071621e-842f-458d-a213-a2853ec39105", "comment": "Malware payload (GCleaner)", "value": "f35cec86ebf05de10a41b9a451a872cd460a206a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808506, "uuid": "d3bcdcbc-c935-4179-9e12-e493c9759207", "comment": "Malware payload (GCleaner)", "value": "49b2040d0e34cbe8271c1f40a712356da336c4b7d597d2166ab841b266250e3b7abede50ef69bffa77e599bd4d37fbb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808506, "uuid": "74a68544-5c73-4fc6-9161-2d8463fdb9ea", "value": "T11126D07263F301E9E0115E798E6E69AC342B3BB337942F68DB9C09DFC1146523CA54DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808506, "uuid": "ec6287b2-6716-4234-810d-4159e29cc637", "value": "c243d5a6283f8eb7bff20dd0797e21c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808506, "uuid": "03c82ace-b2f5-451f-8e24-57936c20ed04", "value": "98304:LH5rSFYRRUV4nulqTDcORffStrPramvEMMlCnSeAm3cebaOt:LBa1axZSxTxvEESeAm3fzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808506, "uuid": "518d78a1-ffad-4e22-b357-a41336aa7193", "value": 4700672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808506, "uuid": "0560c6f8-bd15-4768-9fd9-08fe9b18fd3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808506, "uuid": "146fade2-5002-4bb9-9280-c5c516590c90", "value": "3bedde554291e12285abb97a4fe6ccd4dcf7286cbb9105e59cb02c8b2616af47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5154711c-198c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772822587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772822587, "uuid": "153122c6-cdd7-4835-8ac1-2934be2ae903", "comment": "Malware payload", "value": "f828f29febe7f22ae630e50aaf23ce5a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772822587, "uuid": "34139846-1c2d-47f0-95ea-a457f060cf24", "comment": "Malware payload", "value": "3c63aa190a8008580443448eb6685bca9bf5b2ec3aaf8b1f07b355cc496385f8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772822587, "uuid": "04b90d81-e27f-4ed7-b370-5451d7148227", "comment": "Malware payload", "value": "c6c2586473e2e4c6741ba584c66e571ec9b3ec00", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772822587, "uuid": "ccdc383b-4f95-4181-a6e0-9af82e4a3f00", "comment": "Malware payload", "value": "b007e013ec0c9a8c7acbc7ddbd3492ef72155ba79d4a94f72ecb42bfad85a170b31ed6efa9e39c35bc55f6b9d974b75b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772822587, "uuid": "3c312432-a692-4bcd-b543-47fa83009388", "value": "T1884509126ADC28A9F5B72734EA76616B26347D2D8F11C4EF70543B8E5472BC0CEB1722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772822587, "uuid": "7fbc3854-9fd1-4aa1-9fe0-2c19a97c89be", "value": "5806f995faef2f2c9a26843c97e4e628", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772822587, "uuid": "f985715d-71e9-4946-8e15-c119e18fef0d", "value": "24576:k4u6MfqXTNTulUxgNRuZqykUFSYqAxaTbjd5qGUEe99f:k4u6qqXTNTulUgNLZd5he99", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772822587, "uuid": "24c6ef95-8ba8-4341-8166-be42bb5421b6", "value": 1230336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772822587, "uuid": "c48c9159-3759-47e1-8ed4-33923cb39a5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772822587, "uuid": "581d2d22-00cf-4932-8f07-6d25f27010c1", "value": "SecuriteInfo.com.Win32.MalwareX-gen.89319235", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "724906b0-196b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808469, "uuid": "17d099d2-8e35-4e7f-904f-9d88eea2a78e", "comment": "Malware payload", "value": "e32cd5561f0c2d2104dcbdfbd327dd84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808469, "uuid": "36835234-8469-49d1-9b0e-4b1c56d54415", "comment": "Malware payload", "value": "3cc3af9d88fe88e63fa15aa813dc429c8ada43063c8bbba519bf42b52b06e211", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808469, "uuid": "29b35f99-7269-4082-b212-042a0fd3fda8", "comment": "Malware payload", "value": "13b0526c71f7e8826e50bd13f16b29611046da59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808469, "uuid": "4ef543e0-bf2a-400f-bded-e6537fb87261", "comment": "Malware payload", "value": "dfd1ff4ef68fb8d5284e562c1390e373ab5ce0eb8f4f2cb45303faca7aa6d70aab0cb18e8e140f3d02c017be772322e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808469, "uuid": "706511f8-8af7-4b44-8234-5b0d315b09ed", "value": "T13E3501122D872658DA991FB8C1AA15D833F0D96762CADBBF6FEC01F49EE7B41CD01421", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808469, "uuid": "19bce195-2943-4401-a99b-f4e59addb4b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808469, "uuid": "601a1e0b-6559-410a-b2ed-8b641dfb98b2", "value": "24576:YOq0gSFJynPgKzfjEXfmRyl/OZbEXng07ehNHnz:YONhOPgufjEXf8ygGehN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808469, "uuid": "48da51ec-506f-4d7f-a901-ace06705dadc", "value": 1147904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808469, "uuid": "1e28a2f0-90b8-4807-b9ed-33bd122c730a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808469, "uuid": "076a22f0-65f1-4a40-b3e4-4bef4ab726bc", "value": "3cc3af9d88fe88e63fa15aa813dc429c8ada43063c8bbba519bf42b52b06e211", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53d31058-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810565, "uuid": "099b03da-14fe-48f8-bcc5-f541758c100f", "comment": "Malware payload (GCleaner)", "value": "09b72892512fc737763c8666008c8881", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810565, "uuid": "20a98b5d-e4eb-4bda-bb41-54ccd007fdba", "comment": "Malware payload (GCleaner)", "value": "3d5429ce7fdf355be4c2964090e7399f248e1a87c7f2c64f1dcfbe41fdcf1b96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810565, "uuid": "9409ee62-ff20-4781-90e9-1cc19cdbc196", "comment": "Malware payload (GCleaner)", "value": "f0e1e8a7377cf4db8e963734756dfdd3a37760d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810565, "uuid": "213c1ffc-8f48-4ba6-88d8-d9a2ed93fc83", "comment": "Malware payload (GCleaner)", "value": "617bde3850ecdb3f6719d0a2c2069fd862f9063700837bd5acf19535f7c471b988fda8aa04f09c62e2d406cb01eb35a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810565, "uuid": "572504f3-e3f6-4bfe-9a76-eaf62d7dba08", "value": "T168059D32F2B14837D3633A789D5F765C9429BD406D7D68C66BE81EC81F382813D2A297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810565, "uuid": "b5a5fad8-d7ec-44c9-81b3-847b1d18a306", "value": "5343399a39928268750ade4858cbd1d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810565, "uuid": "5b21572c-faa7-4b38-85ab-62e97e541cc6", "value": "12288:q2d0/V6Chk61Wd0Mv6jE/h/5kvdTtoUfRt8iBPnaPA+PwI:H6N31WB6YJS42/RPnaZP7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810565, "uuid": "fc774869-6408-4646-8246-f4135dc3e157", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810565, "uuid": "12550d11-7b19-478c-819c-bcff5ac20c40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810565, "uuid": "037af42b-7e97-4924-9bf1-8ec11eedd5ae", "value": "3d5429ce7fdf355be4c2964090e7399f248e1a87c7f2c64f1dcfbe41fdcf1b96", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ea3d00f-196c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808892, "uuid": "af0872cf-171e-4d25-972b-51ac72468669", "comment": "Malware payload", "value": "b96e69b4075b324dfefa8ef9f98f577c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808892, "uuid": "24cfb352-d236-4556-b4bd-4a6fe5e5c0a4", "comment": "Malware payload", "value": "3dbb135314eaec7d907c2f94c75cfdf3d82eca5ffbf722649632975f7e642530", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808892, "uuid": "a6a31c5f-45e5-4982-bb14-9874facc1b3c", "comment": "Malware payload", "value": "822d35d613c11c7049b1ba98b343f3fa7d4dda3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808892, "uuid": "fbd73959-e9da-4a4c-b3b8-25edf52878f2", "comment": "Malware payload", "value": "e24429e1b897fc807f0d712e2241795d852871475feb361fd2504265ce1aba21d17fdb4fdbe6feec7dd0c69708b6cc91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808892, "uuid": "33efdd79-1957-4a9a-b3aa-21f498f6ebd1", "value": "T1BE85E00273D1D062FFAB95334B6AF6115ABC79260123A61F13981D79FE701B2463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808892, "uuid": "8fa38656-c3b8-467a-a8a0-428c193c5ce6", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808892, "uuid": "6be7541f-1042-4acf-b47b-eaea326ccb60", "value": "49152:8PVt/LZeJbInQRahulN9mWnMyo1g9ddV:CTYbInQtvmWnMkdd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808892, "uuid": "39834d82-9c8d-48be-ad36-6946acd14d38", "value": 1734656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808892, "uuid": "0a1b69a7-61de-4d22-a60d-5dfb7cc0a2e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808892, "uuid": "6ce56303-17f7-4ca0-85ce-827ee9211f02", "value": "3dbb135314eaec7d907c2f94c75cfdf3d82eca5ffbf722649632975f7e642530", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7d8a396-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772811646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811646, "uuid": "fa45526c-4c80-41da-9cda-52cde212e9fb", "comment": "Malware payload (AgentTesla)", "value": "bbdf1e2c8997cd2b913925f99d1b9bbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811646, "uuid": "6167bcfa-97ed-4da7-b16b-6ee77a565758", "comment": "Malware payload (AgentTesla)", "value": "3de6916c996862fca34d1e1be8fd826371ba94fffd6b51d1f51cfd7398b6b1d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811646, "uuid": "8c395989-c55b-4fcc-acf3-a7cf5a9e9d33", "comment": "Malware payload (AgentTesla)", "value": "9f990a0eec55935468e17bb44a77ecd5fe82bce8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811646, "uuid": "40e9f3d9-a5d3-4ba6-89c1-9cd81e6e2871", "comment": "Malware payload (AgentTesla)", "value": "757a7733e67e9733d361ed5401537dda8479934b9eda340b4d615494a8f08c83b1e167591a8cc583a0cf26cef70b0815", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811646, "uuid": "dfc4a6a4-a593-45c3-add3-85fbf57c17db", "value": "T115F4229759C06EA1C2596334C8328D6189BA39B19E41767C8769F06F3831383DBBB71F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811646, "uuid": "7e79f668-eea8-480f-a97c-48f5b166d051", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811646, "uuid": "95f110d1-8a1d-4e9f-bd78-35767b2f4d2b", "value": "12288:6z7hU5I5yuNHIgzSFKxWltRohBfSTso93UXIDnTAyVMsZh7mCYtuPsUpyqL2yJb8:6f+iN57Gtene3UYTAyVMAh7BYtApy8J4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811646, "uuid": "d6f45582-b16f-4781-9880-ff1990e23eca", "value": 742400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811646, "uuid": "3285436b-5bb7-47ac-b097-d01988d24d78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811646, "uuid": "6b97c40a-0dd6-49fa-9e8c-303a43f460cc", "value": "3de6916c996862fca34d1e1be8fd826371ba94fffd6b51d1f51cfd7398b6b1d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56ff6bac-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811000, "uuid": "60e10845-c652-46b3-b33d-67c94ecd26c5", "comment": "Malware payload", "value": "6b5781eb6d94c66693cddd463e86ab25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811000, "uuid": "b8ff7852-80db-48b3-9e78-baff56cc3ab7", "comment": "Malware payload", "value": "3e153a7edb74f3950d50bcf968418184648a7f195fd81268f77525e9b97c6960", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811000, "uuid": "2a9bd44e-df0a-4fe0-b46d-42150c117245", "comment": "Malware payload", "value": "03cef69bad17e0c3b02e2601258d733354d5e2a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811000, "uuid": "06b2f9dc-d639-4a97-a5a5-ef131722fd74", "comment": "Malware payload", "value": "6d0ae530d64e71d5cc29493fd2350811d2cfd417e494bdc5be5c1447cc7baa46932967e0705da982187339513617f88f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811000, "uuid": "7dc5154a-57a6-41ac-bb74-bac995b03542", "value": "T1FFD5F1302AAC91B6E59D75F1D05071323B79FDAE4B9E4460B6C861A90C15EE73E3F322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811000, "uuid": "4b8ab536-597b-4a05-ae03-37cb602c6b9e", "value": "ac8d714b899fdcb6b2c2a33c5510782b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811000, "uuid": "8649a948-269c-4ee9-8eb3-a53b449fc63a", "value": "49152:VFz4qvhFWMNn2wkh0Vd4/F8zw5x6+tkhVLzcejrEHSd0:Vua60nbA/G+8LzcuEl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811000, "uuid": "7b7e36c2-8025-4e29-a0dc-eb01037fd5da", "value": 2915392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811000, "uuid": "20a76b58-2085-4ff7-b848-b73114b33b5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811000, "uuid": "cd4af0c8-7815-4f1b-8b5e-c6a639b17cb5", "value": "3e153a7edb74f3950d50bcf968418184648a7f195fd81268f77525e9b97c6960", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b974d267-1972-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811595, "uuid": "03da7558-b10d-4c51-927e-e08037b0fd13", "comment": "Malware payload", "value": "3e3a9e7667b27e337a94d6c1c12c0fb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811595, "uuid": "f98dd7d7-d097-4b60-aea5-20d756a89c12", "comment": "Malware payload", "value": "3e9d504758ae48a0343d2abd920e712171726751e411f3be92bbe77222d79fcf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811595, "uuid": "60cb88fb-fc64-435c-821c-9af8dd3353c4", "comment": "Malware payload", "value": "8678d7f578524a3aaf82f1a57f1d62d00f8b8ee4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811595, "uuid": "4987d89d-4ed8-4fe6-bc8e-6f287b50f67f", "comment": "Malware payload", "value": "aa86b0917a867a20da0dd22f1b049f33ae0ec3a3c87338363b0c70be64267297be01764252acc2782ff4f9a6b79f7d3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811595, "uuid": "16dcc4a3-dbe5-48e3-9e54-f3945c5ebc66", "value": "T1D2B402133391E3BBE956C277709E83538F30A41647161A2B3390EB6668F7172F74A25E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811595, "uuid": "730b0729-4172-4ec6-9fd0-f49161a4eb1e", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811595, "uuid": "2232634a-10e0-4464-ace3-9af972438b83", "value": "12288:XZZey8kGh/TPhKiaCIfPGw5HN49tcpWcWm:JZeymlPxaCBw5HAtg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811595, "uuid": "dd120043-9bb8-4f0e-9171-ba3928e084aa", "value": 507480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811595, "uuid": "eece58a3-94c4-43a5-bb8e-cd503c66641e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811595, "uuid": "13f45b3e-6b8f-498a-943b-e1b40dc98388", "value": "3e9d504758ae48a0343d2abd920e712171726751e411f3be92bbe77222d79fcf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3570c9e5-1953-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772798059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798059, "uuid": "794a4168-f5cd-4f52-8bef-6d3e4df3d3b5", "comment": "Malware payload", "value": "47da8d3c86b7b90a63ffa4f5ca24b761", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798059, "uuid": "0449c5c7-8ab9-4116-94dc-569b23d3a0d4", "comment": "Malware payload", "value": "3ed254376109a5a0419ceab44386b0f9bd06fd391b06c82a3e566c0f44875a38", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798059, "uuid": "1c83a05b-3af8-4b2c-85f0-c14b5d86f969", "comment": "Malware payload", "value": "1f9788ac90d7db50e760214e32fa61a6d1e60f91", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798059, "uuid": "21fe6637-1496-4437-a403-c03fa5b2b3dc", "comment": "Malware payload", "value": "7498de3614b4bb256967276a1cecfd79c37e6d50a7603f0e822f33f02c54aaf3f48c405568486baccf5a2932ce9c4a89", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798059, "uuid": "07bdeb2c-6a68-4fa2-800d-dee76aad6c2d", "value": "T1C635125F45D5A390D78B67E8F61E2815B9AC212EF00107FD628CC9ABAE5385D0FB3325", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798059, "uuid": "c75ca58a-7cd8-4102-8a41-6ddffc505a6d", "value": "24:8kTAjFpr4wFg8M329yLgJ8mzIeBtmIyBBI737c0I:G1gBkC6mh6z7E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772798059, "uuid": "5c9d5fda-22b7-47a4-a402-20c1bdb7eb32", "value": 1115822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772798059, "uuid": "61ea5810-b9c6-4384-912d-e557945464ab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798059, "uuid": "b12cdd5c-120a-446e-b9cf-695ad69d9c32", "value": "47da8d3c86b7b90a63ffa4f5ca24b761.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b5fe525-194d-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772795653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795653, "uuid": "ef6efa28-67f0-4057-abbd-7ebe2c3cd0af", "comment": "Malware payload (Smoke Loader)", "value": "90137bb535b8047d4143a2dc7c41f369", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-4995", "colour": "#496C42", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795653, "uuid": "bfa74cec-24e2-4342-bca0-bbeb42eea1b6", "comment": "Malware payload (Smoke Loader)", "value": "3f0003aeba017d37e5fd0c1acf199b3c67e1acefcca71dc2875f190c8f639672", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-4995", "colour": "#496C42", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795653, "uuid": "dc8ca23a-0172-420c-b830-1d08f5d0f74f", "comment": "Malware payload (Smoke Loader)", "value": "88c326191f0a2f1396485ead5f2aa1617ca88fc3", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-4995", "colour": "#496C42", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795653, "uuid": "7fede12f-aedd-4261-a045-fdd243b36b4e", "comment": "Malware payload (Smoke Loader)", "value": "e5a0cdb751352ac8b17a03994728fd3afa33d53583aae76f1cfee522dbe9ffe51643374a53e9a70bb49da7ca4528c5f3", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-4995", "colour": "#496C42", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795653, "uuid": "b4581de1-0083-4060-856d-fa474ddd02de", "value": "T187E633269E3576F18EA4403FF1A45F54F72283249A54799D3288D7BF6F0998EAC20CCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795653, "uuid": "9c71f1fa-37e8-42a0-b237-b846750d7730", "value": "393216:pAHmUSDGC6MfAPp8wc/wDiBJFZoc5fj2wXW2DY:p8p2APZc/wDiP/rjEAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772795653, "uuid": "fa317e2b-3a4a-4c17-934e-1ec4e5a0b956", "value": 14539555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772795653, "uuid": "d5475cce-dba0-41d6-9137-0bdda485a019", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795653, "uuid": "160ee47f-ce47-44f3-a52d-f784c27613f8", "value": "source code of carbanak backdoor discovered.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e73b65de-192d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772782036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782036, "uuid": "e9dcb8f8-ff2c-4f6a-9c8b-d7d1c21e00a7", "comment": "Malware payload", "value": "ba8138df7e0c33c568b8444323f7e387", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782036, "uuid": "7917f49b-7016-463f-9f28-9f96d960f5c5", "comment": "Malware payload", "value": "3fd08e667f1c50944a5594bd05cbed0272ae0b35ea4301ed60e96dab302ee6b8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782036, "uuid": "f99202b0-37da-458f-8aa8-b3189ddacd4a", "comment": "Malware payload", "value": "154f7c4966b96d48cde71184f20cde4b5c02e0db", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782036, "uuid": "720c3e93-eb83-4226-9d8b-0e4221c5381e", "comment": "Malware payload", "value": "54b5e390139fe49bb19355c54c4681f74f1d63c8134c96ea56d86220291df67fc40d513e9c2e7f1f8b5d84e87a00b88c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782036, "uuid": "2ea159af-1b85-4274-a7d6-716d396a5fc3", "value": "T11034121E0619C3ABC57FD67D600C0B938CE24154922BD6B7980A134F46DAB66FD4EE3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782036, "uuid": "634790ed-07ca-43e6-9dbe-d18cbc4baac6", "value": "6144:/OJtNHl1WMQ0k5U05weA8q04sHGDkiKNg:/at/4wk5lwbp05iD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772782036, "uuid": "123a0e95-583b-46eb-adba-e77e66fcb8e6", "value": 247244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772782036, "uuid": "f0dc8c45-07f4-4c71-99aa-673aabbe8ced", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782036, "uuid": "51d11de1-5a20-4d17-a6ba-098030a91262", "value": "spankki.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76aac466-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772809335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809335, "uuid": "e49f3fc2-30aa-4eb7-9e3f-de63f06eee3b", "comment": "Malware payload (Formbook)", "value": "8a77eed03a6ec7ea42367cc6b2c769a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809335, "uuid": "f8d400d0-6843-4840-8b8f-d1eb047a0f28", "comment": "Malware payload (Formbook)", "value": "401b7bb4653506a6382c8204574c37dc49078b5e0aea939a675b5dbd28affb60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809335, "uuid": "b43845e8-8f75-470f-8570-e70b9ec71dc5", "comment": "Malware payload (Formbook)", "value": "db7ee576008480d1129762bf9834f511134e01fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809335, "uuid": "1f7e9518-cc1b-4425-8e3e-315e7f9880ee", "comment": "Malware payload (Formbook)", "value": "74f328a5620f78ba49d95a531e1aff888c18cafa1d8b5a86efbf8940405369f71e1e2fc960169a450d4413a8787fc167", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809335, "uuid": "441b95b8-6e7d-445f-b81b-37d76657a1d7", "value": "T15D251268320ADB03D0A71BB40D70E1B417B82DDDB166C3538FDABDBB797A6A518443C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809335, "uuid": "3ce93795-91ea-47f5-8df9-685d3c2bc1d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809335, "uuid": "6c6459f6-b514-4b43-bf4d-0b05b04a41c0", "value": "24576:p/j2eKWUzX7yxNYQ7frgA11zCf/1BUrDgCwNP:p/fF0OPfgA11zCfdBvCM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809335, "uuid": "84a5b5b4-d300-4f3b-a6c3-da59fecd2db3", "value": 1033216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809335, "uuid": "533c3a9f-f0a0-4b66-8432-956d9619a88f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809335, "uuid": "09c69bad-8bf9-4e1e-acd3-0d7e8cb9315b", "value": "401b7bb4653506a6382c8204574c37dc49078b5e0aea939a675b5dbd28affb60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f90c3328-196a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808266, "uuid": "a774c170-92e6-4b55-962b-7b04616e8fcc", "comment": "Malware payload", "value": "1f08b73d277a1810f3d7b27160938076", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808266, "uuid": "c8827e3f-4e7f-4ad5-975e-9764d686e23d", "comment": "Malware payload", "value": "401c50c10e105b44dac2079d99d7e6980639ff05511ec7e44a9e2be391dbe8a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808266, "uuid": "953749d1-a37b-458a-ad9b-4779d606ece0", "comment": "Malware payload", "value": "f95569aef37292e73f131430b9ef205f1d421f8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808266, "uuid": "262f3119-4643-4ee0-985d-8a7161e47a5d", "comment": "Malware payload", "value": "1557ab4bb38523e6a7110525c384ba8be559e987ba9d5588b72c0a5af5da6a35e1346b055778c22011563a37cb36d72b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808266, "uuid": "cf88381a-7542-4fae-b66e-08faa47a2953", "value": "T1E625DF0527E95B68F4BEAB7991B4142087F2F903E732DA9E7D8C41DE0A32B41C652733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808266, "uuid": "c6c09fc7-027d-4faa-bc3e-f1b0a5d37d5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808266, "uuid": "b5c55a5d-6c15-41ec-9186-3375f2f23210", "value": "12288:O669o2tVX5rVBo83tUsm+u6cgJxPLX4D11K0XGeglq7ehF4h8V5F140ZI:A9oarVBo6tgNExj4DDXng07ehzI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808266, "uuid": "66e3b8b3-efbf-477f-a24c-50d35b98722a", "value": 1048576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808266, "uuid": "2f6e2e41-8d88-4c5f-8321-f26f23fe2632", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808266, "uuid": "98f3f6fa-d244-4f37-a9a8-31835082df1d", "value": "401c50c10e105b44dac2079d99d7e6980639ff05511ec7e44a9e2be391dbe8a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "593cfc81-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772809286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809286, "uuid": "b90a2ec3-d712-4db9-91bf-48c592523a60", "comment": "Malware payload (RemcosRAT)", "value": "57df3640d43a6eb609537dd2a486cd43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809286, "uuid": "dbba332f-c768-4aa4-83d1-cc4b69493c3a", "comment": "Malware payload (RemcosRAT)", "value": "41065376e44e187979cb05bbbcc102ea7d61b110c49907195e2640ed3500843f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809286, "uuid": "23f7803b-8727-45fe-8280-0cd3b0902b1e", "comment": "Malware payload (RemcosRAT)", "value": "129499c72d72e6a3efd7186dffd1931427d9a56a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809286, "uuid": "8c991375-4ea3-44eb-b7b7-d0539bc9957b", "comment": "Malware payload (RemcosRAT)", "value": "00fdfdd234866d709a6c77b030a41f6a2b87cf9b56dd3a3c7a0e82f48179251dcee4e451bb24dc881bcfac81008b0d5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809286, "uuid": "abe1b0e2-872a-495f-9a8c-909eee86bba0", "value": "T1BD5501372DC31660C9A50F75D2A914E973F0CA5B1155E7BB6AEC02F4ED62B0AC8235F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809286, "uuid": "d76d364f-d789-4305-8dbd-8f5fa5e34083", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809286, "uuid": "f9b7ed64-8a53-4ca4-b46f-a203d98d67a5", "value": "24576:m167hpLT/4PPH7caoc7YCnRveYepqMKDmfC4KOSSn2n6kJblNB1:FLzswaoyRveYkqM3fC41p2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809286, "uuid": "02fcd284-b0b3-4f0d-b894-12c066b03192", "value": 1390592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809286, "uuid": "9348c551-31de-4e43-854c-99eb71357103", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809286, "uuid": "659b4a63-0ce5-4af1-8619-d399a93617c0", "value": "41065376e44e187979cb05bbbcc102ea7d61b110c49907195e2640ed3500843f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0bad596-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810292, "uuid": "bd5ce77e-b1ff-4c18-96a1-551b78f3e800", "comment": "Malware payload (GCleaner)", "value": "1c015fe916d377e3c1710beae64bc22c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810292, "uuid": "c5b2b48d-0c25-44ec-b61a-a151f25fc0f5", "comment": "Malware payload (GCleaner)", "value": "41363a642a6a8990422315f9bdab709f04e0e634d2a7fdf0f0856610b689dcc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810292, "uuid": "ccd763ff-56b3-47f6-836a-c7e0ef7602f6", "comment": "Malware payload (GCleaner)", "value": "ace71ea50ab25685a4c72843ea00433c7548bc63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810292, "uuid": "23088884-157e-4512-aa43-9a0ad7909076", "comment": "Malware payload (GCleaner)", "value": "c77c971562a162c5965b1ee822c252fcf60f8e4fe1ea25e2436bd77c24eb09278f7d5ff541480c334f5756889d0cf169", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810292, "uuid": "3f941406-f743-41f9-a15d-48bc5ba60e13", "value": "T12E45AFB2B29A4032CD7117399C7757DC5AA9BE102E38B84AEBE50FCE5F7414174342AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810292, "uuid": "019df5c8-834d-44a4-9f72-30756bc6312b", "value": "0eefadf8e9087d6d95cc4aedf30a5018", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810292, "uuid": "e25d1fd5-5f9f-4a49-90b7-ce45e3106534", "value": "12288:dVLMD7V2wGymFSmu4eDCQi0628ZhcPaGfEdERlSdpgdICRii9L97teH82+Mn3DlL:dVwXV4HSmYq7MPPfEd+epg3f78H9+MJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810292, "uuid": "8fb41be1-8098-4b3f-aa3d-00936bd9e6e2", "value": 1258496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810292, "uuid": "b69ea4f8-b8bb-4177-abee-e86a8011e165", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810292, "uuid": "6f181230-f0af-4d75-b489-2053fcc0753b", "value": "41363a642a6a8990422315f9bdab709f04e0e634d2a7fdf0f0856610b689dcc9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bb36c44-196d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809317, "uuid": "102fcdf5-a226-4791-983a-a8d6cf0d286b", "comment": "Malware payload", "value": "4aedb1303a0527919d7f8cb182438e1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809317, "uuid": "944ad3cd-39c0-4ad7-a17b-6290b4f84062", "comment": "Malware payload", "value": "415e3136d4a107b9de336ef34b51c9f303a8e88fa79a2145575667ad2a5879ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809317, "uuid": "3c627417-28ef-4206-9c36-97d96d3c5b2f", "comment": "Malware payload", "value": "5af2cd9cf0f22b9fa50cc72ec8e6e5dc7b158a6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809317, "uuid": "58012347-821e-48db-9aa9-1dfa6fac1fb7", "comment": "Malware payload", "value": "1f78ecdcb358073084ed15218e51c55556716df1b18ef11c18a9021b7eb4ff6c3209f32c185cd9fa7e9dc3d81910501f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809317, "uuid": "1ead8a93-b0a6-4a32-99c1-7688d3e9203e", "value": "T188C4AFA1E711DAABD5AB0ABA4CBBC4313567AC5E86E2111E315CB62825F331111DFF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809317, "uuid": "b9206a0d-e489-4abf-ac93-ed1ad864dbd5", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809317, "uuid": "56d6e064-ba9a-4a76-9578-7b6cd9cea629", "value": "6144:kwq3NpQ3wDIywUF5ykHERIe6M3O8l8h/D2HXZTf7MIRWs/Smbb1vTep4f2RLo:kzcae6cxl8UZTfgIRWIzdCa2Rc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809317, "uuid": "1ab92bd4-7363-4bde-ba5f-39c740943ef6", "value": 548616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809317, "uuid": "628400f8-7c8e-448e-bcb0-a1038221606b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809317, "uuid": "53ec2b9b-82d8-497c-b547-dacd6c9d35f6", "value": "415e3136d4a107b9de336ef34b51c9f303a8e88fa79a2145575667ad2a5879ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12206079-196a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807878, "uuid": "24ac6a39-abb7-493b-b725-ccd0ec81df9b", "comment": "Malware payload", "value": "5bc60e1523a3cf71f433c8c4382b2f2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807878, "uuid": "92fc5707-9d70-4943-9a98-6029af4e063f", "comment": "Malware payload", "value": "4198db90e1806f265dbce14b5f4e78e5814a8de700bd86345b2051c6f1245358", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807878, "uuid": "dcea805f-6c8d-4787-9cea-47a56c179334", "comment": "Malware payload", "value": "9a639a40e38cb3c307e415bcf880e87dd4b6ed6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807878, "uuid": "247c5bc4-393f-4792-b635-a29a6e8020c5", "comment": "Malware payload", "value": "fc6d1cc26151dbe1423d4ac13cd02478d822473f683fa1fa2081809f9ee44d70edd6986ed47ff008a9f9e59fd072829a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807878, "uuid": "95c8383e-f337-44dd-bfa8-8af381759999", "value": "T154150248370BDD03C05403B259E1D23513B29F4AF663D2875EE96EEB76A6BE619D8303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807878, "uuid": "38980129-c38e-41e4-99b9-96297a2a2c49", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807878, "uuid": "22c247fa-931c-453c-a59f-3c510052f4d0", "value": "24576:U+9v3+0XWEM7oS+kb14GphI88Me1uwLFbcguQlVictA:tVTM7oS+kb14Sh38Me1uyuWQcq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807878, "uuid": "44514498-528b-4f63-900a-f46f877522a8", "value": 879112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807878, "uuid": "1d88a04e-f11f-486d-a92a-4089268b11c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807878, "uuid": "083835ce-4694-43e2-a2f7-d3b4db751997", "value": "4198db90e1806f265dbce14b5f4e78e5814a8de700bd86345b2051c6f1245358", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c1581a2-1971-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810982, "uuid": "840f366e-cb31-486e-94b7-dc86fc00c9c5", "comment": "Malware payload (GCleaner)", "value": "97c2fdc928065a50f6a6bd35c67745e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810982, "uuid": "885db467-62e8-45ae-b3b1-fcf6a40c7186", "comment": "Malware payload (GCleaner)", "value": "41a94ea209617e09d6f6a7f947ae4b74aba87dfa2b3762c9b335d4837f5c4102", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810982, "uuid": "52f45381-fe26-40ab-ade3-abb2edfd733f", "comment": "Malware payload (GCleaner)", "value": "fba08404f395e71e67f2848d24127c626dd415c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810982, "uuid": "b50e5c56-a0c9-4579-a4b5-b492f9a738bb", "comment": "Malware payload (GCleaner)", "value": "81a6fa6b63f863bd3ce645a6775a99f1dcd1b38e45f54af03383b10681148fe11ddb77730b1ce284473baa21da4816da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810982, "uuid": "226e6e4f-8859-4733-a6d9-451517a333a6", "value": "T10BE4AF26F5D08437D1E269F8DF1B92A498357E80292B5B466FF85CE8CF34385F526283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810982, "uuid": "0ac3ac0f-db82-4809-bb0a-e4622a9e6876", "value": "ce7a1d07b14b49824555865592c3af45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810982, "uuid": "3093ee5a-98f6-4da7-a9af-4772b61e11e8", "value": "12288:/kAJdZJGY+5K/Lo9r7WTB+rPAB4Dbd097xSzlJMF4zay4O:dXZJeK0Z0PGndexSRJM2za9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810982, "uuid": "24a0d4ce-42d4-48b1-b2e7-5840ac48a780", "value": 699392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810982, "uuid": "3e4558de-5431-46b3-9137-b6d8e6bc204c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810982, "uuid": "195b30fa-d089-4858-8cc2-bc7d57ba0266", "value": "41a94ea209617e09d6f6a7f947ae4b74aba87dfa2b3762c9b335d4837f5c4102", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dfae068-196e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809643, "uuid": "03b01b51-0992-4fca-8b3a-6882aad9d91f", "comment": "Malware payload", "value": "dfcd16796e48904689a094d93a2ee1b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809643, "uuid": "86c746d7-5e77-4228-adc2-4e366234a39e", "comment": "Malware payload", "value": "41b05aa5a035380c93d37c6327316d927bbaa8cef2a8074a77614a6709b3fb0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809643, "uuid": "83a4debb-1048-45f6-a93c-0cb90e2fdc3b", "comment": "Malware payload", "value": "56463cc5d5c6e166c7a28a2a036f9ae24d562e5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809643, "uuid": "c3704ea7-6797-4bb4-9a82-b1646d9b7796", "comment": "Malware payload", "value": "e8bdac638b777b32b86fb1f9c68b2fe7feba5b0ab3fec8d47adc6e5903778e2bfc88cf5ef571492cab70acf98e63fdfa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809643, "uuid": "73a2fb24-751e-4be6-bc23-2d589c77b8fb", "value": "T1FAC4AFA1F610DAEBE5AB0AB588BBC43035676C5E8692111F316DB62865F331211DFF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809643, "uuid": "3c97cab0-b5af-4df1-a0a7-c691e41c41e0", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809643, "uuid": "b7571b2b-78b8-4a99-b0a7-f7617e1cf07e", "value": "12288:0zcae6umGppQ3CGd4yQJG2ZsI/91OScjqsCaU:aumYQP6yunZLgPCaU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809643, "uuid": "b708a3d8-dad0-46cf-9ae9-9c7a2fcdf2d5", "value": 555856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809643, "uuid": "3185786b-e2e6-44a3-a243-6e4ff33238df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809643, "uuid": "9e810a2b-68fa-4ff6-ace5-804a910ee6f5", "value": "41b05aa5a035380c93d37c6327316d927bbaa8cef2a8074a77614a6709b3fb0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4928405-193f-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772789790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789790, "uuid": "e9f62764-bf43-4c7c-88ca-92f36f9c2b21", "comment": "Malware payload (AsyncRAT)", "value": "3d9d39d5d0b41cc0dbac6aef09042a95", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789790, "uuid": "f7d821e9-fd30-458d-98ce-c05e476648ae", "comment": "Malware payload (AsyncRAT)", "value": "4220773101860bc41dd86e6bf2e25df445de1135ab525c868f4146913de5566e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789790, "uuid": "cc5f69db-81ab-4711-9a84-b24703603d16", "comment": "Malware payload (AsyncRAT)", "value": "c205411b24845e2f27122171d56535193797232e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789790, "uuid": "45a0053b-11f7-49cf-bede-95df0d1af194", "comment": "Malware payload (AsyncRAT)", "value": "935652e957f22cc3a0e2be7c6031083aeaffae5c70fdb9ddafd1714ef2272e40972f70b8fc886e442004a88ae656cf8c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789790, "uuid": "fcf98a61-57b5-4c9b-a95d-27dd74fb126e", "value": "T1159302411ED9C8A8C68ED537079A664A92B546F716292C90BE4C3BC47F808DCCBFF6D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789790, "uuid": "8943f873-290c-445b-ac36-3ee6f3c0df43", "value": "1536:Dy2i2Ny7AmZMV2lRS48kJSe68JGnBG1b8AJhyuO+a97vhJFmHR/0v5/m5Uv+UxsA:Dy2iQSU2648G6+Gnw98kO97ZJFmHlgtj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772789790, "uuid": "ec9071ff-3517-415e-a640-641816454366", "value": 94837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772789790, "uuid": "2e6d448e-1be1-4164-af4b-453c6669c5f0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789790, "uuid": "f9977633-89be-499e-8c02-79cc17332a25", "value": "loader.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1018b710-196c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808734, "uuid": "e243570c-6483-4db0-9bce-abb2a80e3bdf", "comment": "Malware payload", "value": "5a01c75789b62b18293d8b7380d853ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808734, "uuid": "7f6cce02-2908-4e04-bb33-ad2ea5ce433a", "comment": "Malware payload", "value": "423ec290859607655dfce4f545692bae1f1074a8a7275c5bd8303f89429f2219", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808734, "uuid": "a376f873-4397-4baa-addb-8665f698fa16", "comment": "Malware payload", "value": "88395bc6498c447999cb1e089d9b793bb844c632", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808734, "uuid": "4222a60a-a253-4afd-9f93-c7c0ba4582d6", "comment": "Malware payload", "value": "12dd459e29c8fceac2c976cb6a7bfe86078a3875faa3dbbb49d4d5a11d7497702a7f59a73015a68c1db31c6a6fbe1459", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808734, "uuid": "afced6ce-9d03-482d-b524-2b6d6e233252", "value": "T1927512103B2ADD03D8A61FF02AB1D7F057789E9D9411E3838EED7EDBB0796412D91292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808734, "uuid": "978b466c-823a-44a1-aa6f-bd6882529db2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808734, "uuid": "29b0f441-b343-4ae4-b039-7ed2847c46b6", "value": "24576:OZqu2VEWJEHzjeG09rApFkQVLdJCt5GbqGnF6yAwAW+cRkR5l4SrrbsReGa/:GeVEIkO9r2At5xm59ANJPDseGa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808734, "uuid": "c7d6b5c4-e120-4aa2-94ee-2d7a60cb66fe", "value": 1583104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808734, "uuid": "95ea00ef-b553-4449-a0ff-eb779e653cb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808734, "uuid": "4f2b423a-aed0-47be-b0da-83aedd27eb29", "value": "423ec290859607655dfce4f545692bae1f1074a8a7275c5bd8303f89429f2219", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e3c071c-1953-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772798047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798047, "uuid": "445432fe-e478-43c3-88cd-f1162d5293fa", "comment": "Malware payload", "value": "bbd81c5aee62fe307ed7608aa56526d9", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798047, "uuid": "006e73de-4cc9-40e7-910b-cf56c9c5c82d", "comment": "Malware payload", "value": "42448d6daf260d3c5fa633e4469f801f0528c0e56182ff8680c7e7fa2c832aca", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798047, "uuid": "59eb3660-bea7-4262-be92-fd58a6b7e761", "comment": "Malware payload", "value": "e5539fb432e618dbffa2f2329ceef84bc44de571", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798047, "uuid": "4142fde0-8413-4dd0-99cf-2aafc63667ef", "comment": "Malware payload", "value": "7fbc42c7ffc1b76b84de9c6058315c0dedd262257642d78651214a53600edeafd3f16f9d555cf4517bf26e050c442830", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798047, "uuid": "210fee38-e54b-4e95-a69e-4f8993d7ad88", "value": "T11BF4F13127E6BB5E88354F34C1FCA27817B1865E489B0E9FEB27BD406DAB0D050971AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798047, "uuid": "5a79228a-9021-44ca-9120-52d2b0f91599", "value": "12288:7gIhwHzkQZOiYLJPn2Dq6ufZus04t/PMOi8U9I3/nCMU7YH8Hj2nzkGWKp26RJJ:7gI4zvZ7CNJG+2Kvn4YHGKnwGWYv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772798047, "uuid": "1fd006b9-517b-4208-995e-fd8468709a10", "value": 749354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772798047, "uuid": "eb71c150-ca8b-4863-b253-321ddd8bf8e6", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798047, "uuid": "0b7ed1f5-3056-4fa5-9953-52fe12e44754", "value": "bbd81c5aee62fe307ed7608aa56526d9.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ede835bc-197a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772815119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815119, "uuid": "01310547-88cf-4395-b69a-edf311d951fc", "comment": "Malware payload (Mirai)", "value": "7d27186c1db01bbea30510cfc277e4c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815119, "uuid": "9be49678-673d-4954-88c6-e0f5c37a988f", "comment": "Malware payload (Mirai)", "value": "42c15fb2b72d2f7d997fb4b7a0c82c06bad2704c6caf10cae06a713bb87b3dd8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815119, "uuid": "605106fe-4ccd-4255-8d32-3065bef18d54", "comment": "Malware payload (Mirai)", "value": "a5f184172709a6375ce8e827bb0eb40530102f9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815119, "uuid": "da6c7c41-8ff9-4488-8a8a-d101653f7552", "comment": "Malware payload (Mirai)", "value": "7f9a19d45a466f1cf3891ead0d4929b7edf890222574d80233418be6417a10520b238445daf8fa01d52ac61910fd1927", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815119, "uuid": "69ca4fdd-4327-4a5c-ab37-7e6e387def35", "value": "T1F104975E6E228F7DF668873047B78D25A76833D627E1D644D2ACC1106F2029E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815119, "uuid": "de971fe3-244d-434e-9fd5-775852ae9917", "value": "3072:5AV0vz6qOWKZO4idT4SS5q6xfnmBYgZMD1y:qVIeXY4IeqAn4YgZH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772815119, "uuid": "c5fc1529-3624-4ad5-8f98-47a18f7ad32e", "value": 177772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772815119, "uuid": "24b10a26-8538-4f5f-9d67-965044ba9ac5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815119, "uuid": "22505beb-488b-4988-88d3-a9cd2286542f", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6728b979-1963-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772805014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805014, "uuid": "67401881-c1e3-483a-9c91-f05c4918a4d7", "comment": "Malware payload", "value": "c67db58506439801db7577f15a2a126b", "object_relation": "md5", "Tag": [ { "name": "abcknIe", "colour": "#31F8E7", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805014, "uuid": "2362e646-d04e-4658-8054-34d8dae90431", "comment": "Malware payload", "value": "42c7650c2ebbfd5690624483dc4e46ec7bd941a0ffc1e3c380f468ec12317162", "object_relation": "sha256", "Tag": [ { "name": "abcknIe", "colour": "#31F8E7", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805014, "uuid": "8d87bfdd-84f2-463d-8575-f5e12bad4e8c", "comment": "Malware payload", "value": "da88e2e7ac50823a11f0a691c53e81394af8fcc9", "object_relation": "sha1", "Tag": [ { "name": "abcknIe", "colour": "#31F8E7", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805014, "uuid": "6451d9de-d2bb-41b1-9748-56be97129104", "comment": "Malware payload", "value": "e541178a92e4c79887e81b24c43f2ce9a7433db469aa97d298e82d2b55fe5e144bce0294e987a76c3a886908a0ad5375", "object_relation": "sha3-384", "Tag": [ { "name": "abcknIe", "colour": "#31F8E7", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805014, "uuid": "022a904c-53e9-4c52-b26d-c0c29172859e", "value": "T1C7A17DB0B2ABF1E6CCD9016328FD86094556D80926101F29B354F7B85CDEF026E942B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805014, "uuid": "0adecffe-4b36-4ade-9a1b-a776c2a6d9a2", "value": "96:SaImbksFGfzPaD3r8cSlwNimmF5WzOMqT4Seyc0wbW1qO+:SpmbksFwzPa1SlZIzW4P0wbWp+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772805014, "uuid": "55dda84d-5ea6-4510-b530-125e3bca621d", "value": 4677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772805014, "uuid": "6136593b-b0cc-4d6a-8288-d4f447d0cf12", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805014, "uuid": "00e0f3fb-54ba-452c-b3f0-9b7964f97f68", "value": "Bank Transfer Form.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a1f9b60-1953-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772798013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798013, "uuid": "868fc965-5385-4153-8d36-856a6a35cffa", "comment": "Malware payload", "value": "5b8e884a930570b712ca6b65eb1606de", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798013, "uuid": "f6ec7be0-d0fb-4939-afde-b9407f4829d8", "comment": "Malware payload", "value": "4343106fb3ab3623b8d0417a03506cd40a0b42f2b3e03d9057d9bee2fd9f6687", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798013, "uuid": "bac94016-6c0e-4e59-8fa8-086a546f9acc", "comment": "Malware payload", "value": "037006bdc400bb0ea906a46f7d27d9ef24f07909", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798013, "uuid": "47a5df45-0860-4fa2-a132-fd8cbee87189", "comment": "Malware payload", "value": "6040c0ad6da52ac877238fe893581dd4b907f8bec49a56bf3c4bb8245319a3fb93424d8a5fdc7c787cf8db5ea7a1ea50", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798013, "uuid": "571f1e6a-f69e-4762-a9d0-7d8427b13504", "value": "T13E23093E851694DF59C860025C00264A079AAD37697925E1BFCE0CD7CBD6C5FCE2B68B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798013, "uuid": "e9aa7e36-730e-4308-9a05-9e8865356dc0", "value": "384:NInXB6sCrnXE8qZEQgCormKCnX/vnXYxJnpn6Hp/nXY:cR6sCznqZEQgCormKUPv8RxyfI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772798013, "uuid": "9058194b-0c09-4760-b1f8-9fc04bdf6e8a", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772798013, "uuid": "feecd149-e75c-4a86-a004-6c8c992e88c4", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798013, "uuid": "6ca6c4b7-b317-4971-ab95-547480d04846", "value": "DHL Receipt_57216218402.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fde3c28b-193d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772788946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788946, "uuid": "d79f181c-bf77-4020-a387-a79d68968cda", "comment": "Malware payload (Mirai)", "value": "5055274fcddccd2d53ea5ef1dec50ba8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788946, "uuid": "a60026c9-0e6e-46c5-9abf-e3ba280789c6", "comment": "Malware payload (Mirai)", "value": "43759864611d45b591cd2343833ce27d04aaba5d56cd82e251cc90c01713d487", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788946, "uuid": "94183979-a18a-48aa-a709-584aba856cb0", "comment": "Malware payload (Mirai)", "value": "6691ace0c2aec41ae6117634a11a3dead5ec9223", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788946, "uuid": "b517afcd-681e-40d8-9878-d7dc301715cc", "comment": "Malware payload (Mirai)", "value": "69b2a6b59ac5852fabcc343cbe0e961320add5a4bfdb9c541d0e2da55a4087c67d0937c2ea9ff7e5601626d522154d41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788946, "uuid": "82c49182-cf30-41a5-9618-44a60802aa81", "value": "T1C213E1CEB2A87D89D9FD1A7E66E8273C0D4521A0675ED7C387024C6DE67590FB0083B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788946, "uuid": "dfd939b0-42ab-407a-94a3-5adf28451747", "value": "768:3/jFoKGhirlRa0dT5JY8P4iBE4KqpsnEjXPx698ace9LTCezCkagacWM:37WthoFqU4iO48a/UuxWLOezJr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772788946, "uuid": "1cd8ba03-f1dd-4331-87f9-1eaa6417d77c", "value": 43536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772788946, "uuid": "4923c815-cd4a-4718-a0b8-e2227292d09a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788946, "uuid": "7de9a745-9caf-4738-9ee2-155e05e6b9cc", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f9918a4-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772810156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810156, "uuid": "1fb6bda0-38fc-4a8a-b87e-18e099771baa", "comment": "Malware payload (Formbook)", "value": "c21610e8d0d01127634603ff67963120", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810156, "uuid": "1f93ca12-c1b6-4f86-ae17-b7aec723aa41", "comment": "Malware payload (Formbook)", "value": "43fc5815ff2bcf00b85a7a9056eb177294161c2ee9e2dd890b2691bb18cdbb9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810156, "uuid": "ee5ed027-668c-46ef-bf92-350f6d0cbbc0", "comment": "Malware payload (Formbook)", "value": "2573ef9b7e0cd4fe52e467e34afeb58a8bfd805f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810156, "uuid": "8b21860e-4329-43f1-a10d-f497e432e235", "comment": "Malware payload (Formbook)", "value": "2db97a3632ea842e9966f9e2934d8e721830b37c7a31da031acacf0b6aaf8baee54f402de416f81b29df0c522bf5cd6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810156, "uuid": "6559573f-cccb-4b62-86b7-e25443e3b908", "value": "T11845CF027381C062FFAB92734F56F6115ABC79260123A62F13981D7AFE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810156, "uuid": "de86185f-a57e-4d30-bfae-2191faa674a3", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810156, "uuid": "02f02116-be4a-449e-97ca-5ff94eeca790", "value": "24576:A5EmXFtKaL4/oFe5T9yyXYfP1ijXda1Nhlk1od/Ag15c0bZzng8J1QsUc:APVt/LZeJbInQRa1Nzk1od/AI5c0bZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810156, "uuid": "895bed67-0f0d-45e9-9f95-a28bd4ec72cc", "value": 1246208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810156, "uuid": "65ffb53e-f05e-409c-a6ee-27669f7c0bc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810156, "uuid": "645eb9fc-77b3-423d-b802-0de6805ddf8d", "value": "43fc5815ff2bcf00b85a7a9056eb177294161c2ee9e2dd890b2691bb18cdbb9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "438e6b88-196c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808820, "uuid": "f443ce71-7062-4834-82dd-5128e4086cb9", "comment": "Malware payload", "value": "c947df984897370e30a8eb0921b7ecf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808820, "uuid": "d3ead4e0-25c6-4824-8f06-c9ebf2c4467e", "comment": "Malware payload", "value": "441dd55f2aacf3e99ec620662e882d0ceebc99b8b51aa5fa8d255b57a7c87735", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808820, "uuid": "89b9709a-4e94-4e33-b162-97382cf6192a", "comment": "Malware payload", "value": "2b3800a2210a74773b42aac355e94adc959c0aef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808820, "uuid": "dace0966-779f-4e34-9497-5d1fe43defef", "comment": "Malware payload", "value": "654e72d340f2d649bf6c6809723a9191ff81acae6fbf8b120077c9d2e4052ddbce1d1ed085c3b521e5c0d862020b7801", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808820, "uuid": "3de22f74-a396-4c73-92a1-ea1c64166e3d", "value": "T11045BF027391C062FFAB92334B5AF6115BBC79260123A62F13981DB9FD705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808820, "uuid": "730e6d4c-c68e-4c61-a5c8-003bee25b158", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808820, "uuid": "1f63879c-7b44-4457-aa30-97bfc2ca6a81", "value": "24576:F5EmXFtKaL4/oFe5T9yyXYfP1ijXdaDb9QDPiFPc8h2X:FPVt/LZeJbInQRaD+UPc8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808820, "uuid": "a9629dbc-6323-45f9-8a95-d5f4a92f9765", "value": 1248256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808820, "uuid": "1630a284-253f-4c0b-a5f3-6704c3b847b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808820, "uuid": "194752aa-d5e1-4396-86b4-70118f76e31f", "value": "441dd55f2aacf3e99ec620662e882d0ceebc99b8b51aa5fa8d255b57a7c87735", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "973162e5-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810249, "uuid": "581736a0-3abf-454e-8368-fcb4232b2891", "comment": "Malware payload (GCleaner)", "value": "a237ba59c7c883c9ade85f029923bd4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810249, "uuid": "1dff7a6b-d654-4e2b-8ba9-0c0d35c68670", "comment": "Malware payload (GCleaner)", "value": "443f2395c4367e978be2bc3320ac1594f32625245771c5d9f78b3bd5d6743677", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810249, "uuid": "dec37472-dc43-431f-baef-378c7a15407f", "comment": "Malware payload (GCleaner)", "value": "55842085f6153404670b10982f5305ed97d1af56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810249, "uuid": "e0c76807-5745-4cf7-b1a0-676c90bb9eda", "comment": "Malware payload (GCleaner)", "value": "f21952db1034589a8b2a406ae4afbdfccd3fcf5569caf685532f89499eadf2dbd70e627e09b5ed7fdec4f60adabc3f9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810249, "uuid": "02e29419-b15a-40f5-90b6-76695c48d07d", "value": "T1B945AF23B19A403EC17216389C275795D829BE133E38B84A67E53DCCDF7D24978B42A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810249, "uuid": "e829a4f8-5e71-40e2-87ff-c6dad6aac20d", "value": "0eefadf8e9087d6d95cc4aedf30a5018", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810249, "uuid": "71e2dc04-1bc9-49ca-b8ac-60f58b624895", "value": "24576:QVwXV4HSmYq7MPPfEd+epgPdgbsYKONB:hcOfmBgVgbsYKO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810249, "uuid": "b1fa2c9c-7a08-471d-8597-adc05a1e14a2", "value": 1256448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810249, "uuid": "c6c687ee-399e-4e6d-b364-468d29771e16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810249, "uuid": "b9c024ab-a371-4c65-ae2f-7fa7d1d93400", "value": "443f2395c4367e978be2bc3320ac1594f32625245771c5d9f78b3bd5d6743677", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df520971-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1772811658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811658, "uuid": "5ec95bda-2e68-424f-88e8-f2040f20e96a", "comment": "Malware payload (GuLoader)", "value": "12311bfd87a2f1ef73d3064f0693c34b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811658, "uuid": "c88a3cc7-e868-4562-9eb3-0a3742e7d2d5", "comment": "Malware payload (GuLoader)", "value": "44887812f1f0fb51e5c691e1e9fbe18bfc3717f2b766f0cba51b38cfc6e10427", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811658, "uuid": "6c1bcb04-d2ff-4503-868d-630f2fe569f0", "comment": "Malware payload (GuLoader)", "value": "477f24b9b1893cc5dc8abfc9c8720e17a15bf3db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811658, "uuid": "9873e6c7-4575-42ba-a6f1-5e7caf91005d", "comment": "Malware payload (GuLoader)", "value": "149a6547d50c9fcc59328c334e76a4b5087490a28c02ab3dba87a18c6fb8fc8f8ddc82513d43973e147461c87126cc56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811658, "uuid": "ff36aab9-46f8-4db4-b63e-747bdd216d50", "value": "T1E32523896164D813EAF51674066B92AAFEFB6F0884516B8B13283F7F3EF2D704005767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811658, "uuid": "813f9f47-a57a-414d-b77a-55c46139c48d", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811658, "uuid": "fa376fdf-62a8-4046-a06b-bc03b2bc821f", "value": "24576:gXaVwL8BQwrkEi5t/32j7IRUCAm504gmfZoeYCQh:i/I1dj8t04gmmLh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811658, "uuid": "039cba4b-1f3e-49cd-82b4-90724ba477f0", "value": 971912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811658, "uuid": "c4b58c03-51d0-4151-a542-936afaa8b121", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811658, "uuid": "73982c46-8e20-4ee2-b663-c72deb9f9614", "value": "44887812f1f0fb51e5c691e1e9fbe18bfc3717f2b766f0cba51b38cfc6e10427", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0108390b-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819016, "uuid": "0ccacec6-e839-4224-8d91-56f0a8a3cb38", "comment": "Malware payload (Mirai)", "value": "44b6d2467c389f02b1fc9bc450b773a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819016, "uuid": "f8d21532-2fdb-44b1-a3fd-5561d91ccac1", "comment": "Malware payload (Mirai)", "value": "44e0eb07373a95a0c4e1e6f176e20c371f687d20763b16887d15c40565dc1ad1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819016, "uuid": "59821876-e2fc-4ddf-9ccb-60e950746225", "comment": "Malware payload (Mirai)", "value": "84a9cf7c10445641841cadfbf47313db4ea4828e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819016, "uuid": "c92f9779-ad04-4378-a8ea-518b9457ae37", "comment": "Malware payload (Mirai)", "value": "d7b7bdd24e0eead08679e05ade05bb10e7724384e803ed8ef07ab1908ba18c9441f20110911c1fc57269791df6a1b9eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819016, "uuid": "eab53ebe-a783-4ec7-b7b3-44761e4b2cd1", "value": "T16BA35CCAF76BD1F1F90606F03073BB569731E13C5015FA02E7A52833E825616A627BAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819016, "uuid": "c5a843d1-94f5-4d60-a59c-4046bed4a99a", "value": "3072:tQ8KCEPE+JVm3dk+9bzZYB9p31B+lO5UuxBM:tQ8KCU5zmKV3ntSuxBM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819016, "uuid": "1b80c43d-25d7-43fb-8603-8d31a69f4a02", "value": 100048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819016, "uuid": "3ff15543-ba8e-47fa-8273-bf7baf8e8b34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819016, "uuid": "c98ce7c4-c419-4eeb-bf2a-92e6182e5f49", "value": "debug.x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62bf7f50-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1772809302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809302, "uuid": "d1d5f05a-9ae9-4747-860d-e6a981ce0f79", "comment": "Malware payload (MassLogger)", "value": "3fec26c480282ba96eb633c615364f89", "object_relation": "md5", "Tag": [ { "name": "bot8257734127", "colour": "#A03FE8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809302, "uuid": "5f41f703-ddf0-412a-ade5-ac412222c403", "comment": "Malware payload (MassLogger)", "value": "45bd83ee77d9018173098716e1fe06c71539bb2e92c455d83214734704879be9", "object_relation": "sha256", "Tag": [ { "name": "bot8257734127", "colour": "#A03FE8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809302, "uuid": "c7fcec53-99c1-4cf7-a6bd-77cc8a40db45", "comment": "Malware payload (MassLogger)", "value": "ca84f740e995b7d6c6c05e96fb5d2babae9f6beb", "object_relation": "sha1", "Tag": [ { "name": "bot8257734127", "colour": "#A03FE8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809302, "uuid": "a3a30b63-b5c9-4028-9fe1-bb30bad7bac5", "comment": "Malware payload (MassLogger)", "value": "b7a0115a30a492f0295b1482ac89600cc28c928cf9ee915ee10544de0f75da8ae2765574a5f9e802c7489a5dfbd41548", "object_relation": "sha3-384", "Tag": [ { "name": "bot8257734127", "colour": "#A03FE8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809302, "uuid": "55941bec-89bb-4b04-95cd-2ca1345933dc", "value": "T1B24419443BF95619F3BF5F79A8B050504AB6F92BAD1AD30D1C8620EC2E31B51EE50B23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809302, "uuid": "9f7d77a0-170a-4be8-8817-2f17f74d409a", "value": "3072:jRYyGJwDsUAoyV0CdWvHZBdoTSBEegmIWZu1V1XnWO8j9XQIvn5bfIQ7SairKDyQ:jRYfaDsh7WxBq2n9AoxgrKDz/XVv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809302, "uuid": "5738107d-831e-4a5b-86b6-0c5b8b411edd", "value": 261632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809302, "uuid": "78715a1d-de03-4557-a29c-7a2806650b75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809302, "uuid": "fb6007d6-9043-49a7-8892-a4bd07961885", "value": "45bd83ee77d9018173098716e1fe06c71539bb2e92c455d83214734704879be9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e03aae74-193a-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772787608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772787608, "uuid": "4eacb841-a000-4fff-aadc-bd7ac73d38f2", "comment": "Malware payload (RemcosRAT)", "value": "f1eae4c8ac1e3f317c31a3bd90f302a8", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772787608, "uuid": "36be9bbf-1480-4024-8612-31cbe2736d1c", "comment": "Malware payload (RemcosRAT)", "value": "45ea96a958f4f2b2fe495daef883360d989f57c8c9470670fbf4c10ae3e6aff9", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772787608, "uuid": "9f077b2a-b6cb-4879-8909-ab8b4a27db86", "comment": "Malware payload (RemcosRAT)", "value": "f91d3cb54cd21f4bb373531f7926c4df7df4d318", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772787608, "uuid": "c9ba08ae-6aeb-423e-ade0-f355b5e6bc2b", "comment": "Malware payload (RemcosRAT)", "value": "7d32db126f593276d1635eb000c2cad826b26afcc86c245530b2ff1b123fc4ba2f4b7b923f3e5ef66fcb9cb3a463316a", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772787608, "uuid": "5e8ab457-3090-40a2-bdb1-2dc7b64668a6", "value": "T19171A3549B54928A284A54B5698B4481CEFB52F2DC04127F7BE2B03F0580A3DB33FCF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772787608, "uuid": "72110a5c-67ff-4b96-ba59-0ab6678733c0", "value": "48:6afmIT2H8Jh1U6QFm69JheoluMpHmNkUYxdkk+wMvjLPZm7RteBD/IWfxQGRpwDS:hmh0EpeQxpHU5LNmdsBD/IWfKuM7O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772787608, "uuid": "20cf94fb-0f52-4cc3-9163-45721137e5c4", "value": 3732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772787608, "uuid": "4ec2175a-2689-4f0a-92d2-d6b8cd13492b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772787608, "uuid": "e333abba-eb4e-465d-bd1b-aa0c6bfdb84f", "value": "rRFQ_OrderSpecification_Quatity_pdf.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08fc95bb-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819030, "uuid": "65ca6913-ffdb-4bee-b751-2d4a06bc9c0d", "comment": "Malware payload (Mirai)", "value": "4029ecd14102ef8643cf812b4dc59008", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819030, "uuid": "0c786e05-b1f1-4d8a-bdab-8d7512812123", "comment": "Malware payload (Mirai)", "value": "45f5da2332c5d791e59d8c3c28fbddef4220c764658d507761c7636929b633c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819030, "uuid": "8aa7b6d3-9007-4099-8232-1ab899125705", "comment": "Malware payload (Mirai)", "value": "757f91fcd19685deef91e1abc6113d9d3db686e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819030, "uuid": "811a5720-63a5-456d-b719-5c194fc9f460", "comment": "Malware payload (Mirai)", "value": "6ca139a2f3bc7c320aed0712744e18ba4dc9738c86049be1c97029dc13ddb5df6ab0c806c276e49d7b19185801d22c48", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819030, "uuid": "4d461d8e-4764-4408-bfab-dbf912d5e058", "value": "T1CBB31ACFBA0C0583C5E34EB81E3B37E58FBDD62211E46742551AEB8442B193A4267FD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819030, "uuid": "454e81ed-3fdf-4f06-9150-9f7fd3be2991", "value": "1536:8DR+/XVNbeu7XN1GNjv5uVRXVBFSjfsWaOaOWRSH39WdAid+2P1XyFukBf7D:82056XVBFSj49030AYaukBfv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819030, "uuid": "97875f88-97cc-4f8f-a66e-81fee90a4e2e", "value": 116632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819030, "uuid": "36c84c28-fa48-46df-bc66-3134f28caa5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819030, "uuid": "b043e3fa-f607-4533-a419-bc2c3f061b6a", "value": "debug.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "723c58b6-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1772808898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808898, "uuid": "d338e50f-f43f-4f84-b6ea-24d05d6ca450", "comment": "Malware payload (GuLoader)", "value": "5965a9a1112be2f0c1e24fbbf8d02b32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808898, "uuid": "46738739-9db8-4517-8451-3b1920ead7d6", "comment": "Malware payload (GuLoader)", "value": "45fb15a78e1411771b4e49858e1ecfc013ee10bf05e544768b7dc807ea4220d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808898, "uuid": "cc154d91-9081-4322-8481-fc7d0b4f1dea", "comment": "Malware payload (GuLoader)", "value": "2118d8ef99867272629f62481993239299a1b7e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808898, "uuid": "c40e8d87-e4f2-41db-a152-a76cbe4c1c91", "comment": "Malware payload (GuLoader)", "value": "5f825d1c8b30140eb14b4e25f6963231c920105dd26420334ab7634686639271a8d5a0451e3477cd99997dd8403c0f55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808898, "uuid": "3c478992-71ba-44c1-a101-8fa110acf9ce", "value": "T1E4341206BA71C4A3D17607B06D3A9A67AFE2D61212E54BC737AC6E1DBC331424C2D2D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808898, "uuid": "0580bbe5-f040-481e-9306-7abad712e7db", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808898, "uuid": "413d46a1-b46f-464a-96e3-baab1ab556be", "value": "6144:kcBvWb0Av4hxgyUIB8r1Qf4RKaO6xyancOl:tO0AAhxgfrawRKaO6rncI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808898, "uuid": "9bfa9937-8a20-47c9-a390-46bf75e87088", "value": 240204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808898, "uuid": "08895688-a526-46dd-8e01-9d65abb2109a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808898, "uuid": "3bc441a8-a322-4438-a2ac-a350d9ea85c7", "value": "45fb15a78e1411771b4e49858e1ecfc013ee10bf05e544768b7dc807ea4220d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36ed7ea2-1901-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772762843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772762843, "uuid": "1b9fd17c-6246-441d-9c57-7f6301e3b1fc", "comment": "Malware payload (Mirai)", "value": "b3a7a0a9c3555bae5cf857c8e6908f41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772762843, "uuid": "6f12d38a-ac1a-4b74-bf40-1fb682f9141a", "comment": "Malware payload (Mirai)", "value": "46212ca5c0c12c9cba5e5f1888ca664e14f59869122268eba1ea3b203d568b4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772762843, "uuid": "11392935-8631-4465-835b-1e0b7f485046", "comment": "Malware payload (Mirai)", "value": "e78855db6e8adb69ac301e08971b559c6539e5d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772762843, "uuid": "a59491b8-82d0-47b1-9b35-4c7f220d05db", "comment": "Malware payload (Mirai)", "value": "97fbab7f633a88807d2fa96c14386a0777bada5790936e514f854e67408f5c05502bb4769adf66049b8f7f4251199d22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772762843, "uuid": "88cab37b-fc0f-42a3-ac6d-4789ca499ed8", "value": "T1EEE47C99E787D4F1F26344F1024ECBF21534A11A6057F6F2EB842A6778727A22F1632D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772762843, "uuid": "1d9facd8-dfad-4c8b-932d-35778332bb3c", "value": "12288:h2oafjouFul5hSvhtGTbGeKhKXb1ZuMClRclsUZw8gyZ/hsYek2P2rlVt:h2oaf06uDhSvhWXb1ZrClRcKYw4yYem", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772762843, "uuid": "62d50af7-05be-4362-b0e0-973fbfc1f7f2", "value": 719300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772762843, "uuid": "bf68b38c-1503-4011-82b2-f90c4aa621d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772762843, "uuid": "d8a92046-b314-4011-a2f1-91e998461427", "value": "bot_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d3a2293-194b-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772794556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794556, "uuid": "3a7a0806-5341-4982-92c0-41c2409642fc", "comment": "Malware payload (NetSupport)", "value": "eede94cffe8708c896d29658655c27ab", "object_relation": "md5", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "aoaoalsflfkfkfk-com", "colour": "#34764F", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "notaoaoalsflfkfkfk-com", "colour": "#841C7A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794556, "uuid": "6e82e9f1-8a57-4bda-90b2-7bef530441b9", "comment": "Malware payload (NetSupport)", "value": "465b040f238a9909fd2e40cdbf008a5906917f6047df8379e1506e3a6f47d83b", "object_relation": "sha256", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "aoaoalsflfkfkfk-com", "colour": "#34764F", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "notaoaoalsflfkfkfk-com", "colour": "#841C7A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794556, "uuid": "abee20bf-fe03-4c5c-be60-afe5485b1d1e", "comment": "Malware payload (NetSupport)", "value": "5b429891581385265ea75a3d53ae2c374c40ae59", "object_relation": "sha1", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "aoaoalsflfkfkfk-com", "colour": "#34764F", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "notaoaoalsflfkfkfk-com", "colour": "#841C7A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794556, "uuid": "4de15546-843a-4642-91aa-0652ab91588c", "comment": "Malware payload (NetSupport)", "value": "b78f669aef77aa736de3c8b791868e22dd671f93f850bb910d5cacac2d3998a3d4a465d1f5c7a51436d43d4b32b4ff0f", "object_relation": "sha3-384", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "aoaoalsflfkfkfk-com", "colour": "#34764F", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "notaoaoalsflfkfkfk-com", "colour": "#841C7A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772794556, "uuid": "afb6686a-6813-4ae1-b94a-4d57c6af85f2", "value": "T160A5339A990989DFC91B4F74C10B5E1AD33E3A41F25E7080F6728252CC89B9F5BB871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772794556, "uuid": "a9eec736-9293-4a04-aa1f-31352642d56e", "value": "49152:fdWKcquaZYrp7ynWVnJTmm3F+WVcBdj3b2+3bw/0JBAThAnc1N9R:foqukS+W/VYj3b2+30/wB2VR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772794556, "uuid": "add4c10b-34ee-445b-8c8d-365978a6bee3", "value": 2214666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772794556, "uuid": "171a0434-0443-4cbc-a78b-2f7a5dffa65d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772794556, "uuid": "6d870c54-7161-4a8a-9620-8acca5810aff", "value": "at.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "653b0cf6-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819184, "uuid": "615aad7a-ba7a-4afe-ae8b-9bb46359f448", "comment": "Malware payload (Mirai)", "value": "06c0088c6d03fd1732b030c781ff0fad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819184, "uuid": "774947e8-891f-4e21-be7e-7c8267efd6e2", "comment": "Malware payload (Mirai)", "value": "4680003fd59b168497f446bf79aa9e5d16d1a946eddd480a8491e9cfaaaa9bba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819184, "uuid": "7a5f265e-38b8-4a9a-8b4c-0a20596b42c4", "comment": "Malware payload (Mirai)", "value": "f620cf22979e0ef9048fae44e8cb468ec7d9fee9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819184, "uuid": "49f5165a-5f87-443b-8d67-0b8247c3a2a1", "comment": "Malware payload (Mirai)", "value": "fb2766db29f28b827e9dff42315e8ea545eb6a2927244376da99e99963143f94b8ba927a5edf17423000b76b18246c25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819184, "uuid": "497089b1-5096-4989-a4d9-0f014769cb0d", "value": "T16773F842BD829F13C1D222F6F7AE01993715BB68D6EB3242D921BF9037868DB1D27611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819184, "uuid": "eecf609d-c468-4d15-8d74-21a07ba9dc33", "value": "1536:Il4gXjRk4xO9mRBR8JcG8/O6ErSWWUdc9ms/FNm:Il4qEoRwlXpWa6Nm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819184, "uuid": "67a26f85-df6e-40a5-8895-aa89ec003e7f", "value": 74484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819184, "uuid": "70ad02eb-aaa9-4b89-89b1-f8a6217e3b11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819184, "uuid": "6864fec1-ca95-41a9-a0e7-e8e493dae77d", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55e1ea9f-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772809710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809710, "uuid": "341cd559-e5ce-49bf-81cf-b9574a1917cf", "comment": "Malware payload (PhantomStealer)", "value": "55a22d53788ba29a6328f112758841f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809710, "uuid": "172b3bde-9b97-4ee1-8841-99607320429f", "comment": "Malware payload (PhantomStealer)", "value": "4690fe7dd78cf815ea311d64d6503a5fe8b32865ca8e4e74a1d1e1bd2f384a7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809710, "uuid": "6d82bf02-f749-4ac0-b81c-d85dea81001d", "comment": "Malware payload (PhantomStealer)", "value": "4cfaba917d4611f38b3826bd13c1821b687894ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809710, "uuid": "ab421acc-cde4-44c5-8407-a262119d26f0", "comment": "Malware payload (PhantomStealer)", "value": "183fc76d405c88ac6d5ad8d0a66b91465a29e5c71665a120833d33d24463721a34da633eebc07212dc06e4d4114fd84c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809710, "uuid": "60ce6a08-6baa-46ac-9962-6e6dae2765d3", "value": "T10865231833C6DE13D8E54A755A71F23027B92EDC605AD21B8EE6BCD7B93A3D00C81697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809710, "uuid": "f77df936-1348-436d-b883-d922ea55a6c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809710, "uuid": "d0a1303b-a2d4-40ac-9b90-c2fae9dc4057", "value": "24576:s/GKMZDknqnUms4PWVlka9YHHsfddDATuHidNM9ipRSBlyjbp6fpEvdpwH3EbdbW:s/bnG+lP9YAdWTuHiopBlyjbtwH3idbW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809710, "uuid": "39d09e0b-882e-4f17-9651-2e34d1ace597", "value": 1531904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809710, "uuid": "c251ef3d-a9ed-4729-b61a-2227a41cdf26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809710, "uuid": "22953599-6e52-46f6-a0eb-3db45c5aa283", "value": "4690fe7dd78cf815ea311d64d6503a5fe8b32865ca8e4e74a1d1e1bd2f384a7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e423fd1d-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772809519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809519, "uuid": "416ef30f-ff0a-4bdf-b9e8-d4531d645472", "comment": "Malware payload (Formbook)", "value": "9d9e78dcc34ec1661dee86c7ba7adfd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809519, "uuid": "a61806fb-dd52-47b4-b093-f8d71e4945b0", "comment": "Malware payload (Formbook)", "value": "46adae2243b4d7d96f40071a9946bafbd301ed0cb82aab5647479bc6344b839b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809519, "uuid": "4542207e-2af0-4440-a74e-394c816536f4", "comment": "Malware payload (Formbook)", "value": "73b980e23af60698cf94bb401c45cd0d84a6ec35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809519, "uuid": "b162d2be-527c-44eb-9fa3-3a052758558d", "comment": "Malware payload (Formbook)", "value": "8973c3da1ac97d424d2bcd10a66ab5005781c4be2e6de6bfe067fd4fd93459e43a61e7b2b62733cafc0721ee547fd878", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809519, "uuid": "f188758f-2865-4dc0-838a-bf581efc86a3", "value": "T1E6059F1CA4A6B0D1ED11D8F30E5E97E14E1B7313AB9A1C5723B803444B968FF1F6AB16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809519, "uuid": "8dabce5b-5f2c-4c21-b252-a62ff7d40bc2", "value": "d45ddffb05d99f5ddb39bf8a22c9fa9b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809519, "uuid": "e3b4cb46-2826-49a7-9767-9bd9a8861be9", "value": "24576:thFxIIFF4aqTiNyIQWKt57qYZxWuB2WaP3T4:RRQTiNy2Kz7qYuuB2WaP3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809519, "uuid": "0d145558-9787-4fb7-8057-3a385d4b68ac", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809519, "uuid": "b3b45888-1711-420b-8ca6-357280a2508d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809519, "uuid": "c3933738-f6d0-49f8-a978-b1c7a8387c0f", "value": "46adae2243b4d7d96f40071a9946bafbd301ed0cb82aab5647479bc6344b839b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "932dc164-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808524, "uuid": "bd2f9fd7-ae7c-42a0-a06c-fb86b44a9914", "comment": "Malware payload (GCleaner)", "value": "c350bc2e0ebc18fbadf76226056b96d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808524, "uuid": "93f7ce20-1721-4902-9733-1485a588670b", "comment": "Malware payload (GCleaner)", "value": "46b729842072b39d1e79783d05bc0dcb38951a2799abecb940cf68f01c7ce61d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808524, "uuid": "46a55296-efc0-4d43-9115-53c9e052916a", "comment": "Malware payload (GCleaner)", "value": "361b09a7d46e664289b4814c5323950c15e20479", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808524, "uuid": "6feb60c0-572c-4ec2-8351-4aad320004af", "comment": "Malware payload (GCleaner)", "value": "6ebce57514ff317c9ae4bc02bd25efc205b4b3f9fb40fd80be993c95f03902003c88f5fe42ed98029f4dc83605a9e7c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808524, "uuid": "c85ac66e-ab06-409e-84c5-d176a6047f99", "value": "T1A746E027C694142DCD19453CEE3A4A5D10D1EF2674BF481395883DCBCB9E1CF2A1AEAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808524, "uuid": "62c82664-b507-49cb-9822-6aa4337bb45d", "value": "099b2b7fa2a0044e2ca25418be2f8a70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808524, "uuid": "beadd7c2-9f00-4aac-9bd9-fc336ed82036", "value": "98304:ateg+023wQe5WdqsTM6x4p0sWsf53MsbfHKWr:aEwv5e74f/ZMsbSW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808524, "uuid": "623e3313-6562-4687-b3dc-b5bd09907c26", "value": 5815296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808524, "uuid": "d217e423-f999-4fe1-847e-a8f25c08a2c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808524, "uuid": "5bdd02c4-ef5e-4501-90fc-dc0b9fcfe86e", "value": "46b729842072b39d1e79783d05bc0dcb38951a2799abecb940cf68f01c7ce61d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7afccff-1983-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819001, "uuid": "b77f86c1-c93c-4b19-9ccd-8b236843b2d7", "comment": "Malware payload (Mirai)", "value": "b664fc818c44394f4f722f40290302bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819001, "uuid": "1d64bd6f-670c-46bc-9f87-5d194df4d3b4", "comment": "Malware payload (Mirai)", "value": "46c6afe2d46cdd1321f3ff8a01c165a9ab2ca3ebb1bef0e016e4110e9ba66564", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819001, "uuid": "9dda37d3-3bff-421f-8ed3-e0749d9a3096", "comment": "Malware payload (Mirai)", "value": "a78f77168a19dee231161aed36c3d7babfc02063", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819001, "uuid": "e0012c98-611a-409b-a26f-6dd101c294c4", "comment": "Malware payload (Mirai)", "value": "5370d69ac79e58de979172727607c31db346f1fd30c623bc6b3cba7dce531800243c40780b87e1317f8916f611827c26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819001, "uuid": "5647297c-b9ea-4b84-82c0-d2c6d5c3fbaf", "value": "T11B936C85FB43E0F4E90609B011ABF77A8A31DD361014DD6BEB98FE72AD32A13911675C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819001, "uuid": "2de82d60-0396-41a9-9076-236750f8f723", "value": "1536:nsm9i1KJdfC+Sq0zPUoUeRNjRmnj82QRiqoaRGUw31QUHLqEUuKGr:nsesIdfCpVYoUeRNjRmnYyVuiYHO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819001, "uuid": "3458909e-b05f-4ca9-b2b9-41a2feb3c9a6", "value": 95508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819001, "uuid": "bbe9bdfc-f3f1-479b-a16f-87625fc733ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819001, "uuid": "32bd5fc1-688c-4466-9ef8-7ba4fc4d0da7", "value": "jawirbot.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cc6e4bb-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808862, "uuid": "67125c3f-dcb8-45f4-8df4-460a97ffc07d", "comment": "Malware payload (GCleaner)", "value": "b84e8e94da85a6fc212dbf0eb95aa230", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808862, "uuid": "ac734845-b8f3-47c3-aca0-3ffe48b0750e", "comment": "Malware payload (GCleaner)", "value": "47fa339b4f1c4d79cfdf09bb7622040d13cbaa1ec03f879851e5153c89ba0cf9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808862, "uuid": "77530cf0-b930-4e86-8752-0d3963209770", "comment": "Malware payload (GCleaner)", "value": "648b0f934a4516770950f85eb3aac388e887ee85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808862, "uuid": "4a711d70-7918-4a8c-a00d-70614bb07167", "comment": "Malware payload (GCleaner)", "value": "fde110aded7bf5299d1ce53c827e589758b95966092896dfa8fcd690163b4ad23395d787d57f4beb4d13f8ee190b2029", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808862, "uuid": "25d3e44c-5005-44d3-98bc-b477383035fc", "value": "T17746E05CF2846FBEC2DD83329754A66C26A519C636EDB3C0D18ADBCC1D0F2C7651DA0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808862, "uuid": "3b136c42-0a6a-4f6d-909f-c120b826e6a0", "value": "234372fce9eaa047bc4c39047910954c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808862, "uuid": "89cc99bb-b933-44c7-bdc2-bb96596dde32", "value": "49152:oGQJM+ofHuDelP+oVk4qWRm7cCvlZTwhJDwKT2wgb6em+EGTRyWzUFSDUW:oBJMZJ+oOUUcCQrDsoqRNU4D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808862, "uuid": "e7927686-7264-4276-a8b9-fa13a0b82a43", "value": 5530624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808862, "uuid": "a768ea12-b4a6-4936-8f2a-fbcff20765dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808862, "uuid": "17c6d037-119f-4f39-8e68-0a5802c7f8b3", "value": "47fa339b4f1c4d79cfdf09bb7622040d13cbaa1ec03f879851e5153c89ba0cf9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23923869-193e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772789010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789010, "uuid": "17b3ce3f-4207-434a-8e79-4ef20ec01e85", "comment": "Malware payload (Mirai)", "value": "97f5deb812443ee2510aa8c756d7cd24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789010, "uuid": "54040e11-a3a7-4923-842c-16f78c4ea1b1", "comment": "Malware payload (Mirai)", "value": "485cc1e430a234e80e8b11a49a8bea643e9eb2dc05261e6f938850edc9bef254", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789010, "uuid": "8aef3e0b-7150-4899-a156-97e7c884081a", "comment": "Malware payload (Mirai)", "value": "c74b8d3b9ac9048947fcf968486af7fed1f38bd1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789010, "uuid": "5a16278c-91e7-4f71-a553-73740d08f6b5", "comment": "Malware payload (Mirai)", "value": "2df8329bcc594a3d0532f2ece4baa4caad94301ee247163c4f0d1748c00f6e8ccf64aef1ae3c660072c1c27152a32bc5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789010, "uuid": "efd829bd-deaa-4a0f-8a05-2d96137b873c", "value": "T1EFB3C84E6E218FBDF768823047B34F25A75823D63AE1D6C5D2ADD6101F6024E245FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789010, "uuid": "4ace86ec-634c-4190-aafc-28fb7de91f47", "value": "1536:Rhzos8B/D+BnjqnBQCldTs5BiYm82I/2tLedriKSfirghV7:3QB/ujKB1s5BiYSI/S9HfVh9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772789010, "uuid": "e9306e97-873c-4e5e-be21-d8888499c410", "value": 110076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772789010, "uuid": "c17b1530-7872-46f7-8036-eff77aec1da8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789010, "uuid": "9842c6bd-9527-41f0-8f0d-001509329783", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bff60dc1-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1772809029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809029, "uuid": "43dd6e02-8be1-430b-b950-1c1ecdaf503b", "comment": "Malware payload (DarkTortilla)", "value": "078d3846e218ad3f8b8a58460d40de18", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809029, "uuid": "e9ba212f-3ce9-4892-b7e1-e4aea4474b39", "comment": "Malware payload (DarkTortilla)", "value": "489ccd9807e0c63e43cbbec56ed0043151fc47cf84cde1e5dd405ecd4d1fdd6f", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809029, "uuid": "899a61b3-d96a-42e4-9d24-84322991aa3d", "comment": "Malware payload (DarkTortilla)", "value": "7562c29066767547a7dc03a79eacebad970bc841", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809029, "uuid": "b2b22c2e-1e83-4ee9-8401-bf54fc7385f0", "comment": "Malware payload (DarkTortilla)", "value": "dbcd1cbb445b8d2c79c029cefe6ccb353d02dded25cdc11571bc14356fec0d58652bd50172d3e6a775f8f79c1724276d", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809029, "uuid": "57dc6fc5-4753-4f38-bddd-02199b41e16f", "value": "T198E4F1325E822A20D9690FB9C066109577F0C857526AEB7B6FFC01F46DB3F49CC279A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809029, "uuid": "2535f73f-10e8-4fbc-8c4e-cb7b30d91496", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809029, "uuid": "1135060c-3a6d-4177-9aaf-dac70eacbfee", "value": "12288:Bqy/ZDD3GszIMjy1j89CFnLT/N0HPNI0iAxxrKXBxoo1C7PHQaeJblNB1N:VDDchpLT/4PPH7caoc76JblNB1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809029, "uuid": "6eaac90c-e424-469b-b6e1-eacff79c9ec3", "value": 671232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809029, "uuid": "08390963-e06a-413c-8489-474317b877e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809029, "uuid": "a586927e-bb0b-4985-b9ee-a01257d8ace1", "value": "489ccd9807e0c63e43cbbec56ed0043151fc47cf84cde1e5dd405ecd4d1fdd6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af042254-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1772810718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810718, "uuid": "320425da-eeaf-46bb-84f9-22705821c205", "comment": "Malware payload (GuLoader)", "value": "a03ca2d71feb691db1ce725b9983739d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810718, "uuid": "fe5546fb-e545-481d-a019-c36e35ade262", "comment": "Malware payload (GuLoader)", "value": "48a0c3b93362dae744c054e94cd1e62f6e02e5f0ae8b3b48ae0ca24c5da51340", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810718, "uuid": "3b3a53b4-4ad1-47ea-a701-512f8ece2a08", "comment": "Malware payload (GuLoader)", "value": "be86d6d149b0b814c45c71131aabdd6375b955d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810718, "uuid": "10a79714-92ec-4a0d-8da5-25f092b0ea09", "comment": "Malware payload (GuLoader)", "value": "d935b8b5af71aa2a95a9816abe73fcc2ba27f64103bc87644f8fba254de550631f9ea004e5cf2c0356d430303917bbde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810718, "uuid": "f1639a53-a64f-41d3-8311-3df4a573cc4c", "value": "T1D345D09CA8FF4497D77D3A70FBE764794A9392BAE2F22A6A357540214F52F000D0B523", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810718, "uuid": "01f49822-bf7a-4f46-895a-3c85140033aa", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810718, "uuid": "a7e9ae67-4af7-4055-8bc4-b51539be3730", "value": "24576:Lo0blzGT6ZmeCpRrFH8JmC+KlUunOKZQYuObYX2/tqJahTuIk:ciURrR8YC+MUuJZww3VxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810718, "uuid": "cb784b90-d155-435c-856f-66eb3cdb5c2b", "value": 1239183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810718, "uuid": "29f2f2b2-f63e-4e75-847f-a25d7996a1a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810718, "uuid": "256b4fc9-9b34-44f7-a4d2-60a75e1400b5", "value": "48a0c3b93362dae744c054e94cd1e62f6e02e5f0ae8b3b48ae0ca24c5da51340", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5952bac-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772809548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809548, "uuid": "978051ba-9ba1-4e81-9671-e0b34f8d3d51", "comment": "Malware payload (PhantomStealer)", "value": "89deddf2918580b776ee1a242b70d04e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809548, "uuid": "404846a5-3b54-4c8b-97e7-5560cd1f7eb2", "comment": "Malware payload (PhantomStealer)", "value": "48f2adcf18a6e77923a921accf888bce1aec1826088d245111c5655a6ed78087", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809548, "uuid": "68acb601-a21c-4d6a-b2dc-f689e1e075f2", "comment": "Malware payload (PhantomStealer)", "value": "f58313c8964e559d937c38b7c1f2c814414b49c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809548, "uuid": "cab1f28e-f366-4596-9a23-5bf7ba0efe4c", "comment": "Malware payload (PhantomStealer)", "value": "0199ac7afcd4f2a5c8b239e23578d7bead0c4ec34806a028f37c9249b43e67e4a5ed2cc4255722bf06b6661bfbdeccdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809548, "uuid": "2b51e347-26a6-4737-a520-6067dfd13851", "value": "T19FC533116852535AE008D3FC8EB4F123AE14561ABBD352F5313B226DFA81F7167BE683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809548, "uuid": "3a7b36c1-8fe1-4a74-9c1f-6d4923946bae", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809548, "uuid": "bc099156-ab8d-41f9-8f07-1d0eda9f371d", "value": "49152:4woPEBFtqUC8NA/yO5qlU81p0rkhlaekEgIzwnH4YskN36Hxvp:4FEHtqUCyA/JqE8oekQz/td", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809548, "uuid": "bd7d0e33-7fd9-445f-a45c-b9324562ad8f", "value": 2671616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809548, "uuid": "34e7e6ea-9611-4d44-84ba-36dbf26e8e96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809548, "uuid": "8a51c8c6-1cf6-4ae4-b799-4007811c2ef1", "value": "48f2adcf18a6e77923a921accf888bce1aec1826088d245111c5655a6ed78087", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19ad62a0-1970-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810468, "uuid": "9fb51c58-906a-478a-9e07-8523ce89f402", "comment": "Malware payload", "value": "85d816224a787fccaf973e36edc91b08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810468, "uuid": "8e1915a9-d194-46fd-9048-1ea5975164c8", "comment": "Malware payload", "value": "4915e81ffdd5ee0dde827c847306a3a625210db1cf2c67278484068fb5cd6042", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810468, "uuid": "29cf0557-dbe8-46eb-9e63-644f1c933c77", "comment": "Malware payload", "value": "93ec8aa0867d595e3282b9795ea6079a0575e88d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810468, "uuid": "5269a40a-6768-464f-bf61-4536a830b7d9", "comment": "Malware payload", "value": "cc37b2b247edd9bfc144d80618d9e0356a70d161bf64687184d81fd1ec9d1f9511799fc2030d6ec2a3c4ad950e3e5db8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810468, "uuid": "64e3401c-ff12-46dc-8583-898c20116a19", "value": "T16E1523D92211FDE3E8F20730C9A247FBC954DE40CE28B69B76567D9A3C376A5140E70A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810468, "uuid": "ac8defc9-c66c-4a1e-8bf5-744ac3e04eef", "value": "0293eec0b5432ad092f24065016203b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810468, "uuid": "dd524916-16db-493c-99a2-e8e1859e0339", "value": "24576:K65Dl/93z1QgeLoAODKPfJykLZ+Kd/2cc9+yyauEEjgP:nEROoAkV+KFpqpfuEqgP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810468, "uuid": "63de3df8-b83e-458f-a515-1c419bece025", "value": 948744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810468, "uuid": "99044366-9384-4b73-84cb-b72735928aa1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810468, "uuid": "4da26fb4-f216-448b-b994-9af0a32f1a51", "value": "4915e81ffdd5ee0dde827c847306a3a625210db1cf2c67278484068fb5cd6042", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06d94095-1970-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810436, "uuid": "dadc2d8c-2765-4986-96f2-f44cbe86ca2e", "comment": "Malware payload", "value": "2d78320a7f8548ed838ec11284fe582e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810436, "uuid": "da025009-7092-4beb-8a63-6f1b731d4bd8", "comment": "Malware payload", "value": "491afd4bfca310a9196bde3cdcd2b234c1db31bb055fee5163e37749d9cf3524", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810436, "uuid": "a7f6fed1-eb36-4e9c-ad3b-5bf46fb248af", "comment": "Malware payload", "value": "14758320105ca33ae26821162fe0dfb9bf13d61f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810436, "uuid": "4997b9ec-853d-480b-9db8-a10de823ab7d", "comment": "Malware payload", "value": "13fad7a754b4293ed40ade7fbaad398f27669f6f2d8f8cbb940bbffcd56b0a52c7b0ed30754620f14616794f3e4b485c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810436, "uuid": "0ac49c03-1d4f-4a2d-9945-2abaebbe6c2a", "value": "T136841260B925D42BD9E045314FB909F9E957BEC7805A03078B40BE5BBC3A6F19E27327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810436, "uuid": "08754b9c-9045-42ef-98d8-f8159cd7afcc", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810436, "uuid": "69110070-854f-4c4f-ba22-e7c4822546af", "value": "6144:XR+xXxN56n7m8rZQvabDtTfltsjMI7xkcbywLP3vwL7fFaszwoU0B+b05dCm3:BcN5w7zrZT7rAS43stzw8+2Cm3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810436, "uuid": "9ac632ac-892c-4484-b5bf-79b920c9f835", "value": 406912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810436, "uuid": "16ffbc71-5d9b-4817-b269-fcb4c9a0c642", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810436, "uuid": "cc48dd0b-c142-4d9d-9513-52dce047c43d", "value": "491afd4bfca310a9196bde3cdcd2b234c1db31bb055fee5163e37749d9cf3524", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaeb7128-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810389, "uuid": "266a56dd-f95f-4839-ab5a-5d80282c8943", "comment": "Malware payload (GCleaner)", "value": "f0570dacdfe3aed7e1dc98658d3549a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810389, "uuid": "0e3151e4-9b6f-4e7d-9a25-863c3398204a", "comment": "Malware payload (GCleaner)", "value": "49df570be9e1aec6fc08a8e319107281c034a6558b86a9530d467c29c4315dd4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810389, "uuid": "56ee963a-10ab-40dc-a5b0-e85f225bf17c", "comment": "Malware payload (GCleaner)", "value": "cc061f2145cffd03eb28b87a923a00215357b146", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810389, "uuid": "ee5d8255-2ccb-48e3-9328-b6a811dca317", "comment": "Malware payload (GCleaner)", "value": "4371c9c94f6a4ede2ba8b109e7786a23e88b6c9493ba8742f1c156a47767ee34514a8baa92c3195fce2e183667a35609", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810389, "uuid": "a17a80af-5c55-46b2-b89e-686a0705203f", "value": "T125059E26A1E16437C37F3A79AC5B5E58A82DBF102DE858462BE50DC84F3874F74621B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810389, "uuid": "64c2ef3f-3b7b-42ef-ba27-ae1672c5122e", "value": "fe4280c06246cc873fe89746dadec91e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810389, "uuid": "d90c0ebb-4a2e-48e4-a1e8-ed8fec64a345", "value": "24576:illuEBpPj6o4CPbE9taCbvIWuiI6X64M:ilwa1Vp3sG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810389, "uuid": "f18c8c70-01d4-4bcf-97ca-6a8b6529ea82", "value": 841216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810389, "uuid": "8a8dcfe8-ffe0-49a7-b89f-11da1aa8e64e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810389, "uuid": "f87923b3-4c6f-4939-b1af-2fc9b131031d", "value": "49df570be9e1aec6fc08a8e319107281c034a6558b86a9530d467c29c4315dd4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cfd958e-1950-11f1-a769-42010a9c0008", "comment": "Malware payload (CryptOne)", "timestamp": 1772796837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796837, "uuid": "b93b1f7c-ecf6-4b66-ace9-a74ba802c000", "comment": "Malware payload (CryptOne)", "value": "a845fe8e2698aaac472644dc70bf0def", "object_relation": "md5", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796837, "uuid": "958f0b9c-368c-4f08-b4a7-29695c5387c9", "comment": "Malware payload (CryptOne)", "value": "4a024b1c0bc95ddb35bec16e31933d1ffa371c36e1f11e9f4e2bb3e025124bf7", "object_relation": "sha256", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796837, "uuid": "3fc9b721-9448-4649-96bb-232afc6cfb79", "comment": "Malware payload (CryptOne)", "value": "4abb1f0132ad25b668be18470ecf2825d2066339", "object_relation": "sha1", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796837, "uuid": "002f279b-9047-4c7c-8e66-6e6270912da0", "comment": "Malware payload (CryptOne)", "value": "271f0e49d63f78266a0ca56096ec8cb3c45d934ebd2a8b33e67e2023e1c6f37e1cf14a540b950dc727ef00f5bb8f6ff6", "object_relation": "sha3-384", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796837, "uuid": "cb5791cc-1e9f-4444-811d-2bd64127bcbf", "value": "T1AC6602B6D321CB7ACCAE0D76980A968E0C1438DD39A48864EF8CB5E635E1E717D351D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796837, "uuid": "95d9404d-649d-4df8-b562-46860a8802cc", "value": "9b6b7a746f3489fa02f3177f6843a73e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796837, "uuid": "48e9899b-103c-49a5-850a-76736085aa17", "value": "49152:Hz3VIcmwxwawgBxxDxNpAcOTE6Sut8EQyFTWDmXMX98xZpM9tRiK4z0u1XCSH8pB:Hz3Voh+Bj2x3DKiXWOx4ScOx1VC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772796837, "uuid": "a44fecb8-9894-4220-8d62-3f134f588f0d", "value": 7043072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772796837, "uuid": "db5ddc03-8c8e-42f9-88ed-cd949fc7a64c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796837, "uuid": "acd6f6eb-5d8e-41c6-894e-8173c0bb2ef7", "value": "a845fe8e2698aaac472644dc70bf0def.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8513b9d1-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1772811507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811507, "uuid": "f2c282fe-03c4-4ad1-bacd-e6e8983dc139", "comment": "Malware payload (GuLoader)", "value": "f46329e59f449cdcd96a1d78b4e96f59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811507, "uuid": "05f84208-91e8-4e95-b570-c6818e0b0ce7", "comment": "Malware payload (GuLoader)", "value": "4a6b8d26d298279a62f2a27aa6a8a9b67db22a2195f9e4de3c19dccb0a0f8126", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811507, "uuid": "99f1c2d1-5656-4b0c-a5e1-532af9f819a7", "comment": "Malware payload (GuLoader)", "value": "007386fadca47afbe5632420c46f658a978eb688", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811507, "uuid": "b01cfd0b-7775-462b-b9a8-f9db2b00d0c0", "comment": "Malware payload (GuLoader)", "value": "8d5d80be5377f01d0acc94be0427c1982c2400068d6199a01f0be92526f8326506d42e9d3e2787d9b3163ef514f426f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811507, "uuid": "b9c052e1-d44b-4b0a-a650-6c3c19a5f033", "value": "T14225230AE0B99463E9F11170043766B6FEBB5F1155A0838BA7343F3F3DB58B1852A693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811507, "uuid": "55973144-bf63-49ce-9867-aafa2cf5652b", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811507, "uuid": "3bdb7874-f8e7-43f3-8eaf-a0ac5b9389f5", "value": "24576:RXaVXbFfDTwbaCoMoZ2j7IRUCAm504gmfZoeYCQ:FobVDsmn4j8t04gmmL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811507, "uuid": "6fb223c8-ef86-4d1e-95a8-aff25416b86f", "value": 985832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811507, "uuid": "4f6c4c5a-b474-43c8-8e14-ef11b3dd186c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811507, "uuid": "50b19790-e774-480b-a037-ef030c1a3d5d", "value": "4a6b8d26d298279a62f2a27aa6a8a9b67db22a2195f9e4de3c19dccb0a0f8126", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab3b2d9a-1969-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772807706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807706, "uuid": "b8ebbd64-0ed6-4a04-9f7f-cdb2781f195e", "comment": "Malware payload (GCleaner)", "value": "9386e72987c91a972d015d4c3ebe4b62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807706, "uuid": "7030874a-2294-48be-b600-c8666ed0458b", "comment": "Malware payload (GCleaner)", "value": "4add6b0dbf3c6b341133382c31245669ac85a5e115b68dbe65a07ae69b3c4ad4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807706, "uuid": "ecda00f5-ab2e-40e7-ae7b-c6363a3865ce", "comment": "Malware payload (GCleaner)", "value": "fd73050a2da1f32a051d01b0bc9bb82906352797", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807706, "uuid": "33e21339-8115-4880-8e9f-779655ce256d", "comment": "Malware payload (GCleaner)", "value": "26cd3f982d5c583f0fea9172ed025452a7d57e85df49132a9261be12fd6cb77e495206426ea5ce8abc4b0a42657dd076", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807706, "uuid": "daffa770-ca56-4f49-a415-122c76b92010", "value": "T15906F132B471D0EEDE23063AFC2E566CA6057818ABE58D16F9ECC52CB6716C3581D1F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807706, "uuid": "60e62f0e-cadb-4318-8b27-971f3e82eb6a", "value": "85f3ca0400d93842304463da19f2baf9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807706, "uuid": "43e163e2-244f-4a02-a190-3b60de1f0097", "value": "98304:lEz3SsN35FZ0Poptf5kWCjVt3fuWsdEUrz26J1K3MVoFJ4RImHL5:lOlbVkbr3GWkn2o8JC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807706, "uuid": "05284d55-3b9a-40d7-8e3e-430b4cb4b02f", "value": 3880960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807706, "uuid": "e3baba5c-b582-4ae9-abd9-35438c889e35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807706, "uuid": "2088a8c8-aba6-490b-9eb0-ed63b25d90e2", "value": "4add6b0dbf3c6b341133382c31245669ac85a5e115b68dbe65a07ae69b3c4ad4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a892fe3d-196a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808131, "uuid": "7f30453b-b81c-409e-ac3d-03f545b7e7cf", "comment": "Malware payload", "value": "fea55b4d561f96d703caac847584b7eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808131, "uuid": "f5511188-3334-4b9b-ae58-c11552cdfd71", "comment": "Malware payload", "value": "4baba9f76642a51a4acdeb13b211e512aad359aa09017a1d47faa0b2a4d7ef4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808131, "uuid": "2837d132-f89e-4b4a-8c8c-aa53cf3a8629", "comment": "Malware payload", "value": "cf531060be24e3fb6aa4545c12ee6d102a37670f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808131, "uuid": "ec3c003e-0a1d-416b-a06a-2271bacbdca2", "comment": "Malware payload", "value": "8ec771b4452f8c8a6a0d307c7b6f1a1cd8f18ed1e2f6897c995b6afb862fc5aa08537daece984f607f81293626526b8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808131, "uuid": "bb2b54d7-b3be-4f4a-ad93-99f58f3944ea", "value": "T1CA641200B694D923C9632370D9B7836647B1B93296CD070B77A0BF8A7E76381CD1DAC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808131, "uuid": "f5633036-90f1-470c-9dac-eb3ab9d69ecb", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808131, "uuid": "90557c97-712d-4abb-9ce3-51e512a904ba", "value": "6144:t+MvoJXYsbLSd6KjTKIaPHiPA7j1ejJePXkDqOJ3qN4Ukc5mrMYgDKj:t+FHbLSd6eSCcejuuqq6ijbgWj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808131, "uuid": "913768c1-5a7f-40c4-ab11-c9ccc81cad11", "value": 321728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808131, "uuid": "805c4ee2-240d-487c-a466-82b0ce2a2630", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808131, "uuid": "a12c946d-5e03-4ee0-8b35-12ae1f287dc5", "value": "4baba9f76642a51a4acdeb13b211e512aad359aa09017a1d47faa0b2a4d7ef4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "534dca2a-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810994, "uuid": "a75e2121-e7de-448e-b3f2-e1a19ca11a2b", "comment": "Malware payload", "value": "f7b3c1cf089b3347eb1ba5e9f667a9f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810994, "uuid": "55bf5f7c-20bd-417e-8e8e-70b31ecb8d5a", "comment": "Malware payload", "value": "4bb88d12593d6c5476990c1ddb96fe13ffbfc68ffb40c396d048c39cc06c2940", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810994, "uuid": "ec800da5-649d-401b-aa9a-86f3a10a7f61", "comment": "Malware payload", "value": "2afc232e74afca61a36f775e9116e2cf3d042261", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810994, "uuid": "85571cf7-e046-429b-b651-232aab267725", "comment": "Malware payload", "value": "63c1e77e5b93d0a4e129201674c1e40ee15f1b30e239552b55ec2734dec5f004a052b811bc0393ff22bf44b5b0e6f412", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810994, "uuid": "273957da-a74e-4beb-9bae-8585f4c6fad1", "value": "T14B6412267706E817D5C502708DB295F6D9AB9FA80428534B2F203FAF7DB27B14A1E317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810994, "uuid": "c0ada28c-69d1-48b2-b37f-3c8fedcfa445", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810994, "uuid": "4b6cc9d4-2ced-452a-8bf3-7aac4dbb7262", "value": "6144:IR+xXxGYvWqhx1/OYW4dWjF3e30X1XtibgaBR9VKmrElOxqlNdG2t4SpQyjH/Mcl:AcGkhxsQEVIg1Xog89VJrElHlNdG2thh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810994, "uuid": "3370640c-b51d-4e3d-85bd-be051a864ace", "value": 327480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810994, "uuid": "96f1aa73-3af2-4591-b270-bfb74c24946d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810994, "uuid": "ce3a5ddf-828e-46a7-8cf5-df80834ff938", "value": "4bb88d12593d6c5476990c1ddb96fe13ffbfc68ffb40c396d048c39cc06c2940", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51b7e032-1972-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811421, "uuid": "81ba698a-b69f-4f71-b571-ea4286a4e9b8", "comment": "Malware payload", "value": "1151be3e43597e4ee29ef91da693c159", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811421, "uuid": "f8750761-6577-488e-bbc8-f504275d7e9a", "comment": "Malware payload", "value": "4be75a1f4949de392b98b2a2ab16a469c20bb494bd34f23c270ef9bec086ced7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811421, "uuid": "91179b0b-8770-46eb-8847-0c424370bcd5", "comment": "Malware payload", "value": "916196f1a720829414e7e68141780a3255c0a6f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811421, "uuid": "6c699852-9d9b-41fc-9ae6-3546d0cfe5d9", "comment": "Malware payload", "value": "962df6208627f5c868d381f038fdd8cc9d60f0c186d94390a72ceefb2f252d04b7f5a8c146ee229569734fdeb228119d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811421, "uuid": "8a23bb8e-1bc0-4adb-b991-53645c1f72e1", "value": "T10F650726E640B00EF0A38174B569E2B7916E2C721458C81EF78D7B1A37706E779F172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811421, "uuid": "d4175897-9190-4e29-aa97-ce01e7b57a52", "value": "8b07ad58d25a6b73f77cdd25f11dab2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811421, "uuid": "5d50a364-e0a2-40db-8b26-efc807ce757f", "value": "24576:GnQHtOUTzK0lfCY6E0Bbmjs421KSIB/XZ:GQ4SlfCY+mjs421KSIR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811421, "uuid": "ff4a3b5c-0b18-4de4-bd7e-3c460eb7d7ac", "value": 1454080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811421, "uuid": "9bec265b-a4d3-4f7b-938f-19ead1828ec2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811421, "uuid": "f1b6193f-b59b-4ea1-b629-238d5eee21cf", "value": "4be75a1f4949de392b98b2a2ab16a469c20bb494bd34f23c270ef9bec086ced7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "690bbe5e-1945-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772792133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772792133, "uuid": "753e5110-bd9e-4a4a-9381-89bb3699fcde", "comment": "Malware payload", "value": "c69687b023f19800db5a82bd8857b3ab", "object_relation": "md5", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772792133, "uuid": "4b3baa93-e932-4d1a-aab8-38a73da2f99a", "comment": "Malware payload", "value": "4c45663f05b49b70af2bc404ea8f459ec5a576b887afdee14f471eafe1ee6be2", "object_relation": "sha256", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772792133, "uuid": "457725ff-112a-415b-bc4f-e2c70cae887d", "comment": "Malware payload", "value": "f6c656fb98394465e93f99af6b3a5fd2df865d44", "object_relation": "sha1", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772792133, "uuid": "618513a7-a435-4c31-8324-26f76e0f0f57", "comment": "Malware payload", "value": "9fef38d21ad5350bd46759691b11ad5bdba3b1f89a52e30f5d2e13ec1200806c9192780b8f8d8c29030c70aef2f72c00", "object_relation": "sha3-384", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772792133, "uuid": "1271ad8d-04ef-4a29-937f-d6a2609a195d", "value": "T169413212BBC61F14E3FF8AF46DB772441A14B0D2160B490D44E085041CB3EE9DDB8A2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772792133, "uuid": "eaaa4482-8565-4774-86d4-e6f0cd257e69", "value": "48:8pysGUZUeRtEvM1yjVwk2DR1DQ6XgQ8vj4:8fP6EkN6Xk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772792133, "uuid": "759addbf-9de3-4532-b057-601b3e5a7333", "value": 2373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772792133, "uuid": "32bb92f0-0a39-49d3-abe5-4b189f597df5", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772792133, "uuid": "91588ae5-80ed-4d1f-8489-84a4a0e19e79", "value": "neservice-lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74a66fed-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819210, "uuid": "9572acd2-bd28-4a4e-9741-a73679606d3e", "comment": "Malware payload (Mirai)", "value": "059cf07e9f472bbbf037ae238419ca63", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819210, "uuid": "6d68afdb-4f67-49dd-b1ee-3a5c73fe93ff", "comment": "Malware payload (Mirai)", "value": "4c6e3e8812cd240b454e05e89cbc7ac49f19066d7b6f251344d4df40bfa4482f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819210, "uuid": "d56ac3b9-f02b-4908-bc01-e465eba9044f", "comment": "Malware payload (Mirai)", "value": "5586813d68aa7ffcb35b158067f0aeeda4e0e2ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819210, "uuid": "4d69ec6f-da88-4c61-b962-b5bd9312a3a8", "comment": "Malware payload (Mirai)", "value": "6e430140bd8ebd4b949d83838a6e60fb0d7cb307df5f740c2d791c8c429f2732ee01be94cf6a6ef457b2e1fd7bde82a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819210, "uuid": "42e67508-e61f-4761-817c-155260b478e2", "value": "T1A35319C67A43DEB7E95311F002F3AB325A31FC3A096AD5C6E375FCA269115D0A50636C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819210, "uuid": "517f8756-9418-46af-9487-d46f0195ad28", "value": "1536:Bfm2PcWZeMAqkNo966o2pELGvTaDC+OfHlU8NRc8juBCKSfXbU:BfmMjZeMj9R9p9sdOC8DRjPU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819210, "uuid": "d4216b08-6387-4109-bce5-a774460e1bf0", "value": 63580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819210, "uuid": "f169b2b0-b232-4d4e-ab8f-25adec30d9f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819210, "uuid": "b7b974ec-14c3-48c4-927e-ca344e6db193", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2632102e-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810918, "uuid": "09f9f446-d705-41d9-b8d4-bb37450577da", "comment": "Malware payload", "value": "66c10f28378f5b73a0a3d19f3ac7f297", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810918, "uuid": "436ec33a-371e-4457-b04d-2298a1096191", "comment": "Malware payload", "value": "4cc2ab119438950aeee01fd33fe268802e5362cb0d38349bf5df6269d9b8462f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810918, "uuid": "e4030580-6663-4286-8965-3b8562363a34", "comment": "Malware payload", "value": "7b39d1b367c691be7f21e63594b02409c6e8a40d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810918, "uuid": "453482e3-d0db-481d-9a39-f8d8342bc19c", "comment": "Malware payload", "value": "8b920cb26149fd30a9ea54c96961752a03b98fea397d6d9fbe9e3e63d8396a0c5fc1bff593b040d4254247d0e0d91a73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810918, "uuid": "1f39a70a-649d-4beb-b86a-025c3642a3ee", "value": "T1A215E0228E626A38E55D1BB9C527086C23F1E307211BD71F2FEE85F94A62FD7CA17504", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810918, "uuid": "e2080228-14ae-4308-b353-66d0fe6e2e25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810918, "uuid": "6cd8b303-3049-4b81-a659-ebe540eeffb9", "value": "12288:J9dMjn1XAdpr+8Esd4sEwRA8DWSW/+2PmvszdvW9n4Z:9EOdZ+8EsdfRA8DFWm2dzded0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810918, "uuid": "8e9798b8-1622-45d2-8f06-a03b1fe6af42", "value": 952320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810918, "uuid": "c24fe264-8afe-431a-a2ef-c3c997b21cf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810918, "uuid": "7f0c8632-6b8a-4781-ac65-e33ced529dd0", "value": "4cc2ab119438950aeee01fd33fe268802e5362cb0d38349bf5df6269d9b8462f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba346f06-1971-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1772811167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811167, "uuid": "68489ec3-2362-4a34-b72a-41d6a4b4ba4d", "comment": "Malware payload (ConnectWise)", "value": "ba4a8da291e98615ce190aaa72f2dba4", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811167, "uuid": "fa50a280-928c-4b4d-ad00-23c900ecdb02", "comment": "Malware payload (ConnectWise)", "value": "4d24949840cbe6127c1a949786a10fd526693cb8ae286be0da8fcd776f635387", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811167, "uuid": "e08b146b-33b9-4f68-80dc-875e869d863e", "comment": "Malware payload (ConnectWise)", "value": "cdb529aa6077a3b490b16112b25000798b652359", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811167, "uuid": "498643bb-ae0d-4d5a-920c-c57bc39865c2", "comment": "Malware payload (ConnectWise)", "value": "6c69d4ad78c3b515be210efed87c2b1f978c49573660b5171247c08c4ae26dce8734f2a9885e537ab9f496907dee91a2", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811167, "uuid": "231ed318-d507-442c-a602-4566dab56ba0", "value": "T165A6232153F9D028E0F35B35EE7AD165AA32BE618E12C15F1354780E39B1E8196B373B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811167, "uuid": "f56fe026-cbe7-433b-9918-69953f384e1c", "value": "196608:kBn2hg5kEWmXhcfKjSVih7vGe2Bn2hg5kEWmXhcfKjSVJBn2hg5kEWmXhcfKjSVM:ggdEEijfDGbgdEEijsgdEEijSgdEEij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811167, "uuid": "dc3528fd-1e4e-4fda-88f5-abf9a809f9d7", "value": 10121216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811167, "uuid": "a23a3c96-95e8-49b7-aae5-5f6fa575aeb5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811167, "uuid": "83414637-3336-47d3-b797-d50bfbcb5405", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26c2f02f-193e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772789015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789015, "uuid": "a1af4af7-6284-43aa-a7cd-c5a33a82479c", "comment": "Malware payload (Mirai)", "value": "2cea8fc8007509cdfa6b3448f79ada0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789015, "uuid": "7f88e8f9-8b5e-440b-b8ee-163731308d30", "comment": "Malware payload (Mirai)", "value": "4d538e0ffafd519a096c9c630e6315c8432b04d6708842edff1157e33897a337", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789015, "uuid": "656c1782-43f9-48b8-bff6-2a66d2dc661b", "comment": "Malware payload (Mirai)", "value": "8880ac365d2144247a869215792ec8a272e0a288", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789015, "uuid": "cbc0b567-5f9e-44ff-bd26-a815ff574877", "comment": "Malware payload (Mirai)", "value": "8a8c4a52d44f161ae076eb6d6cad1cf188ce9e34ee8533fda3b5a7dc01487461e669b3ffd2ccde5f855915b958530fc0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789015, "uuid": "d3f4a93f-8bff-44ba-a0de-f3fc4a07d168", "value": "T1BC933B56FD818B21D9C112BAFA1E118E3313177CE2EE73129D186F24778B96B0E7B845", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789015, "uuid": "dd573c02-c1b0-4b6c-8294-1920c059a0bc", "value": "1536:n/nqxCpuHewdcOagKOZzgGPN36U5Jb5ad40YOVKUyi0ZJk0Dp7JKBY1F81:imuHejUKOtNqU7b5adEZJk0Dp4BT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772789015, "uuid": "175d7324-9012-47de-887f-e6af9e3237e3", "value": 92176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772789015, "uuid": "ca5c22d8-b640-4ff5-b224-347eaee6fee8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789015, "uuid": "5467fc3d-5714-419e-9f3f-f680d3c2ea66", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ea5f3d0-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819200, "uuid": "5e55e034-5274-4d3c-905b-0b820be4caec", "comment": "Malware payload (Mirai)", "value": "0157a6b4813cd7d48bd4e7ef94880ade", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819200, "uuid": "92c9c35e-b3df-497e-989b-1d60ef5529a0", "comment": "Malware payload (Mirai)", "value": "4d5ed15d4b6b6ad04fad1d9f73b175d484a6feb6198fd3dfd81d21fcdbafed45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819200, "uuid": "7d40647a-fd4d-491d-8373-7d091d95ef39", "comment": "Malware payload (Mirai)", "value": "91bfc8145e7fbe2c58409ac4a836797b0ae2a679", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819200, "uuid": "146f68a0-ad20-45a8-9718-d4aaadc2728f", "comment": "Malware payload (Mirai)", "value": "b57128e31de146119913aaf56037bdd12f8184d29fafa8e7343121884d994b818a5d609f18b6ea9b6cd6df1079fb78fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819200, "uuid": "4e3a90d1-deb9-4e27-a8ae-934c258e487c", "value": "T1A473F842BD829F13C1D221F7F7AE019D37166BA8D2EB3242D921BF9037868DB1D67611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819200, "uuid": "e32f5d60-79df-47e1-8c14-142b4492dc9d", "value": "1536:+ZCpnu/0VgqiBGZrYXp8/OPraSinB3TAbCvPs/FEm:+ZCpNrYZpIzWEm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819200, "uuid": "6e1666a4-d767-4633-aec5-0d18542d0976", "value": 78580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819200, "uuid": "a013340a-aebc-4e83-be49-25b500810b80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819200, "uuid": "6743f9bc-ce56-4908-a858-abd36719fb06", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67e62ff8-196d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809311, "uuid": "b8fc739e-9bab-400b-a0db-9ced652155f1", "comment": "Malware payload", "value": "0a79e4c8e615dcffcaab938465f0bfa1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809311, "uuid": "b3db0af2-b04e-4b6e-8d0e-6e8cae11e97f", "comment": "Malware payload", "value": "4ddeb9962531aba8d4eb01bc065b86edeec3d2f15d7c3f66f5730f7e025208f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809311, "uuid": "1907e79e-b00e-4f56-b59f-d684fd975e8f", "comment": "Malware payload", "value": "8fef0883b75c71d0cba845e0afd8bc3834ff1d5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809311, "uuid": "98019b2d-d42c-4c42-b6cd-3858e979ae57", "comment": "Malware payload", "value": "bea91750a551260ae7f2d8ff589a60d3fea333d95a16b9168357b084f314ebffcacd67e8e51fa9fadd865dadd6e69c16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809311, "uuid": "7f30ecbd-2c7f-4d7f-b780-387398fcdb29", "value": "T1BAF4F0321D462B14DA792FB9C023109867F1D857116AEB7AAFFC01F4ADB3B49CD235A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809311, "uuid": "b69f277a-beb8-4244-9a87-47cf5537e587", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809311, "uuid": "f2c2bb44-9e5b-4470-be09-e1c47a989cf5", "value": "12288:GVtrrGszIMjy1j89CFnLT/N0HPNI0iAxxrKXBxoo1C7hzu6DUhNJblNB1:7hpLT/4PPH7caoc7hFUJblNB1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809311, "uuid": "4869bd26-80cf-42dc-b790-85ebe912529b", "value": 756736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809311, "uuid": "0494f4f1-5fab-4196-91b7-987e2ea2a5bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809311, "uuid": "41b54119-0e74-46c7-a8f7-76d1d60cf36f", "value": "4ddeb9962531aba8d4eb01bc065b86edeec3d2f15d7c3f66f5730f7e025208f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "418847b9-1969-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772807528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807528, "uuid": "6bc4cb38-ffec-4a53-bf93-170930fe46e6", "comment": "Malware payload (GCleaner)", "value": "6fd13874d684505e3ea7e14d7b4b79c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807528, "uuid": "40b55db6-7444-4bb7-9d12-e0298445109e", "comment": "Malware payload (GCleaner)", "value": "4e00d82a772d8ab507e8aea0205e57f5094d5e23defca25162354e5196f3628c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807528, "uuid": "1c9b89d6-ad48-4669-9ce5-f05815ccc278", "comment": "Malware payload (GCleaner)", "value": "79f7d6427fc5a893fecea3aabebaeba64851901f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807528, "uuid": "104d42e3-f97a-4b45-8f0e-c5a3ce700c01", "comment": "Malware payload (GCleaner)", "value": "f62328fab59d88f43a1556464eb6c8704e976096ec9b0283ed5447d33a7ad2fd1a70426b22bbac2440e32f92585db4c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807528, "uuid": "f25fad66-b27b-425e-a2b3-43b02e415d53", "value": "T1FA56CFA3D691ED71F1873E7EFA174E6FD216B251FD3C2961AAC47CC888297018413A63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807528, "uuid": "4d9298e4-4144-4581-9e44-968881c4c1ea", "value": "85f3ca0400d93842304463da19f2baf9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807528, "uuid": "0428e443-ef4f-402d-9404-dd5801c2b8c1", "value": "49152:OuBqw3SmBftTN/YuAdRQPkrraOq4Yplo0ghOY4Q8VI0E7JnQa8jMAxtq:OEz3SmXN/Jsfabi+YcCv7JA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807528, "uuid": "876ab4f9-5adf-46e6-840b-49d61024737d", "value": 6214656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807528, "uuid": "094e7985-0d41-4375-82ab-bc16f8d675d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807528, "uuid": "b2e35a09-5f47-4400-a703-53c6803bd057", "value": "4e00d82a772d8ab507e8aea0205e57f5094d5e23defca25162354e5196f3628c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5791daa0-1970-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810572, "uuid": "51d4de61-6c9b-4708-909d-ebb2d4145da1", "comment": "Malware payload", "value": "e6076a92f8fcb862f0c9347514b1def4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810572, "uuid": "100f3ce2-9931-4bad-a35d-e7eaf2e8aa94", "comment": "Malware payload", "value": "4e091b9ed8dcb8328eaed042d47d10eaa8fe35cc6094e5127df7184f17ecdb57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810572, "uuid": "0d8b5eab-464e-46f1-b202-7087ab6052b3", "comment": "Malware payload", "value": "de9c3d1cec7238265c235ce09c27d34b4b21a824", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810572, "uuid": "1ed4b3c5-383b-4c22-a95e-c68cd4ca6878", "comment": "Malware payload", "value": "c884a703c346e535464276285e3c80100ac079e26f73946a476636b76c111cdd8da4c029ac99bd1437fe1b0f105666ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810572, "uuid": "5219baa0-5f4d-4621-bd55-651f97e492dc", "value": "T10A35E0E06304C921C86357B98833E6B762379E9EAC14D60E6ED5FF8B7D72706441389B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810572, "uuid": "ed1f4829-0d99-4df5-b148-29fac0799e89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810572, "uuid": "94c8433b-eacc-4b14-9256-2ec6f4a7dd74", "value": "24576:U8jBipudRE9a/+YX9zPIDTTkdhNWORM9BrJu9PA:XjBisE9mHXFIAdaOcJu9PA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810572, "uuid": "857c4823-945a-43c9-90b2-d84025fb31c1", "value": 1103872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810572, "uuid": "3c3f4342-f8c1-43b3-8096-65625c491dbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810572, "uuid": "04c68239-c40d-4d51-9aa5-279ec0b0bc5f", "value": "4e091b9ed8dcb8328eaed042d47d10eaa8fe35cc6094e5127df7184f17ecdb57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7c548e8-196e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809955, "uuid": "4deba0f5-bb92-44c4-b769-5516032d7199", "comment": "Malware payload", "value": "e19b940c1dc12d25544308f5d351b3ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809955, "uuid": "1b2bd4f1-54fa-4aab-be3a-b6d9ce079d23", "comment": "Malware payload", "value": "4e5d15afc37e313296a27f94002517b351bad2dc3f3d1125e26ec078b57edbad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809955, "uuid": "dee8395f-f42b-4a94-b1bd-b0bee051069d", "comment": "Malware payload", "value": "894e1796044c30bb634702e96db35b19a599ea0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809955, "uuid": "917f7fdb-a605-453a-afdb-ccaed62e3b1f", "comment": "Malware payload", "value": "0d2bbed25371eca176449232f59c508575484f70d0ba60c4cb86159b299ae660ff3ebe5fbb583c1a35d5f70862c33d68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809955, "uuid": "e1f506b3-8685-44e6-8cdc-84313995db39", "value": "T10635BF2537E50A04E07BE739967A0E500BF0BD52CA22DB1EBD5501FD6939BA18B72723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809955, "uuid": "d107e533-701c-4b06-888f-aac1ae5223b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809955, "uuid": "d0743fd4-17e6-46a0-be7a-a4556405c0d6", "value": "12288:kN55Cq7Jb8G26y7p3YS+quCvCY6+6WGEJ5Bjp1K0XGeglq7ehF4l8V5FHg0ktf/w:C7P4lTp3YHdCvVGEdXng07ehpIDqU/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809955, "uuid": "f90112c1-ad5e-419a-bffb-b50f97334f69", "value": 1058816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809955, "uuid": "d9ff47fe-3e0e-47c2-9670-89c6414600b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809955, "uuid": "a62548a4-e73d-4c3e-abc3-7d121badf9d9", "value": "4e5d15afc37e313296a27f94002517b351bad2dc3f3d1125e26ec078b57edbad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20898bf0-193c-11f1-a769-42010a9c0008", "comment": "Malware payload (EpsilonStealer)", "timestamp": 1772788145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788145, "uuid": "9dbb6692-cd5f-482d-ad44-ef3ad69eb03f", "comment": "Malware payload (EpsilonStealer)", "value": "860f53faeaaaef4eaadc40ea28a3f1e3", "object_relation": "md5", "Tag": [ { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788145, "uuid": "322bb1c2-3c99-4728-acdd-9cf67e6dd900", "comment": "Malware payload (EpsilonStealer)", "value": "4e7bc4bbb8199dd8aebb9dd01e624f0e9b63906af056b33d0a746e6604f0e9a8", "object_relation": "sha256", "Tag": [ { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788145, "uuid": "7c4dab69-6d88-41fd-b1c6-d28d9cef89cb", "comment": "Malware payload (EpsilonStealer)", "value": "7009165a49443c81987bec3a7d4e76ac1bdbd902", "object_relation": "sha1", "Tag": [ { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788145, "uuid": "6a71c4c4-7b9c-414e-b0cc-6c2b69cba4d8", "comment": "Malware payload (EpsilonStealer)", "value": "0e2c0ac417236abd1204982c4e16499360f582480056b728f2effe16d5c6b90c4bdec2f0c2e13af5781fa140dfe1aa1c", "object_relation": "sha3-384", "Tag": [ { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788145, "uuid": "9308dbd7-65f6-455b-89ae-7be6f134b5fb", "value": "T1EC0833FDA2A35BB3EF89193717F598176ABC45F80654DCF7827E1172DA02D821CAD028", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788145, "uuid": "6deaf7ca-deb8-479c-898a-eb108c855a43", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788145, "uuid": "3b3e72c6-91ed-43f1-aa16-1e9239881423", "value": "1572864:VSnyLU23CpuwCPfj+MBkQw14U2Ap0E2Mq40LNUib95cyoIRTp:VeyLUpuHPzirp4MNWUO95cyoI1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772788145, "uuid": "2db18f13-2808-403a-aab3-96f20114fa47", "value": 84147854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772788145, "uuid": "6df858f7-5ea8-410c-94b7-63594dbd58f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788145, "uuid": "71993f42-7760-4525-a313-6583a09e1d37", "value": "winhelp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b289a53d-192d-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1772781948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781948, "uuid": "b4a05f96-6fbd-4ca2-a594-808f0ee90125", "comment": "Malware payload (Gafgyt)", "value": "9fd2f1ca392011a3ac418b5ce40e64d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781948, "uuid": "b4c68303-583e-44d4-9ec4-14be196b19a7", "comment": "Malware payload (Gafgyt)", "value": "4e9fb4f793e7fed2a3a601b821ce802ecad9680ccea906ac2c495c9af65cfc1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781948, "uuid": "b34b0ed9-ab4f-4b1c-ad54-0cc58556e3dc", "comment": "Malware payload (Gafgyt)", "value": "51af39ebc306ae87f19979cee137a51f4d907ca5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781948, "uuid": "768cfc2b-e818-4966-acae-b0dad7a10856", "comment": "Malware payload (Gafgyt)", "value": "a514e13a163477131e2e568d9f15be25cb3e99c5101c2a8b0ff8614f43916447c75b8e40f348bb9f9033494499f41824", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772781948, "uuid": "a8a41d75-4845-40e9-9cf2-e67213cca691", "value": "T130F34A1BB4C180FDC8D5C2B44FEEB216DA72F45D2238B25B27D46E262E4DE205F6D250", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772781948, "uuid": "8dbf460f-6b7a-422f-92c0-c44b119ae76e", "value": "3072:XmwAM7GeyDW+GvdXTAmDfh80JCUvYvJSXMm/gm:OM7LlvxXbZsU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772781948, "uuid": "7ee7c2d0-436e-42d8-b130-2ddd53b039bc", "value": 169928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772781948, "uuid": "68900e7c-58d3-413a-934b-fbf60bbe0a28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772781948, "uuid": "38996d84-1c16-4c63-b903-95ca1539b8d8", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8825b4c-196c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809097, "uuid": "5d8e9108-7f2e-4599-9e0f-2cdcc96094b1", "comment": "Malware payload", "value": "09060f9ac4d13475d7834772949ae1bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809097, "uuid": "96867b49-dd70-4688-9653-cb3d8deaecc0", "comment": "Malware payload", "value": "4ea23bc9c4f6d5aac40a4c1073609febbfd0ddeee9312b7388e00d6225e14813", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809097, "uuid": "9d3d2839-95ac-4da3-a2fe-6b7ef760dfa1", "comment": "Malware payload", "value": "daf02c37d8be5ab61e11e816a238cecad4d5e3bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809097, "uuid": "4b42dcfc-6e39-487f-bbdc-706f35675d3a", "comment": "Malware payload", "value": "96e0970d62f138ea894978f4871e8d4953f71a5f55643d8eb2fb09e1c674ed0bb7a6b53e452f89ad097430cc7839c46c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809097, "uuid": "1c17281b-b3dc-41f8-9c5d-6771a5892871", "value": "T13B550218272ADD02C8E60FB45E71D2745BF92E89D512D3538FFAEDEBB4363416808396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809097, "uuid": "0618c613-2524-4d3f-9a36-9e5ec9b64aed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809097, "uuid": "66c172fd-6d97-4619-b73d-32d28af1320c", "value": "24576:fqu2Vnlr8YMhDuV0zyKXM8RCaQbHr/3GRGYk1UTQGIFUS:feVlIYMhYKXM8RCaa/2MYSUTRI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809097, "uuid": "7419a2de-0a6d-4097-89f8-13c27be9840d", "value": 1291776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809097, "uuid": "b1b68d06-aafd-4594-9282-48e32af45ec5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809097, "uuid": "2a26ec34-0835-4967-982d-5cebbdfb3590", "value": "4ea23bc9c4f6d5aac40a4c1073609febbfd0ddeee9312b7388e00d6225e14813", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5652783-196d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809441, "uuid": "21b0c8ff-e89c-43c6-a1b1-c9e0d85d2311", "comment": "Malware payload", "value": "6ece62cf5c457f0dc2eed82615234360", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809441, "uuid": "6fcee8ce-470b-436b-8b9a-02c27257964b", "comment": "Malware payload", "value": "4ea5f9cec6f993b1d7025c37c29f88c2e6d2108e97111b553c9117cdc06b4c94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809441, "uuid": "54f01de0-e032-49a6-b4b2-243880b692a2", "comment": "Malware payload", "value": "b2d5f706a7ce4222674d906dbed257d881056acf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809441, "uuid": "635ea0a3-9e49-4e04-ad95-dfa90a02840b", "comment": "Malware payload", "value": "408de7b2e1b9b5a521bde602cbcab6a926f8cf610d78175de730cc500ba63913b13127d85226a5f2d491cbb36349cb86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809441, "uuid": "196dc7eb-622e-4808-9b4e-d424b796288a", "value": "T19CA402D27181B277D42289726EB79EA65BD72C354A8166033360F72E7073872DB4BB43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809441, "uuid": "3635b2c8-f156-45de-8333-742c2f04e12d", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809441, "uuid": "1f350923-ce66-4237-8e2b-0b652e23ce08", "value": "6144:YNDlOiP+7wHtoS8CP/yvTC3lEkqwIBt6imIzWoWEhEHrHgh:Yl3f8IyvTC3qkqwIzZmPLHrAh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809441, "uuid": "ed04b3b9-713f-4e8a-8841-a54e12b2b2c9", "value": 456016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809441, "uuid": "35f1db45-69c1-40bf-8f41-3336485ff0e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809441, "uuid": "95bd5932-2376-4c4a-8ed3-145cdf7c9444", "value": "4ea5f9cec6f993b1d7025c37c29f88c2e6d2108e97111b553c9117cdc06b4c94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "747f4d08-196c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808902, "uuid": "1af47c89-cbaa-4c20-bd63-b5ff41593944", "comment": "Malware payload", "value": "ad7e519ba2fa49288af82d394fc7b97d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808902, "uuid": "0abb28cb-48ce-4551-aaf0-d4a910167769", "comment": "Malware payload", "value": "4edbe53c8bf965f8680a60339c20097b1b97eb218b1a617a29b501b7e296466f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808902, "uuid": "5dec4b92-f0c8-43f0-9a2e-e71a6ca49f03", "comment": "Malware payload", "value": "d2320da81b00b54e23819038845d4325c6bbd6d4", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808902, "uuid": "e2996392-33c6-495f-b92c-2a3e6c977bab", "comment": "Malware payload", "value": "7806e0d04fe501a0c69b6488ebf4cc8f7d1badafe399bf8ae6295861abdcb8eba9d7f962ab5d579ede33c7b07b072910", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808902, "uuid": "af7a2a3b-a398-461a-8117-7a7acbe21864", "value": "T11E517606D2F2316127529D2412B76E3FAAA85817DE07CD50355D1EE8BF76874FC03E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808902, "uuid": "8a042489-1827-4330-b932-d7be6caa94fe", "value": "96:3YPYSyiXfUJMPqUpIHHHHHP9naHHHHH/1WP3:3YP38JTWIHHHHHFaHHHHH/4P3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808902, "uuid": "fbecb5bc-dbd3-4797-a25f-4346689b07ac", "value": 3117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808902, "uuid": "4d4c2d6b-8968-4aec-be93-4ffd7f89fede", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808902, "uuid": "34be8dd4-c931-4f7f-baa7-c7a54ba9b213", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3abd09a-196f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810377, "uuid": "e3db04ca-76fb-41c5-b6fe-b90b45bba4ec", "comment": "Malware payload", "value": "febfc3a1583eb0fdaa61a4290890fd25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810377, "uuid": "f384eb68-4569-4c46-9d14-7441b162bdcb", "comment": "Malware payload", "value": "4f69024400000c827a30e308b4c0db2cf7a4dff1d171f1c407ec1dfdde80a7b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810377, "uuid": "1a1baad9-e43c-4e4a-bcdd-ced626b8aee0", "comment": "Malware payload", "value": "e7c53c7099eba7df128349b6737c63c1dcad489e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810377, "uuid": "421cbdb3-6e5f-4b6b-a0ff-5502b3cc0504", "comment": "Malware payload", "value": "ff3891c9cefedbe3d9d570f36121a5633568d41d8dbecefba5bfcf34321a7759c3893099a585d33c8d36641f72f207ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810377, "uuid": "e6b79ec1-f8f8-43d7-9d44-dff9a9a3d401", "value": "T17B05BF32E2E17837C17B2A7DAC6B565C6839BE1119BC984E2BE40DC84FF575138E11A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810377, "uuid": "ea4976f1-ce12-4f2b-8458-f43afaf27f58", "value": "fe4280c06246cc873fe89746dadec91e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810377, "uuid": "cd29bf27-27cf-4856-b50e-faf065a8a059", "value": "24576:flluEBpPj6o4CPbE9taCb+IWIwM2MC5zy28HQ+:flwa1V2B2b+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810377, "uuid": "fe6add23-0572-4987-a52f-6ca364a6b93c", "value": 862720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810377, "uuid": "21e1295c-7c01-4013-bde1-d1e1ccbe8561", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810377, "uuid": "6b75b5b9-9518-4239-85fb-0f8157416b4e", "value": "4f69024400000c827a30e308b4c0db2cf7a4dff1d171f1c407ec1dfdde80a7b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81b8e9f4-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772809354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809354, "uuid": "9e777e74-d998-4cb2-896d-16db4e22a8b7", "comment": "Malware payload (GCleaner)", "value": "40c6554f275c29502c423cd072dc24ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809354, "uuid": "9357eb9b-3061-4aa5-918b-1999cc28b80b", "comment": "Malware payload (GCleaner)", "value": "4f814801b95a2b762e1c49f6b277112912b4a3c3430513c285cfc64b514210b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809354, "uuid": "33c49da9-5004-41a1-a61f-46f08c170827", "comment": "Malware payload (GCleaner)", "value": "831462d0855e8d9dd530933c81dfae4055bdf52b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809354, "uuid": "798619af-b452-472e-9c51-6e35c18b53be", "comment": "Malware payload (GCleaner)", "value": "383c8779a7b1c7e65797c1cf5288b9709a4d1521df1014b84aee45b5206bcdc8c384aa685f788976637cdb11b64b4ab3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809354, "uuid": "2b24c04a-0f49-4870-ba39-8ff96307a106", "value": "T1FAD4AF22F2EC8437D1226D78DD4F56A55A25BE80A92858463BE84CCF9F3D781343639F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809354, "uuid": "e8de56d3-791b-47a2-ad91-274a5afed3a2", "value": "345624d13ffc2b7f296b9d2972b1c0a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809354, "uuid": "a4a43085-f208-4b67-a1dd-119e3b8295d3", "value": "12288:o48VY65TrPsgNDHZ8nqReaHokxnBOFakmog:h+7PfJZ8qBHokxnmpmo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809354, "uuid": "888711c1-ec7a-4325-ac27-7c0bd4bb6c04", "value": 650240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809354, "uuid": "bfa7f446-2c7d-4d90-b6fa-53b2039ae6cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809354, "uuid": "85b20c65-02cd-41bd-b688-1f8c42729f74", "value": "4f814801b95a2b762e1c49f6b277112912b4a3c3430513c285cfc64b514210b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28863b46-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810063, "uuid": "0ef5ccfc-f88e-4698-82d1-b932cb899cc9", "comment": "Malware payload (GCleaner)", "value": "779b646da66b862025464816595d7af6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810063, "uuid": "dd298d70-c1a0-4585-bc20-13dde65f4745", "comment": "Malware payload (GCleaner)", "value": "4fb806c520858db6cae7cc94fa790f555ab3ed1ad30fa88c54c6e91491de2488", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810063, "uuid": "90cc1897-9097-4a0a-a0b8-5301ccc8f185", "comment": "Malware payload (GCleaner)", "value": "428e08735b87c3669b5c5de61b3e619cdf7b3f21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810063, "uuid": "46429301-3a0f-4c73-8b52-10b6723b8130", "comment": "Malware payload (GCleaner)", "value": "024f4069322fdb0e76c6d43f5851afc46cbbadbf87fdb59dcd39e24e81c9e66350f88698032842a3076cda7bff12c98e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810063, "uuid": "00be6874-0496-4e55-95d6-403964860080", "value": "T18AE4AEF5E6F08472D2321D38DC1A56649C29BE912D286B5A3AF82DCBCF3D3C13465293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810063, "uuid": "65333e20-3423-47d3-b049-5488ec13671f", "value": "c475b6e242f56325f64c2b76233f720b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810063, "uuid": "4f5edd3d-ed66-47f9-9b69-42e4bad362fc", "value": "12288:deM9gzhW/BsjB7V+bRO88pvnlU8m3zctrVm1z6cWzaR1NiJ+niy3ETFrLtOOOOj2:MK3/q7gR8UItr2Jbf8J+iy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810063, "uuid": "a56cc662-3bb8-4dc7-8177-9f6ae2f7767c", "value": 697856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810063, "uuid": "d139ae37-0813-49c7-be90-c167b1a0dd23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810063, "uuid": "529c5ff4-a5a2-4956-aa05-c6065cfc1396", "value": "4fb806c520858db6cae7cc94fa790f555ab3ed1ad30fa88c54c6e91491de2488", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b36d9d9-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810900, "uuid": "ab910ce9-c537-426b-a73e-81b0dbc68c68", "comment": "Malware payload", "value": "fe71f338f5733a85ff532a8af682f429", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810900, "uuid": "0c6812f3-6fa8-4a37-8bfe-749a68406993", "comment": "Malware payload", "value": "4fba4987f80f1f78dc0edc7d5ede0f4cfbde340e016a073db8d02d5a38cbe78b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810900, "uuid": "6d046ed3-5765-4bea-802a-c7450ae2b416", "comment": "Malware payload", "value": "931b62097734a6ce0233b7fdf06ada836d13d475", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810900, "uuid": "6c07e263-a668-4eac-9109-5a982eb11fc8", "comment": "Malware payload", "value": "4a0b40b05f4a0711c0a9fbe19d3a4e46a3555650b0df1ce37a2a71ad36c972916e33d116594b34223ebcc64c335e6b53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810900, "uuid": "04c1609e-a7b6-4c30-8414-53c18be4ba40", "value": "T139E53379DE069BD7CD5A96B231B67193964F0C5B0FB4CFD2A2CCA3AB340691C4D9A070", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810900, "uuid": "18e136e6-de3f-4e88-9a64-03c4f1a96e59", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810900, "uuid": "1233e6da-9d9e-4f24-b8a0-cef3ab4e255c", "value": "49152:NktmGhY/xyXW226i+0MEpDkodPM46HHb/gwsI+/XEoKInEu+h1NIlHA9if9zYLM9:If++J23MEhkodb6H7ZsIyXj5xAOzWvC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810900, "uuid": "faeba272-9f4c-499c-a013-10dcad1097f6", "value": 3142137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810900, "uuid": "cf3f1b03-7c36-4fd2-913f-cda043341c46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810900, "uuid": "0a89770a-dea6-463a-9e19-063026c618ed", "value": "4fba4987f80f1f78dc0edc7d5ede0f4cfbde340e016a073db8d02d5a38cbe78b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b60451a6-1985-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819750, "uuid": "2ef4f2ac-d840-45be-988c-47f4695d1a60", "comment": "Malware payload (Mirai)", "value": "5a2fbc6b41e655d6407103adaeef89aa", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819750, "uuid": "7f0a5d2a-4369-48b2-b73e-0b4293d518a7", "comment": "Malware payload (Mirai)", "value": "4fd9ed6881d2b7e80d3d2db30c02eb20060e512e5bef4e5cbdd42ec15a9834e9", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819750, "uuid": "e628ab54-d504-44fe-bd4b-6c516b1d6fe9", "comment": "Malware payload (Mirai)", "value": "1ebf7d502a3297b1e59ae095c92f93481731614b", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819750, "uuid": "7fcbb2fb-1c14-4bbc-9ad5-955304eca4e3", "comment": "Malware payload (Mirai)", "value": "69f6ca2db4bfc1a5c39c3f96c27c2336736d2365880910cfd3b9bd1bc5ab199c124648fdc82494cb87751a0451a7b3b1", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819750, "uuid": "2a14cc48-ac68-4fbf-88cf-191cb3191fa8", "value": "T1DD969D45FC2E6472CAC976351E6752643335EC488BC2D72A2A24B77DF9F23588F132A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819750, "uuid": "356ca41d-e2fa-4400-a949-b550bc964ec5", "value": "98304:H/nNKWy8F0gKskb+eQJBE65+AJYScNCxG0PgokMKZzLJAiQ:HfNKWyLg8IPcNwGqkMKpLJjQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819750, "uuid": "c556cb46-3f7c-4f0e-9306-b770f7f688b5", "value": 9002328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819750, "uuid": "afe558d5-dea4-4232-a862-bbbc6c33095b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819750, "uuid": "72096378-0de6-4809-b2b4-77264836eace", "value": "bot.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "815cf6fc-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808494, "uuid": "5ae542f6-6a73-43b8-bf00-63896a4dc411", "comment": "Malware payload (GCleaner)", "value": "4933fd270c8a514371adc61f46651695", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808494, "uuid": "a60461b7-659f-4386-a882-d438560e3830", "comment": "Malware payload (GCleaner)", "value": "5005314e7796c187392ab56241bc342900b31faf9b0eb2106498f4f68ba56a09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808494, "uuid": "5d89ba3e-3cc5-4989-8112-1b411b15428a", "comment": "Malware payload (GCleaner)", "value": "edf0569beb61dcd9379ecd67791db023eec3a7ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808494, "uuid": "f95ceee1-64d3-4b8c-aefc-1e66cbeb4047", "comment": "Malware payload (GCleaner)", "value": "9112786e55f5c1ae9c0d0fff1a5b516405272b799e3b3166e77d1c5ab90aae14dbef3717427c6e67d0eca2fa86dc170f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808494, "uuid": "197c3bb9-3042-4e64-bf89-7d3f75ea3b2b", "value": "T1AF36D09396BD027CE7F6E7B5AD6EBA747FF628224C1824AF055F8EC4991050303252E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808494, "uuid": "72d6cbfc-7885-4c52-b6b6-143d6084de6d", "value": "c243d5a6283f8eb7bff20dd0797e21c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808494, "uuid": "6ac50dac-58ac-4d6b-9d94-3898e36fa7c5", "value": "49152:MH5nlZBmQuAvATedrjw9wBR8hsJVL+SpeutF1g82vaHWb4ykvvhM0:MH5wQLH5Qn85PyEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808494, "uuid": "4e1e15cc-7323-4483-8a0c-b50a936cea64", "value": 5251584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808494, "uuid": "2d985a6e-e713-4671-9072-05a21e73ee34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808494, "uuid": "5ba9f83d-3df6-44d0-92d0-53df54d317e0", "value": "5005314e7796c187392ab56241bc342900b31faf9b0eb2106498f4f68ba56a09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5411f236-196f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810136, "uuid": "90c2e533-c0bf-47f8-96a1-dec48e8de117", "comment": "Malware payload", "value": "cd1933708366737181cabdd34bd04956", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810136, "uuid": "591341bc-15c7-4b7c-ac25-b8eff0d699f3", "comment": "Malware payload", "value": "50090e722ce3c3c0b551f5c7df9d5c7e43bdf23ab84d70ab4f3730ab7d99e212", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810136, "uuid": "544a69a6-6633-4ffa-9ff4-ae30a2dda9c3", "comment": "Malware payload", "value": "5c567e3c16734b40400a98250d5c0697dd09290c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810136, "uuid": "0459cdb7-8a14-4b60-bfc5-d0fef1418bb8", "comment": "Malware payload", "value": "3abb0035b467c95443ffa3cd22cf9773ba0058a4aa2547f26bbb537969cd920444b8cf2f6f3ca4d68fe3e7846dc26e5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810136, "uuid": "fc6a8118-4043-4f0f-b419-81eb327dd0ab", "value": "T13025F1715D56BB70D9BC0BBC80161A4833F4EA0357A2E76B1FFC04F69C96B98CD6A052", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810136, "uuid": "f1d35701-f9c0-4607-b2c6-d57742e82614", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810136, "uuid": "a5bb8f63-c12a-4e4c-9ca7-9826ef69742e", "value": "12288:YOlFU1EZJWlLoRyEYLzXAPbCML87sgMXaO4RAD2YI1Qsc6F3lrK/CD8gIA:YOqEZslLoRymbJ8wgMh4C7sjF3lek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810136, "uuid": "ca53cd54-fda5-4ba4-9ab4-5234902e62d1", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810136, "uuid": "4a681f60-8adc-4a03-9d37-06f8bf2849dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810136, "uuid": "c9cb9758-059b-4f8b-856a-838bca926771", "value": "50090e722ce3c3c0b551f5c7df9d5c7e43bdf23ab84d70ab4f3730ab7d99e212", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10503fe5-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772809164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809164, "uuid": "f142badf-2c48-494e-bce9-3e6fb56a039a", "comment": "Malware payload (RemcosRAT)", "value": "ee718fbf8996ef12cf62f410ba489d00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809164, "uuid": "9d5e305a-77af-4395-bf16-4c079ba6698e", "comment": "Malware payload (RemcosRAT)", "value": "50116fca27249e42e0304690c9c3f41f237a9a80064896aa8caa5f781669fbb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809164, "uuid": "26bbcc67-3a5d-4dfb-a81d-e1cbdc5d48b8", "comment": "Malware payload (RemcosRAT)", "value": "f6e30751bede6bf6638cf2a5acd868d86364b5e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809164, "uuid": "08671279-663f-4e87-b97f-00de4d48b87a", "comment": "Malware payload (RemcosRAT)", "value": "a71671c141fece21d075f5cac341b246395474ce16408eebafc6b3bcefa9b9dc95d7bdfb880eaa27f20d26d56ed35e89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809164, "uuid": "8b03f943-a04d-4ca5-8c87-dc82aa01e663", "value": "T19355012B2DC31564C9A54F75D2AA04E873F0C65B1115E7BB6FEC02F4ED62B0AD9234B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809164, "uuid": "b27bdebd-5d1c-46c7-9311-39cd1d2f03ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809164, "uuid": "5dfdaad2-520a-4fa2-8443-29c7f9c05fb3", "value": "24576:SHSK//hpLT/4PPH7caoc78CnRveYepqMKDmfC4KOSSn2l6lU4JblNB1:MLzswaoMRveYkqM3fC41p2r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809164, "uuid": "e8697eb7-741f-4cdd-a63b-a456aa9beedf", "value": 1392128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809164, "uuid": "495b14fe-1840-4497-abb9-98854edbd34e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809164, "uuid": "14db7cd5-f64c-4e02-8a37-7890f3f264a1", "value": "50116fca27249e42e0304690c9c3f41f237a9a80064896aa8caa5f781669fbb8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cefb94d9-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772809054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809054, "uuid": "74abe654-4df0-4fd7-b094-24150bc9f40d", "comment": "Malware payload (GCleaner)", "value": "88d9a829a1fdfc2c4533701626f99cfe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809054, "uuid": "cea8f3cc-4c38-4abe-8b90-b08966b58e08", "comment": "Malware payload (GCleaner)", "value": "50775917143488cae39f01742e3fcdca74192c43d8d38a3a5d8b00d18791cab5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809054, "uuid": "9db57d5f-6f94-44dc-b13c-f66d469e77a9", "comment": "Malware payload (GCleaner)", "value": "58332271a9d6fc4f15fd72031387738c21f1efc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809054, "uuid": "e6601668-456b-4d26-8d48-6d6a1d49af72", "comment": "Malware payload (GCleaner)", "value": "d278843f9c68530a175a6b69d49858305848d07fa14bbe8cf96279ddd227cc9686bde4974e9e981e0c1328368f1a5a01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809054, "uuid": "912cb46c-1fbb-42f8-98bb-d22d81d28919", "value": "T18356E03ED070F17AEBAFDEF459B9129CB431B5C454162E8430E968C745E798823B06EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809054, "uuid": "a49472bf-2b28-47b6-8293-cb7685ad2a12", "value": "234372fce9eaa047bc4c39047910954c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809054, "uuid": "2b55ab8b-4090-4051-93bd-5b85eeb79163", "value": "49152:YGQJMCDnz6ZSdBcGCrgkvTXV4CKm+G/7KFRhHgJ0fKVIuUCP78hUVG+p6znNVeuh:YBJMW6Z1GGgSDsmmivIuoUVsB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809054, "uuid": "730bb837-2782-4990-9c65-c88d63b8014f", "value": 6178304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809054, "uuid": "30f82bf2-418d-48cd-9a55-2db8c0b580fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809054, "uuid": "d144249b-0289-47fe-833c-dafc623c1976", "value": "50775917143488cae39f01742e3fcdca74192c43d8d38a3a5d8b00d18791cab5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01c0c8f4-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819018, "uuid": "5eb77f26-d31f-468b-85eb-c1c1bcc4065b", "comment": "Malware payload (Mirai)", "value": "9508a25cd97a58468505adf3ab94bf55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819018, "uuid": "9459e710-6fdf-49c9-93f4-f7a68d1871a4", "comment": "Malware payload (Mirai)", "value": "50d3c1fce3f5adfa7a50c3e72e4409cea1bcca69f3a0f4ccdaefad74a5ddcffd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819018, "uuid": "9212a5ad-1f67-4c47-8d4d-167013fbf4ee", "comment": "Malware payload (Mirai)", "value": "f1d18c3dc5c40fa9d69c13d8a651bc1dd38e3a5a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819018, "uuid": "e4f37576-3789-4e96-8af9-623ea81fb828", "comment": "Malware payload (Mirai)", "value": "788b2d21bfb4cc1312d56d7f494fb1333b7e259a617d7e98d1ca7ebd910a3ba966186defdf0ee3ecb5ecdbddce680612", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819018, "uuid": "a4fb12d4-7d72-446a-ba4a-36cab8236020", "value": "T179935A13B9C480FCC889C13057AFB136D963F17E1279B25F67D4EA127E8DE512B6A680", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819018, "uuid": "95511bb8-6022-4a43-9810-b376d091a9a0", "value": "1536:wOJWCxljKvh6uTH/HwinvUsBvhzAA1x1Asqe+tHXXnlGJHqBO:wOdvjKvBTHzvtvhZ1x1AsqDHXXlGg0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819018, "uuid": "c58d117e-9145-47e5-b71c-4a0b96e3474e", "value": 88928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819018, "uuid": "42dd008c-ac4e-40dd-8827-d9e06dea40de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819018, "uuid": "104eefe5-2196-44fb-b276-c46ef86eb17f", "value": "jawirbot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7eba8ad-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808666, "uuid": "420d8788-1776-4367-a7aa-bc49851b0dc5", "comment": "Malware payload (GCleaner)", "value": "2bce8ce2acb1bf6b385ec0eb43091510", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808666, "uuid": "7ef3863e-774f-4bb3-8ed1-bf8e53101752", "comment": "Malware payload (GCleaner)", "value": "517830cb86f8f83207f38c9aee52665f44d3f5ff9abcd1c1d5fe90b9ec734ba1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808666, "uuid": "5c0a085b-94e0-4471-a507-a404474473ff", "comment": "Malware payload (GCleaner)", "value": "5e9aa381b6a82310ac6e668d6293f287cc9f9f32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808666, "uuid": "4f90fd8f-d88f-49aa-a318-eafe8264c38d", "comment": "Malware payload (GCleaner)", "value": "ca4a4a1c125de3b45a41b46b18c222f54e3b2caf5d0583be78228ab51dbe062914fa82daf55d7550804be21e733d2c61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808666, "uuid": "f27608bb-f0ee-4d0e-8a92-62433a165756", "value": "T1CB26CF15F7AC2372D268EB799B1A43C534FF742E1356B41BE2C86AD88E606463E34C47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808666, "uuid": "87468a06-0df8-436e-88a8-84522f068c81", "value": "234372fce9eaa047bc4c39047910954c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808666, "uuid": "521680e8-46b7-4d3b-a217-7a1568dcea86", "value": "98304:jBJMcIp6dE3EohsQAF5nHcSLWElEUAAy46Hq4mV:jA6DoiQI5nHcUgA0K/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808666, "uuid": "99dcb64d-5a83-4f88-b444-e86fb9ec7829", "value": 4592640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808666, "uuid": "a4c26283-2b6a-48cf-b864-2123fbdecf43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808666, "uuid": "7e295d75-3024-48c9-bf0d-3a9afaccd9fc", "value": "517830cb86f8f83207f38c9aee52665f44d3f5ff9abcd1c1d5fe90b9ec734ba1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "366b84f8-1949-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772793766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772793766, "uuid": "ddc20887-f9b9-4cac-93d8-e4fd5ca170ac", "comment": "Malware payload (Vidar)", "value": "54dd8883d08be44e8a22bd5748e87759", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-OpenClaw", "colour": "#525D1F", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772793766, "uuid": "7fa44102-aa4e-4daa-922f-66b7343399eb", "comment": "Malware payload (Vidar)", "value": "518ff5fbfa4296abf38dfc342107f70e1491a7460978da6315a75175fb70e2b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-OpenClaw", "colour": "#525D1F", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772793766, "uuid": "743d0130-e6ec-4543-ba02-19cc607386d5", "comment": "Malware payload (Vidar)", "value": "66c27ef465437a28bc13ced74253a712af3cf3ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-OpenClaw", "colour": "#525D1F", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772793766, "uuid": "eba5e9ac-1711-43be-b077-1950bf1e1758", "comment": "Malware payload (Vidar)", "value": "87f58c2eb3e829baed7b982e3514444b005b97de128b442627297402039771046764314295bb214858a44cb2b4c95004", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-OpenClaw", "colour": "#525D1F", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772793766, "uuid": "f35040b4-1c4c-4a92-b6be-e8cd1e3b6f28", "value": "T17F282302BA9A2974C05EC8B0D2574A934F3130DB123BA5BF50E942643FAB7F49B3E755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772793766, "uuid": "c0a16479-3d4a-4840-9a4d-dd9d5f0d179a", "value": "4254307620427790ca15f1d084261e51", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772793766, "uuid": "13991946-9a37-4c2a-be54-e7d41f11650f", "value": "1572864:K+EyZr0L/k71lrPX7qUeSLAs2dekoIxBpo3MhBGUhXRS4XZhNExO5pSs97cbOtrD:KByZr0L/kZMY32wVIxBi8hEUhBS4XZPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772793766, "uuid": "ec8c945a-317e-4bdd-8d27-a4ca97923d68", "value": 99131392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772793766, "uuid": "7f858d0d-7563-4f85-9804-0ba1ebf87c40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772793766, "uuid": "41a8ae4e-212d-4e97-b29a-f6b46f76afbb", "value": "518ff5fbfa4296abf38dfc342107f70e1491a7460978da6315a75175fb70e2b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec36cb0-193d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772788948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788948, "uuid": "13316fcc-8166-41b2-958f-3782d38ec7d5", "comment": "Malware payload (Mirai)", "value": "c1a96c23ffed6b452f1368db2929a031", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788948, "uuid": "3371bfa8-e1fe-4b6c-b3d8-dd9edcd51efe", "comment": "Malware payload (Mirai)", "value": "51d91d601fae9db7b1f2cd184347e3ded3df5afb9174133eb1235adf5cc47925", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788948, "uuid": "89271043-7a6d-405e-8473-7974d8a1a351", "comment": "Malware payload (Mirai)", "value": "d7ec13cfbda93aacc9e85b2e44aba89e61cbe1d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788948, "uuid": "50767b37-ba81-4e77-bc35-bfeade7416a9", "comment": "Malware payload (Mirai)", "value": "de195ac3f5d6d48f47230eadff5ba5b0a57e1999bdfd520204804c1693cfff8c2441649f802867e33aec750213e24e26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788948, "uuid": "038c5c71-9941-4cb6-b76a-a3f2f311d77d", "value": "T12B933AD7F400CDBDF84EDB7B44530A06B531E3A20A835F76625BB927AD361984933E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788948, "uuid": "97759483-b220-402f-8044-8ee303f38fd4", "value": "1536:eGXP6gt/it/zX/HyyPATI9RoP128D0yJZWyKN8Nk4urDTbhl/TVcdNp81b:CtLX/fAT4RoP19Hw8S4snTVcd4V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772788948, "uuid": "ba9ca5c4-dc89-41f8-8189-c63f74585463", "value": 90588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772788948, "uuid": "555e1514-f5e2-4629-8efc-82342e30db35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788948, "uuid": "e29d943d-085d-4a24-8ad8-90cad9ab9131", "value": "morte.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93eb0990-1968-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807237, "uuid": "03a2e642-368c-4b84-8462-1f0744b3aaf0", "comment": "Malware payload", "value": "f002a7b0c0055fcde6435e9ae5997f30", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807237, "uuid": "41b04763-1dad-4bdb-8c75-71dc58569d4d", "comment": "Malware payload", "value": "52027c64cde09012fcb8e453fd384a3cc4d5fd391f544b1f7694f97279c93f95", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807237, "uuid": "708876c5-9628-4d48-b02c-2699632e892f", "comment": "Malware payload", "value": "c4ca35aa87a4f2b3fff8c0d7c00bab856aa27e6f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807237, "uuid": "ece032ae-31f3-434f-a9ae-448b441f1786", "comment": "Malware payload", "value": "a1e7a42cfc6993f609e0d080ad1d26eab890c111da6e85f1ff8491f9c56bfa8cd1590226470612f628769fe780d093ea", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807237, "uuid": "c15f8982-8352-4e1a-b972-26ae4c4ba3e2", "value": "T1EB925BB916496C79BBC0DE7D9F3C7F0CADE4C1C02218A3ACBA4F39615A2069DDA0535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807237, "uuid": "1479d438-99a7-45f7-87a5-d343941c04cc", "value": "384:Zs0M3vgRjGlsaq7tzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:ZWmjfRzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807237, "uuid": "acc05b46-7ecf-4b6f-bd6e-c282642cdcf0", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807237, "uuid": "a6a72071-902b-474d-a495-85288d596f76", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807237, "uuid": "ae0653a7-bb3c-42a6-8bae-26a034b762ba", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "675ebe30-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819188, "uuid": "7632e655-5f5c-4db8-b478-e5772ef0d343", "comment": "Malware payload (Mirai)", "value": "398e7782535f72298eb08abe86039a8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819188, "uuid": "beca0522-e786-4589-8b6e-7f1c6dc012aa", "comment": "Malware payload (Mirai)", "value": "5211b6491710960a40d248e108d845fb0497b6c16437b23bb265068249477bf8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819188, "uuid": "e3defd8d-60f8-412e-b210-448144f14e69", "comment": "Malware payload (Mirai)", "value": "f54747989fcda6797a81ff6e1d39e2c786c58c5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819188, "uuid": "7dcbb9b6-5222-4deb-b197-8fa2687d7295", "comment": "Malware payload (Mirai)", "value": "5cfcc34ae5b3278686f783a4bee377f71416934ae984722e494d94e705631bcf9129eced47d762d7d41dd6cddc9d125a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819188, "uuid": "7ba12af9-a65c-4fc4-90c1-b4aa37cd9219", "value": "T186C3961A3E11DFBFF65D823147B3CA31969837963AA1C585F15CEB481E2028E641FBE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819188, "uuid": "cefa075f-ba9d-453a-a3b2-9599ec02bd06", "value": "1536:VqF6WzFPvtgTVsIqmiw0sf+y4PRYa2O0LeyY4K2xqs/VcCH:cAWzFPvyTVhqdof+y4PWa90DjxlfH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819188, "uuid": "e2fa33ac-fe7b-4b1c-a2ff-81e794f67f42", "value": 122052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819188, "uuid": "0b8d5217-2db9-4f71-a000-0c5a863fab13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819188, "uuid": "1f28cb3a-aea2-4536-9a68-dd24e990c0b1", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af9cdf0e-1969-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807713, "uuid": "1939693b-6dd2-42f3-a298-195159fc70bf", "comment": "Malware payload", "value": "a0bfd01b31d64a126473d5bbb0234212", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807713, "uuid": "9703919d-99e7-470f-b189-4bcc41dd3cbe", "comment": "Malware payload", "value": "522a30ee806efaee61721a63478abc144d5bfd8da69c93619191f611fa7d0d87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807713, "uuid": "058dc81d-428f-4cc9-a48d-cdc9fc25dbc1", "comment": "Malware payload", "value": "5b79f893c87389fce99b5e8f250c1e49832b4552", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807713, "uuid": "f0aaecf3-62c2-42b2-9dd8-25c65477245b", "comment": "Malware payload", "value": "235b23aeffb88c9ffe27bd04900a10f51e7b0a59192daa846e8809d0795364f53dd042a83158ac450140a54f31dbd6af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807713, "uuid": "f89a122f-3d3a-40b8-8828-2b6b6f58b853", "value": "T13215DF0B27D44AA8E5FD8B75D2B900E803FFB7079722EB5D6D0551EB4D22B429E01B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807713, "uuid": "61dcbf50-21d3-40fd-bedc-b0ac51bfc602", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807713, "uuid": "4d68392b-6b8e-4a4c-b647-3259e1b02a08", "value": "12288:ObzCiB3nlPAg0C6+6w6ZD5Ww702NUAHKbNCX0WT0D88NoV0NW+Lnc2h9f4Wbe3ED:S/h6fZNC8ZHKJCX0fI8mVS7h03EC+8G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807713, "uuid": "0dc159b5-91fc-451e-8d21-dcfc282ddf51", "value": 876032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807713, "uuid": "5c02a6eb-fa23-44f0-bcbb-80369de4ba7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807713, "uuid": "5b696ac1-f8b2-4a0a-b82b-e75438294851", "value": "522a30ee806efaee61721a63478abc144d5bfd8da69c93619191f611fa7d0d87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d52bfe88-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810353, "uuid": "93dfbec6-08b3-46e4-b371-b79c7e25ac85", "comment": "Malware payload (GCleaner)", "value": "80b23e8a9e6e4be9f5007ac0802898ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810353, "uuid": "4965657e-33d4-4b98-8174-b11d381b628d", "comment": "Malware payload (GCleaner)", "value": "524430020e76d6670fd23f26a2edcea015256db342b54131de1b322ff8a57037", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810353, "uuid": "7af2725c-322a-42e4-8a91-0a8e3452544d", "comment": "Malware payload (GCleaner)", "value": "8d0c6956fa4b42dfdda7184bbec827cd8292133a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810353, "uuid": "4f46563f-f5eb-4bc3-a418-e591484b976e", "comment": "Malware payload (GCleaner)", "value": "223ec23320550d16723d4acac5eb0c1fbbea9539acea64269c47ac6fdd82f19220ee0820631b588efb2bbaad455406d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810353, "uuid": "6e107221-0cce-4b93-b8ce-8b5e306c5328", "value": "T11A258D22AEE35537C1272B39EC5B6E987925FE10E9F858463AECCDC84F35241F4152A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810353, "uuid": "fc274153-5b44-45f6-ae98-5dd4ab9b49b6", "value": "fe4280c06246cc873fe89746dadec91e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810353, "uuid": "03d6290e-512e-455d-9954-201763f74622", "value": "24576:UlluEBpPj6o4CPbE9taCbEIWmOE+awleT:Ulwa1V0r5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810353, "uuid": "001cb62f-d002-4707-bb7d-d832ce99aa9e", "value": 985600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810353, "uuid": "c8b9a34e-4eeb-421c-a03c-df1aaba2cf01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810353, "uuid": "08b4c70b-49aa-45c3-8425-ce743ae00c0e", "value": "524430020e76d6670fd23f26a2edcea015256db342b54131de1b322ff8a57037", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d7a0d8a-1970-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810662, "uuid": "0efb5a3c-fa3a-4706-adc5-69155c391f3c", "comment": "Malware payload", "value": "808060c103a9aaed24de4be70dd076d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810662, "uuid": "81bb35fa-4378-44f1-896f-d66d8d8dbbd5", "comment": "Malware payload", "value": "5255291f09289a4bbb320bb8c97f20fff5bc4977fd3316bc906e0b2f2bab0a76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810662, "uuid": "7b280cca-cb4a-4b2d-b34d-213ceb624ae4", "comment": "Malware payload", "value": "9b43561829ead98430802803c1f5bec26433e9a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810662, "uuid": "268f004d-ab24-4f03-967a-01c3c5f9f5d7", "comment": "Malware payload", "value": "911b00a42aa0865c9673c1a42efb28b64981bef1c60be5aa62adb8c5962965fc65dbc38fac4332f8fca0c6f5874632c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810662, "uuid": "1a3529d6-31c3-400e-9127-73b2edb6cad1", "value": "T1070501A02325CA13CA5197745BB0F6B81B7D1FEEA811E3079FDE6DDB7AA2B154C04183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810662, "uuid": "b79d6c6d-3692-4105-8f2c-8ea49b82b594", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810662, "uuid": "65215a1c-c496-4ae7-92f9-70dd56ffbcbb", "value": "24576:zKLy9WHTBw9WuG2spl7EbmFTu4Micaejy:OOQT9Hj4bOQaejy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810662, "uuid": "94169e60-43db-4f21-9c7a-6047edb71bda", "value": 826888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810662, "uuid": "a9260cd1-1d19-4397-b965-e00c75b0961d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810662, "uuid": "2d09930b-5077-4a96-89a2-255445688eb6", "value": "5255291f09289a4bbb320bb8c97f20fff5bc4977fd3316bc906e0b2f2bab0a76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09cc90c2-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819031, "uuid": "02a60f7a-536e-43dc-af97-e4b4b623d871", "comment": "Malware payload (Mirai)", "value": "4dc0fd90987910e0b9f82e1512681c8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819031, "uuid": "6e3dc654-a119-4573-abaf-8a0a21dfbfa4", "comment": "Malware payload (Mirai)", "value": "527aaedef25c03c462a69ef5e511e5e4f62f45f5791a4a234c120db8aa43bcfa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819031, "uuid": "9607aad8-aaf8-4c5b-b656-0600d6543735", "comment": "Malware payload (Mirai)", "value": "460f2c8d4ac2e7cc92dc7a612b51d47bab9fca6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819031, "uuid": "eba35072-b1ab-4e25-b334-d418831172e4", "comment": "Malware payload (Mirai)", "value": "4516cae5d231132338ec347d0cd3242a789be07a43bd60a8f42029124e366b5691470fbdcc4c96e8609d9f397fd1ca3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819031, "uuid": "7a5977ce-c5c3-46c3-b078-0eaa4d3d560c", "value": "T1F5E33F1EAE325F7EF7989B310BB66E34935912E333D0E656D1AEC6102E7024C585FB90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819031, "uuid": "4bb6723d-2952-435b-a2fd-3714d43e0a16", "value": "3072:8jnYAVmfMlNt4BIxM51SKPo4TRmdY6duZBEi+9:8jJmfMCTncduZBEi+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819031, "uuid": "92728990-b5de-4c36-83f1-87f7163642bd", "value": 156348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819031, "uuid": "b696f40b-9f52-4ec8-9f8b-ec91c5f2e563", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819031, "uuid": "e3832dc6-97e2-40d3-81a4-b50afb17e378", "value": "debug.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73aef3bc-1965-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772805894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805894, "uuid": "8a9ca0e5-04f8-4e9e-9cad-1bc3450fa1b5", "comment": "Malware payload", "value": "799db6d0cc2d10f22842d9d5b7b73d97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805894, "uuid": "90b01708-2d85-460f-bb7a-28ccc3677074", "comment": "Malware payload", "value": "52984ca49620519ec8c3210dc15c56328e74d9a3621edbacccadfad3fcda2af8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805894, "uuid": "38d6fca9-ee67-4323-8276-03bbe2ca1fda", "comment": "Malware payload", "value": "7bc74069560674da84dc9a52e4c4a84bd63f3ed7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805894, "uuid": "f0fb11b1-29db-438d-8d99-d5cb12d935e6", "comment": "Malware payload", "value": "75423c95846d00bd7d4e54e380d688b9225dda82c6f3fdbe58fff1fdfffa5f2970ca02e9c920c3a42b7e9feb9093ae3a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805894, "uuid": "6f857eab-827e-4932-a10a-0b955836e0c5", "value": "T1C8E3885A6E228FAEF67C873147F74A20976D23D623E1D684D2ACC1141F6038E545FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805894, "uuid": "7039e3a1-4c23-4ecc-babe-78dae9e21123", "value": "1536:p+vTcKot8sp2MKypYz8ZOfGQ+v3eB/hub8mXRCTUGk4onuftL4VxydbK:p4lybKpzEOfGQ+vEubTt4ouftL4+dO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772805894, "uuid": "4a2698ac-c302-465c-9fec-151d3a81b38b", "value": 156680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772805894, "uuid": "f996496f-8f63-45c9-b576-1492ac939fce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805894, "uuid": "d867f87a-6ce7-48d4-99db-8412409c7f47", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a9b2674-1992-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772825126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772825126, "uuid": "883cff18-ecc2-4633-b9e7-fccc3a221be4", "comment": "Malware payload", "value": "805df090f52cfabae5b3090df492d34d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772825126, "uuid": "45b6c007-445b-46fe-bb83-0fe55ed39d92", "comment": "Malware payload", "value": "529c9f56c17eeb7f5f49fb924562da572c3eb2a291b33740476b9bafa3abb966", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772825126, "uuid": "85bedde2-14db-40b6-ae5a-b2502db2957b", "comment": "Malware payload", "value": "54c4f667352595712953bfb6fe0d86c5c5435540", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772825126, "uuid": "30884484-2fd9-4340-8e4e-3bd6580d917c", "comment": "Malware payload", "value": "da5da74d5d116aef7501ef0bdd78c94f5806ca4c66cedcec04d978ef22722cc2455aa04c8b36a720d328015965ea0121", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772825126, "uuid": "fff4f42f-69c8-4be7-9bf3-ff8f22785879", "value": "T17495749E8E3E92D6C0AEC5F4A73192A7B4503C8DD17077D76BC00B6D2723660E9A63C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772825126, "uuid": "1b6a8e68-888c-4e64-81fc-9dc9c79da607", "value": "0e6421c4f9fcf89bd5b84dae1d979cf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772825126, "uuid": "47560da9-c7c8-4e4c-9255-59ea75077f2c", "value": "24576:RYtJZPdOtwzwuSYXCL5alXOYiTqunKKcwFtotHp84V4fIBaFEz:kY5RUVpZV4fIBYy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772825126, "uuid": "b7dfd9ae-9ceb-42f8-9e78-b3455825c215", "value": 1900032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772825126, "uuid": "126c360a-916a-4904-9eb1-0f83c359b409", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772825126, "uuid": "7b9899d0-fab7-4b94-8e57-b385fc9dff32", "value": "2026\u7b2c\u4e00\u5b63\u5ea6\u8fdd\u7eaa\u4eba\u5458\u5185\u90e8\u8c03\u67e5\u4fe1\u606f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7d8e996-195f-11f1-a769-42010a9c0008", "comment": "Malware payload (N-W0rm)", "timestamp": 1772803512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772803512, "uuid": "7af3791d-687d-4a6a-a7bd-94f64fae936d", "comment": "Malware payload (N-W0rm)", "value": "602d7a1cb0b972c170d3a295e59c5244", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772803512, "uuid": "1eb158fd-d02d-4054-8e1d-849dacad1770", "comment": "Malware payload (N-W0rm)", "value": "52ce2f6b54f59176161c110aa56b42f1400ab17563c698ab27bb8d99aa7d8493", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772803512, "uuid": "369d4705-73a4-4085-83fa-a979902bf44d", "comment": "Malware payload (N-W0rm)", "value": "064591946b1e73ce0f967a182fe2c3fa55ba5b20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772803512, "uuid": "3fec3e69-2c86-4bb9-b2ff-fa2eed68d075", "comment": "Malware payload (N-W0rm)", "value": "813f7618b20de84e07810c3a585b6c19c578cd3e74b57241b9a6604ede45aabaa9044919cbd41cc6e66fbb44a4b68c45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772803512, "uuid": "7852d6ac-bc07-4038-b4ec-44e0a884407b", "value": "T16876223FB28F753EE16E1A3A3A72A620653B6A1065134C42D6F4C45CCF6A1711F3E786", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772803512, "uuid": "2567eac8-dac4-464d-8629-d5173da3f6b5", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772803512, "uuid": "e324ed55-d4e7-4c10-a97e-9b5626110145", "value": "196608:SyaEJoIio4Jl77IUMAi1X7+5BRQShdjZn:SmKZo4HIfAi0pDj1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772803512, "uuid": "3a756f1b-f052-48d7-91ed-008825bf3057", "value": 7633888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772803512, "uuid": "beaa7c2a-4209-4fad-a9a5-7eeb907f7803", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772803512, "uuid": "913391b2-2dd7-45fa-8d21-0add1035bd7c", "value": "52ce2f6b54f59176161c110aa56b42f1400ab17563c69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "768234cb-1972-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811483, "uuid": "c3ce0f73-8388-4d6f-9754-b6135f59de25", "comment": "Malware payload", "value": "d1d5e4c604dd63fc94561c778e293989", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811483, "uuid": "85878a29-9a44-4a65-8e0d-c29ddef0b757", "comment": "Malware payload", "value": "53296d6ead8510fb6858cc3719d0145baf34fdfaca52a46f3a7a7a4d585df9f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811483, "uuid": "c94ebe8a-e1e0-44fb-b090-b7a423cba739", "comment": "Malware payload", "value": "5b4ec8f126aad40538916aa5dec7ec60d7106f6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811483, "uuid": "c8d61c1b-51e1-449a-a2e0-0c73601032a8", "comment": "Malware payload", "value": "534c27386f3d33dae978fc1d3f8a2e93029abae68c2f289343c6042d80772646ad34db6d06d523993c1e3b77b23c5220", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811483, "uuid": "b296b9ff-218c-47cb-924a-11051cb98822", "value": "T15E2533297462068FEFB346FA18F88F222AE75B13252449CF9314B7DE3A4A754C51D3C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811483, "uuid": "94f5952f-f848-461e-bf6b-d07f745ea7dd", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811483, "uuid": "c827e02f-9b0e-4c11-8c8c-dfa576151fdb", "value": "24576:ooYiwHuKGH9FZDI0hMPdRCBlSRIsvjr03sd/Ei/vB:U6RFZDzh7kPLr5ci/vB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811483, "uuid": "a881d188-cd7e-4bdb-855d-66b15f079ad7", "value": 1049056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811483, "uuid": "5171195e-8cbb-4154-b783-4ed2cbf4fe07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811483, "uuid": "4ce3c417-908c-4f4d-999b-58234de82c6a", "value": "53296d6ead8510fb6858cc3719d0145baf34fdfaca52a46f3a7a7a4d585df9f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dee67db-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819199, "uuid": "c844565c-d58d-4c5d-b104-dbedc04f3595", "comment": "Malware payload (Mirai)", "value": "ad940d7ea077e4b0ecf88ad0b7c01494", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819199, "uuid": "2bb4a503-fa3e-4f72-a4fc-730dee06ea96", "comment": "Malware payload (Mirai)", "value": "5448aefaff216b89bc000559f6f6c1ccf06e5da5c4d4884d93dcfc67509566ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819199, "uuid": "31704c41-d850-4626-a880-f4e6ffed7d0d", "comment": "Malware payload (Mirai)", "value": "8df541f74a3bb0d97eb4ebe2f6e00ac9a5d14eb1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819199, "uuid": "699053ab-c73d-4790-8bd5-3fdc2333c8eb", "comment": "Malware payload (Mirai)", "value": "b7d6cf216012ae656177ecd274d93598921b2b2ebbceff5a064afc3dcb9d7e012587d561b6c3925f5cf028631d5cfe1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819199, "uuid": "46e50a34-9793-465e-a562-1e11b27fc168", "value": "T16F636B23DA269F46C10761F0A9F64E751F13FC9989630EFAA665EEE540039ECF5093B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819199, "uuid": "1f94c4f0-793d-450b-9959-2a6309755fa5", "value": "1536:pawwtrvFQgwu2N1K+wnLMKFpfhC4XgfKDREs/F:pjwFQgBQc+TKFpfhECND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819199, "uuid": "3d7efc06-866f-4544-9e1e-023505a4d3ad", "value": 66844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819199, "uuid": "18a016c7-fcbe-4629-b42c-d5d68f8b1e6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819199, "uuid": "be74e3d2-a787-4797-953c-2f54150c089f", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "606bf3c5-196c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808869, "uuid": "972adf17-b164-4e93-a308-70da89596138", "comment": "Malware payload", "value": "0bd4cfe09fdf8cc7f6698374ad545af6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808869, "uuid": "6b3bca02-342b-480e-8b9f-eb546cb19e18", "comment": "Malware payload", "value": "544bd4d4c374708cf13e874f9afd052484a8f822c4069452feac28be98e08bb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808869, "uuid": "9cbae8da-7e90-43dd-8eb0-ffe15bc95ac2", "comment": "Malware payload", "value": "2575d418f822aeffb09e073b482b3d4f7332211b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808869, "uuid": "f69f7d44-151d-44ce-8264-86dc1582b017", "comment": "Malware payload", "value": "32055d040ebb5fc2e0ecd7fcd40c34736d203854455f95519ec55141925ca3b13d78edc32a70f35b868d83017bf472ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808869, "uuid": "1a5fbab0-0d18-44ad-99a5-feef055ba5c2", "value": "T10645BF027381D062FFAB92734B96F6115BBC79260123EA1F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808869, "uuid": "ded9c3f1-bef7-4303-8873-67a178e495b6", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808869, "uuid": "647f374e-b8f5-43c1-b344-c34f0575b098", "value": "24576:Q5EmXFtKaL4/oFe5T9yyXYfP1ijXdaYH06DmIJKbuTk5:QPVt/LZeJbInQRaYH9yy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808869, "uuid": "fad2c33e-31a1-457b-8671-64d0b36bcc37", "value": 1273856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808869, "uuid": "8a2abaa4-42b2-4bfb-8d56-62e7a76fa1c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808869, "uuid": "41352637-1b50-4864-9e54-a8aaf06ad8a8", "value": "544bd4d4c374708cf13e874f9afd052484a8f822c4069452feac28be98e08bb9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9343222c-1968-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772807236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807236, "uuid": "e2d55046-2824-4071-9612-2fb6cc5e0b0f", "comment": "Malware payload (Mirai)", "value": "f94b718f6aaf8434f8128fc9b1911b87", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807236, "uuid": "cd6a71e6-fe98-4801-8356-a5192981208e", "comment": "Malware payload (Mirai)", "value": "54fb30d02e4910a880020c20ce6ac8e940c1ab31ffdbeaddb88e5ff822d8d9f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807236, "uuid": "d6eaf2dd-02d3-4bd0-8312-17d61dad7514", "comment": "Malware payload (Mirai)", "value": "53c053bd00737770dcec18423ee38245cda0f470", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807236, "uuid": "f11210d5-886d-4789-b27a-e5b13d7eac9b", "comment": "Malware payload (Mirai)", "value": "ccef184e2d1bdfc79be50f044ee08b54348b80bee43ee8cf02e312f58b2f53203eda23933d9679a6e92121e7fae07050", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807236, "uuid": "1f441ce2-9d5b-4a16-acd2-d0ac373bf06b", "value": "T18D3495563A22BFBBF1D9C67047B3CA2046D565912BE19346F29CD71C1E2028E681F7E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807236, "uuid": "690d26e0-1606-4dd6-9454-8a1e4c14cba7", "value": "6144:ALcnnOd8F1A8qhzjvzvP5XZGUR1dQhp+1J71:8dz/zvP5XZGUR1dQhp+1J71", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807236, "uuid": "bbb1eac5-f7f1-44cd-aa11-fc2ea61321c4", "value": 231318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807236, "uuid": "628b9346-a0ff-4079-934d-2253a647c26f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807236, "uuid": "bac1fd66-a122-4ab5-a8b8-d48503b143b1", "value": "m-i.p-s.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d18eda7-1957-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772799790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772799790, "uuid": "7154778f-dbad-4eda-b302-543fba7d8bef", "comment": "Malware payload", "value": "5b1f8c4dc9f3d891bb91ebbd9ecae54b", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772799790, "uuid": "73ec742b-a989-46b0-9308-fffa8d7ae3e0", "comment": "Malware payload", "value": "550d298ec1ffa48fe4060b95becd6851accd0174f148a728b884a7f85b7b8d75", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772799790, "uuid": "71bdf8a9-a215-4018-aecb-9d135915e1f8", "comment": "Malware payload", "value": "aeef84ebd9edb0c7eb1688978d71f5ce314a4da6", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772799790, "uuid": "75fc5179-c9f0-4cfe-847f-cc978ca45160", "comment": "Malware payload", "value": "92c1cb1fb9666d9f6386c332e8f03479a670db885add09008399fa294b90ad3e2b43caee7711ba8376235f08df05d240", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772799790, "uuid": "e9ca7b3d-107c-4812-b7df-aa7fdbb1c4c9", "value": "T1A6C73382BA93C232D9AF413441B7D7BF4A39AC018F2548D7A35C775C99712E12B3B35A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772799790, "uuid": "39315ef4-01fe-4c37-a1d0-7ac14e8221eb", "value": "1572864:kjrWGQC0xGXiIl7i/D7/wD9k4FbllKesPg+IjQtU:kjQC0SiIlur74D9k4BT/yt5U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772799790, "uuid": "2046db5c-614a-4fa4-8215-a4f5a17722a6", "value": 57319424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772799790, "uuid": "b5a7c87c-e73f-406c-99c0-f1ba4db22a8c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772799790, "uuid": "f0cbf3d8-4759-437f-a437-9be58a236ead", "value": "XML_FISCAL.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee954602-196f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810396, "uuid": "fa164025-efae-4bee-b7ae-02e0988e7ed1", "comment": "Malware payload", "value": "abe9a548a24cb6f54bb3d9f9dab49dc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810396, "uuid": "83f282a7-25c7-481f-bc1a-3fceaccad0ae", "comment": "Malware payload", "value": "555d3bdd7b5cac945d885fbd3e57a94b5261a9e6847ea62838d23ab5c0d8abc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810396, "uuid": "46ed50d3-8384-475d-aa5b-587d68b455d9", "comment": "Malware payload", "value": "25999b6d215465d8699beb47dbbd903da3a2d9d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810396, "uuid": "13131a84-4d4b-469f-b6b4-65490961e3dd", "comment": "Malware payload", "value": "dc0ca90302ed5c3976a5bec5f1a36676127f7fea4f663dbae2915495ac70870cb1a145ead433066adf605e6ae81ea6ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810396, "uuid": "f62e1d14-2528-48e1-80df-7d4866318901", "value": "T1E12533625BD1243AD3021971D473C5E326A9ED38058A5657DE41BF7EF873FA2884F223", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810396, "uuid": "a4dece25-047a-4c09-99ec-f6bcfb9532dc", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810396, "uuid": "37b9d64d-7bbd-4624-b9fe-9a9312dfa553", "value": "24576:kGXkL2lERLdcjOl1yFvDKZDX3X5ViTW97nCOZ1zHK6WTz:ALNdcjeyFvOZbXzjnCOZtUn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810396, "uuid": "ce1cc788-8a97-4b92-9e25-4238d555ce8a", "value": 1034056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810396, "uuid": "5c48295f-90bb-410e-a7de-9f8904588924", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810396, "uuid": "bf2f5649-52a9-4e3a-91ea-ffd9f026a173", "value": "555d3bdd7b5cac945d885fbd3e57a94b5261a9e6847ea62838d23ab5c0d8abc3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ffcba47-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772809673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809673, "uuid": "46e43b54-de0c-453d-a23f-355decdf98ac", "comment": "Malware payload (PhantomStealer)", "value": "a16f0d8380db597c0f705207417f8792", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809673, "uuid": "1857591a-b759-4e31-b69b-14ebd4f9ec6c", "comment": "Malware payload (PhantomStealer)", "value": "55a9d922e96e48f6dafe5d3a8026268cc10ae3958b61b9121f0e4c93edca3b29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809673, "uuid": "0cc2a89b-5b18-4fe2-9cf0-cb749df3e14e", "comment": "Malware payload (PhantomStealer)", "value": "4177a1e8e62f44d18c566b21b1f568e5e5e1fd02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809673, "uuid": "a270de98-1c33-4ee9-bee8-8c95d7b897d0", "comment": "Malware payload (PhantomStealer)", "value": "16a1851b90c5cf460bfa2248a147b4a3f74e43af3524db66f1f530b890285067c11debbeff75409c19b3b22f32adf364", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809673, "uuid": "3a6481cb-7df9-4b77-875b-921025b83c16", "value": "T10285F1357E834B41C627677AC5230E8423F0C5929653DB1FBFED01F8AA2A7B98A71351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809673, "uuid": "afdeca4b-f348-4ef2-8a29-8143990a778c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809673, "uuid": "68c0eac3-2606-4806-8afe-6516a745ba1d", "value": "24576:foEA2P4lTp3YHdCvVGEEKIcsjU6UsHMdrE6Jv3oqriYg1Ai4JhHo:fHA2PYp3MdCvMXvjxUsHcJv3fo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809673, "uuid": "63b94504-323a-4b9c-bcfb-523713eb510c", "value": 1764352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809673, "uuid": "948aaa18-78fb-47e5-92e6-f04707d6dad1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809673, "uuid": "16c91b90-bb48-473e-bf9e-962ec7e71bb6", "value": "55a9d922e96e48f6dafe5d3a8026268cc10ae3958b61b9121f0e4c93edca3b29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4e5aaf9-1971-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772811265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811265, "uuid": "11331055-48c4-46c3-827f-914da915bffc", "comment": "Malware payload (GCleaner)", "value": "5dacf83e155e11b0cf721dd9c60646d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811265, "uuid": "82e97aaf-8730-4cbe-a804-91d144e32624", "comment": "Malware payload (GCleaner)", "value": "56e75f28e9c262f902e1f17ac5ae8c3e495ed8a67243fe17fb32be292e54bffb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811265, "uuid": "335cf6e8-87ab-4c7c-aeb0-4199c50c0131", "comment": "Malware payload (GCleaner)", "value": "6264a6804ffd4f843b230aa576bc144bd033ac6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811265, "uuid": "6e43615f-df33-48a8-8dc3-e8a7eb6f6c00", "comment": "Malware payload (GCleaner)", "value": "2ca943ccde8d36fdcc954344a25f4155fa2a6d3cb244bbc1b9067d00201006afc741f9f38cb2f95b85e7d543a89ae3ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811265, "uuid": "36ac4e9e-6f90-458d-a4f8-5b6600a2ad54", "value": "T176059F35F69C84F7E0223D78DC1B56955825BE846B28BB4A2EE81CCF8F38781B525353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811265, "uuid": "8524ea79-a926-4335-9b47-0fce5115fa41", "value": "ce7a1d07b14b49824555865592c3af45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811265, "uuid": "d98993b9-0f03-492c-8c68-f0b49c8411eb", "value": "12288:dkAJdZJGY+5K/Lo9r7WTB+rP3cx6qLGpkjCCPoxpFHpNgljy:PXZJeK0Z0QMuk8xDvglj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811265, "uuid": "2e0eeaab-de75-4981-9cdd-7f65ce46e332", "value": 854528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811265, "uuid": "6668b352-376f-42ae-9ab6-f8b74e1ece1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811265, "uuid": "44fdf721-2e25-4fe8-926c-1c48dad51aa4", "value": "56e75f28e9c262f902e1f17ac5ae8c3e495ed8a67243fe17fb32be292e54bffb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "648c27c0-1984-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772819183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819183, "uuid": "aa8b83d4-1d34-4583-9890-1633d71e0b50", "comment": "Malware payload", "value": "1cf705a41d936c7d9b20783f041ebdfb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819183, "uuid": "fd464272-2922-4ad8-b808-08bd8d364b35", "comment": "Malware payload", "value": "57143da9ad8f68aec49cd9cc60344dc6b0447f62ef10283a31bcca945462e222", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819183, "uuid": "a8278132-084f-43ae-a87c-fe9e904c4936", "comment": "Malware payload", "value": "dcde4d1b37aba4120f57e3d94047be75e4c587a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819183, "uuid": "b4c40c6b-3d5c-496d-90f8-c37ff4f3a539", "comment": "Malware payload", "value": "b4a7a6368b0fa995bd4e32807bf10dcb46382fc6bd8105bc6b89e06bf27d90fc24e136053468a626c73f193f499daccf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819183, "uuid": "64b4365c-df6a-4829-a2d7-7427693eddf1", "value": "T1A5D2C70AEFA44EABEC7FDC73059A1B0235DD510A15A87F2A6174CC28F66E18746D3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819183, "uuid": "6581fb26-47a5-4c03-b0ec-8108f4c4c22d", "value": "768:g+VcDgFi/06elkki5AZzNLQPXiMxeuzSedMQ:gIcDWi/0Tlkx2ZzuxPzSA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819183, "uuid": "11d9e6e4-85be-4799-9c90-6f37566c9b70", "value": 29016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819183, "uuid": "fbb6f81f-c559-471e-871b-c9a1bae3ffac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819183, "uuid": "32b10e8e-871a-489d-8af8-7b6cc2913fcc", "value": "violetmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1022914-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772809890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809890, "uuid": "402dcd64-670d-44eb-9806-afc03b2e7204", "comment": "Malware payload (AgentTesla)", "value": "abb1a1416593de09d1959cc90481dc82", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809890, "uuid": "c1907111-33fb-4625-953e-bca14f06ffb8", "comment": "Malware payload (AgentTesla)", "value": "575cbafe1e3389a27b800403154594ff11237635bc01bc7989d76ef74ed62d52", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809890, "uuid": "ead65ec5-a5da-415e-b6f5-01f5823b6167", "comment": "Malware payload (AgentTesla)", "value": "3114df7e767b5c8c11f63ecfddb67996934a728a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809890, "uuid": "5d130917-cd13-4b56-83bd-c2af2d8252f5", "comment": "Malware payload (AgentTesla)", "value": "b437fbd00f277308c4a4ad35f2f244b4f183a16e292962d16db62d02d95f731bc0c6e7365e9deeadf108e5c52164a1e3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809890, "uuid": "efe944c5-875a-478a-af0a-1ac42984911e", "value": "T1C135AD1027E84A54F7BA9B345971061CCBF9BC1F9A23D61EED803CE91975B418AF1B32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809890, "uuid": "d1fc17df-ef52-4f0b-87c6-b4178f27b1ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809890, "uuid": "09fe3689-4ee5-4629-a6d6-877dbc85270a", "value": "24576:mz6lLoRymbJ8wgMh4C2t3HdvaHNjMMw80s:BajbOhMhj5D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809890, "uuid": "cef5cb58-8627-4963-b7e8-8cdc4d1c7a75", "value": 1090048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809890, "uuid": "ee7ccf3e-8873-41a7-9695-b4b4d6b4b671", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809890, "uuid": "4251b682-5de7-4b78-8bc7-9c1ed06c8a8c", "value": "575cbafe1e3389a27b800403154594ff11237635bc01bc7989d76ef74ed62d52", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d8ca0f8-196a-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772807897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807897, "uuid": "bc937378-0cfa-4f3a-a29c-c9f55b04b610", "comment": "Malware payload (GCleaner)", "value": "65276c11e7354f547182b6009c0798c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807897, "uuid": "f7149c23-5b31-4c97-9492-3cc72a8511c1", "comment": "Malware payload (GCleaner)", "value": "579754973ff76861cf89740fef0f0547cfa74bc605bcf8ab357f6cae60bc2192", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807897, "uuid": "4c604bcf-aa57-4a4c-86a4-81e123f2515d", "comment": "Malware payload (GCleaner)", "value": "512be83c503cea717913caf8674228057e4c8fcd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807897, "uuid": "8e162063-0bd6-4067-8511-74dc60724a00", "comment": "Malware payload (GCleaner)", "value": "00f67b5a0c681d15bcca6bb312e3115d6a7ee5fad635d296a54de60d713ad25f261bc75451de217efe2053822b9e2498", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807897, "uuid": "7d1218dd-e5a3-4d76-b55c-478cc78bcc05", "value": "T17E56D0E6F1ACC535C1D783FB089B29E6FFE5F620BD60168628A74ACC245704077695E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807897, "uuid": "0ce74eaf-5665-41a1-9b09-a9264f745d56", "value": "e5f32a93ddcf3aa9009cd70911b0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807897, "uuid": "1aea1f15-c240-46bb-8cbb-c86a4aa27732", "value": "98304:K9CexHFONXP41YkopOUcBYZ56uBVxEln+lFNDAsim7JeW2SAQ:KlMNXDF356iVOcnieV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807897, "uuid": "6177771f-0a7d-410f-abe5-43c02dbf4643", "value": 6469632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807897, "uuid": "b4cd80a6-074b-4601-a3d9-350e530906cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807897, "uuid": "999efdc6-0b9e-496b-8c10-a1474f2c2d25", "value": "579754973ff76861cf89740fef0f0547cfa74bc605bcf8ab357f6cae60bc2192", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a69dd1b-1982-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772818388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818388, "uuid": "dc54263c-0143-400d-9ea3-1009c2d8d413", "comment": "Malware payload (Mirai)", "value": "8b3754ee1f2c4d48f639e016f3f22a5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818388, "uuid": "3bc0e310-aa10-4842-95c6-c600e2790667", "comment": "Malware payload (Mirai)", "value": "57f782327e62a5946d10c7be5cc58b4806668bafbdf80ef2324e39100d9f37cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818388, "uuid": "478e806b-8c07-4e20-9220-90d66000c598", "comment": "Malware payload (Mirai)", "value": "8525e2e1eb0f9315b07450f901793f2ffac68dfc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818388, "uuid": "02fa7f1e-8195-4a12-94cf-a9652fd37e65", "comment": "Malware payload (Mirai)", "value": "b5e7ce35b1ca9e7c5b8bfcd0fc11f382155193eddd7ed121b99f18e6d46e8b6d64a20fa6fe40aeb201e469b2a9df8046", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818388, "uuid": "a694dbb9-d184-4fa3-86c7-bef48d666cb5", "value": "T1F5C33A06F58184FCC08AC2341B6FB63AA935F1DD1238F6E76BD0AF127D4AE614E1DA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818388, "uuid": "5bd05897-6783-4764-a269-a29df538dcc2", "value": "3072:pxv986gurREnQI8ysmTn645T1c4n2pPCZzFr0PGvmDxN4zQrPUAackTzSj0:DPgurREnQI8ysmT64J1c4n2pPaFe0ziN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772818388, "uuid": "791b4cc5-9195-4837-837b-2a5da79f81b0", "value": 126304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772818388, "uuid": "5af726a9-efab-4b51-be58-d31d2671c2da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818388, "uuid": "f651e322-8d8a-4183-a4c3-8392679933fa", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fc9edea-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810129, "uuid": "5024d15f-aaf5-4bd9-9094-8d3b20d3716b", "comment": "Malware payload (GCleaner)", "value": "70a17d1f2c775514c95e06239bec2a13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810129, "uuid": "e9f8af8f-368c-4314-9d8c-42929299180c", "comment": "Malware payload (GCleaner)", "value": "581eaf933ee712821990a334b20caf8358eeac5491818bc9b5fc7e075130b5e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810129, "uuid": "b81a6fb3-886c-49e7-99cb-5289c9c51f13", "comment": "Malware payload (GCleaner)", "value": "7f160e58134def47da3679dee0b84f5dcf976aa4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810129, "uuid": "7157eafb-05e4-4dfa-803b-84e7103a99b1", "comment": "Malware payload (GCleaner)", "value": "ab652302c8c3fa00892ca16ef1e31fc87dd20e2ffc8f1cab5713415bb3891d40acd70aa8cb72716d0d114d34292fa984", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810129, "uuid": "5f2e491b-6099-4f9d-be56-c91789ce223e", "value": "T14EF49E21E6A0B437D1725D38DF4B5E559A2BBD80EA2468C72BE41CCBDB3538D34252B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810129, "uuid": "e1b8333f-4dd1-4d70-a58b-48e221672fbf", "value": "c475b6e242f56325f64c2b76233f720b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810129, "uuid": "f64cb138-2cd6-4245-8f93-59efdb256ecc", "value": "12288:reM9gzhW/BsjB7V+bRO88pvnUUJc7qraqG8Dq0:qK3/q7gR8paqG6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810129, "uuid": "e43df862-689b-4754-9519-819cd4a482a4", "value": 784384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810129, "uuid": "18280c04-ff94-4365-900c-a30aafc015ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810129, "uuid": "1b632e37-fddc-4cfc-a1fd-23ba90d260a0", "value": "581eaf933ee712821990a334b20caf8358eeac5491818bc9b5fc7e075130b5e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d56e03d-1969-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807655, "uuid": "0fe1f6d2-df2c-4eaf-912a-a65c0ebae15f", "comment": "Malware payload", "value": "e6e9dbea9516c3aab1bcc21d47917efb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807655, "uuid": "79852424-13cd-4a5d-aef6-358612b779f3", "comment": "Malware payload", "value": "5833916a02b1d28873937098cb46a3c1730b3d1bf5876808dc4e7646a69ef4d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807655, "uuid": "b10fc4cb-074a-4795-8a1f-1191e895321b", "comment": "Malware payload", "value": "1632d9d4970d0d97b829f6a630ef590f392b4766", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807655, "uuid": "80c2ca05-d9cd-4996-addc-8df80e7e6d0c", "comment": "Malware payload", "value": "cc931dff2c4c4f8a576ce4d9b9dee930b7512dc41ae17128b432282272c6da285e98ecfdbd9e90821761260df774ffd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807655, "uuid": "bdacb0aa-d0a2-47a8-a895-d5ae257679ea", "value": "T1C50512A01B15644EE0634C74A9F57776FB98AE56336CC3823AC0B958BD3B3068F653C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807655, "uuid": "f0103e48-193f-427c-98ba-5ddc154701fd", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807655, "uuid": "ec5bc3a1-4e1d-4012-9723-a2b3c94ace6c", "value": "24576:PHO/MdQWsoAvKK2ZWdBz6kqd43jbz1HVkMIwSqLbBYNGC:PHO/uarOWdBGzKb0wSqp9C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807655, "uuid": "66de6ebc-bb3f-4786-8369-48f64fb7326a", "value": 864648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807655, "uuid": "689be342-4686-4752-89d1-ff41307f6c6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807655, "uuid": "2a9bcb94-e173-4861-b1f9-1750942ed3d7", "value": "5833916a02b1d28873937098cb46a3c1730b3d1bf5876808dc4e7646a69ef4d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaa9e1ee-1942-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772791062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772791062, "uuid": "a1539ad8-6896-47c1-af4e-f09da98ff8f8", "comment": "Malware payload (NetSupport)", "value": "e743c389ddf015302914044d35251afe", "object_relation": "md5", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "sonosnewbh-net", "colour": "#0DC82B", "exportable": true, "hide_tag": false }, { "name": "sonosnewfq-com", "colour": "#D8A565", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772791062, "uuid": "3ec9d7e1-d225-419e-b9f4-b5c830aaaab0", "comment": "Malware payload (NetSupport)", "value": "58671391dbd1dcf8819f151ada1cc31aaa3c77fff0a02dccecdf733793c6bf75", "object_relation": "sha256", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "sonosnewbh-net", "colour": "#0DC82B", "exportable": true, "hide_tag": false }, { "name": "sonosnewfq-com", "colour": "#D8A565", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772791062, "uuid": "4fd41e2f-034d-455e-8393-2c12af3801ef", "comment": "Malware payload (NetSupport)", "value": "82c68e8bd9d65ac2623e7ad4c573a3c7c05a14e2", "object_relation": "sha1", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "sonosnewbh-net", "colour": "#0DC82B", "exportable": true, "hide_tag": false }, { "name": "sonosnewfq-com", "colour": "#D8A565", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772791062, "uuid": "98f96975-3cb5-4328-8491-9a953ea265e7", "comment": "Malware payload (NetSupport)", "value": "195c4dc3860b3d81c0419df81eef8a50cbd927c3a3354cea80b7bcfaf740747a4dd4352285adf9f5522a10b492ff0ff1", "object_relation": "sha3-384", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "sonosnewbh-net", "colour": "#0DC82B", "exportable": true, "hide_tag": false }, { "name": "sonosnewfq-com", "colour": "#D8A565", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772791062, "uuid": "25f5c548-4a75-4d9f-9714-a2c155671d28", "value": "T16516339A6CEA1CCA45FCC84A8641E2B4D519E21744DFFCC1AD70E5919EF620CB7273E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772791062, "uuid": "41c4f46a-76df-4200-81ac-94220e07cb77", "value": "98304:9vOmeQn3+daz8qNEiYB0lJtphpZA6lM2I8zXbpO9ofMLeBRf0qHO:9vT/qQrNEiYBStphLA6lM76k9oUSBa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772791062, "uuid": "63691fbf-73e8-4afc-bb32-980bfcc04f24", "value": 4019526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772791062, "uuid": "02d08226-0689-47e3-b6c4-fae2bc5f3457", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772791062, "uuid": "e2625bcd-8ac9-4877-85ca-7db604eabf2c", "value": "58671391dbd1dcf8819f151ada1cc31aaa3c77fff0a02dccecdf733793c6bf75.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f88b3b96-1971-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772811271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811271, "uuid": "3ba3be52-7ca1-4210-b120-aee2ed73f7e4", "comment": "Malware payload (GCleaner)", "value": "2d0759cd0de2e232620c546d72daa2c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811271, "uuid": "a35174a2-1566-4c09-84aa-1aa300a7d81c", "comment": "Malware payload (GCleaner)", "value": "586febacf5342b1f3cf15099166a0eb9702154b8f46a504a0ddf2f28808da83c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811271, "uuid": "7bae5a90-5e3b-4bb3-9655-70c0af173d5b", "comment": "Malware payload (GCleaner)", "value": "8b3db75d0c2d0bf0b6386f92b85c4d298db3b889", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811271, "uuid": "a2a5d51e-0f28-4be7-beda-2ed9c5c49506", "comment": "Malware payload (GCleaner)", "value": "f3012322fb89c89b1dc771b10405e1fc57e3ac8c3407684f4c839cfc68aa2bc9f019803df424f7e9a4f0d053aeb4225e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811271, "uuid": "60b2ef85-1867-401b-a8e9-8e9bfc2e5227", "value": "T1E9F49E22B6D08433EF625938FD1B56B598E5BE912D2C58066BE85DCC9F37381382528F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811271, "uuid": "ded7df82-3a8c-4c23-aafa-29ffc853dbb6", "value": "ce7a1d07b14b49824555865592c3af45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811271, "uuid": "a4ffb489-5c50-412c-801c-5596098c6714", "value": "12288:8kAJdZJGY+5K/Lo9r7WTB+rPvXuicO3RIfENCAUh4b7PPLXf/Btg0:GXZJeK0Z0w+icsRHhcig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811271, "uuid": "5884a94f-ccdc-4be7-b042-b78c3ee6f49e", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811271, "uuid": "ea32085a-4c10-4668-87ef-b31760afae6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811271, "uuid": "b640d3c6-4c82-43c8-a0e1-9e5f62c2a4d2", "value": "586febacf5342b1f3cf15099166a0eb9702154b8f46a504a0ddf2f28808da83c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b1c8c71-196a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807947, "uuid": "8ba4b08f-0186-401e-9030-f7ee360ca20d", "comment": "Malware payload", "value": "6bb1084d9345a56425518d27bf2379d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807947, "uuid": "67a68f0d-0ae1-4943-abc8-98394f1ce042", "comment": "Malware payload", "value": "58d1598db1444d858f0bb38b9d9cb7f34b6067792c6de99dc1b61153921ef277", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807947, "uuid": "7e8f6e26-6080-4692-aa6e-b9283fa8ad95", "comment": "Malware payload", "value": "4d9ad334dc48ccd71a26c4fd8338ba20903a937d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807947, "uuid": "fb0233ab-9f9c-45f3-aded-daf082e0bd8d", "comment": "Malware payload", "value": "0b5aebff09075c69282b1c3a1c837ccaffb761396e21db0aa190f4adc08661886ade1394eb8e6314741571d24b041a07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807947, "uuid": "41f8f14a-a0a5-416a-af4e-6123ecda6b71", "value": "T1E736EABB8E384C89C6D7F1F69381D6700DE6AE67A4EAE0FA51D109401F437106F61EB9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807947, "uuid": "198d205f-e318-4a0f-9bbf-1fefc575423b", "value": "d512f74fd5e290f01bfc48029b75487a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807947, "uuid": "a30a293d-1d68-4704-9103-f9cbf3c6033b", "value": "24576:uAWrm6oG2WxgeP7Gbyhl2RYzPG9lz/VBNMVPKlBDoaMfMwTVqr/10RU+S0mhAf0E:HWawV5T5l2RQClz/VHMVG4R3IBo8xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807947, "uuid": "f8a841f0-7eff-41cd-9e63-34fb45a6ac4a", "value": 4965888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807947, "uuid": "62a619f5-8dfd-4735-b50c-51917d45dfd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807947, "uuid": "0e15d520-6263-4e5b-897e-3647d81aaecb", "value": "58d1598db1444d858f0bb38b9d9cb7f34b6067792c6de99dc1b61153921ef277", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57355942-1904-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772764185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764185, "uuid": "6a2f9c12-ad9c-4828-b302-ccfb4fce1a60", "comment": "Malware payload (Mirai)", "value": "10e6300783cac6a7fbbb1cb4e32f16da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764185, "uuid": "a88467a6-b8a1-43ab-ac00-f263c1600353", "comment": "Malware payload (Mirai)", "value": "58fbacdd6055f8f1672d64ec83dba0b46efd2acf4da846cf7fed28fd15042f96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764185, "uuid": "f74c8d5c-b85c-4767-b045-85650b64802d", "comment": "Malware payload (Mirai)", "value": "3185c4e3b1ee47527dbc52977b4f9b56241147a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764185, "uuid": "deb6852c-db70-45e9-aad1-ef9a67e31940", "comment": "Malware payload (Mirai)", "value": "6d6c80a24a3e960b4b638d031de919185680d6eddfa8a69f83a25ba7f133157ce171e4156041f7b0d316f20a1cac8ae9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772764185, "uuid": "f6624f06-2d94-4619-9497-156dd0677b4e", "value": "T15BD33B07B6D180FDC4D9C2744F9AF13AED33B1695238B16B2BC4AA171E89E309F5D614", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772764185, "uuid": "b17cab68-d963-4de0-9c07-1d2bd3d6409b", "value": "3072:+Kzk/bIs2eUkmx9nBYZPRZ9tIX5gDCCuD3pIE9fu8vB:+Kzk/bIs2eUkmfny6lZM8J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772764185, "uuid": "ebd56fda-a942-42f0-833d-a5f6c71420f5", "value": 141288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772764185, "uuid": "f63f8eb4-391c-45e1-9d0a-77809eade20e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772764185, "uuid": "57342232-3a05-4e47-a27e-386f123b82c1", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5757d573-1968-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772807135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807135, "uuid": "51342ecb-7097-4354-afae-a7cb7b188bb7", "comment": "Malware payload (Mirai)", "value": "02bf2ec7042c098a5a586b75e2a7363a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807135, "uuid": "3c5ac72f-b412-4f66-8143-1e1968ba10b6", "comment": "Malware payload (Mirai)", "value": "59769d49d37eabb1773f6bb1e98f870d821a27f1abe1fdcbb263cbc68e6ab435", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807135, "uuid": "78691fce-d354-45c2-82fe-de5c414af170", "comment": "Malware payload (Mirai)", "value": "506b8bc105f5525b377c81e37b708236b3479313", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807135, "uuid": "cb4907f0-a8ee-4058-acd0-10b39098a88c", "comment": "Malware payload (Mirai)", "value": "614da794edb9d9af1824aab1468d0e24e757d684b6e4153fd20609f4e9d2a46fe152431ff1df9bc2252ac4cc3e21b1d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807135, "uuid": "7e5f28b3-1a6c-4dff-9a58-a758322e6f8e", "value": "T1FAF3F742771D3E67D1D7EEF026F7E3F043EBA8011B936540F19EAE845276AB12409B89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807135, "uuid": "0f5d365c-ef87-4744-b168-029b791fb5fa", "value": "3072:+Z8xRSE/rVnKK4f1qw86uSxty6vd0vL+i41pl2mn3F8+:W8xRX/xKK21b86uSxty6vd0vL+i41pl7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807135, "uuid": "da0814ca-c582-4daf-9cfd-8bf20f000e0b", "value": 172646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807135, "uuid": "443827c0-242b-4db5-8861-c6f7516f9169", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807135, "uuid": "51e5b1d6-fc55-4ccf-957e-c3e4f2e63aac", "value": "a-r.m-7.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45441d77-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772810541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810541, "uuid": "fd546a2f-30da-4f7c-9c13-100eb8a4e784", "comment": "Malware payload (AgentTesla)", "value": "5b6dda54b85413742ecafb03839e52f0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810541, "uuid": "b84b9a1c-ce79-4a90-9c60-075d7003d510", "comment": "Malware payload (AgentTesla)", "value": "59c9635334a28526caf067643b3a5001ba392f025e3f651e75c0bb2bd85687ff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810541, "uuid": "d5567f21-1f0d-4679-9a8d-d3df633a1f4c", "comment": "Malware payload (AgentTesla)", "value": "8153be7348feaf3f1639b1c2402a2d9bf2f65da3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810541, "uuid": "7b2ea1b0-3e85-4717-8610-e7068c1a7801", "comment": "Malware payload (AgentTesla)", "value": "af1848a33660bd83a201371f92b35105e30a164461e4bd50fc17da6ed5f0fa4f49a0133fe81d7eb29703afe8608ee6a1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810541, "uuid": "eb836438-131c-43b8-aa88-6da1c1ee453d", "value": "T11715BE1123E85A69F5FFAB3898710528CBF5BC57DA32DA5D2A4940DE1931F40CE62B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810541, "uuid": "04371fb8-bfa6-4a70-9ff0-32d407d00703", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810541, "uuid": "c999e7fc-da1a-44bb-acdc-612dabd14421", "value": "12288:Yrn1VzXAdpr+8Esd4sEwRA8DjDx/l+POuHizHhVMQDBYmGSjyrNLR:Knb8dZ+8EsdfRA8DvaP3HizHIdnSjy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810541, "uuid": "e546e435-575a-4942-94d6-aee16c97d1da", "value": 922624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810541, "uuid": "76300f8e-3991-48b3-8dc4-f9858115f5b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810541, "uuid": "8320b891-175d-498a-98b6-e42f8baaca8b", "value": "59c9635334a28526caf067643b3a5001ba392f025e3f651e75c0bb2bd85687ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbe51ded-1983-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819008, "uuid": "0e6274ec-3018-481c-bea6-04ba3f4cd32b", "comment": "Malware payload (Mirai)", "value": "1608227629e15371c957db861068b292", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819008, "uuid": "0374baf0-97f3-40b5-b3e9-a56d09f70937", "comment": "Malware payload (Mirai)", "value": "5a07a6eeeef206e25a96c78aae7d6dc3a419cdee2202c955617506645d0384b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819008, "uuid": "61c7015f-6a2b-40b9-ac8f-f26c71ed44f1", "comment": "Malware payload (Mirai)", "value": "4062dc0dadabdf6b193ae04b385904f73c1a8f6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819008, "uuid": "3145991a-a00b-4336-b8c9-c084786e7c9d", "comment": "Malware payload (Mirai)", "value": "e986ff6d0d2f2b9c559ecc056ce53871a794f0ca0059790ae391970768d3473f406dd346e9f1c0537ee518c21abf1fcf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819008, "uuid": "23a2d486-f345-4209-ab58-57f447bbe0bf", "value": "T1AB435E92F892456AC6C117BA771B978A33A253A5C2CF7313CD080B6177C9A4F4E77E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819008, "uuid": "f0f439df-6098-4732-b4aa-2ed2b39dd4f4", "value": "768:TWcltKWWiXZ2/x7N8OMXLPtdjYocDCW7Y4CEIMfl2Fr0nMz:TBltFXYSOqPtdNcDCW7OWa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819008, "uuid": "00994047-9f87-4e3c-8ea5-81c9026bcd87", "value": 55452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819008, "uuid": "48a6f430-b64d-4900-a5f7-4796027f930e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819008, "uuid": "5c0a1bfa-bad2-4774-b60d-41fe5fbbad7d", "value": "jawirbot.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84e3deec-196f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810218, "uuid": "2f2b83f7-c8d0-403e-8074-74a0f258bd00", "comment": "Malware payload", "value": "430d34adb039c1f4a1574c25a31fbbad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810218, "uuid": "7aa2a6e9-c2ef-46a1-bd0d-150759b3d2ba", "comment": "Malware payload", "value": "5a9bec59f6368482d789e8e369b347a49d42e397133e1a90ebec71b16a58f4f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810218, "uuid": "62b57d27-504d-45f9-b92d-4bcbb86b528a", "comment": "Malware payload", "value": "476a65eba32b00fb76fcea9764e76525ce57e1c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810218, "uuid": "c08643ac-0e51-4541-8b36-8b60a7bf762d", "comment": "Malware payload", "value": "f977a347674c260b3250a2da7a2e934925014c0881334c371bdb0836b2eb0ab02e6f7d7354ef9180df36f87cf1bc6fbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810218, "uuid": "54c3f01d-5981-4447-a7ec-cc8a8e074183", "value": "T137652318124EED03D95B0BB05D71F2B427662EDDE4A2C2168EE5BEDF742A3F02D54362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810218, "uuid": "21405922-efad-47c6-a321-5a5c4e6ac54b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810218, "uuid": "5f5396c8-1d87-4823-9f46-21c290fb91f1", "value": "24576:J/onoxG5wMrGk4lNyxgUTckZ+Eh2MH9s0iRIS9e6gaggPwkrQ5VKK6F0+AxI89pM:J/pVk4fy/c++ilxi/98OxE36YJajWzXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810218, "uuid": "86fb6545-d51d-4c47-83b5-5af9fb0b7eff", "value": 1533440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810218, "uuid": "f7907d17-1ee6-40c3-99f5-17bc98485a82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810218, "uuid": "6078d103-4657-4306-ae27-21f111117439", "value": "5a9bec59f6368482d789e8e369b347a49d42e397133e1a90ebec71b16a58f4f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feec22a5-197a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772815147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815147, "uuid": "469f4fd8-071c-47d9-9441-9018b8287f31", "comment": "Malware payload (Mirai)", "value": "b469fc787accff44b058a90cbf69fe51", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815147, "uuid": "9ee5987b-5ca5-4a7d-9cdc-cfee6f31004c", "comment": "Malware payload (Mirai)", "value": "5aaf6f8c6459aecb6ec08b8e88e0f7f143dcff69e200e71b58e18e0535c77307", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815147, "uuid": "3cabb0eb-bb43-4e50-ad71-a9e4fe3e9d2b", "comment": "Malware payload (Mirai)", "value": "aac525ca543850d4ee8a48ff4c0ca4eeb7d314dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815147, "uuid": "5eb4d5a0-69fe-46af-b367-6236e8e6802c", "comment": "Malware payload (Mirai)", "value": "9bedabe7602bda57e65039b3c0d58748cbd5c11046faa91015762b9b58da5be9dd1433e338b43753f89f0895c06eee13", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815147, "uuid": "5ae9eb16-db97-42df-a044-e33872b51616", "value": "T1D8D32A05B30C0A47D1A32EB43A3F67E193EF9AC121E4F644255F9B8AA1B1D335586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815147, "uuid": "6aaf3174-d82f-4207-adfe-91b106dd7d2a", "value": "1536:FetnOCu/HhjAgESKxfitGtegk2eZ/wTLlYkJvAxhv7suWvnqvcOWvD:XpBjHESKxNtyjwPlWx/gD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772815147, "uuid": "01c3b2a5-679d-4ce7-a5a2-209606a73c45", "value": 138132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772815147, "uuid": "0ed6c667-6ed5-4dee-8f11-933c6c1a24b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815147, "uuid": "1428c6d2-f8c1-468a-ba17-b12d501e6ad2", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f85b7f36-1954-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772798815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798815, "uuid": "2ee0db55-46ee-43b5-a7e1-445b9a252c22", "comment": "Malware payload (Vidar)", "value": "6fdff05a839d16331d09803cf2bad974", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798815, "uuid": "af570287-3f80-4cc1-ae3b-8ed58a628549", "comment": "Malware payload (Vidar)", "value": "5ac53e312732078514a827b41e1b2cbc6e7161970f9d9ad91f382eede969ac39", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798815, "uuid": "f20e75ad-72c3-4def-a7e6-8aba52e86d8e", "comment": "Malware payload (Vidar)", "value": "60b01f2c3aa3ae76d87a6331fb1c48ec75f6905f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798815, "uuid": "80dbd6ca-e79e-4b9b-b469-aae3c031257f", "comment": "Malware payload (Vidar)", "value": "7e3d81d7e54e9bbefde3fcd1203e0d9b2d5df9462af95ae87ef8120e0c611c00c3ce84e6f6d1ca88f638bc44308f2f07", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798815, "uuid": "f386702f-e386-41e8-9f4f-bc9ccbe06943", "value": "T161241237CB1C8765F49A6031D4B2028B5BADDC7385B56A48880EABD7A91C7E440B376E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798815, "uuid": "7a22708d-0cee-46f1-a99a-5d75f962d8da", "value": "ee53c10aff1d01eafea53328179e33a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798815, "uuid": "2d3b615b-383a-459f-b137-244660e9e424", "value": "3072:F/TtjgJ4dnyJIheU9acZI/WLhevbfm3vIRJbs13b4m3z+YF+I3h0CPsnEF0t2m:lTxg+5WcBb8bfm3MJbIkm3z+YMI6ClQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772798815, "uuid": "cadbac87-12be-42e4-b629-0dfd527e41ed", "value": 219648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772798815, "uuid": "ed03c2b8-0df1-487f-a901-b3874ba40d5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798815, "uuid": "2cc6673b-818e-473c-a031-3314d3c4e948", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "638228e0-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772810162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810162, "uuid": "5cf8bdf2-7c79-4773-bf83-a4c3427e46b0", "comment": "Malware payload (Formbook)", "value": "ec533a32d31ec8bd1f1f6273c0882d56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810162, "uuid": "4285a617-eeca-4ad5-aff5-78b912da6a50", "comment": "Malware payload (Formbook)", "value": "5aed2949335f10e3dfe86b753c3525ec2ea22d24afe6e12b3220f1ce81b955db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810162, "uuid": "86ca89fc-fb87-4ab0-8d67-1273337aab5b", "comment": "Malware payload (Formbook)", "value": "4dcb129e46fcbf710501d0e4f134ac17642ce6fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810162, "uuid": "d7850565-8ac3-43c5-a177-330a942afd10", "comment": "Malware payload (Formbook)", "value": "bb417c2f73a57a307551b4e7511e708fa54f302c89ae31922a38677db358d9f65a48f089ef37539dc0813801ad2dd202", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810162, "uuid": "49463c5a-78de-4c70-aa74-9ca8a3eef5ed", "value": "T17645BE0273C1C062FFAB92734B56F6115BBC79260123A62F13981DB9BE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810162, "uuid": "a39d7d6f-018f-4ada-8d30-d7e3f9b4b199", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810162, "uuid": "e4f39424-1cd9-49b1-9acd-02393147df89", "value": "24576:C5EmXFtKaL4/oFe5T9yyXYfP1ijXdaT/vd5WpMLszIvL:CPVt/LZeJbInQRaT/vd50MYzI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810162, "uuid": "5b239bd9-aca8-4c94-9936-737496e548ae", "value": 1182208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810162, "uuid": "8c2e329f-7663-43b8-a975-0acdae9535b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810162, "uuid": "666d28ca-e98e-4478-805f-1db8198dc71a", "value": "5aed2949335f10e3dfe86b753c3525ec2ea22d24afe6e12b3220f1ce81b955db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b0a6c26-1951-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772797236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797236, "uuid": "e7811f10-2401-4093-96e4-1d38366546b0", "comment": "Malware payload", "value": "e760898856e6913a5afc4dd8fb3c5678", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797236, "uuid": "3b578396-4de0-4a19-affd-35230f01a05a", "comment": "Malware payload", "value": "5b081ebb7a5e17b31d750cccec654f0b075a7a405c51baf3a2329f54549b05c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797236, "uuid": "2f6a51c7-7e4b-4253-9fdc-3a271108d636", "comment": "Malware payload", "value": "d58a6b5f0d21009452c81fa94e532b4ee1714329", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797236, "uuid": "3fc4a980-ce90-4ab7-8583-4b9c8fe3d6ff", "comment": "Malware payload", "value": "9bcd67c70981850405598003d1be6c2f523adfb80bab2a2af00bb992a7cbc30720d8b6db794009029c203c49b34f9f78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797236, "uuid": "74d84d77-47e5-4dd2-9930-ed2cab83b1a3", "value": "T152D42BBDAC60E376F60CD0BAE286D3538F2139011236AAA319BD97241245473DB577FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797236, "uuid": "5f0889b6-3a8f-4b5d-9351-3113c138179e", "value": "e6a9ea00f059c8f148d2aaa9d51e3613", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797236, "uuid": "0fdf7d08-ec06-4a14-b092-37c2181901c9", "value": "12288:AEyurkSSu5EkPm8b7k4ao/CXjp4JgtU8F6CmSYw2g:AETrk5u5EkPb7jgjp4JS36UYw2g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772797236, "uuid": "17933246-7b2c-4422-b700-c4e368111324", "value": 629760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772797236, "uuid": "2156a922-d8f2-43cf-8e3d-2e9ad076b801", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797236, "uuid": "28f06cdd-067b-40df-bb7f-fc4c5f872971", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55b46047-192e-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1772782222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782222, "uuid": "456f477b-98a2-4c17-af64-1a27b3e3dd1a", "comment": "Malware payload (Gafgyt)", "value": "22a6c15ca9fc85e5f9155be3cba96ee3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782222, "uuid": "6b908363-f1fa-4797-8597-21d6926e267e", "comment": "Malware payload (Gafgyt)", "value": "5bdc31fa48b8e5c8ab2f2c603af63f454b4190dd73e0dc3c8fd65c7746fa29b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782222, "uuid": "8896119f-88fe-443b-8b90-6f5ded9189cd", "comment": "Malware payload (Gafgyt)", "value": "c03b7a1ac0d0add971840d553e8f228e0ab3cb45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782222, "uuid": "547907bb-02f6-4e0b-b412-c30c394f4ac9", "comment": "Malware payload (Gafgyt)", "value": "1204bb344e625874ec32a17a7fdd0fa406c5389d1955487ab766c35febab7e4bf947bb916cc1d5273b5f967ca9f69136", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782222, "uuid": "07c1f1d9-bb31-4fce-8ff4-060fe311af76", "value": "T188E34B0AB4C0D8FEC499C1744FAAF5369971F4195234F5AF27D8AF622E4EE201F5EA10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782222, "uuid": "8edfeb61-f93c-44fb-af6f-be3e9d79688b", "value": "3072:J0hKs/9ydD3XNzGYYTBCG+iaSPXra9ECxazy+oH1:uhbF+HYbN/r5oV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772782222, "uuid": "84eb589d-d50b-40ac-8ca4-095d23075592", "value": 155816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772782222, "uuid": "e09a4830-4a12-4458-b6b9-1405005dca66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782222, "uuid": "240a1e5f-edab-444b-a4c4-82c6564f0c39", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b72ec7cc-196a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808155, "uuid": "e61cd456-79f0-4fd1-b0de-1d6b26c03f6a", "comment": "Malware payload", "value": "da0793b39fee7504ab08840780fa2f0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808155, "uuid": "1d2233a0-fc22-4545-b0ef-8028255ad87f", "comment": "Malware payload", "value": "5bf369e08dd40e79be2e3f04095f2dfde751d92ad5212ce91c3e58ec02011cc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808155, "uuid": "d0916c66-0128-4231-b4c1-ff6d077344ac", "comment": "Malware payload", "value": "d355bd8c45545e4e9c0938e680abf6311b91076a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808155, "uuid": "25ee377f-990f-4b68-8369-c86d80d436ce", "comment": "Malware payload", "value": "195cf553da0ecb96a660648450826d0f18f50f060bf39367303b5804279911b718f74cfb230a99963cd1ca33b069c113", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808155, "uuid": "13508f06-fda9-4adc-8deb-3594659e727b", "value": "T16F35026467AFCE13C6A51B3380E1D23003B59F56A513D207AEEA3ED77E57BA71984203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808155, "uuid": "9fde05aa-0a92-4a75-8498-c79d9b79eaa6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808155, "uuid": "4ce9c607-74a2-4f9a-8611-7f5e048abffe", "value": "24576:qPkVzl/OdHu5f/5NHUIN0MxJtfndV0bfgR8t2ANpkguQlVict:skVR/hLHUe0MxJtPdKFdvuWQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808155, "uuid": "18404cfd-5d98-4708-9ca1-d0dd79e9b2fb", "value": 1111552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808155, "uuid": "8d0c82cd-3c44-4a98-b367-230e56e1d13d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808155, "uuid": "e5f14d3a-89f9-4568-9ffd-48feaaceb237", "value": "5bf369e08dd40e79be2e3f04095f2dfde751d92ad5212ce91c3e58ec02011cc5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "281669dc-193e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772789017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789017, "uuid": "d33509b1-73cb-4b24-b3a4-a273b6aba3f0", "comment": "Malware payload (Mirai)", "value": "f915b0f661de536ee19cbb959fb580c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789017, "uuid": "84115a64-eb12-452f-aaf2-1ae57c0b9ef0", "comment": "Malware payload (Mirai)", "value": "5c02327c0fbe632e5ce99eafc2170c9878af1b92277aa9f272db66d8acd9771a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789017, "uuid": "e4b9b5e0-2a93-4fe7-92ba-fe824674e8d9", "comment": "Malware payload (Mirai)", "value": "4017d3975a1417d27839dd2dfe0813ae957e4f82", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789017, "uuid": "90e1cc97-1c7b-4146-97c7-7d4d23f2311b", "comment": "Malware payload (Mirai)", "value": "daa266ea0c95084a776a6e39641f075520a3e49a0b7b7dd4320955e17ea3c76ab81901e1494757b6bff053c7b1d71c28", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789017, "uuid": "09f64e29-9fe3-4f2d-8943-07409690e354", "value": "T1CA230992FD928AAAC5D067B6B72F52893363A3A5C2CF3353D8184B1027C661F4D67F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789017, "uuid": "9efd95eb-10ae-4eea-8bc8-9e91b8a1d262", "value": "768:FrcoXKnc4VsC0jaH1pF+6/5d3mnbBFR1ffXvgKLNoY/MXRNeyF3gnZzX:FrD4Vd0jaVxd3mndFR1fHgKL95Ey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772789017, "uuid": "eb488ff8-8f2b-49e2-aa08-daf70f893605", "value": 47704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772789017, "uuid": "13572144-32ec-4f66-8ce8-399a34348873", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789017, "uuid": "4796eb00-90e3-40be-9211-b68191a20d1b", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ad026da-195c-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1772801987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801987, "uuid": "f3b1f39f-91bc-4c7b-8bfb-ca58bd384d78", "comment": "Malware payload (RustyStealer)", "value": "cea3656786c4db1b54d19110381145cb", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801987, "uuid": "2a0d2c1c-3333-4c46-a1e0-093de8854b6c", "comment": "Malware payload (RustyStealer)", "value": "5c839cefd688071e99846649af0f11fc080b3d5923df5ce0c229c4c96d7acb3f", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801987, "uuid": "c6d7b7f1-1c7f-4917-9687-61b8e8c2af9e", "comment": "Malware payload (RustyStealer)", "value": "1322df32d57dadfae0bcd4f9514ba19b761aff2b", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801987, "uuid": "b9a5d58c-6dfc-4720-8eb5-535f7490eebc", "comment": "Malware payload (RustyStealer)", "value": "5b05562e512bc2c8a2c1d979bcb08c9e8ce3e9109722f7b47f97b3414d918754f3ebc0c832b80ba238f21f0d00e5d901", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801987, "uuid": "4d90bf0e-3046-40cf-a7a0-f23b3b6ec4fe", "value": "T1E567332C60DB601985A7673C597F8B3B83FE19D6EEF848F7C6090947B0B219B3D46168", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801987, "uuid": "67c8ec94-cc60-4a14-8a61-824561adbe02", "value": "786432:YdaPlxnjYopdHc5jrZkxsJ0/iw+JOmXwDw:Yd6jYyHcJmKCaR0mXwDw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772801987, "uuid": "3d8a4d0c-a66a-4719-b968-e955628611a0", "value": 31603664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772801987, "uuid": "4c1c687c-bb32-41b3-8121-baf70ef55dc3", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801987, "uuid": "525413a3-6a26-4633-bd8f-b7e06f215f52", "value": "KeitaroCheats.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8595b7e5-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772809360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809360, "uuid": "162c6de4-7eb3-4a17-8a8d-68ce3828359c", "comment": "Malware payload (GCleaner)", "value": "82082efb24bd7e50f92bcabc9c7d0d5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809360, "uuid": "0ed2da28-4cd3-4019-9a1b-28283b13e6cb", "comment": "Malware payload (GCleaner)", "value": "5c950334e9f991442e8b2d750204d32606a7e81d768de67cd48045b09eb0b07e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809360, "uuid": "5f39b54d-984d-4b76-8a83-689e67fc1b3c", "comment": "Malware payload (GCleaner)", "value": "d78e76b10de4eb155d0f8058784cb33378eb58f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809360, "uuid": "41d38a1b-8fe9-4863-92f1-9177fc2d4fd8", "comment": "Malware payload (GCleaner)", "value": "fde18f71e3d1fd81358a2941c3599ccc88248856b715b0c456bee407558645fe12a3434468a9695f40771d73c22aa6ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809360, "uuid": "ab80632a-2600-476e-b071-b783439b6fa3", "value": "T17E36F1B4B09E44B9E0EA0C754E438EBDD525AEE6CC2E6439B6FB1BCC9F117521CC5806", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809360, "uuid": "d6c13658-f21a-4d41-b72a-fc5611bec3d6", "value": "345624d13ffc2b7f296b9d2972b1c0a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809360, "uuid": "62e77b3e-5fad-44d3-ba07-5f253062f629", "value": "98304:BiZGok1cmdHjhsIrAn+blgY2VW7RchUL+Xqytr:B191cmdPg+ZLSzXq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809360, "uuid": "1cd701d0-c60d-4756-8d3f-3bd9332c8a42", "value": 5302784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809360, "uuid": "bd1d0d8a-757e-48ec-9aca-7c264dae71e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809360, "uuid": "3e59a92c-1601-4438-af56-fc6891b15b93", "value": "5c950334e9f991442e8b2d750204d32606a7e81d768de67cd48045b09eb0b07e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "986d07f8-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1772808962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808962, "uuid": "5ccab87f-2662-4180-84bb-64309fd27805", "comment": "Malware payload (DarkTortilla)", "value": "0e635800cff06a9682866dea869bffe7", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808962, "uuid": "b640c036-b5e1-4117-a94f-a7adf52ac53b", "comment": "Malware payload (DarkTortilla)", "value": "5c9d3ace3f25c3decb1ef93b612b4b52732ad54c9531b9eaf1b5666b31c5ba47", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808962, "uuid": "7e1b474c-a432-4258-9a8e-6de1c76c3934", "comment": "Malware payload (DarkTortilla)", "value": "58518f3add2d54b02209bff7c73e74cf3cdb9ebb", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808962, "uuid": "6d63ff64-cbf2-4956-a99a-71c67710e4f0", "comment": "Malware payload (DarkTortilla)", "value": "a2184abf1f1aa67d39453d3ff84d85db67c2a6f50b76e2113450301e335c5abb4f0987b9744d60c6f792603ec0fe0513", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808962, "uuid": "a2ac12da-c9b4-44e8-9521-c1f293fa4306", "value": "T145F4F1325E426A24D9B90FB9C066109937F0C847625AEB7E6FFC00F4ADB3B49CD27561", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808962, "uuid": "0758acc6-1317-4d26-965b-ead45f589fd2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808962, "uuid": "e5daeecc-1fb2-45d1-861b-a5e05a4ee9d0", "value": "12288:T2CovtrGszIMjy1j89CFnLT/N0HPNI0iAxxrKXBxoo1C7eYzc1g8wbKJblNB1:MvtQhpLT/4PPH7caoc7ewc1gLKJblNB1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808962, "uuid": "37c0d759-b776-44d5-be29-017ac91ebb5c", "value": 775680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808962, "uuid": "131ea72d-e170-4c4b-bf0e-360f6ec625a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808962, "uuid": "2412411f-1762-47cd-bd4a-681af3f94e1c", "value": "5c9d3ace3f25c3decb1ef93b612b4b52732ad54c9531b9eaf1b5666b31c5ba47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd166a02-1972-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811601, "uuid": "43e9f031-3b4a-432b-aa3e-0327aadd8c20", "comment": "Malware payload", "value": "b5ffb48475d4bb5cfaaaba446546dd1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811601, "uuid": "1a2e92da-5b0a-4e4c-be26-fa76d65b1624", "comment": "Malware payload", "value": "5cbb8eb4846c4a900a1843a047d4fb07359be8a7d18a668aca2db0dc693d46a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811601, "uuid": "e1acbf09-460a-49b5-8a07-7406932cae6b", "comment": "Malware payload", "value": "94c69a3416896c52e742a5ea940e2ece8fba97e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811601, "uuid": "2d91dc1d-e3da-4bff-bc78-3906d17b82cd", "comment": "Malware payload", "value": "0da9511b9fe584c3887e4e2badb5b60d17e4b621d269c98986a8da37c1f6ddda1a9782f6ff38fe172efbe9a2ff1313be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811601, "uuid": "938a9170-6221-4f82-9fbb-33afb8afc5aa", "value": "T1ECF42301A9C0EDA0D554A731C8338D64823DB831DD1A666AC77EE65EB8303C2FE9779D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811601, "uuid": "5922b460-877a-4d63-ad25-89ff76c18e41", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811601, "uuid": "ef9df5bc-b85b-46c2-b29a-1ad30f314909", "value": "12288:1z7hU5I5yuNHIgzSFKxWltRohBfSTso93UXWknqHjiYpXkMDZC+7VTWQ2fvQub:1f+iN57Gtene3UBn54UMVC+Z4fTb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811601, "uuid": "445db719-9337-44a5-9567-1eae86e128e6", "value": 743936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811601, "uuid": "13f30cce-c546-4f00-a00a-0f40568b0d70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811601, "uuid": "fedc48e4-37c4-4940-baca-515811b52446", "value": "5cbb8eb4846c4a900a1843a047d4fb07359be8a7d18a668aca2db0dc693d46a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36fb6e71-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810517, "uuid": "4fa65223-c5ab-4c06-8bc9-0b28e03d8893", "comment": "Malware payload (GCleaner)", "value": "6f82b45fc00236c5b88edbc3803a8f42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810517, "uuid": "7bbe63e7-e550-4402-acc4-31501066541a", "comment": "Malware payload (GCleaner)", "value": "5ce75fc92e535c035ec90cb57dbb1286a0387fe3b6560bb31946097d05ce3177", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810517, "uuid": "f373abc9-cbf1-425c-87b7-d3233db5a65c", "comment": "Malware payload (GCleaner)", "value": "6bf4cdfbe5596eee93e2509081603f93ac654f15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810517, "uuid": "30515b5b-1e46-480d-9f2d-18d73d7ffe14", "comment": "Malware payload (GCleaner)", "value": "8b6ee8939f9cb6031aaa74c35c65d4fe8e9fb530e555587b071ee52c8ccb8ea5571d8ebd7af30bbc0bedcc854a14fdb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810517, "uuid": "23999d15-25a2-4b5c-b5f8-503fe325fea7", "value": "T16205AF32E6D0B433D1237A7CEDD7D6549B2ABE902F24584D6AD81FCD8B3D7822419293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810517, "uuid": "2fd986c0-ef71-4ef7-bffe-048c0e3fb096", "value": "ca01ec09235c3305d2c87228ffd6db40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810517, "uuid": "0e99ddb8-ee78-409e-9c38-0661d513507b", "value": "12288:glOUK2LDqP1ft//fwykZznp1m+fl0gPnkBRb6nKwgMJPVln:hR2A1ft//f98n/bn2eKwgMJdl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810517, "uuid": "2b22299c-935d-4f0b-a0f0-f0b3282159b6", "value": 801792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810517, "uuid": "9fe244ea-46bd-41f5-9648-f63b2a2a5c2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810517, "uuid": "6ff0f050-95b5-4004-ad0c-9a3adfab39db", "value": "5ce75fc92e535c035ec90cb57dbb1286a0387fe3b6560bb31946097d05ce3177", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44dea38e-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810970, "uuid": "ecc97879-6cec-4c2a-b50d-9b623f312a3c", "comment": "Malware payload", "value": "a35ed494c4a9122d7d5964b8cc1d4183", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810970, "uuid": "6df50767-8d74-4421-a7ba-04bf3e94163d", "comment": "Malware payload", "value": "5cf5afabaeeebbbe8b755bcdf16bb40421974a79c4f9bdd04e7d116fe3085595", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810970, "uuid": "89e408f6-fb91-46ee-8b8f-ee855b2c4741", "comment": "Malware payload", "value": "231adae7770ae5c1da21f09455edc4afa9dacdf0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810970, "uuid": "5a0011f6-1af3-4872-a7fb-4e728ee6952c", "comment": "Malware payload", "value": "b6f006a15b6a638cc2aed866d38ca700ec87b27c943faeabea8cdddfe7f3119aede18b19002340820f64273a46ce265d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810970, "uuid": "c38c9348-2dc7-466b-b66c-b81cbb9f1061", "value": "T17E0501586A26C803C5A9173685F2F6B427B84EDAE502E3175FDDBFDBBA13F650C40242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810970, "uuid": "b859481b-1bb8-4fcd-93ec-ec6f7f9ce0b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810970, "uuid": "aee3bcd1-7bcf-420f-b2f7-2759a25effea", "value": "24576:7jQdkqo2f0GoZpXljixKy5U8US36i4tB:7jA4rl+w+YSfE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810970, "uuid": "e92f6150-e7a0-4c38-9174-607474e00cd9", "value": 818688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810970, "uuid": "e4bed23c-945b-45ad-b945-5e7d2d8493f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810970, "uuid": "d44a1a3a-b17b-427f-bb29-1e854be1c431", "value": "5cf5afabaeeebbbe8b755bcdf16bb40421974a79c4f9bdd04e7d116fe3085595", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13e7806e-196d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809170, "uuid": "d341ce77-ac04-4039-af1c-b205239898ea", "comment": "Malware payload", "value": "5cf973d7cabe267b9a4827ee0820f3f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809170, "uuid": "da508cf8-f461-4209-a42e-87e6c27be5e5", "comment": "Malware payload", "value": "5d2f183a8bbbccf21a8a609873e68f83d2f94c3b2e34a34fa3d74ccb711ed43f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809170, "uuid": "8f01c069-a781-49d1-a39e-3fb970a8e6de", "comment": "Malware payload", "value": "5cd98a821f3b2194774de296c4e91ac98b80fb36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809170, "uuid": "fb6540a6-2574-459b-8cca-d760a4723845", "comment": "Malware payload", "value": "00fcc3111b4dcbb80cdb1dea4d02062cf995a955c9b6274ff2a2a52b546283c1351628dc662c26515517e35efd947fc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809170, "uuid": "6662b06e-7d7f-4d0b-b8cd-7780f7b313ae", "value": "T11D64025036EAC567E9604F715E7AEBF75EE9DD482960031B372029EEBA31201F90C397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809170, "uuid": "d69ad6af-0190-4e2c-a19d-be579d2543e2", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809170, "uuid": "ae19fad8-78ea-4174-8391-8cb8ee1cde25", "value": "6144:14t6LsyAWYRsw3HWstV+xSl5yQIhOygAtNSIJ/TjsuMal+CSWl3aGon4OqpuegnR:1kdW+TtV+5OygAtXlrFSq3ab4rm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809170, "uuid": "49bad0a9-9383-491d-9122-85a878b231de", "value": 334424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809170, "uuid": "ec08e951-7539-4b3d-8504-d609e5a72406", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809170, "uuid": "5d19cc79-0734-4a87-9655-dedcf720ab80", "value": "5d2f183a8bbbccf21a8a609873e68f83d2f94c3b2e34a34fa3d74ccb711ed43f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8cc7cdf-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810359, "uuid": "788f6735-0c00-4c94-93a0-cd0c9a2412ef", "comment": "Malware payload (GCleaner)", "value": "00ccfdbf8964e5e450aa5bd35391faa9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810359, "uuid": "3502b01b-af93-4380-8f83-8dd72e8899b2", "comment": "Malware payload (GCleaner)", "value": "5d9f23a172f47c41c57b189ed985f398b44e8f3bdf694c0b606fc4c500934ec9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810359, "uuid": "73cd3b57-5bdb-4f20-9bbd-dfb2a066e3d9", "comment": "Malware payload (GCleaner)", "value": "d08d8ffd18e67eff2a820cca4f6ead4e982465bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810359, "uuid": "eaee53a9-ec1f-411d-a123-18f78aa2b115", "comment": "Malware payload (GCleaner)", "value": "0cc5105a42758864c277279bd63e77ccdd0534556a4dcb5c1025cc31b2e2b87b9a01a67b5d18db89431145d453142793", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810359, "uuid": "b1280940-fc49-4eff-bb19-cd5e1807a137", "value": "T19A159D23A3E18737C1A72A7DAC5B9E5C9935BE111928584B2FD48DC84F3539337361A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810359, "uuid": "02b4f1b5-f1eb-4a89-93b9-21438945b035", "value": "fe4280c06246cc873fe89746dadec91e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810359, "uuid": "4c4ad9f7-1e0c-4042-95e3-d134909dd873", "value": "12288:MNnqG7tucDD94ypPY2VKHF7O4Cy4MOjE9taCb6CI9/wy1vBq3uBWPE1m9urv:MlluEBpPj6o4CPbE9taCbtIWEQDqm0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810359, "uuid": "cc2728f7-eddb-46f6-9f34-fe012af49e99", "value": 900096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810359, "uuid": "3ad498ef-960e-4e8d-a0e4-1c89b2bbeed3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810359, "uuid": "5708edb1-f77e-4277-8e8e-2f2f344e9540", "value": "5d9f23a172f47c41c57b189ed985f398b44e8f3bdf694c0b606fc4c500934ec9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c00a967-1970-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810686, "uuid": "fe3cd6a0-f434-48c2-9a61-4c5d6e280178", "comment": "Malware payload", "value": "4a93a863b6f9eec7fb9d8761bd7b083e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810686, "uuid": "127008ba-6a8f-468e-8887-0c95680e0833", "comment": "Malware payload", "value": "5dc7a70aa997eb386e557d6111949e9c0e4bfea2622b37f44ea686497378e1e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810686, "uuid": "47126e00-9987-4045-95fb-06189f2dc225", "comment": "Malware payload", "value": "113dda9080f8c1837baaa41a5547236f7c3f28fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810686, "uuid": "66890a44-7135-4c36-855d-2c4a6258f727", "comment": "Malware payload", "value": "f78e6dac01d80e6cd9d97818bd8f7cec02f0daa66ef793b347277d0c064a3c6e29d1994700f728df2f725f175a845792", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810686, "uuid": "0bd262c3-743c-4f21-b9af-fd1b36ce02ce", "value": "T123641A16E7607815F85349B03EB8A65629293C3A1680ED0BB78D9F4A3771AC3B4F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810686, "uuid": "e28cc657-3007-4eb8-afba-31f90595c93e", "value": "48910c907ae6315ad29ed318da26cdd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810686, "uuid": "b9f5e22d-2015-4b58-92e4-f5becbb55714", "value": "6144:aJ7qKOtsi9PGJKKU0GkfiFbfy1Hi/YFm3ijiwZ08GqOkVfi9BaEsyEyhUgH74vju:aJ7HOtsi4ffiFbfy1HidGVfi9BaEQyhW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810686, "uuid": "6f223ee1-53f9-4b9a-88a3-ed52f4353a7a", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810686, "uuid": "b217e893-3417-4d97-a7c5-ba89fe8d8b7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810686, "uuid": "277b1ce8-39a3-4ee0-8de0-a35a972e3a42", "value": "5dc7a70aa997eb386e557d6111949e9c0e4bfea2622b37f44ea686497378e1e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dbcbab5-1969-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807522, "uuid": "fe632b96-800f-4a30-9a74-a09fc5e3102c", "comment": "Malware payload", "value": "3e49375f26520e5b331d9cb8ae7acbde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807522, "uuid": "e6953588-3751-4154-a36b-357d8a2ec6bf", "comment": "Malware payload", "value": "5e4006ae43d56a61fd0796f56b99b93a1fd53ee9be7688f34d3a45d774d67677", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807522, "uuid": "ba3f7fd1-71e8-42a4-84bf-375623e1ab85", "comment": "Malware payload", "value": "9caadaf498cc4d8ad0559cfc5f817fe977c9037a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807522, "uuid": "bab697d8-8888-4fb6-b0eb-81783a079283", "comment": "Malware payload", "value": "5435cff3e973b4c6c7d1820262235d241fcf662a3fe1d97ab52d5e6644e8ad5f860cc1fb95feda495833bf500e62eef7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807522, "uuid": "efdce4f2-954e-4155-b7ab-3e5278d37528", "value": "T1CD0512550B52684EE093087469F27776FBA89E663768C7C277C0B2887E3B3458F253C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807522, "uuid": "daabc879-0eee-4329-b1d9-e0bc0d0ff5e7", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807522, "uuid": "3ba854e5-00ef-4609-a63a-e6cff194ee99", "value": "24576:IHO/MdQcpoOXcx7tWdBz6kqd43jbz1HVkMIwSqLbBYNG6:IHO/u9X+tWdBGzKb0wSqp96", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807522, "uuid": "95557e7b-7313-4c16-87b1-b1d394c8b62b", "value": 866320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807522, "uuid": "4628c8ab-787a-412b-a374-dc22c570357f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807522, "uuid": "d954ca8b-c410-4f26-ae80-399a3c745289", "value": "5e4006ae43d56a61fd0796f56b99b93a1fd53ee9be7688f34d3a45d774d67677", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcd63ba2-1971-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772811171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811171, "uuid": "1bac18e3-79b8-4c9e-9527-b2bb80db1b11", "comment": "Malware payload (GCleaner)", "value": "cce4b4e81074fff9a0991ac6cd3f0dbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811171, "uuid": "c1b7fc7a-4214-4f15-8940-0b7126985141", "comment": "Malware payload (GCleaner)", "value": "5e415efa26746b7fded56b109de4ad01c65e79e6f5523426cc6be05542a63ed0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811171, "uuid": "4d84c9cd-240f-4647-a772-d8e348695d0c", "comment": "Malware payload (GCleaner)", "value": "d8c63db151994560e359a5df7e04e313236904b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811171, "uuid": "189ddc78-d0a1-4eb5-8836-a67fbf531db2", "comment": "Malware payload (GCleaner)", "value": "a490f4ff4b0fb4df61242cad438f4673de1bb1203f1906965bca6db9546f008cbd566b22154fdd39a3b6bdc52b317c96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811171, "uuid": "4c8885d0-5926-4cbb-9c77-13cb1d5a3af2", "value": "T1BC25AEE2A2F08532D27216389D7B5E6FC9257E10ED2C98492BF41DCC8F3C7817535AA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811171, "uuid": "67717e49-e8f4-489e-b491-4fe6f132408f", "value": "1b5561a94cb01af2569d6f2ff45e087c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811171, "uuid": "3da9586b-f8c9-46be-b85e-dfe3c26519d3", "value": "12288:PXXYiviV8rqIPazxvzRNRhBydf6o2uzIrOG5kP+7l/oiA8fs08gp84zWJQxK:PFTPaZNNIN6ndG+7Kir8gp8RJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811171, "uuid": "74a9c859-3859-4065-85ab-1eae9cb06979", "value": 972288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811171, "uuid": "18a78b23-fa4d-44ce-b42a-a9a479d18e75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811171, "uuid": "24ab69f9-48cf-426b-9dfb-4014b836e7eb", "value": "5e415efa26746b7fded56b109de4ad01c65e79e6f5523426cc6be05542a63ed0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b460eb2-1982-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772818389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818389, "uuid": "b9fe5742-ed7f-40fb-b45e-d99d922a1bda", "comment": "Malware payload (Mirai)", "value": "42b4f0ed28be47e2ec801ef8ca3021f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818389, "uuid": "25919c06-c188-4489-88d6-13183963dc38", "comment": "Malware payload (Mirai)", "value": "5e753270b1a4906207487542b15d7e065a6640e9986af6db418b107e4677e018", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818389, "uuid": "86c00697-a775-4103-bcd1-57ab218de84a", "comment": "Malware payload (Mirai)", "value": "53fbd12066c22f163ab23d6e5282f5eaf35422b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818389, "uuid": "ac1ee511-ce3f-4cb9-a984-fc5fba32899b", "comment": "Malware payload (Mirai)", "value": "a89c85a6dbe1250c2c7eb80e6459def0877f2267a14a19fc71fabe0f441ee9fc98178bae36ffc0bd52e579be63ab86c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818389, "uuid": "66a179d4-c83d-4dcf-83b1-e637c6c064c9", "value": "T1E4B339C0EA47D4F5DD1642302277F73B9A32F17A1139DA93E3A89F327C52A41D90A29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818389, "uuid": "91b99f44-4a54-46c2-a40b-d382ae8c43ea", "value": "3072:XFmzGpEWmXBLFkpzjYS3Z/5+JcDEh6ohHw0pJbLv:XFmzY5mXBypzjYYZ/5+JnlHLv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772818389, "uuid": "ceebc91d-f348-4ae9-a679-ddc0e9358fc6", "value": 107824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772818389, "uuid": "740c4dd2-3586-412f-895f-4df66c4266a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818389, "uuid": "c43ba14e-03a4-46d6-85a4-e14716cb7376", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2af9f933-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772809208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809208, "uuid": "1dd0cd97-2aa5-4e0c-ad6e-a16a2fc233b1", "comment": "Malware payload (GCleaner)", "value": "8fc80117e9c35fa3ef16711692306d10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809208, "uuid": "3b7da981-d758-42c5-88e5-3e16392306b2", "comment": "Malware payload (GCleaner)", "value": "5eacc3c6d453ce49b1f8ebc66f457c060923046e4039b76bffee3f1e24be486a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809208, "uuid": "a082a07a-ca49-4cd5-bf16-5fb3eb5dd26b", "comment": "Malware payload (GCleaner)", "value": "d32bca4795cc843127d70d267ba30f70d6f6fcf8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809208, "uuid": "322471b3-7bc0-4d29-9fd5-6fa19a7eed45", "comment": "Malware payload (GCleaner)", "value": "54d917c4a237943e134051d16ae9eb6499580fe4715d9348c91cf301d70afa6b35e3b965fe4802fe2a09f1d40b51323d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809208, "uuid": "102332ca-99fe-4564-9d1d-b4e7d692e882", "value": "T18C06E0E2F2733151DD31F33CEDAAE21D1834B67E7C9409EB85469AC65B10A43E2C52E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809208, "uuid": "50c5e59c-adfa-4084-9c0f-ab1508b8dd32", "value": "234372fce9eaa047bc4c39047910954c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809208, "uuid": "07eda66f-19cf-4fea-9200-00acaa0d01aa", "value": "49152:SGQJMIn5Ld2f+SJRQgQ+Du2aZ3wUVDMxDHyQcLiBC1CyPLCLgCURGyljB:SBJMk5Ld2mSXQwtaSUVwMhCyPLCLLoG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809208, "uuid": "52b492f3-4684-4ffb-9998-25494a90c63f", "value": 3835392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809208, "uuid": "25bf4a96-85d0-4c76-9c83-0f5cfe422922", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809208, "uuid": "aa9df818-1a52-4946-bc2e-6e3cf63eca60", "value": "5eacc3c6d453ce49b1f8ebc66f457c060923046e4039b76bffee3f1e24be486a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c654d2b-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772810553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810553, "uuid": "68ced263-f064-4770-b97e-ea623a503af9", "comment": "Malware payload (Mirai)", "value": "3f9aef2bc3a3ece65412b8f499a26f6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810553, "uuid": "af617ebe-eece-4029-83ae-d9ff7b992cc9", "comment": "Malware payload (Mirai)", "value": "5f2a5ec8d40f23e0954024dcdb6b8f9e82e860c76d2af395a354a8e8592a2bd2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810553, "uuid": "c2d89a03-d2ce-45dd-9621-d069e644a2d0", "comment": "Malware payload (Mirai)", "value": "26ad1eac714759014de2c0e711b47161b0ca1fb1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810553, "uuid": "51cea2dc-0092-49f1-91ea-9f1bd60eae80", "comment": "Malware payload (Mirai)", "value": "9548f3672efd68d77e58971509a280729c1578ab32a8e185e1c9dbd6f689352db6526a6af22ec65f94d984043b202697", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810553, "uuid": "ad1708cf-1209-4bb3-bf1d-c94f4bd2642c", "value": "T19BF33969BA0F6C41F2C2D3F9DA8C87E13E1735E3C6778DA1790252EDDBA39D94980502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810553, "uuid": "7f266543-a27e-4ae4-86f8-f0c9e2aa5c91", "value": "1536:wdMiHrrc/qDHavM5Dtrg89RPA4b1X75rgmnX7Dy+IfMp3En5p5M/LW:i7vDtrnPTR71gmX7Dy7fMp3xq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810553, "uuid": "95f3a29d-42ec-443c-bcda-3c696ad67eaa", "value": 157544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810553, "uuid": "7bc50a0e-91dc-4b39-b7fa-0e5f94f57991", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810553, "uuid": "b316a1e6-b676-4cf6-8757-00adb20d2b26", "value": "iran.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "057ea81f-1964-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772805280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805280, "uuid": "7e21a8a5-0497-475d-894e-70d534e6974f", "comment": "Malware payload (AgentTesla)", "value": "1e5d40dc6ca64254f1f04ba1ae8f6b1b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805280, "uuid": "d2a532fc-d6fa-4f64-b0cc-0ee567068722", "comment": "Malware payload (AgentTesla)", "value": "5f47f9ec37932ce319cb40f451be31a9c62500dac31b79d16e5970d32612c094", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805280, "uuid": "dab428cf-980a-4515-b2bd-528234b849e2", "comment": "Malware payload (AgentTesla)", "value": "7e45fd1cc78ce76f28e51a0a2c2b57ac3a645a6b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805280, "uuid": "b18a8548-3342-4659-b69a-84dc1def6e8d", "comment": "Malware payload (AgentTesla)", "value": "06a595b0eff6786da18666c4fdf1c14b30dfa8936669bb5c9982fd278a25bf6f9885fe6a88d185dd60b22197dd7a3ecb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805280, "uuid": "47186b68-ab70-4e8f-a014-abb1dc5500dd", "value": "T1C53400027F88EB15E1A97E3782EF2C2453B2B4C71633C60BAF49AF5514516826C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805280, "uuid": "50dfea97-1417-4b40-b1fe-161bbde829e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805280, "uuid": "9c198a9a-4c64-42ee-9a87-eeb4fc8a6da7", "value": "3072:kKxZ6iyqa9PRn6sO+4YUTHo9rG8KaG5jnTh9qcufzz:X6iyqahhX+sq8KaWTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772805280, "uuid": "62d98a3c-4aa6-4e2c-9778-8626b8ad741b", "value": 245248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772805280, "uuid": "c2e570dc-46ca-4714-a3de-e9943a2d98e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805280, "uuid": "7ef3063d-8b7b-4790-841c-e249c22f4b42", "value": "5f47f9ec37932ce319cb40f451be31a9c62500dac31b79d16e5970d32612c094", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24cf6fea-1970-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810486, "uuid": "b12deec5-8a8d-444c-bc4b-1b0b2f030d22", "comment": "Malware payload", "value": "4d559ed18483c24c9b8bf9f981d681df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810486, "uuid": "e44e4de2-d7c5-41f6-a6e3-d320910c513f", "comment": "Malware payload", "value": "5f63df6ce6e6a01dc73e3120000ee6b8bbf18635a93125cf6ab91a1e636c0eab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810486, "uuid": "1b8e414e-6563-4c50-b8f1-1b108d5337f9", "comment": "Malware payload", "value": "934f30998cca07e8e2c6cc980765980134030101", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810486, "uuid": "202f30e6-49b4-4198-89c3-c5b8d454b672", "comment": "Malware payload", "value": "5a0144ad46d7717cc4421c7e4ceccb109f3f8198ca416c110fce63f098546cb2848ad7cf9b1e2ba584752705901a6436", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810486, "uuid": "9fb2c2f5-19f5-4102-9338-21d5534124ca", "value": "T1A43533C232D16A47E6D44F313A3727A81A36EEF51626424FB7486F4CF8079C6298FD12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810486, "uuid": "30f5b7e6-5698-44b2-912e-e02f67e52d2d", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810486, "uuid": "512706d2-a61c-41f8-ab78-1f599fd2a146", "value": "24576:cpkkAx2hVugNeT87RTSWOX8mCwqRnMzZsBllsZluZ3JsQb:wdAsLWokWOXU9RnMqBllelaJs2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810486, "uuid": "97b2d229-a0ef-4e09-9486-08fc1f0d02ca", "value": 1059968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810486, "uuid": "f1c055f6-0896-4188-81f0-be308d7b6210", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810486, "uuid": "4f5de89d-3862-4709-b970-e9284dc3d4d4", "value": "5f63df6ce6e6a01dc73e3120000ee6b8bbf18635a93125cf6ab91a1e636c0eab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "925e7582-194c-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1772795208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795208, "uuid": "cce3463a-25b5-4913-ac9c-f672f9244772", "comment": "Malware payload (PureLogsStealer)", "value": "488d3192c9bd94ccc2fb2e793165f983", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795208, "uuid": "d7ee7b20-defa-44f1-97ce-3282e725b4f4", "comment": "Malware payload (PureLogsStealer)", "value": "5f7e3dd13957b17da8fc4d42f97a5b07b99775ab716885b38a186e14229927c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795208, "uuid": "e210722d-5e2e-4659-ac27-e7d2d9e1789e", "comment": "Malware payload (PureLogsStealer)", "value": "4abeca97750fa7763c82da6745665090bf3dc9bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795208, "uuid": "b38c7472-49d7-4cbc-bfe8-96d06677e180", "comment": "Malware payload (PureLogsStealer)", "value": "8473048a613b9cf94db05cb34cb336c66fc6ab673ea89af3a22939f0644f3ac6a593b1394841b8be6f35272aeb5bb7d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795208, "uuid": "38592a1d-a0ca-497b-ace8-5bb0a0edcfb0", "value": "T119E6333494BDBA49C84C3430AF289F9F4DD5BA309F55534E784B99FAA431A0AF35BE10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795208, "uuid": "9d3a3c38-12f1-4a0d-9558-ad2256165b6c", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795208, "uuid": "78a6d46c-ac06-4e38-a950-82d8a12e51b1", "value": "393216:vzMsY7coi2dTbBjI+5kINnGdBzOZjiH5Sb:vzFYrB7HNnGdBzOd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772795208, "uuid": "1976af3d-9045-4dea-bf78-0ad766c11de6", "value": 15034880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772795208, "uuid": "5f8d3c25-af16-4054-b383-157316a6b6f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795208, "uuid": "383bdbf5-264a-471d-9e96-b638c89e3ae0", "value": "Installer_v6723_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23c38a6f-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772811344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811344, "uuid": "e0ea9547-fa65-46ec-976a-f132a5182448", "comment": "Malware payload (PhantomStealer)", "value": "47fddf718295946a2d1ab53f01ccd334", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811344, "uuid": "7d9fb9e0-2272-4682-aa7a-e395f3af62fa", "comment": "Malware payload (PhantomStealer)", "value": "5f7f0c5c9aef6352a28e58882f571f249dfb451daf00a0261d7a7bbb9e551d74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811344, "uuid": "658c636d-0bc9-4d49-87e9-9bf5c4e37790", "comment": "Malware payload (PhantomStealer)", "value": "3979e67d752a6c927415a6989657050121491a3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811344, "uuid": "a25a37e0-f424-4ce1-b764-56d6db4ed7b4", "comment": "Malware payload (PhantomStealer)", "value": "bee23ceb8e69080edcc214b2ee762b8d7a788c4d317a6280f44beae6291e6ea2917327e60ca8958f2b8fb8b14b77bbfd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811344, "uuid": "c06381ce-5646-4753-af50-4d08c9757be8", "value": "T1B67522682651C913C556573816B2F2B917788EEEB921E3139FDCBEFB7C22B551C08283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811344, "uuid": "23331a71-825b-4f37-a61b-8964ffbd3df2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811344, "uuid": "00614f55-3635-4350-91da-305c386b593d", "value": "24576:CI8oz/XaMQCmGUAlk5tMCxSXXWnNldPLvxYs6VmGxEcQ3JcG/2j:IoWvCmZAlk5t5xS2NljGzxEDcGuj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811344, "uuid": "c15ccd1d-570f-43a1-82c1-d1303d52b001", "value": 1597440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811344, "uuid": "8fbe2c40-a381-4618-8718-2d15cfbaa5aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811344, "uuid": "c7da2b0b-1fdd-4996-a946-f106623ca79c", "value": "5f7f0c5c9aef6352a28e58882f571f249dfb451daf00a0261d7a7bbb9e551d74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "987d7d79-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772809822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809822, "uuid": "1024c300-4032-41ce-b8e6-68da51559062", "comment": "Malware payload (GCleaner)", "value": "13b53a712e5cabae2e00c652fb849e73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809822, "uuid": "1b06b62d-1dc2-4e3a-aa28-b9c25df70efd", "comment": "Malware payload (GCleaner)", "value": "5f8b481b077b35e6e69cda8fede9d8b810357fd96d62575857249fc7ee24ace7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809822, "uuid": "79898926-db8e-441e-a17f-7cd684f03b5b", "comment": "Malware payload (GCleaner)", "value": "21496e9e61bf8b428466a8262ab9528be62ef95f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809822, "uuid": "ff7eed3d-0e2a-45d2-ad88-35b14952e2f2", "comment": "Malware payload (GCleaner)", "value": "939e0275ba8df5957a7f7ad7c8efd6280e4c6c8b8da587ef8f180858812afc43940d8c08732ec67c58aedbd384f339ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809822, "uuid": "4d994d59-f88e-4591-88a9-6c13c3b6ad31", "value": "T15FD47D65E6D08C36FD636F78DD0B52A5582DBE80692858CA3FF81C489F28381E735397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809822, "uuid": "4293beb0-e188-418b-91b4-4395414b9e6b", "value": "c475b6e242f56325f64c2b76233f720b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809822, "uuid": "dc0798f4-76a8-49eb-9a42-53c79f760b16", "value": "12288:1Q8mJu5T0Ns+MD77lUjVMSokIR3y3Jdn2tSIIIvs:WJFNhu7lK5okIxy7noBv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809822, "uuid": "77687b18-0479-4072-8275-5093fc067742", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809822, "uuid": "c9cf45ce-60b0-4277-a363-912c79284eb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809822, "uuid": "5f5da312-1955-46f0-9ed6-9736b9a28b63", "value": "5f8b481b077b35e6e69cda8fede9d8b810357fd96d62575857249fc7ee24ace7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60a84fed-1972-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811446, "uuid": "a6c3c576-935a-4256-8145-6f90f8f98bcc", "comment": "Malware payload", "value": "0d318ef1757ef664eec86e6e895f7a12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811446, "uuid": "c1b21f1a-87cc-4b5b-bb38-4d6626b80472", "comment": "Malware payload", "value": "5fb162b52b2a301a0b614f287b05301de027a43287c11e21f85949105f0db35a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811446, "uuid": "29a73b7b-fdf0-498e-953e-514ac0edb475", "comment": "Malware payload", "value": "edb46ba9fe43b08d73f74f1d10a6f873dbf3b05c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811446, "uuid": "837a065b-b212-4ca5-8d4a-77d89b718e3b", "comment": "Malware payload", "value": "b164606c38ea5a6501abfcc563991eed4fe5c4bcba109513b9d5a5c83da61c18520aaf60e99d9705e3b5952c9fd7647f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811446, "uuid": "ce2a32dd-2543-4c88-aea6-e1db738b01e4", "value": "T11FE6E00AE7AE41E4C276C03C9522632BF6B17C598734DBD76AC02F52DB933D0997A781", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811446, "uuid": "164ddccd-7c2c-4323-aadb-debc61713303", "value": "c87bab6b83ec10488c6e5237d9cb78ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811446, "uuid": "86c4de67-a30e-4a1c-acb5-eeeda4922984", "value": "196608:uZ0ETECmrKLSVvvS7LcMJkJaWqt/7dXMESyjlw4QRk7dXMESyjlw4QR2lP:00ETECmrKLSVvK7LIit/7dbjo27dbjoI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811446, "uuid": "7ce6e56c-4f67-4300-b415-ab7c480cbf06", "value": 14294528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811446, "uuid": "6c50fed4-7149-4f9c-ba06-275076613599", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811446, "uuid": "cb0d5d7b-3bfe-4679-b019-d3a4d7ed13b8", "value": "5fb162b52b2a301a0b614f287b05301de027a43287c11e21f85949105f0db35a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "027005ca-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772809999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809999, "uuid": "8d6d4ee4-dd0b-4706-8ba4-fda7f95ed190", "comment": "Malware payload (GCleaner)", "value": "48ad7b5268ef8ef20c6e57fcafc95690", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809999, "uuid": "4a5a512c-676e-4fc6-ae3d-713c01682ae1", "comment": "Malware payload (GCleaner)", "value": "5fe08d47873d9c36ce7a392fefa8ee07bb64616cc93db3356648d507f2eb5c0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809999, "uuid": "ef476f8b-b34e-4f54-b28a-96ccc529c67d", "comment": "Malware payload (GCleaner)", "value": "f1760ca7e2c973ee74e986138cdc7f8ad91fabc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809999, "uuid": "54355c72-1b36-4156-87c7-0fd74e3a00a4", "comment": "Malware payload (GCleaner)", "value": "fa686776b9f5b709db25bf9e93c74d4d00f970c247e800fd6da78a1828df0590079ad5a195e7fbf74affa1c680ec39c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809999, "uuid": "39d0bd11-0490-44ac-bc12-010ec8a7fae6", "value": "T1EFD48F21B2D08F3FD922D938DC5B56E5B836FD8029185846EBE8DC689F25B913437273", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809999, "uuid": "37de2eaf-dfab-4679-a318-ffdb3693ae5b", "value": "c475b6e242f56325f64c2b76233f720b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809999, "uuid": "99b65b54-e409-4a92-9338-555fd8ba3dc3", "value": "12288:nQ8mJu5T0Ns+MD77lUjVMMokCfMWJylPLxLxK:QJFNhu7lKvokCfMWJytxLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809999, "uuid": "efe5334d-dc06-408c-a440-0d24341b8d72", "value": 629248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809999, "uuid": "6dffbbec-3b36-47ab-bce7-2f5cba05a62f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809999, "uuid": "d7adf0f1-8e23-4c5f-aa3b-d2e88eb8a4df", "value": "5fe08d47873d9c36ce7a392fefa8ee07bb64616cc93db3356648d507f2eb5c0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0d38fdc-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772811607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811607, "uuid": "d15b19c5-fefb-40e1-a82a-e75912517a67", "comment": "Malware payload (Formbook)", "value": "5edbc15373c3406d8d94a780b3be8288", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811607, "uuid": "3345aa1c-bd9a-4a78-83ab-08f8234f1b05", "comment": "Malware payload (Formbook)", "value": "6001ce5f808cda3ca7ab33a6cb598a106a05c811607e3c7c631a6a67b2e913bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811607, "uuid": "3829448d-47e4-48ea-9810-4efdf2f51d5d", "comment": "Malware payload (Formbook)", "value": "dd75351cd50816eecfbadc0c22a7d62561f2f1ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811607, "uuid": "f70e2c86-7947-4953-8f9f-9e0ed592802a", "comment": "Malware payload (Formbook)", "value": "d1b04b1164c950a13000be74c13e93d6f0be3323960252d6b2237627e9574e49e2fe47eb01b0aea590b290a9790c48df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811607, "uuid": "1f9fd270-e3d5-4b32-ba06-8b08f52f1e9a", "value": "T1FFB4E00A775964FED41BC578C6834612AD327C8A4B71AEEF4B944E766E226F05F3E300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811607, "uuid": "f2733787-0354-4418-83b4-e5bf792cca72", "value": "c71d9111a77fb9217f1e372fa1b6214e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811607, "uuid": "9ea0a65d-e4b1-429a-b8ba-4526c3dc8232", "value": "12288:twO/jk3vRC7KJlTcv2WrwqGCNinQdIC4wNURv:twialo+OwCNdVI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811607, "uuid": "655890ba-9543-498f-b97f-846c1a0333c2", "value": 495648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811607, "uuid": "e6487ced-c436-4eec-a42e-42ea41dceeb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811607, "uuid": "8420a8c3-789d-4f14-84de-fa54f6406bdb", "value": "6001ce5f808cda3ca7ab33a6cb598a106a05c811607e3c7c631a6a67b2e913bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed2982bc-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772809534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809534, "uuid": "8b42c01b-10e2-4ecf-bf87-37a65503106d", "comment": "Malware payload (Formbook)", "value": "3985bb3638e50458db07d15b08fe5ca7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809534, "uuid": "bc25c621-490c-49db-9e1c-8c9ff8a868c5", "comment": "Malware payload (Formbook)", "value": "601b6b1a2e8c908aa336cebc2d10913c89e8ed44f7f80eb8687a8dc7be78f576", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809534, "uuid": "68f4cb53-f6f9-42a9-b41b-7f9074676328", "comment": "Malware payload (Formbook)", "value": "6c39ffd79ca0671bd91865e100ac392944e39115", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809534, "uuid": "b0128c7b-3200-4d79-a75a-f733ccc2f043", "comment": "Malware payload (Formbook)", "value": "0f7aa8f561a1b57a0fd0fa91e0b68f75fd7b17b00f2cbf7abd3ed2b5eae52d8d37b06dfff35e10a17885597af5e974c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809534, "uuid": "f01bbb01-1f56-447c-a1bd-682ab56d61ba", "value": "T16B45CF0273D1D062FFAB92334B5AF6115BBC79260123AA1F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809534, "uuid": "31309e56-bcf6-41c2-bb91-a86c53fccd10", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809534, "uuid": "4dd359c0-56a7-4271-8f8e-9dbf01cdd310", "value": "24576:w5EmXFtKaL4/oFe5T9yyXYfP1ijXdaUus8x1sDbPNX1GrILqVt2NSL:wPVt/LZeJbInQRaU/8MPqqqVkN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809534, "uuid": "d25657f5-23a6-4008-8ab9-db5825ce865f", "value": 1253888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809534, "uuid": "85877d0b-a1b0-488d-8a23-72415037777a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809534, "uuid": "7062955b-af43-4a59-bbf0-2e97f8316570", "value": "601b6b1a2e8c908aa336cebc2d10913c89e8ed44f7f80eb8687a8dc7be78f576", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f59a0a6-196d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809323, "uuid": "5a25fadd-1239-40ba-ad88-83155edbb89f", "comment": "Malware payload", "value": "9a45c849e8f745c161460019a5238532", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809323, "uuid": "da8bc2ad-9a81-45ac-9f0a-b090bc1035d5", "comment": "Malware payload", "value": "6030d27ec9229c5211dfa3ebb91981cee067c00f3a53d42c9f9dcf86c335cab7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809323, "uuid": "18c1cbf3-d785-4594-99b0-74dd3b885a79", "comment": "Malware payload", "value": "61ee5f40c1732f9673cf1fed0597c1585a567aca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809323, "uuid": "0de7f5f1-76da-4923-8504-6a96a06c264b", "comment": "Malware payload", "value": "4c55d2646c40f3220aaaf717291569739dd4f5c441e14dc232ab0ca74a790e25c87f262a29d1a274893711aee7b1ff0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809323, "uuid": "5a7356f1-1684-49d9-b7cc-110cd84eca4c", "value": "T17CE48F23E5D2C432E1226938DD1B57A5D837BEC12F285846EBE71CCD9F293827835297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809323, "uuid": "5f1a48fa-b461-4866-9b1b-331fe34ab27a", "value": "c475b6e242f56325f64c2b76233f720b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809323, "uuid": "64aaed3a-6e25-48a7-b72b-0cda72410c78", "value": "12288:MQ8mJu5T0Ns+MD77lUjVMCokGuthnqScbN2tGlv6d:tJFNhu7lKZokz+SMcMlC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809323, "uuid": "146964bc-ddb0-4c1e-bd9e-e00b210fa70c", "value": 674816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809323, "uuid": "19f442e7-aeb1-4743-a28a-7addd6cc20f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809323, "uuid": "2ec45a4a-faeb-46e9-932d-af0f2915c2f2", "value": "6030d27ec9229c5211dfa3ebb91981cee067c00f3a53d42c9f9dcf86c335cab7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94b6e076-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810674, "uuid": "5a0f5705-29ed-4186-802e-831f3a01b4df", "comment": "Malware payload (GCleaner)", "value": "c6b264b0cb2bf21642293bf5d1efe2a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810674, "uuid": "2c601896-e3eb-4dbe-8097-ac77bf7900db", "comment": "Malware payload (GCleaner)", "value": "6032a1c8dd74b15aadfb3314d5295719237d40b29600930666ced58f43d63f2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810674, "uuid": "3b7e1965-833e-4f70-b64d-d8509abf89cd", "comment": "Malware payload (GCleaner)", "value": "4ad8ea589849c79e5cc1efb5012ff03ab0d022df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810674, "uuid": "bdacbdee-cbf9-423f-83e6-97002fa253a4", "comment": "Malware payload (GCleaner)", "value": "2d8ba51dc8f364b894daf8a085936986c2c5aa66920d057af0700979fe487649d9163d53632642b6fa2a9dc3d8d42f21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810674, "uuid": "9d0dce78-3766-4099-bd2f-d2b837f7f77e", "value": "T101058D66F6E08437D1622EFF9C1BD2549829BEB02D3854457EEC2DCD8F293912D3A253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810674, "uuid": "0b71fd68-6ed3-4734-8ec5-2e56c2413feb", "value": "ca01ec09235c3305d2c87228ffd6db40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810674, "uuid": "0061cacc-1b34-4c38-beff-b6d8a3bc048e", "value": "12288:ulOUK2LDqP1ft//fwykZznp1m+fn0gPUxZOqLFqItpQdtsD:HR2A1ft//f98n/FUzVhqIDQ3s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810674, "uuid": "747e7c7f-a583-459b-a616-b808937edf96", "value": 821248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810674, "uuid": "ac9a6fd0-fe2d-4428-8d11-64c877f82d5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810674, "uuid": "ab6173fa-72de-4b36-a550-2ee74c3153bf", "value": "6032a1c8dd74b15aadfb3314d5295719237d40b29600930666ced58f43d63f2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd8ce421-1933-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772784570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772784570, "uuid": "e1bdbe3e-5b95-4f14-ae21-b692b8edd7c7", "comment": "Malware payload", "value": "34063a1cbba69f8e9a2271f334234f3d", "object_relation": "md5", "Tag": [ { "name": "app-64-7zp-dll", "colour": "#80A805", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772784570, "uuid": "9e8305e5-2d8b-4114-9148-0f236a9ab7ac", "comment": "Malware payload", "value": "6057b8ad8bd5f236767e4c6225db33e3afa79378b9b1264f6e22febf4841682e", "object_relation": "sha256", "Tag": [ { "name": "app-64-7zp-dll", "colour": "#80A805", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772784570, "uuid": "9b884598-e5c2-45d3-871d-086c10fed3e1", "comment": "Malware payload", "value": "0cef9e27b737c8d32c5cf406e614c95d2fddabe7", "object_relation": "sha1", "Tag": [ { "name": "app-64-7zp-dll", "colour": "#80A805", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772784570, "uuid": "99bd2eac-8bd0-45f3-bb7d-924316798324", "comment": "Malware payload", "value": "1d4d1ba6bbe73cfd49606b2b95a9cc1419c9d0a52466bd8e305d1c10dd59e60f52a182a7271113fbf3817e6701729455", "object_relation": "sha3-384", "Tag": [ { "name": "app-64-7zp-dll", "colour": "#80A805", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772784570, "uuid": "f25e934e-d2b9-47f3-beb5-e16606601cdf", "value": "T1AD183322B7E4C07AF0FB1B3294F2A7150A7A7FD51A35D21B3348924E5D71680EA38767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772784570, "uuid": "9c0c8f9a-b435-4042-8813-f68b22976e97", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772784570, "uuid": "549fa507-2ea7-4de8-ac4e-1824dc6506f6", "value": "1572864:K+e4h7TL9BHCLLjt2DLwCXmaBcSrufGanp7GgtcQ3AsERuqWF:be4N6jQPwCWaBcSruZkUEhK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772784570, "uuid": "d2bd76d4-4aeb-413d-b837-397095bcd0d0", "value": 88515062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772784570, "uuid": "e326ee17-c9b8-44dc-a316-93087fa7a557", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772784570, "uuid": "2970ed2e-a3f0-4024-a7b2-388338f55586", "value": "6057b8ad8bd5f236767e4c6225db33e3afa79378b9b1264f6e22febf4841682e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6ef22f0-196a-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808235, "uuid": "102e5e76-25ae-4185-8352-daa6abcc6927", "comment": "Malware payload (GCleaner)", "value": "b1bdcc580a8471f8c9a16dfededd6abd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808235, "uuid": "b0898251-2a06-46db-beb6-a7e95f4146be", "comment": "Malware payload (GCleaner)", "value": "607c0ebb43ae647bee2e66bfc794b15b334736e5e1b9887fce80cf3cd18cd2cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808235, "uuid": "2c0bbc74-31fe-4860-a6d4-17f3bacec4fa", "comment": "Malware payload (GCleaner)", "value": "2883f417b6866dfa69301a2fb34972b7eb9bd201", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808235, "uuid": "f793430c-7f8d-477b-882f-2c9286526495", "comment": "Malware payload (GCleaner)", "value": "f6a96c3fab4849d49b08fef3ea44f7ad1ac20fb4b6ce31910221c26d3e09570de2791d5a96d0c602184a28dfa3b23164", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808235, "uuid": "2c250f28-e939-4a53-94c8-6fabbbc09ea3", "value": "T11146CF0922A11BB2DB6592755D1F432CE736AE001524FF0772A46BCC0E75748EBED2AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808235, "uuid": "67109e35-a8ae-46a1-8d5b-c871bebe348f", "value": "336c69b6e8562d1c5231f219b62d7473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808235, "uuid": "a9f69e1a-34a9-48ce-94af-797711942644", "value": "98304:p9zuA3YV2ka/351pVHwh6aTYYzi+zfh4:pPTLVHSJ7fO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808235, "uuid": "9035a156-3c1f-44dc-a4d6-bca625ef4388", "value": 5537792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808235, "uuid": "4402506b-4fab-46ac-bf47-0e398373465b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808235, "uuid": "ae85590e-c9ac-4d07-acab-8e167f715232", "value": "607c0ebb43ae647bee2e66bfc794b15b334736e5e1b9887fce80cf3cd18cd2cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb729691-193d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772788942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788942, "uuid": "2f67f3a6-926c-4e91-862e-ce437882f689", "comment": "Malware payload (Mirai)", "value": "9708bfd0d68836f1719b1b07faacd218", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788942, "uuid": "6ec66cb3-2c83-431b-8620-c2556738cbfd", "comment": "Malware payload (Mirai)", "value": "608ee847563381ead73c06adb4e39b93dfffa5bb1604a7557800c6c2c2be3f7b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788942, "uuid": "e896cdd4-e6ce-4bc5-b8ac-0844ce5bd043", "comment": "Malware payload (Mirai)", "value": "a02e70ea4a3b83d7de1c3d6aec1ca944cfe056a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788942, "uuid": "88001789-9d54-4a6f-b000-73e00ed76fef", "comment": "Malware payload (Mirai)", "value": "58adb24cd87b7f54ef9b553098a05cf81595e4084bb9f7365e6ce38c771ce1c7ff79f1c2ddb6ad4016c8c66e0ead5808", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788942, "uuid": "72ef1043-68df-47f3-b6ec-ece8b11cce89", "value": "T1B903F25526A74D8BFE4CD1F6C17F23AF8D24D070D44888B9A361B07E6424FE82B761B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788942, "uuid": "61cd5017-37d7-49bc-a42b-872b155a6a43", "value": "768:W7kCXLzAmwMq8Rj1ilR7BaV8uYhat+sLcXYkyB3sUMgucKbnbcuyD7UHQRji:W7DbzCgwlXuSacsgXKHtAnouy8Hy2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772788942, "uuid": "6c9ada35-b1b0-4601-bd6c-c8751ab4bece", "value": 40244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772788942, "uuid": "8a986cc1-ec5f-4d52-be6a-bbc82910e2a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788942, "uuid": "e3a2d0bc-93f5-4219-bc4d-ff4e827f70b8", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a13065e7-196a-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808118, "uuid": "2a7d0675-3cff-4b36-afc6-8577e51dfb7a", "comment": "Malware payload (GCleaner)", "value": "1ebe3ee83bf170af5cc26e8fc662615f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808118, "uuid": "4fed1fbe-df78-4ebd-a7f8-beb06802d77a", "comment": "Malware payload (GCleaner)", "value": "6099aa532671e2e2a4da977650539a05497db072a89ad1dc20568e6f37d58796", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808118, "uuid": "58141bc5-fe20-45c2-b786-4e7b24407e56", "comment": "Malware payload (GCleaner)", "value": "81b5f6141041f65a81c40c1fe6c31a7f66d484ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808118, "uuid": "a2897444-276d-4be1-be62-09be05845b0d", "comment": "Malware payload (GCleaner)", "value": "fd8049e7f31111018331bb2c4bb67b3ca6c89d19887e09a936dd56760b37633a73b786cc0bc18acb9510bec45059de81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808118, "uuid": "3bc7fcb4-d56d-424d-abd5-ed4ba0736a26", "value": "T16736CF3252D884B7E33D117DC925CC98ACA3B93539939C0A5BED18CED61DBC41C266AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808118, "uuid": "8dc0d622-0639-4a4a-9201-d2ab05bc7e09", "value": "e5f32a93ddcf3aa9009cd70911b0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808118, "uuid": "e34eebe6-6e2e-49b4-aaea-f95ec6e46303", "value": "49152:G9CiLxuF/Fm+pQJRKOC+BkuXNbRRGqfuUL909ZecZB0D75wAAZxLC57:G9CexeFBQRjCuNbRQUcQKO5wxU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808118, "uuid": "dbe85af0-b91b-494b-8691-fd6373ea3e1f", "value": 5182464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808118, "uuid": "35ee6bd4-4fe0-4e50-a169-5cdc55594e32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808118, "uuid": "d488f32b-3276-45b6-a6c3-aff24717c613", "value": "6099aa532671e2e2a4da977650539a05497db072a89ad1dc20568e6f37d58796", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ace18cf7-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1772808567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808567, "uuid": "9c6c67b6-8e67-43a4-8439-832bd12bf7bd", "comment": "Malware payload (GuLoader)", "value": "b78b3c73f51db7529a22fe41cdeb5b2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808567, "uuid": "05dbbd94-dd06-485c-95eb-73c40b775011", "comment": "Malware payload (GuLoader)", "value": "610094ae9885f10f3019b8fa38d3ed756f2f2e5c019861ea00275b3e0e55852c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808567, "uuid": "325b0f8f-0880-4817-b6e7-7f537847682d", "comment": "Malware payload (GuLoader)", "value": "adfa25d63a61fe0527a3c32817746919c5fd96af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808567, "uuid": "f8abb59b-bccb-4c9e-a50e-a8fad860cf4f", "comment": "Malware payload (GuLoader)", "value": "c221842eb45f619abc9eef8dde6289506fd37f1c2a5f2182552059baee48e99ee16bb19f906cef7ff3e03c2d88036e3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808567, "uuid": "d14b8df1-c786-4a95-bb9c-504198f864cc", "value": "T11484F147EB1BA851C2858873C9F488FBE7B09D62A456083E3352BF1A59355CFCD0927E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808567, "uuid": "1ddab93a-0ba6-4633-bac2-5d3590bdf5b0", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808567, "uuid": "b5aca63d-84e3-4ddc-9563-a7161afe3760", "value": "6144:ZNDlOLZLClTgENcFAlyqR+7xrFC45/XNeftQC3jgG34CL6pSg0TevpX:Zk8TgENct++7FFNXNitxjg06wJSvx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808567, "uuid": "d2aaba81-07b1-4ba2-bba9-6c9bc14b53f1", "value": 384552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808567, "uuid": "7b5ea930-2fa3-4fb6-b35b-d14fdba4c6b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808567, "uuid": "1b9a5ad5-199a-4025-8d82-973a78b53599", "value": "610094ae9885f10f3019b8fa38d3ed756f2f2e5c019861ea00275b3e0e55852c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a0cc007-1974-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772812213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812213, "uuid": "749e4901-514d-42ef-af56-41e7a0a29754", "comment": "Malware payload (Mirai)", "value": "bd186ce3a4c51af66ecba71f9397f2be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812213, "uuid": "4f7f6642-bf3f-440d-9c56-b29eecfeb777", "comment": "Malware payload (Mirai)", "value": "6150972857b45f29dd37d503a1f90a5c833e4e0419a10ecbf2342931677d0231", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812213, "uuid": "6244a926-5425-447f-971c-26e1beda2edf", "comment": "Malware payload (Mirai)", "value": "e95625de086d574591fd4bd56972456e68cb36db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812213, "uuid": "927c095e-0e93-461f-8423-c5dfcf5047c0", "comment": "Malware payload (Mirai)", "value": "12c52c12f9daa8c67338da037261ce5cab026abf155b35a0b296613c87b5e62c67ea0af39a629d35507b7ed121af109a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812213, "uuid": "9168d1a5-3fe1-4f74-bae5-84f28dbb50a7", "value": "T113E3F845F8418F17C6C612BBFB5D428D372A17E9D2EA71039D216F203B8BD6B0E36586", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812213, "uuid": "ad19ce7d-175d-472e-b1b6-cf65ac30d4ae", "value": "3072:J/RfCNaL2tGeQaZdSvfleF3pc2k7X2SwfjrugMhAD:FInZQ+SvfUpc2k2SQMhAD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772812213, "uuid": "361ae648-fd1f-4163-b2ce-1d4a71c160e0", "value": 145448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772812213, "uuid": "dbe6adac-6b12-48ce-8ca6-e3bdb6fea3c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812213, "uuid": "690120e9-13fe-4d83-8f15-b580e0686104", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "034a27c0-196a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807853, "uuid": "6aa1b016-0e82-4f83-b364-2f430935fac8", "comment": "Malware payload", "value": "ba59f84eba753360edfece2df6e161de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807853, "uuid": "23316da4-2568-48a6-b0b9-6989c969050e", "comment": "Malware payload", "value": "618577e56628367433a296514db3ecb93d736b74a7366a964774355010f664e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807853, "uuid": "328604b9-da1c-4c04-9df0-eb6e123a8036", "comment": "Malware payload", "value": "8f15e2f7155c5ebe128a3b2ed5022e84827b95e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807853, "uuid": "ee4d7e73-c7a0-4d81-b87e-a744d12beddd", "comment": "Malware payload", "value": "74154dbd00c5281ab0bb20a3084d8595cfbf2c4f1052d49baf1989f3746193ae2ba64f4d7433bcab95d8df234127dc26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807853, "uuid": "cda7d051-0bab-4b5e-ae8b-2863483d4411", "value": "T156151202B750C42FC4570B714A76F2B96772DD446E521B4B27C4BF6B3C723A2DA0A39A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807853, "uuid": "5413f774-e0b4-4622-932a-9ad7db068ab9", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807853, "uuid": "80112f38-4dec-491d-82e2-85f5e23c776f", "value": "12288:1RpmoFy2cDVMbBvbvCD+2Xpq2NRF7+CHSy7+8892YTQ/Ue1Txon6dB9mf0+5CtMB:1z5y2cDVMJbvC6m7yQ89PMUmTz1+5Vv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807853, "uuid": "a1760762-062c-468b-94f4-d6d7978ba956", "value": 949536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807853, "uuid": "d5c03e76-8c88-455a-befe-92d3a565d473", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807853, "uuid": "3233d874-488b-4282-9b30-0c03f955ca17", "value": "618577e56628367433a296514db3ecb93d736b74a7366a964774355010f664e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72305723-1985-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772819636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819636, "uuid": "1f60e5e0-8aa2-4b71-8626-314b2130aed9", "comment": "Malware payload", "value": "1dce663ce3b420e25d6de86102388c57", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819636, "uuid": "b50a8b3a-3a14-4177-95e5-7ccfeba90bae", "comment": "Malware payload", "value": "618975cfc8db362cb387777103e9721a2e809f301cf8308eb4ec39d80e3fcc03", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819636, "uuid": "587d7b00-ff94-4c1d-bee1-7fabe1b50b23", "comment": "Malware payload", "value": "e0afc71146e1dcb3c67279f43b91e53cf52d987f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819636, "uuid": "839be042-7792-4d1e-83f0-adf19d33a894", "comment": "Malware payload", "value": "4abf964c099d42c3858e9038637083c23b0ea1e2a55c09657ece479f4f37cd2acade9aea1ddc2797a303b8415baca873", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819636, "uuid": "06f5b42b-da27-4299-a8b9-df666dace10f", "value": "T14B1198CD3505495EC976EF387F6187B29248E2C7B8C0173569D8AC27186463878AF93E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819636, "uuid": "19fa82f9-0b20-4e4f-bf3a-a4d9e25228d2", "value": "24:tdo6oOo3oOomoFoaoK8o7ocQq7yFxdhIqr:zbFMZLy/YYbfOFxnr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819636, "uuid": "154db233-0f83-4bd5-ae02-d4fbe10f193e", "value": 921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819636, "uuid": "0dabc537-449d-4821-9d43-201f5f896db9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819636, "uuid": "57a085be-4f8f-45d4-8c60-16be967058c5", "value": "milan.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "773c27b7-196a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808048, "uuid": "d8ed6c71-048f-4808-8c03-5762e475f789", "comment": "Malware payload", "value": "a64e5eb64d2980b7817627262e6e0b79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808048, "uuid": "607f87ae-e228-491e-af5f-eead292f304a", "comment": "Malware payload", "value": "61a6dd82d55d890c38d6d6649962549f634340275d4838ccac38df5d60cd6641", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808048, "uuid": "f93b598c-e0c3-4a8d-8bc6-3af904967cfa", "comment": "Malware payload", "value": "eaa4ae882f5360fd740f2132e65f6975b959036c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808048, "uuid": "b6e3541f-d346-4dfe-afc6-96ed076add2b", "comment": "Malware payload", "value": "d34c7731d17d5aaa4db9e8c7927e64dd83eaea4c00f71188a831ba3a59510f2b37267e09d4bfe04716ba1d35fd9dad0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808048, "uuid": "6907849b-096a-4cb6-b4aa-9c32a056b2e7", "value": "T1FD94E516EA60B0A5F49349702D78A25A392D3D3A2640EC0BB78DDF463B7199374F931F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808048, "uuid": "1ec09fe4-6ccd-4dff-a6da-294fcdf68689", "value": "c70c44f51c21e1f8732ed26038d85562", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808048, "uuid": "9dc5f4a9-8308-4c8f-b135-894c8f8c5fc7", "value": "6144:8XNqXmDfXyrEyY/AJtW76NiEE3SzW0EXbVB0c/hwb8RBGp/CraguQ1IvjlLbiQ+w:8XFXy6t76NiEE3SzWltWmM/CrS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808048, "uuid": "0c715a7a-8dbd-47bb-8cd2-957a85476d8f", "value": 409600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808048, "uuid": "6fc5ad51-986f-4fd1-a753-933cdb636abd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808048, "uuid": "646b03c8-c062-4e75-b19e-a8850410877c", "value": "61a6dd82d55d890c38d6d6649962549f634340275d4838ccac38df5d60cd6641", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eb883cf-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772810181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810181, "uuid": "4d5a2f3c-67bd-4f9c-a311-e52fed1d0ec4", "comment": "Malware payload (Smoke Loader)", "value": "bfef3bf8c26ee66cab64cc9a997ad94c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810181, "uuid": "70fdd02a-d00a-460c-9303-15813461de2b", "comment": "Malware payload (Smoke Loader)", "value": "61bf4833dc24be291e3a21803a8b47a397fbd8d706267e64ac0b7aa24a5d5fad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810181, "uuid": "75220032-a58f-497a-9ce0-8cf75bf7c425", "comment": "Malware payload (Smoke Loader)", "value": "e1efd876b02d8cf86e11cf7ca8eb976ca53a3367", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810181, "uuid": "a2b131c8-ca31-418a-baba-65607b4e80e3", "comment": "Malware payload (Smoke Loader)", "value": "0ae3a8a075699de25e5e349ad08879ad4f97168557560559aa0f2e01bad3efded19023aedaa4a2dd4ff7cdc5189b0fc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810181, "uuid": "372e3a9d-6df9-43a0-a883-babba45fc1ff", "value": "T153B539537C819074D5EAF238A9B01256B3B0B848473037E37F967AB95D767CC1A3A398", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810181, "uuid": "3c5e986a-6b62-4e66-b3b9-bc8579c16b33", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810181, "uuid": "7298cd04-7f28-4afc-8ad3-259d85c30e3c", "value": "24576:XVzLWmva3oT/T33lGOUXZEpou2oISgnDOvK1I01G:XV3Wmva4T/T9ouWSgnyvK1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810181, "uuid": "95906de6-4af6-4560-8bfc-9a3960996b96", "value": 2296832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810181, "uuid": "99be79e8-b5f3-491b-85d8-e638bca9d2f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810181, "uuid": "d9be6d8b-884e-4d87-9fd9-7d60e5239593", "value": "61bf4833dc24be291e3a21803a8b47a397fbd8d706267e64ac0b7aa24a5d5fad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3267b372-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1772808362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808362, "uuid": "a5bc4a0a-08e3-4c70-ba45-3d172069daa5", "comment": "Malware payload (DarkTortilla)", "value": "13f0f52cb6b7dec59cfb027295bf74af", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808362, "uuid": "4fb45a36-0b6c-4e74-a854-3597850bb574", "comment": "Malware payload (DarkTortilla)", "value": "627377ca652feeb00041406f9db5a9489c8b4ad07e798762a1394e907feaa959", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808362, "uuid": "4a8914bd-1b47-41f3-860f-cb2705845fc4", "comment": "Malware payload (DarkTortilla)", "value": "a2deaade79362297c05bb21a6895c6509b4a3aa1", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808362, "uuid": "f43425c6-6880-423d-b649-1fe5907a0654", "comment": "Malware payload (DarkTortilla)", "value": "57c8b1b88788b66625299d02079fe4f5fc6d192856f0bbe41bead36c14806ca00647f6388c61a0f38e53eba585a0c2b3", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808362, "uuid": "3d59f5d4-5532-4e40-995e-0164c80b5972", "value": "T1B655E10B27C04A64E5FC8B75D3B900E543FBB71B5722E75E680A11F78D22756AE01BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808362, "uuid": "cc81dea2-8240-42eb-b75c-ad18427cf5c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808362, "uuid": "ec4c5f12-cf1a-44fa-b456-d7eeb8b114e8", "value": "24576:6sfZNC8ZHKJCX0fI8mVS7GSLCFKwWd2KezQuwwsvRjS:tZWWgI8mcCSLHwk2RMBJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808362, "uuid": "1eacab16-8507-41e8-be32-244797c58c4b", "value": 1386496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808362, "uuid": "a86ade45-d0ff-4a16-9fa9-ecca6bb3d89a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808362, "uuid": "ec3f698c-8a4f-47a0-afe4-0be13ba1eca5", "value": "627377ca652feeb00041406f9db5a9489c8b4ad07e798762a1394e907feaa959", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f4fc6fd-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772811309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811309, "uuid": "9b46c88d-c047-4dea-bcd0-378afcd61771", "comment": "Malware payload (Vidar)", "value": "133e519a95fe4e613a1abe54081587cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811309, "uuid": "cc64e4cc-9ef6-4dca-9256-fa9f24aa57bb", "comment": "Malware payload (Vidar)", "value": "62a5e40ce8684d549b48540e07559b3fa2a00354cb30ad352101f2b12e29780f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811309, "uuid": "cbb94f8e-16ed-4983-b7b9-109901416dd9", "comment": "Malware payload (Vidar)", "value": "8793ba264867f45771feebf6da8c908477349771", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811309, "uuid": "283d2aec-c03c-4b56-86f8-a1d0cc42965d", "comment": "Malware payload (Vidar)", "value": "6d8752d3e71a1d276e394ddbae69f505f25223ef9f0263e328068b583ec5e757bc0331adce16ba8da781c9d1a68e174b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811309, "uuid": "904362e7-eb4d-4cfc-9784-5b9c53248521", "value": "T149C539AF9D9219E9C4699371C8B6C1D2663BF869073E63D31E407A301E726D44CBFB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811309, "uuid": "9741bf91-32ee-49c3-a6d9-466ccdc3fa79", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811309, "uuid": "cb3c5d71-31b1-4d05-93b5-d28eb6adcc23", "value": "24576:b89c4QLYCkmAeijpHDlltSRm3Z25PpFWIc/ZMaoD1rtPobI+/Tisi:b89cxLYCkTeiRlW5PvOK1sBh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811309, "uuid": "856e64c8-e000-40ad-b92a-27152d14367c", "value": 2534400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811309, "uuid": "1b581eae-5c80-4ede-bb4a-fe0ac4d6007b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811309, "uuid": "01b55d97-3875-42c5-9753-20acdc80106c", "value": "62a5e40ce8684d549b48540e07559b3fa2a00354cb30ad352101f2b12e29780f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29b093e7-1977-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772813501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772813501, "uuid": "b23ba5a0-435d-4be8-9d42-fbcf301ad045", "comment": "Malware payload", "value": "3024c175054363148639e437d815f5f7", "object_relation": "md5", "Tag": [ { "name": "pw-ryos", "colour": "#D57FE9", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772813501, "uuid": "8d7cf200-70cb-4573-a1f7-003f1bd81b8f", "comment": "Malware payload", "value": "62b0303d06a6c3be5cef2d8205d93f79d991ae7823a6d6a458bee1a095847f3b", "object_relation": "sha256", "Tag": [ { "name": "pw-ryos", "colour": "#D57FE9", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772813501, "uuid": "b870dd20-2d35-43ca-bd8a-95fa608537c7", "comment": "Malware payload", "value": "8ff330dfdd54a72bcfe613905463a04612d326f5", "object_relation": "sha1", "Tag": [ { "name": "pw-ryos", "colour": "#D57FE9", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772813501, "uuid": "1a10aeb8-34e6-432b-81e8-4fb541a22d01", "comment": "Malware payload", "value": "89eee9984f971eeecfc4840fd27e5f98462d7e2b6b52c51b124cc944e06211767c66b39c162ae5f1a58dbc19a3b1921a", "object_relation": "sha3-384", "Tag": [ { "name": "pw-ryos", "colour": "#D57FE9", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772813501, "uuid": "dedd1233-20e5-4ad1-8c29-14e5d2e52ccf", "value": "T1D716331D910E3B28EB304A3671F2A9629ABF7F40E0502103539D5B81E145FEDFEE5E69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772813501, "uuid": "e6233845-d4e4-45f7-ab2d-81b02f78cfe7", "value": "98304:dW3NYhG/29XQrzoSr81sjIEP+zbbSop873Hbdo9i:Aetw81C+zU7Xboi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772813501, "uuid": "b32aa2c2-834f-4dd1-87c3-8df0aff9b773", "value": 4326297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772813501, "uuid": "d6ccbcd5-444c-4d1b-a3b7-11be7e92fcab", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772813501, "uuid": "ccdb5eec-7776-4c0c-80d7-a06f77320bd8", "value": "Bootstrappper-9.991.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0af83e93-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772808296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808296, "uuid": "2e085c1f-7cc8-4a14-9fae-2e30510df4df", "comment": "Malware payload (Formbook)", "value": "4e472ff0280677a49773831908e4ad2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808296, "uuid": "babf36b0-817a-4ba7-8f66-b01558fefa0d", "comment": "Malware payload (Formbook)", "value": "6349ffe959c00ab04329bf59e7bc1cefaca892bd112077d6ec4abdb0891d3b1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808296, "uuid": "ab7c91be-36c4-4fad-b25e-d4a90565acc1", "comment": "Malware payload (Formbook)", "value": "173ade348797fcd596a41db973a568dc01aee11d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808296, "uuid": "cac98ce4-5a36-4a63-99b4-beb088c151de", "comment": "Malware payload (Formbook)", "value": "fae410e01816a5e5d042eb18ed354fd79bc7697e34792cc32b77dced26b739336e5c8794989ce5cfe04ed5a680e966ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808296, "uuid": "aa9732eb-4273-46ca-a581-2f553ad11e32", "value": "T1F635235162CCCD47E89903F58A72E33053B8DD9D7921F3528ECE9EEBB8977818848356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808296, "uuid": "c5c4327b-296d-4d3f-a950-265b5990375d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808296, "uuid": "3af1a411-4fbf-41d6-a718-6d2ffa382095", "value": "24576:psjguQlVictCgnLKYnM4ts2i9F8H33X4M2OCn5/o4ZrFty5X+ka:pssuWQcngbjWHoRhnJo4Jy9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808296, "uuid": "6c2ab6bd-9a87-4787-a9e1-1d2cf93559ad", "value": 1093632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808296, "uuid": "892af168-7c03-4289-928f-d6b821d081c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808296, "uuid": "750def61-141d-429e-86fe-b2cee1ddc2a6", "value": "6349ffe959c00ab04329bf59e7bc1cefaca892bd112077d6ec4abdb0891d3b1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8c80b8c-198c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772822734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772822734, "uuid": "2f615c06-19eb-415b-9986-d86b29fc2b8b", "comment": "Malware payload", "value": "b7a3fe9d4782920be951f343b01cd3e2", "object_relation": "md5", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772822734, "uuid": "0ebb1824-21e2-41ef-9565-f9e9bf4cd650", "comment": "Malware payload", "value": "6371f599f652fe2126886c487718173008a14bf830d1a1f707201cfcc2e7f552", "object_relation": "sha256", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772822734, "uuid": "068c965e-e246-457f-8dcf-f3e0feac2cd7", "comment": "Malware payload", "value": "ef3bc448f27824d905d8826e6a5dd5cb339c782e", "object_relation": "sha1", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772822734, "uuid": "002a9858-4211-4343-960a-dfcadc63a6a1", "comment": "Malware payload", "value": "cf78653c0488c0b90eb2fbf80726ed8584efedce658ebaf3f14b8e7b36a50fa93176c0a7e1f322084f54f67b8e728a78", "object_relation": "sha3-384", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772822734, "uuid": "e7f8b135-a53f-42e7-bf3c-4e9d5b124b7d", "value": "T16393C09073EA4E04F6754B38853B66A08A9BBA49DF32DF4D0264D5090CA1754DD98F27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772822734, "uuid": "d5c5a483-bef4-440f-bead-867b3320acc7", "value": "24:95Ks/9l5lck0YTef10gdiio2Ae6rxlcsnPcYXFD1:919l5qYSfMBe6d1PcU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772822734, "uuid": "ddb56eab-0c1c-4c65-b654-5a4613be1517", "value": 93947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772822734, "uuid": "51aad5bb-363a-4caa-b547-a51bdb3ef840", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772822734, "uuid": "8fb64107-7b4d-47ee-86c7-5c86159ce30e", "value": "Odinokie_Zvezdy_Svetlano_Gorsch.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf46a5f3-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772810746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810746, "uuid": "8cf4a4b4-4285-418d-8b88-4809dc602918", "comment": "Malware payload (Formbook)", "value": "4b5d3c9bb87910786673ca1701a68abe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810746, "uuid": "2517d1fb-f482-4733-8e9d-bb5c2a822942", "comment": "Malware payload (Formbook)", "value": "638d7f2a954d485a5a85f3b010dfc6505f8677a05f69cce79d482dde618f71a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810746, "uuid": "45aea7b3-90c2-4c9b-b342-de63c6543709", "comment": "Malware payload (Formbook)", "value": "fce1b4873196dd80c9b451f02cd2404ccb925e5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810746, "uuid": "1d6b5cd0-0d5b-42b5-b9c5-1b3f23f1df93", "comment": "Malware payload (Formbook)", "value": "d83be69d0797e5a9d4a9f5de5977702338b51e6177becdfa37fedc895fc6ce6e717c62ea2def035f08745b6cdd1f219e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810746, "uuid": "30ddb1af-d976-4dc9-a213-e0daec73ef4a", "value": "T1C6641216375AE827D5D402709DB266F6D9AB9FB8042853432F103FAF7DB13B18A1A317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810746, "uuid": "264b3a99-8959-4d53-a7cf-9b97ea3d42fa", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810746, "uuid": "510065ea-b3ab-486e-8716-8c9d946e8e2a", "value": "6144:IR+xXxGYvlSHBdWjF3e30X1XtibgaBR9VKmrElOxqlNdG2t4SpQyjH/McLoYE:AcG0gBEVIg1Xog89VJrElHlNdG2thQya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810746, "uuid": "ed1d3142-4ac1-455d-8c2c-ac7f44d82c12", "value": 327480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810746, "uuid": "a111aea9-7f10-40ef-9d20-5b8a7b42fb98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810746, "uuid": "1fd3b97e-7278-446f-8d85-9dffaf054b45", "value": "638d7f2a954d485a5a85f3b010dfc6505f8677a05f69cce79d482dde618f71a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "102ae1a8-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810881, "uuid": "2e2b7f49-6f73-4961-8bb7-6b515eec3814", "comment": "Malware payload", "value": "de5fd5655f7a8a651ae8b4345fead359", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810881, "uuid": "306a2150-3903-4555-a849-18961a5319c5", "comment": "Malware payload", "value": "63e15f73bcfaab46aa55adaefd8117ebd0be1cb29713d3a9074e1a91c78d82fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810881, "uuid": "f488e6de-76dd-4cb3-8185-c79540f6efd6", "comment": "Malware payload", "value": "392d363f079cf4c80498c6b98c3b7399e661d7e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810881, "uuid": "8a2dd05e-2249-40aa-a0e7-b27698ccb2d8", "comment": "Malware payload", "value": "1f369870512aeac465cef7e50f32436379a70d20ba5baf5f9ac1f0238cf95c2d571bb0751381bc99a4599ce224b51112", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810881, "uuid": "a493e436-1570-4bb4-8464-b356108b42da", "value": "T11AB4236973E8C923E96A5E36CAFE1A5ADEADE4035024630FDB20DF2C3C2775015993D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810881, "uuid": "856ca270-9ac0-4a08-a8d3-6edf8337e5cf", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810881, "uuid": "31b8b3a3-5bab-4791-bc6b-13fcb6276f90", "value": "12288:Q1yDJzhz/8dNXPTvMPng+7qgYNjulSzcqYO:Q1yDJzhz8XrvmnX7QNylSKO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810881, "uuid": "5ca4eb10-c9d7-4c94-8f82-42df19d89bcc", "value": 535592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810881, "uuid": "7271071c-b7ff-4c10-9c0a-4b6e8223f402", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810881, "uuid": "1c3fc49e-9332-47a3-9f35-458a385573eb", "value": "63e15f73bcfaab46aa55adaefd8117ebd0be1cb29713d3a9074e1a91c78d82fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17e16285-1972-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811324, "uuid": "6cb69c54-b08a-4a87-b83c-d9e4b9075870", "comment": "Malware payload", "value": "d78fec4f96713d609e12936554ee3308", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811324, "uuid": "30ca8e40-f089-4ffa-b7e8-6b698879c660", "comment": "Malware payload", "value": "63e6fd867484bf1421ad7b525bff9630ff6a0bf042ffbd388dd2d5a5716358ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811324, "uuid": "7a98350a-0944-40be-b13b-9e891d8024bb", "comment": "Malware payload", "value": "8018f028f697c3d2c3916a19ff66783ba3c2dbaa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811324, "uuid": "5110caef-001f-4ede-83b2-4ed07a1dbf17", "comment": "Malware payload", "value": "20f37122de774d8fbcbb24079611b48b0f8cee32cbde4bd56578e50901d62238bc1ecae66c0f0326863ced154152c200", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811324, "uuid": "31edcc85-d1f4-47b2-98d1-8055205cf37c", "value": "T10C9412063DA6D05AC98314710DB2A9BBC974ED6DA418871337B13F0E7A71245BE4E3E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811324, "uuid": "0deff5f8-fb53-4127-8ee6-f8fce2c0f566", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811324, "uuid": "3741f739-1428-4132-a48b-1f689b300bea", "value": "6144:nwq3NpGrARtjLMJMIk9UAPFBQwIWXAELpTagWDKslQKGuSzfz7q7:nzSiG1k9dtBRI3EttWDLQ33y7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811324, "uuid": "8e32f49b-1da4-417a-a034-134e8b0bdfee", "value": 408353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811324, "uuid": "939ef1b4-959d-43f6-bd06-288f44da1b11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811324, "uuid": "5f131734-e854-468d-a33d-a25dce667788", "value": "63e6fd867484bf1421ad7b525bff9630ff6a0bf042ffbd388dd2d5a5716358ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd607dbd-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1772809561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809561, "uuid": "d772e2b9-eb3e-4e7a-9e3a-2274548df341", "comment": "Malware payload (GuLoader)", "value": "6bd61fa1cc45c7721a34123449a5442f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809561, "uuid": "e7f28be0-394c-4335-9990-0645db7d79e9", "comment": "Malware payload (GuLoader)", "value": "64aaa3dc6c606a2c1b6015db31526762f465ce9b347d06e2cef0420cb6199a5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809561, "uuid": "f50f8c3d-0e34-4b33-b2ad-2a48fb33cb75", "comment": "Malware payload (GuLoader)", "value": "9499b25d10eb98dc58282f5e26c799d056cb71b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809561, "uuid": "a5854600-e79c-4dc0-8810-71cc9db4c979", "comment": "Malware payload (GuLoader)", "value": "4293d83c56fbbd421922083f3bb880ceb9cca61ada8563ad097a5f2e2aeacc81c9c194afbc382230ee16b27c7566f020", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809561, "uuid": "1418e6a2-abb8-4013-ac98-d9f508b7dff2", "value": "T1FD44120672D1C1F3E5734B748D3B9A3BE6D5CB122191960B3B753E6F7CB2306092A162", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809561, "uuid": "bf679a97-2db9-4474-ac98-258f679b0a0e", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809561, "uuid": "3b7802d4-7b3d-4151-a23e-3bfab37c3f45", "value": "6144:0cBvWb0e4vcCmotxJNIKduziH6+2Rk+VzpA1vqloiE0QO5Gq127:dO0e4UCZ/Jp9a+GtAVyoZoLW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809561, "uuid": "39f3cf7a-832c-4239-b943-808ebbca12a7", "value": 258680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809561, "uuid": "2fd61cf2-f7e1-4a14-b814-51e1b47a6744", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809561, "uuid": "7d906542-6cd4-4478-bdbe-7fd732c2d1a3", "value": "64aaa3dc6c606a2c1b6015db31526762f465ce9b347d06e2cef0420cb6199a5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a7c79b1-1972-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811409, "uuid": "c85bfb44-1655-4d46-bd80-8d75938c099d", "comment": "Malware payload", "value": "f1b572df273d3b3661a494bcaa01f59b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811409, "uuid": "b3b5d3a5-8622-4ea5-9aac-9b9223511703", "comment": "Malware payload", "value": "64b46908a7d14db0bc2f7dca5bf479e7570dbb60fcf6d01ec2c8627912918cf5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811409, "uuid": "c170d000-2607-4767-a54a-f23ad6c496ac", "comment": "Malware payload", "value": "7a160fab8d34fcdc585aa4c63215af04050e112a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811409, "uuid": "3287884f-8bd0-4cd0-bd3d-322b9af1bfbe", "comment": "Malware payload", "value": "a069665026c5c9b0fda14718741fd5d16b264617f9f4eeb9df7d10fd778bb626dcc79bff2b490c2410148a59748fbecd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811409, "uuid": "9568a70f-5c6f-419d-bfea-5d15ebf399ae", "value": "T1B735233B03C3A663E894E77099BE06980DA4390F5DF9B6C9131DC73C3905DD2DA6D261", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811409, "uuid": "efd09195-2b14-46b7-9829-da9a4f369f02", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811409, "uuid": "c2d3cc88-9de9-4536-ae3e-1ebb855ceeba", "value": "12288:og5xD+s6owgJzgQOekDU+MKemqc1Ptnq6WwPSroVjvprHI4oFzSYKVP8L40lc2qi:ogJ+kLHdKDqcVWwPYkjteS7mE+39Xyfq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811409, "uuid": "a74f1a8a-71e1-487b-8eee-a019ca2f1256", "value": 1081224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811409, "uuid": "dd38c258-ca33-4afa-98ec-96c9c1ece656", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811409, "uuid": "8f8c0068-b212-40b8-a4fd-6d52e903f748", "value": "64b46908a7d14db0bc2f7dca5bf479e7570dbb60fcf6d01ec2c8627912918cf5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddd3afb2-1969-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807790, "uuid": "c18ea50d-357d-4ba8-8a8c-ac13dbfc5484", "comment": "Malware payload", "value": "e2bf458a4d70197f6814b604b6ab7f7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807790, "uuid": "0c59185b-b1ad-4a3f-8367-806bb10c3f7c", "comment": "Malware payload", "value": "64d9d1874ea3494861adaf7f6799fb693e5cfa0b2f7b35f0fe12b1c55ea34f0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807790, "uuid": "9692a352-49d1-4d2e-8602-ee38ae357390", "comment": "Malware payload", "value": "42d6654b066ac70f68137192892c0f3ba332da53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807790, "uuid": "d4e2e76e-f502-4765-aa69-09e01b6daba4", "comment": "Malware payload", "value": "1db04599e7ee4fc85920b4f1200f9148c5dd1ec7a28a4183bf41308a9d2c3eb4232097ae4541d73044756c0dcbeb1bda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807790, "uuid": "6d3a5e2b-542d-4bfd-8e00-02faadfd38cd", "value": "T1380512601741689EE0634874ACF27375F7A89E66376CC3827A90F598BD3B7464F243C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807790, "uuid": "b2453d30-8ffa-4616-9cee-605453c86abe", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807790, "uuid": "e352aa74-d7b3-4d09-b831-6b21c27fb24e", "value": "24576:mHO/MdQm3oOS0yqUWBhPaWdBz6kqd43jbz1HVkMIwSqLbBYNGQ:mHO/uHyqraWdBGzKb0wSqp9Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807790, "uuid": "25d25fbb-69ac-402e-b65b-4a7a200e5f03", "value": 856305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807790, "uuid": "c01f2c4f-e4ce-474e-abdf-52269e3cb436", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807790, "uuid": "f815f38e-3a23-4fbe-a492-7e49c190f568", "value": "64d9d1874ea3494861adaf7f6799fb693e5cfa0b2f7b35f0fe12b1c55ea34f0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4319b10-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811237, "uuid": "3fc3d8ba-6612-4f3f-a2dc-feebc9e5a65d", "comment": "Malware payload", "value": "f1d724264a17b14f2f0286aa20a84cb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811237, "uuid": "bff5399b-3868-407c-8f60-08e3757102c4", "comment": "Malware payload", "value": "6537d9909f868f54149f91a607b180ac6f6797c9859ead899a6445dabdeb6bd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811237, "uuid": "788717f7-09e0-43f5-b357-93df03bd4cdb", "comment": "Malware payload", "value": "bcd87b79b5cca83a6558531713cfb73343a5eed7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811237, "uuid": "2a5ea853-9f99-4b41-8390-5c144c218a22", "comment": "Malware payload", "value": "c9493cc3b90a16a8622da72eba0ccddba496bc363bfaded8818d73a22b08504d85166454dffd7f019d5fe7b811c2b31e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811237, "uuid": "28523f1d-dc6b-4edd-aafd-b9d873c9a2d2", "value": "T13494222016B9DCA7C5E205709A7BABF9DBAB8C942541438B9F683F573C732B6811D343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811237, "uuid": "5872f384-c7e1-47e0-b520-5cc7e15df382", "value": "9a16e282eba7cc710070c0586c947693", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811237, "uuid": "549c45a1-084c-4fa1-826c-9ba8b6719b3b", "value": "6144:lfYBQx6zVFxj7XWiDjL9NsDiTJ7m5nYJFqOsKkeahz6VmNF/Z1Wjstep:KQxst7XWiDfsI2nYJMx6cqsYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811237, "uuid": "59f6f8a4-2bce-43e2-b07f-31bbb906514b", "value": 421664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811237, "uuid": "98cadb3b-cf2c-4b2f-8b03-856deef770f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811237, "uuid": "97b0cf58-a836-4e8d-bfbf-0bce2a7d0a02", "value": "6537d9909f868f54149f91a607b180ac6f6797c9859ead899a6445dabdeb6bd6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4094b91f-1982-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772818264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818264, "uuid": "a8473628-a252-4bba-b368-4ef76c9fe371", "comment": "Malware payload (Mirai)", "value": "cebc862c8b21de091c79c37a60183f09", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818264, "uuid": "b3f73c61-2db7-4dfd-81f0-3d79ac48f4e3", "comment": "Malware payload (Mirai)", "value": "659fc80e372398501e9875260e870e8394c61546d5842fa15a3ca2a36141125e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818264, "uuid": "c1b9466b-1400-4324-a5b3-4b5c54c8a898", "comment": "Malware payload (Mirai)", "value": "3c2c704550f5c85db47eabeaf058a09c86b1d317", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818264, "uuid": "59912dfb-b3f7-473b-b513-d5792b3330c4", "comment": "Malware payload (Mirai)", "value": "af5eac4080faba17a2be60b3eb0956f6b7194165217faf0aed450afa7756b880505f0d6abe3943b92251031bc39c2e63", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818264, "uuid": "c3cd858c-878c-4ce7-81a2-28b3aedd47a8", "value": "T164344B45FA418A13C4D117BAF9AF414A3332A795D3DB730699286FB43B837AF0D67602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818264, "uuid": "7b651c8c-9048-4b9a-be15-223286d58240", "value": "6144:W8tTPA7OBzabKacEK1dAnJd7pLfdfM/9hWfAU:W8RAqBzabKacE62J7p0/yJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772818264, "uuid": "84bc637a-fabf-4042-965b-8c6a44283241", "value": 231680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772818264, "uuid": "754d6ede-e3d7-4f92-b5ad-ee6519d68452", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818264, "uuid": "fee66397-b6e5-4351-a13d-023c102cfdf1", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03228519-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819020, "uuid": "4de9147e-5bca-47f5-a738-04099c9d4ac0", "comment": "Malware payload (Mirai)", "value": "d3f71db2624bb69ba15cb9d39a5cae31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819020, "uuid": "eef88c25-9791-4fb4-9fa7-c8650318d8fa", "comment": "Malware payload (Mirai)", "value": "65b84650ff8480e82f6398afdf33f51679f31cf57e4a451d78f2c7ccea25c7d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819020, "uuid": "785faeaa-2b7b-45b4-8726-203147801494", "comment": "Malware payload (Mirai)", "value": "6c0abedc04911ed56a6385482da53145146dfbed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819020, "uuid": "5f413b1c-2d0c-4506-9b3a-13ae0901ffb9", "comment": "Malware payload (Mirai)", "value": "8d77b082f352c4bf5941f9bbb763c310997c1c7909aa33b72bb126c6b9d0aecb9d1fd19f34c6f5fa56c96faed9bee2c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819020, "uuid": "d9ca18df-ee4a-4065-9dc7-ccacdbc2ff9d", "value": "T1AD434D92F892456AC6C117B6771B978A33A363A5C2CF7313CC080B6176C9A4F4E77E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819020, "uuid": "7402308d-e501-4c81-9bfa-bf7367f68c83", "value": "768:IsWcltKWWi3Z2/x7N8OMXLPtdjYocDC27Y4CEIMfl2Fr0nMz:IsBltF3YSOqPtdNcDC27OWa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819020, "uuid": "aab85b91-ecba-4a31-9ebe-8cdf4a1552b6", "value": 55452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819020, "uuid": "606c730a-9fd6-46e2-b242-6dcdb0bbcd61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819020, "uuid": "2c20a760-8f89-42c2-b0a7-fe02b32b3309", "value": "jawirbot.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "770df688-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819214, "uuid": "a0f0e227-c2c2-496b-a800-0c5dfd3f669d", "comment": "Malware payload (Mirai)", "value": "38aaca50eeb0fd5cb343895095a91f95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819214, "uuid": "a1a225e5-f28a-4799-bedc-e11be1e0dcb4", "comment": "Malware payload (Mirai)", "value": "66f39e8528c9e95baa503cf100376315656869b69b9c4e785de5fefc6abace0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819214, "uuid": "d1ef7c37-dd5d-447a-a223-1b7c0d332a19", "comment": "Malware payload (Mirai)", "value": "ed5b9d14fc1254a36b1808d17fac43f1c1df639b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819214, "uuid": "a4d781cd-20ea-435a-852c-4ba0a61b952a", "comment": "Malware payload (Mirai)", "value": "18fa41e879a98493d548af84ad3a8f4ba6ddf55d7f8da6abd6c5af4101022774e62a61758a316ab08408ac5964fc9cf6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819214, "uuid": "675adc25-2f32-49cd-865b-b6b159dc963a", "value": "T123930A45B9819F12D4D621BAFBAE418933136FB8E3FE7111D920AF5023C69DB0E77612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819214, "uuid": "871f8fc0-9517-488a-94db-8476eb6ecc09", "value": "1536:5Tnul1UvUXZiKyoFYpra1j3/pMfbhxf9lK/igCgBO797ZVYHyLs/x1HUL:AGvUh9FYpra1j3/pMfqxCgBO797PZu1O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819214, "uuid": "b4eb9776-a774-4781-8239-e5b9cd92a141", "value": 97560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819214, "uuid": "6a578245-1732-4fc7-9853-9fb59a1cf8eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819214, "uuid": "65475000-cd79-43a3-b351-956261f587ea", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28bef78d-19a0-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkVisionRAT)", "timestamp": 1772831109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772831109, "uuid": "09ace6e5-f50f-415c-9c54-17d555292670", "comment": "Malware payload (DarkVisionRAT)", "value": "54dd9cd36da312f6c89d0a2cb0ac00aa", "object_relation": "md5", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772831109, "uuid": "6a835d94-bdd9-4c77-9a6c-324855e59eb6", "comment": "Malware payload (DarkVisionRAT)", "value": "6700075bf252fbc09453df6f543d36bbd7f7a011ed2b5bf7fc86df1c4b634c8d", "object_relation": "sha256", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772831109, "uuid": "323914d4-f423-463d-bc24-41d8e233f319", "comment": "Malware payload (DarkVisionRAT)", "value": "a0aa2bea7ad211680d850e3c0a4079de9e6ca600", "object_relation": "sha1", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772831109, "uuid": "d852daf3-958c-4726-b639-cae1820960d8", "comment": "Malware payload (DarkVisionRAT)", "value": "b863ca47f46f49f52d221c3404df9bf9e500a80aea27dba944671a274a13d11f514af4d81fb8f01bd026c82b93e51d98", "object_relation": "sha3-384", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772831109, "uuid": "80de476d-44fb-4a0f-8f88-05c7c98e3246", "value": "T1D2E40222FE4995BCC406C078C30156767B76B4CA1B32AAFF0295263C3F59AE56F38B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772831109, "uuid": "f3a30e4f-3062-4e23-8d81-4aea7c5b80e4", "value": "59a9ef17b48ce0b3e398d1c5c81c194b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772831109, "uuid": "92d11116-fcf3-49f2-935a-247214af7dc7", "value": "12288:viM7rr3MzfOwaZSHsR3d3QIS1zPA1QCaGpA+DBNWg7dilMu/KNYj/gCazB9sM7/u:viMf7QOcsdtQIzFaGxD7Wg7da/AYjk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772831109, "uuid": "5bb48430-d11d-404d-8dae-ca21541b5d48", "value": 719872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772831109, "uuid": "10449267-e2e1-4a6f-9a17-58d285d60cdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772831109, "uuid": "82b5f4a0-c868-4dbf-9231-54809940bd1b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17eef78b-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772809606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809606, "uuid": "32ecb226-68d9-4a20-9848-43f05918a8e7", "comment": "Malware payload (GCleaner)", "value": "52e1cfc321c86da8f7c64946125caa27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809606, "uuid": "23e3808d-1f49-439c-ad63-3df48a285c81", "comment": "Malware payload (GCleaner)", "value": "674748de99a3341518d5a418851c3d31ad3e9087cad4c1795c2495dcb4951fca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809606, "uuid": "9a12528b-4378-49e9-a8d2-a0c476df29ed", "comment": "Malware payload (GCleaner)", "value": "b0bb252217d8631ace955dce230cc88dfcabb2c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809606, "uuid": "e7f66291-263c-428a-9994-939037b68bce", "comment": "Malware payload (GCleaner)", "value": "2774b7a196f6db59c4e858ea59ac9c88db58cee1dcd0f8823543ded3ab58762ac8b5134852e2a332435124f66c4c1b92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809606, "uuid": "578c2769-71e1-4584-9153-258deb39e100", "value": "T1C336DF1B9EBFC13BDD6CB8BE680058CFB0B38A5451EC6B30625895DCCE5F2C9246255E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809606, "uuid": "6630e813-d6d1-4e69-86f9-93ed0b63ab72", "value": "345624d13ffc2b7f296b9d2972b1c0a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809606, "uuid": "436b1983-0dbf-4a62-91a5-9bd51db51150", "value": "98304:QiZvok/3ZM4ArVbmhmBF4lgnQqBPfeLa5bOl2xkMXgAdVXA+zwMAmc:Qo9fZM4obmAmgnQqBPNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809606, "uuid": "138c80f9-7760-4ffd-a15d-1ac95d5d8e25", "value": 5029376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809606, "uuid": "83d3403a-3e80-4a70-8d0a-845ff6191306", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809606, "uuid": "1def9c0e-4216-44fa-8972-6f422480d82b", "value": "674748de99a3341518d5a418851c3d31ad3e9087cad4c1795c2495dcb4951fca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cafd3a8d-196b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808618, "uuid": "89061758-0c06-47c1-8416-7e1b884341d0", "comment": "Malware payload", "value": "52203769e93071995ed90115a56533cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808618, "uuid": "ece7bb2e-8d92-4c9d-89a3-739c8a2cb5d1", "comment": "Malware payload", "value": "67fe04b760067e121b3a5ff191b6a59caf265b66972774075df5fe0e60bf6ac3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808618, "uuid": "742fc10d-8d9d-440a-91dd-f3baeef767ec", "comment": "Malware payload", "value": "ecae632c599aee72a91704957fd60c59677245dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808618, "uuid": "05ab7869-4a56-4186-a497-13bff4b8463d", "comment": "Malware payload", "value": "76d5e24e21fcbdbdb2ca51ba3f22fc3f1f1ff60855f8fdd46d47ee578447eeb9b2b516e56873599d7ee7c6625102e6f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808618, "uuid": "4f98e188-7273-4d00-8b25-18f9c1f2dbfa", "value": "T12545BF027391D062FFAB92334F5AF6115BBC79260123A61F13A81D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808618, "uuid": "58befb1f-6811-4210-a72b-02ee185a3e34", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808618, "uuid": "5da25e2d-1d86-412f-ac42-90f0ebf3a613", "value": "24576:j5EmXFtKaL4/oFe5T9yyXYfP1ijXdaxPQbaWxpKcgOfH:jPVt/LZeJbInQRaxPQb7H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808618, "uuid": "328aa0ad-5bf3-46d4-9349-81c3d31b75c3", "value": 1247744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808618, "uuid": "6ccb395e-d229-4c45-b11c-ace784609635", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808618, "uuid": "2d1b211a-0be8-4f34-8168-1258db405682", "value": "67fe04b760067e121b3a5ff191b6a59caf265b66972774075df5fe0e60bf6ac3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d143271-1968-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772807011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807011, "uuid": "d4500e91-acda-4419-ace7-9d5449124aa4", "comment": "Malware payload (Mirai)", "value": "37a4366a29004b2dd9c6083523c20b5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807011, "uuid": "3700620e-bbe1-42ed-87ce-68eb5efd4871", "comment": "Malware payload (Mirai)", "value": "68eed2b97161c75322106029922d3ec7eb8272add423bc18d58ee3bcc4656d4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807011, "uuid": "4919836c-49f0-4c54-a046-8454e36cb42a", "comment": "Malware payload (Mirai)", "value": "96ddc8c68e4091bd73c295e3ba0331e7f78fc61e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807011, "uuid": "60109f8b-8679-4cc9-85dd-847c12658111", "comment": "Malware payload (Mirai)", "value": "d562a8f9711d8f164ffc931126a2304922ca71c240b679cbb930a5c789f8dc8578b68bb2bdde326d4b5571d0eb896409", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807011, "uuid": "3544a7e8-84eb-4004-bbfb-55f7be3ea351", "value": "T1D623F1F6D39BE07CC8B0A6B7025EB1C6946664029721370E43E232DDFD7B5986D02783", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807011, "uuid": "54870040-cd2b-4aac-9093-b85f60c38101", "value": "768:RdGwNYm3GJyOvAZhON6YONKVLQi0jytVwLRZ+v84GZ2S0Jz1b8HuR4x:2wkgI6YONsLsjwVwimoLzxTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807011, "uuid": "60e5f25b-5f55-4790-b259-3e0f16c5b34b", "value": 47768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807011, "uuid": "695e6d02-a104-4e1d-ad30-6fc2abcfc831", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807011, "uuid": "71fef915-e1e7-4402-8b3c-ba4d97d87282", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "315820d0-1971-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1772810937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810937, "uuid": "ab6bef63-487e-4888-a6ba-23584c3b9bd6", "comment": "Malware payload (SnakeKeylogger)", "value": "d5fc549db0f0c4d5c87c17a8dfe5f8d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810937, "uuid": "95381635-06e8-40a2-a79f-487a5dbec553", "comment": "Malware payload (SnakeKeylogger)", "value": "696cad6dec39d460faa61e4cf11cb5fc7f554b4e5584cab27f1e189c0cf935f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810937, "uuid": "3c4fff3c-7699-4861-b42c-04a9d36ecb2a", "comment": "Malware payload (SnakeKeylogger)", "value": "6f1a9214029c1698e04c5dd86837c3ebca2559cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810937, "uuid": "0b668f93-c18c-4474-aace-b37b1f296660", "comment": "Malware payload (SnakeKeylogger)", "value": "b06517ecffd80d089f01402b42d939706cee004ab65ceb9dc0e26ab5ea895d5f848c2aa5f5cac134a50570539b0c525d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810937, "uuid": "79ffd658-f57f-4cd5-88c3-0b8a813941dc", "value": "T11545BF0273C1D062FFAB92734B5AF6115BBC79260123E62F13981D79BA701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810937, "uuid": "166868f2-8b3b-4f14-8660-1975186b4a8b", "value": "c1ce208b1192bfcf652c179f34f034d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810937, "uuid": "fa2deb86-c7ce-478a-a6b5-3507e8b82ad8", "value": "24576:y5EmXFtKaL4/oFe5T9yyXYfP1MAXDzcqzjT5VYplm1O:yPVt/LZeJbInGizcKT5V6lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810937, "uuid": "fbe2d8fb-08a7-47b7-afa3-460d46177814", "value": 1257472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810937, "uuid": "91536a84-47f6-42a5-a442-192b074835ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810937, "uuid": "0436c2e0-df6e-4e9f-8eb9-6372ba9eb726", "value": "a1eac05b425841350c27d46607b35627c810d1454fe6037458f5b31739885c74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13a7f4ec-1968-11f1-a769-42010a9c0008", "comment": "Malware payload (Kaiji)", "timestamp": 1772807022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807022, "uuid": "c515e146-a2a2-4498-a82c-7929560ea9c2", "comment": "Malware payload (Kaiji)", "value": "fe4617f616fc3aa1ad7222f9ef434046", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807022, "uuid": "00bf5a6e-ffde-4634-986b-9cd9bd3e8cab", "comment": "Malware payload (Kaiji)", "value": "697e5f7231245db67804794309ecbc55d403c20f9efdda785eaef08ebe02dd63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807022, "uuid": "2e659fcc-3275-41c5-83a2-330944d5d0c5", "comment": "Malware payload (Kaiji)", "value": "78f5f55a20e53123fd4cb03f759f9010a7d6c014", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807022, "uuid": "270eb9e5-8f99-457a-8033-d0fd9525e94f", "comment": "Malware payload (Kaiji)", "value": "79c50d1831c1736fc3767d61bdf049e2046ebb8c405d8700d514204cc9b57f751c37b3e27824d0d394d31c7d942e5e95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807022, "uuid": "8c666503-dc95-4056-b7fb-e54d6544639d", "value": "T196A5330C7059913814D49B99EBCBB4E805023A28BEAE2E0F47176BD6305F9FD49617BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807022, "uuid": "cdce18fb-d4ed-472f-8e1c-a15b926cc5e2", "value": "49152:zVU8xqZzWitdN7MIqZxl4CNrRVuSt48wwnSwKp:zVq5WiT4xHlfBnw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807022, "uuid": "196bc1b9-24da-4e15-8dbf-e3abc2bba4a3", "value": 2067688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807022, "uuid": "c1ecd23a-ef3f-45b4-9875-f05fed9fa00a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807022, "uuid": "68bedb33-85de-4598-8cb4-1984f216f6ea", "value": "linux_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9f5c52f-1939-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772787114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772787114, "uuid": "72ce9419-6e4f-4c21-bef6-ca343cfdb012", "comment": "Malware payload (Mirai)", "value": "979998b15cd5be3c394801b8742440da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772787114, "uuid": "dcc8b84d-01a7-42d7-94ba-0592f4128d5a", "comment": "Malware payload (Mirai)", "value": "699b40606a134fdef5dd5ff6a5ee1de6ac351d2bb36dd4e731fbe7e53d0ccb87", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772787114, "uuid": "58a4eecb-a4c7-48dc-861f-03a5abd71b91", "comment": "Malware payload (Mirai)", "value": "5e2bc58fea713d84708a4ce1eb06b628044ddaa7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772787114, "uuid": "6a84d525-11ba-4e4b-9bec-57999638b027", "comment": "Malware payload (Mirai)", "value": "b47ae6df53e7e6864e66da3d8cbf452db5d5a9553134017a0b61eff9fdb1385827a832395e95f3cd19c304c1785a69b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772787114, "uuid": "8ac54850-81da-401d-a13f-e5c95c573477", "value": "T19BF31795BC519B16C6C616BBFF5E428D372A1758E3EE7203CD256F20339B85B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772787114, "uuid": "8724c3bd-c1cc-4e42-aa01-5cfd485d25f1", "value": "3072:9/GP143xpXFi2ibsip8xI2V9jDs/4+OBWg+LwemLaGMW:9uP143xpXFi2izp8xI2V9jA/4+CWg+Lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772787114, "uuid": "70f590ad-03de-4933-8b3b-dc8c9f693c39", "value": 161080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772787114, "uuid": "4dfd1d72-d1ea-4ba9-8073-51d28e21b76d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772787114, "uuid": "a815a177-6b47-4cb2-8c4e-d3702dacf06a", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "519de767-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772809273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809273, "uuid": "981ed64d-e047-481d-8128-97aadf78c558", "comment": "Malware payload (AgentTesla)", "value": "909e7aa7deef2c9ddaee711f556dde2a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809273, "uuid": "869d112d-69ac-455a-8eaa-03d80cc95b7f", "comment": "Malware payload (AgentTesla)", "value": "69d0dc781e1674538b7ff6d180dc117c5fbcd154745b5642a26acd5dae2a2c4a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809273, "uuid": "1509b27c-449d-4470-89f4-1a2f1c0e6311", "comment": "Malware payload (AgentTesla)", "value": "400eb5b76e238c8f95156f127aac8b1d30dbffa9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809273, "uuid": "edbcf66e-313f-4144-86e6-1f1283fec538", "comment": "Malware payload (AgentTesla)", "value": "abe1fe89d04771212ce68689ec05541ac8601792a8abfce7bd8eed34a5bbf2caabd5ab85b39c110554b70627f56c671f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809273, "uuid": "5a8c4993-f586-4449-8112-0f231f3efd5e", "value": "T1D484124979A5C06BD9758FB11D2ABAB36BF2EE013460531B33603EDE6D32795980D383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809273, "uuid": "56140019-7e65-49ee-b006-3cfa06088779", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809273, "uuid": "bdde4cf2-e292-43c7-aa4f-46c1e998c647", "value": "6144:w4t6LsyAWYRsw3HWstVvCq4XINGtIn8inuMcyu0+CajkTVki8ojtMjE:wkdW+Tt5Cq4XING2bnrk0+CqzTs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809273, "uuid": "ed711275-8693-4c78-85e0-e9c15fddc43b", "value": 371716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809273, "uuid": "971e22ac-96e2-4a21-bb9d-41a4f7e252d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809273, "uuid": "40293b10-1a50-4213-ae98-c05e31ce6c82", "value": "69d0dc781e1674538b7ff6d180dc117c5fbcd154745b5642a26acd5dae2a2c4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9091b2eb-196d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809379, "uuid": "48ff5efb-ccf5-46d1-b76c-e50b4887d73b", "comment": "Malware payload", "value": "4874a0bf9c3555441a1c4fe3f954205d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809379, "uuid": "8a4d8b12-bbe8-4c89-8814-892e8e7ac1e7", "comment": "Malware payload", "value": "6b189b16ba675952d19d5ed0f1098220ba7a2defa6068b70edfa35e6dd464ec1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809379, "uuid": "68451af6-cdb2-4242-9d89-87d71c7428ba", "comment": "Malware payload", "value": "93e6549f6e08f47750ab107e4ef803d55f563065", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809379, "uuid": "41658307-e910-48ac-9554-50d42900c162", "comment": "Malware payload", "value": "1cc8c007c5017ec0ace5bbc771b3ff2eab04c2181638b5695fbddb2b45cd9f0f912d0da9fa830c32e9f519a5715f7ce5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809379, "uuid": "2bd7a6be-ef2c-430b-a140-c42672d4f30c", "value": "T14584CF80E2849C97C8077271BD3ED935252FBE5F6334491A372ABE297A732935067D0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809379, "uuid": "97af970c-bcad-452a-a9a2-a31427ce72b7", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809379, "uuid": "eb270d09-4c58-4b1b-9aec-dac2ec6e4aa2", "value": "6144:V5lz/9GpewMCuSgepLjXWi4WnrIBWAWtPfMf8twbyx1pePSub:nHzYUepfGiGItXMf8tw+zpBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809379, "uuid": "cd73494e-9a67-4ce8-8924-ee32448c7152", "value": 370976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809379, "uuid": "5fba4a42-c070-490b-8cb1-65972f6e7a16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809379, "uuid": "8be4c7ab-72cf-42d4-827c-3db8dc2a24db", "value": "6b189b16ba675952d19d5ed0f1098220ba7a2defa6068b70edfa35e6dd464ec1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20f9eff0-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810051, "uuid": "9f3abb31-3fc9-46dd-9375-c1fd3820ab27", "comment": "Malware payload (GCleaner)", "value": "8b3cbdcb88ba6841fb3f11c118b3c125", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810051, "uuid": "83bd0319-c40c-484d-96c8-38b7bf0a5047", "comment": "Malware payload (GCleaner)", "value": "6b512fcb41d3fe531ea52b8e24cecb39320bc7d5ecc8cbe774f6ed77f2774f4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810051, "uuid": "91bb879a-78de-4b34-a3ee-f58a07c8c0ab", "comment": "Malware payload (GCleaner)", "value": "6b6adbe397fbb7f47a744173219ec9e17f0fbb21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810051, "uuid": "06cfe204-2eb0-4d46-84ed-e3d9703e11c8", "comment": "Malware payload (GCleaner)", "value": "aca405335ce645834ca2e09fcdc42d77aeb596240fe3d04efb6bbe439ad97e0691b53294024ed22f56630b46da64704c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810051, "uuid": "d926b200-50ff-4dfe-9c5e-98408a1f2231", "value": "T18505AF2EF1A08436D1727DF8DC0BA254942FBE90ED24698A2BF81DC89F35F81752525F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810051, "uuid": "723f0cc9-ab74-4b89-8bbd-44a054b1b8d5", "value": "c475b6e242f56325f64c2b76233f720b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810051, "uuid": "bdc018f3-b215-4d81-96a0-e0259e2aabd7", "value": "12288:deM9gzhW/BsjB7V+bRO88pvnDU3+a9EJSyHtVndNEGh/54:MK3/q7gR8Na9EJFHtVnvvP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810051, "uuid": "f257c1d0-4eca-40aa-8e7e-d56e242e9681", "value": 799744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810051, "uuid": "4588be7d-1df4-49b0-8767-11456cb72d97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810051, "uuid": "86fb4bd4-3e0e-457e-94ac-81005c516e58", "value": "6b512fcb41d3fe531ea52b8e24cecb39320bc7d5ecc8cbe774f6ed77f2774f4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f98b4d8-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819229, "uuid": "b829ff33-1d30-4239-80e0-9bf6d2ddd2d9", "comment": "Malware payload (Mirai)", "value": "61f59d380c0c781bc36d4674f47819ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819229, "uuid": "2745d03b-113e-4842-930c-c458081bf470", "comment": "Malware payload (Mirai)", "value": "6b53cd3f41fe89d3291dc4663629df9242030cdf369accc2cc50ce126e6bebf0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819229, "uuid": "8700eed2-fa23-408c-9243-2b6a1645b8f2", "comment": "Malware payload (Mirai)", "value": "a5d6a84ed3229a12c5bcb36404706c60b8852426", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819229, "uuid": "daa2ae0c-5732-405c-b90d-b9c88c0bf58e", "comment": "Malware payload (Mirai)", "value": "bb9667b4ab9cf1a3940f3bc68c67ee7b9bca020944e9dcb658c0813d27a817978619ae1f21b7907edeb38299767931dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819229, "uuid": "0a29eb9b-a4c3-45a0-a040-72fc2d878dfb", "value": "T1E7E34A55B8828A26C9D513BFF92E118E331327A8D2DF7213DD205F2477C6A2B0D77A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819229, "uuid": "dd937f27-1aff-47a8-b17e-be5057f1eae6", "value": "3072:ZXR8mzV2+p+rHEIV6nm56jbK0pz1aua8YarnECFnHsh0i:zV/MEIYq6jlzUuagpFne0i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819229, "uuid": "b22d290e-7400-48a5-a9c0-6c0d7fa12736", "value": 150172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819229, "uuid": "e828dd66-bb08-425f-ae40-2c8387ecf6be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819229, "uuid": "cc384ea9-8f3b-4a12-8869-4810b42f376e", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c78c007-196a-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772807922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807922, "uuid": "254eec0e-c351-4603-a409-c759fd3f7178", "comment": "Malware payload (GCleaner)", "value": "a28acd3a3ec70cf3bf72a09460263a4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807922, "uuid": "2815a81a-e99c-4c47-859f-fa65873df3ab", "comment": "Malware payload (GCleaner)", "value": "6c3d3f29a0a806449d723ebf789ae7e76175bbcc03d2cee68d5deb296c0ac8d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807922, "uuid": "7c82255b-53ed-49e0-a6bd-6718d7079458", "comment": "Malware payload (GCleaner)", "value": "a2ec781c3b05de168226f57b700cfef7e7ef9aa3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807922, "uuid": "2cfe5390-aab1-4982-9e39-af10c8647435", "comment": "Malware payload (GCleaner)", "value": "dd9408ac8f4b7cd59e1576138edebe837e24649254c79c11382ee51042a67774625e03a34f3a7682f7182b067baf4d05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807922, "uuid": "d8740a18-9748-4959-843e-2a1f7e9ba95e", "value": "T1DC26D0D2E1D49E76F05ACAFC683D5D0CA4D7AC1DBA98525A6AE104C910DD34CB32E2F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807922, "uuid": "a059c4f8-e99b-42ea-89d3-99028a40a89f", "value": "e5f32a93ddcf3aa9009cd70911b0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807922, "uuid": "dd31f414-3f20-4bd9-a9ca-994cc3bbebca", "value": "98304:+9CexrsWJKhorCGi3X0I7f/wuBhYVQDeMzm:+NYwCnpj/28", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807922, "uuid": "f1302aac-9255-461b-8cc3-8d5875696174", "value": 4747776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807922, "uuid": "78207f9b-d796-4330-8212-6c20298473fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807922, "uuid": "8680f1eb-acf3-42cd-a5c9-15c9eab08c86", "value": "6c3d3f29a0a806449d723ebf789ae7e76175bbcc03d2cee68d5deb296c0ac8d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4143a8e1-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810964, "uuid": "830e55b4-1f1b-4c3d-aac5-232cb2963585", "comment": "Malware payload", "value": "5d15c1980ebc9021bff3de5231754192", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810964, "uuid": "962cd27d-d803-44c3-b45e-af370f509f5a", "comment": "Malware payload", "value": "6c8473e2d1457be392d3e95b0b06611e83a32264348528f52e1071003f77b0fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810964, "uuid": "366d4a10-c589-4bf8-936c-3e18db9af010", "comment": "Malware payload", "value": "8d7a6c9b859917468e0a07b734433dca9e366d0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810964, "uuid": "3e2b0f85-994e-40d6-8405-fbd82adc9cdc", "comment": "Malware payload", "value": "e9da5df26e39a448a74cc83f5faba2bcd11879952080621f175f527864ac088c7428603bd7968aae6cd202c920094172", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810964, "uuid": "5cc8aede-d426-45f7-b2ec-f66981e12837", "value": "T1C0E49EA7B2628E21D1492337D1DB8A4097F49745B5A3F74F768413D228423EEDE4B2E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810964, "uuid": "580489c6-e174-4342-97ff-e038ff2acaa0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810964, "uuid": "c831db6b-a343-4a03-8d62-4af9d6ad91a2", "value": "12288:ABTN/Q0Rn+mjxQF/8TPuvdAqliHgO87WOGjfoLJvLp:ABTN/V+mj+h8TPuvP0AO0baQ5l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810964, "uuid": "e91b3889-3288-4000-82b5-09a49aae9de4", "value": 671232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810964, "uuid": "096fe5a1-ee93-413e-96e9-dd3880d288fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810964, "uuid": "77b7b1df-96b8-409f-8d37-41d7d44d72a2", "value": "6c8473e2d1457be392d3e95b0b06611e83a32264348528f52e1071003f77b0fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e02cb0b1-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772808653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808653, "uuid": "fd6c99d6-6a82-4dec-a7a3-26759d5cddde", "comment": "Malware payload (PhantomStealer)", "value": "4eba7ee04d8a1019644190084621b428", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808653, "uuid": "71eac510-41b6-487e-84d7-1aa49aa39039", "comment": "Malware payload (PhantomStealer)", "value": "6c8ee2c0b378ad189bb22cdf465ec277b05b3e9818379242a91afd50c4d49079", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808653, "uuid": "7ea7ce56-5073-4aab-9f88-d77accb51ad3", "comment": "Malware payload (PhantomStealer)", "value": "521c881d17c8790c08c441261006f1ab9ffadba7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808653, "uuid": "e776d723-1aa5-4a93-8755-d5e40f1eeb67", "comment": "Malware payload (PhantomStealer)", "value": "405ae103b934706850a3996ef2392dd3d83e100d2007d69ae5e16f6dd29f0f35aed5aea8b108ee61dae3b42f319f6d35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808653, "uuid": "edb13f78-dafb-4c84-9d7d-81ed35297585", "value": "T1EA6512482725DA03C8EA0FF40A73D3B157F91E66A511D3538EFABDDBF429B4069442A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808653, "uuid": "fdeecbd0-0402-47fd-81ee-94c73f9e4bc2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808653, "uuid": "fe05706c-0e4c-48d1-9031-f6b93a41f5fc", "value": "24576:bqu2Vfkm9OWv5b3G0AN7CMAC0FYkxjU7+9MQ3GbCh5u2yl0Xo:beVHRbbAN7FMPxYK9NujC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808653, "uuid": "41b84b68-69e2-4e6e-a507-5db9e969571c", "value": 1511424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808653, "uuid": "5cb76283-1b3a-42e4-8bfc-4c7f46b1dc78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808653, "uuid": "6e35ac0f-47f3-4592-9a5d-0ed567d1350f", "value": "6c8ee2c0b378ad189bb22cdf465ec277b05b3e9818379242a91afd50c4d49079", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d406e543-1983-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772818941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818941, "uuid": "ff8a19ea-dca6-443d-bd83-5d5d2e008709", "comment": "Malware payload", "value": "2f3943e23f9419178d65db6e9d494d53", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818941, "uuid": "1d0b1e35-1c27-4925-a75a-edff6c082289", "comment": "Malware payload", "value": "6c9a6fcfdee9cdabc2e9e63ebae13c8d3cd452cea9b721d040a393d6acafaf07", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818941, "uuid": "dcb38419-a712-4db5-8890-2be83db00332", "comment": "Malware payload", "value": "b5d8c657507803e940b394a2472a92b0c1e32a7d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818941, "uuid": "abbdb390-8b5e-47cb-baf7-9f9e92248151", "comment": "Malware payload", "value": "4e3911faf10c77471e0fa9b9341707d946b898866075c444b54eba6f2ed9ccb33d030428a142110d801b222adf34011d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818941, "uuid": "2ef281b3-5f44-4357-b89a-d477b35e8be9", "value": "T1832833C35765DD18D2D3FE3A5250A8E3223D02873B44C0AD9DD271924AFC679AFED922", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818941, "uuid": "9ee1786f-b3c1-44b7-a1e1-dffedf88437c", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818941, "uuid": "87a40b36-29af-4595-bbd5-aafaf43a595c", "value": "1572864:AYxc1AY7ZHGRhbZFKT4foTuwwwXYPDwmjA8d+5ZW1e/W5JGxHR7:DeTHSB/KkoAPxkIIaJGxx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772818941, "uuid": "4b86a368-167b-41e3-9474-c8fbe1edabaa", "value": 100908891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772818941, "uuid": "ed5690cc-1f95-468b-af9b-dfc17b1364f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818941, "uuid": "14e3fe71-a52c-4b3c-a031-1d20db0e0515", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26efdcc8-1974-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772812208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812208, "uuid": "86d240c7-d312-4ca5-ba8b-f5386f1804f8", "comment": "Malware payload (Mirai)", "value": "8a91234dc92176f46f586dc0cdc5de47", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812208, "uuid": "ce8e308c-64e2-4b6a-808a-5617f852ddc6", "comment": "Malware payload (Mirai)", "value": "6d0aee6ceeb84d69a7098c5c531971ea7715f1ebb820612564ed39fe3c1f9c8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812208, "uuid": "b6c66802-8960-45ce-9e4e-69d8a8778676", "comment": "Malware payload (Mirai)", "value": "1dc5675c63cce5b2d82d7ef32ed8409786bda97d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812208, "uuid": "5d026cc9-69a2-4d02-9f89-bcded6dac16a", "comment": "Malware payload (Mirai)", "value": "9e5620c0edbc315b3d08cc46d15884a3093a6204a417b39794cb599748e9ea60d956ceae9c1bd06271fd50db53a50d32", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812208, "uuid": "5b24a722-7997-4d60-a1d8-a1b2753cac80", "value": "T1E5935B13B9C480FCC889C13087AFB536D963F17E1279B19B73D4EA167E8DE511E6A680", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812208, "uuid": "2c5f861d-a47b-404e-ac45-3c4ad6581466", "value": "1536:Ac50J45j1WS60TrxMQQ+8TW4yxAw/1h1ss6fuftHnRlGJHaBs:Rf5j1W0Trxh8fyx91h1ss6feHnvGQ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772812208, "uuid": "aa158d3e-36e6-41e8-8d85-34f676ce5b19", "value": 88928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772812208, "uuid": "7c3d638a-87d7-4f97-9fe6-efb4ceb64c8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812208, "uuid": "a28c6607-c176-4e48-8290-a6863cb7c5c4", "value": "titanjr.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9ba4d92-199e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772830601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772830601, "uuid": "b7705cee-348a-4fd5-8ce0-c7a84edfd44a", "comment": "Malware payload (Mirai)", "value": "fa4868de155ef0a56fa965c67ce33c82", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772830601, "uuid": "7eece960-5faf-4a07-9c57-9ccfda7b77ad", "comment": "Malware payload (Mirai)", "value": "6d1721fff5c74d2dcaefd3b378d7c70a4ea87afec74fcd506ed3019532719bd1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772830601, "uuid": "55493d39-5916-4d19-bc12-a32061191ac7", "comment": "Malware payload (Mirai)", "value": "f307d6fc3573974e5619978b402ec4c2b91d7035", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772830601, "uuid": "d8d7eb66-dadf-4814-9b27-503ee2d68455", "comment": "Malware payload (Mirai)", "value": "6d50bf73a7afd940ddcf1d3e1bef36d364f7b2e1d988aa240dc6374cfc1163d1049624264f9862423f48355e8075c712", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772830601, "uuid": "085b54c7-bb38-47ff-80f2-525b83e6dac3", "value": "T1F801CB5A42511C342ED9802FB9EED1E0706D14AF26C29C3874DCBDA77F2CE086E109AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772830601, "uuid": "452579a5-2e47-4a04-98d4-77e072ed5dec", "value": "12:dzCuMtdX+J+828z/KUoub/YDnY2+jrfZFt+jrjgyufiMPZIxy/0w9nG:dzCtOJ/XouTY5+P7t+zgyuBIxy8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772830601, "uuid": "9e8264bf-85d1-429b-b5b6-56b83b9fcf79", "value": 709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772830601, "uuid": "9981ae7c-1cfb-45a4-ad9f-aaee3d0f97ce", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772830601, "uuid": "215f319f-05d9-441d-9135-da79e17fb877", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc6dbafb-1972-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811627, "uuid": "8a194fbb-7daf-48a9-a678-44133789e45b", "comment": "Malware payload", "value": "c9c6d28c90d95a1c2a9143c712d4429e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811627, "uuid": "ce9cac69-01f7-43ee-b498-85f7d55d07e6", "comment": "Malware payload", "value": "6d436d4ba44921dfa6d5672f9efb42ac7d94639ce56dbe2ef8896620821a59f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811627, "uuid": "c9b9a58b-007d-405e-9081-357206fd902e", "comment": "Malware payload", "value": "18a69444378fb5d79ed37367c9e4e428abea2e28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811627, "uuid": "e2e7a052-1efd-4bd2-89c1-d22dd1d1e1ec", "comment": "Malware payload", "value": "befcacc08d5fe1248deca0745e853f710408feb82248e59bdf8d86e8990b6c786995612a5f9e19d9692843ca2ecdf41d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811627, "uuid": "1b7a3c55-99ec-4138-bcc3-a3ef96d5d53e", "value": "T13494C466EB10B4A5F89745703D7AA257782D3D392581EC4BB7898F4A3670A83B0F431F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811627, "uuid": "70b8fb94-ca16-4ac5-9d59-c58cd2450272", "value": "e5da4da466e83dcb6ae28e193bb0cae6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811627, "uuid": "59739dd6-8242-4bac-9dc9-cf94342a087c", "value": "12288:X6GWK3PfHB3S5mQA4yn/iDQnstUJo1eUU5dS2l8SqZqoCveNGfK+6b3+jHFNH:UAfZzstOP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811627, "uuid": "2d06c037-fc84-47bd-9763-43a4ffe2b65e", "value": 434176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811627, "uuid": "760218ef-3133-42db-8a82-eaa34c58d7c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811627, "uuid": "c464fceb-58aa-4be7-8c3a-cb8139dfc70e", "value": "6d436d4ba44921dfa6d5672f9efb42ac7d94639ce56dbe2ef8896620821a59f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6174843-1971-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772811213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811213, "uuid": "fb5aba73-05b3-4aa5-b4d4-d70cd5f9a111", "comment": "Malware payload (RemcosRAT)", "value": "8422a58a2a94670547dd37df0fab8e90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811213, "uuid": "f364a87d-20d4-49d8-a7ab-2226c55d4611", "comment": "Malware payload (RemcosRAT)", "value": "6da676db8e7ca7727cc19b92aa9e4beebbc82e41bb0ebf04e022edbaf090e333", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811213, "uuid": "abd863ba-c051-4e7e-a0a7-b5d1ceb17718", "comment": "Malware payload (RemcosRAT)", "value": "5cc48ec82ef3de69b43358000716067fa278686e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811213, "uuid": "35773acc-dad2-442d-a640-2784cad1b1f9", "comment": "Malware payload (RemcosRAT)", "value": "3a1df373ff784c42c96f14cee1c21263c149c91933a7e3efe0b7a747c03033f1eb9cb7c9646e50993037d0b2fb8750cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811213, "uuid": "b0c4b37c-c5f6-45e6-b82b-d3239d672484", "value": "T1BB1502985605CA03D96A473406F2F2B52B7C5DEFE912E3179FD8ADEB7DA2B510C04283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811213, "uuid": "2dd1c4f6-9747-42ee-a865-7efc587495db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811213, "uuid": "42aa528d-33a5-4796-a3d5-f341ccc76b4c", "value": "12288:MjNiMwP29Vh3jyg2QPvbx1yKw33JUG6KELwDLDQNcmZxEojmKIE5T2Xzuwo0IXdC:Noj711/0JYmAx772XZxua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811213, "uuid": "f16f410a-282a-480a-bcd9-1b2adf97f639", "value": 918536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811213, "uuid": "667098ed-f196-4567-94da-55a9a90301ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811213, "uuid": "71aba52e-1b98-433c-a70b-e227eebbe3a1", "value": "6da676db8e7ca7727cc19b92aa9e4beebbc82e41bb0ebf04e022edbaf090e333", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce19d26e-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772810771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810771, "uuid": "d0b80779-fd7a-4635-8c61-aaf7796d99dd", "comment": "Malware payload (Formbook)", "value": "5e4656f45923d02fadc9aa4199b003cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810771, "uuid": "58cefd33-9d16-49a6-8920-be4c5cfb71bd", "comment": "Malware payload (Formbook)", "value": "6db9660f6fe86e0bf80e93f67a903f81ad700ddbfed057d51ba0b3b89983161b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810771, "uuid": "feeaab94-e62a-48d3-904d-301d564f1060", "comment": "Malware payload (Formbook)", "value": "b733c715b752dd3cff5ca85eba898e21b828f1d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810771, "uuid": "fb1ea623-4f46-4572-aa5e-26e97b869332", "comment": "Malware payload (Formbook)", "value": "ce0b524ac94ce8e46475504003c0e3ae4c1ca6055eb61248518a4be3e043ff795c078aac6ebbce369c3418a152352a20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810771, "uuid": "9aab8493-89e5-47cd-92c8-fd70d99d61eb", "value": "T1582502683616CA13C952C7B84A71F678077D1EEEB911E34B9FD5BDEBB962F124900083", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810771, "uuid": "fb89a94a-df74-4805-92ad-059c2d850a5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810771, "uuid": "2878f484-5774-4af4-a62f-3ce8a6ce75ed", "value": "24576:arMbSWzmQk34iF6s8ZIujyPd2xRZeudQFPxXuMfnVNNc4xrEpj:jbhaQi4W6s8ww7aBVpTNej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810771, "uuid": "0cae24fb-b364-4c82-966f-246e3f80f76a", "value": 1021952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810771, "uuid": "3ef4696a-4ca0-43e2-ad5d-fac8b6093e6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810771, "uuid": "5d030273-3f9b-4fa9-9de1-7f67f3caf78e", "value": "6db9660f6fe86e0bf80e93f67a903f81ad700ddbfed057d51ba0b3b89983161b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8e7e554-192d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772781986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781986, "uuid": "badf7766-f259-4fdc-84e7-ee5165d8b7df", "comment": "Malware payload", "value": "4f4d6721337cf7823ada6748fe01bc04", "object_relation": "md5", "Tag": [ { "name": "api-devx-help", "colour": "#8AD189", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781986, "uuid": "2eae5d07-f58b-4af3-b06f-5cf46abd0169", "comment": "Malware payload", "value": "6e06fa1686b71a3679533277086026cbcbf352ba9232fd1441bd7482abd470bb", "object_relation": "sha256", "Tag": [ { "name": "api-devx-help", "colour": "#8AD189", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781986, "uuid": "6754cbe7-2b25-4a53-b43d-2e754ea9158d", "comment": "Malware payload", "value": "7380b9bc2edd2805f313000e90c333302d80b60f", "object_relation": "sha1", "Tag": [ { "name": "api-devx-help", "colour": "#8AD189", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781986, "uuid": "fc4d4c9b-f8cf-4c8b-a4c0-f28049c59caf", "comment": "Malware payload", "value": "914ac15c1ca6976d5b17df44376d433ee1a220be8729b41129b15bf73cb209ce6dffeee10f27df5c6c0185d6fa50508c", "object_relation": "sha3-384", "Tag": [ { "name": "api-devx-help", "colour": "#8AD189", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772781986, "uuid": "b0c36fe0-13ea-4ee8-ac9d-6235f8f2939b", "value": "T1CB648E15F6A814BDE17BC578C9634942EBB2BC560360E6DF13A049962F33FE0963EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772781986, "uuid": "38f7195c-7280-4936-8b33-667ed0d93e7e", "value": "eeaf882830fde45ace5035bb9c4e5338", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772781986, "uuid": "0cbcd167-8376-4bd3-b701-5f44aba4c1c3", "value": "6144:TiSNqb8kYDPTIPdPPKKfvW9k+ak9tgD5F7z:FNqb8kYrTo5K/S+ak9aN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772781986, "uuid": "7f2d8328-c86a-412e-917d-e90022781c54", "value": 330752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772781986, "uuid": "26f7231b-49ab-4fb4-b01b-0f27c085605a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772781986, "uuid": "b94666d0-cfe2-47d3-96ef-e45c1bbcd31d", "value": "6e06fa1686b71a3679533277086026cbcbf352ba9232fd1441bd7482abd470bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd2627f8-193d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772788945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788945, "uuid": "6b694b34-417d-4fd1-913b-c2688a5d6eca", "comment": "Malware payload (Mirai)", "value": "25b8353d2cde33a6841d69f5c528799d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788945, "uuid": "b67d19e6-2c84-4fca-a1f4-9869133d7230", "comment": "Malware payload (Mirai)", "value": "6e6a3f89988d8cc017e706a5c41348cb404dfb145b95942d808e6752f844dd9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788945, "uuid": "f459cc9a-7f92-401d-9cd3-6a183c2da475", "comment": "Malware payload (Mirai)", "value": "27da203aa7c773057c104f5a00a170da4365058b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788945, "uuid": "b7c7b5b6-335a-4280-bec0-700581abfea3", "comment": "Malware payload (Mirai)", "value": "d40e6f1e74e5301ab809a460e86eb3627cc3a1274caa20294b5cd7813e1828dc9d6b52926f4da1a4f9f27e0faefee1d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788945, "uuid": "9c1ccf9d-fa96-4c12-b4e7-3ff2302ee9a0", "value": "T19E03F160C4EF920DE43D627944AFF20A0B45D41B5468A7F7FBD831B69CE2AAC099CF54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788945, "uuid": "fe2e60e0-1ce0-4577-8b13-28a0f6077bbd", "value": "768:6rDE1uLV+u1Q/bG0MYdoVkB48WZ9zzewpEHKBHjkPBnbcuyD7UHQRji:6rY1uL4u1Q/KqqVq79qBHjWnouy8HyO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772788945, "uuid": "01aaf50d-5526-408d-83f7-60ab38f96e82", "value": 38960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772788945, "uuid": "5e507ea4-9f9f-4254-8335-e5cc303550ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788945, "uuid": "1a792ec0-019b-403d-9e06-e61e962b3165", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4da6c2f-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1772809091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809091, "uuid": "aa80f1ff-a777-440c-9e99-933725eb69d8", "comment": "Malware payload (GuLoader)", "value": "cbb37204f99e4b34dd1f06e1e9ef6c22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809091, "uuid": "973c8e75-2961-4c61-926c-c75d5df64015", "comment": "Malware payload (GuLoader)", "value": "6e75030c0166aac5d9b66e92d603721dc0bf38e5a1a2aaee31f589ab3e9edc72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809091, "uuid": "18dd9196-5f70-4b57-b7ed-a706cc98351a", "comment": "Malware payload (GuLoader)", "value": "4da8d8bb6d25c098adb5d1ca4a84e982f04f8cf3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809091, "uuid": "6d319109-5373-4959-9ef4-8c9a92772a16", "comment": "Malware payload (GuLoader)", "value": "b6e3260fee9aae530ed6fb5a34e034bf7b4bf13107411161e56470b4dd9839f132cf7612c2e6af32e251def06d36ce2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809091, "uuid": "a0aa4ec4-1d1d-4849-9d50-c49bf8c9a2a9", "value": "T16274BFD0E285DC9AC80772717D3EEA21246FBE5F53344616372ABE1A3673283546BD0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809091, "uuid": "71fcea07-da05-4083-8513-7f4a4fb46438", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809091, "uuid": "d71017f4-c037-4047-91ee-4b5cedf0db02", "value": "6144:b5lz/9GpewMCuSgermPq8y0Tvvt2oVcWUGH6f1kezuxKkds:lHzYUerEq8bliVf1kezuxKkds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809091, "uuid": "9dd52c27-ddcc-48f6-8cb8-a908de2dc4bf", "value": 365040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809091, "uuid": "89105da1-54a3-4a1e-90e2-2ac409eb5561", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809091, "uuid": "db7b7a0b-28e8-4c17-afde-5d19295e66c4", "value": "6e75030c0166aac5d9b66e92d603721dc0bf38e5a1a2aaee31f589ab3e9edc72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d607d2c-196a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808112, "uuid": "feb2f971-1324-4197-904e-64ce59a76ef4", "comment": "Malware payload", "value": "33fb5fb9afed06629978b8faa59d4242", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808112, "uuid": "f736392d-3d73-4d1e-b638-7ad107c0a4d9", "comment": "Malware payload", "value": "6e7ea9e48a4f77b25af4f002bf9ea34fc9f9265fe2c44cd21c205e21e47454c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808112, "uuid": "04d68961-2b6e-45d6-a002-65fec7b32c59", "comment": "Malware payload", "value": "ff973ef1fa012c98e256f44471fadd010f5a06cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808112, "uuid": "c73b39a1-e2ce-4453-bf2d-f20614f37689", "comment": "Malware payload", "value": "67bed5cf02c44a113ca01687cc4ca6dcdde3f5b50a28073abb7ad94f71ee5195884c1a5b75222a118be0d54d5acfff41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808112, "uuid": "085b08a3-36a4-4419-946d-70bb7139f8d0", "value": "T11D35D00723D44E68E9BD9B7A856654D143FFB746AB36DB0DBD0A50EB0C22B41DF01B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808112, "uuid": "9ff2eac2-807f-401f-bee3-25fe372b270f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808112, "uuid": "02663ba6-aebf-4063-bc5d-acd6fa46a9b7", "value": "24576:nOfZNC8ZHKJCX0fI8mVS7N73O/WoGYdvqx2Fa:sZWWgI8mcJ7uWvYdc2F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808112, "uuid": "cb37297d-15fe-4057-af61-84e978e06ee8", "value": 1069568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808112, "uuid": "f5827ca0-0cd1-4274-815f-90abd54570b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808112, "uuid": "574f5712-66b8-4a3a-a492-a43ab30dbc17", "value": "6e7ea9e48a4f77b25af4f002bf9ea34fc9f9265fe2c44cd21c205e21e47454c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5b97a8f-192d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772782034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782034, "uuid": "ed735616-3957-4427-be79-a084605d1d4c", "comment": "Malware payload", "value": "4d7c9a1de72f208533f1a50a110a3c0a", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782034, "uuid": "ced21e8b-36a7-4c87-904d-62d9dd999a1d", "comment": "Malware payload", "value": "6ec2aec3151feaf7b4c6c7934e7ad601cca984266f0604b93676ae698ffed738", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782034, "uuid": "848cbc7e-14e8-47e9-9c00-36d9d39c851e", "comment": "Malware payload", "value": "8145f0f242a09daad7f429e002e240761ccdee47", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782034, "uuid": "afa8d2d8-8148-40ff-95e0-45317d0a92be", "comment": "Malware payload", "value": "e1e5e9551dbc1b3cd1e1d8bbbb3eb08468c1367e32dc4f79d8ed0402742635c9b193b7f25db28be3f7b79c9542680816", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782034, "uuid": "5af8a175-03f8-49c4-8e93-0d0e1e2e922c", "value": "T1535601C5BB88E92BC077543286A997B651474D0B8E83DF43A914360C2DBBAD44F1EFC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782034, "uuid": "69cd0108-28eb-4c75-954f-9583faef85cd", "value": "98304:l75bLNrZ3oXuk5KRPp1nNZw2fHZr3a7zpuKXc7eRDYH2TKBV5hH1uJSzf9a:l7JoXX09LRR3U/s7e5ISKBVfVuJSzf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772782034, "uuid": "4a4458bc-57ee-468a-88d1-0e54e1c6ce63", "value": 6221164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772782034, "uuid": "9a5672b1-e60e-4cec-b6c7-5d8ba7c58969", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782034, "uuid": "357ca64d-da08-464e-a047-d5583a69af20", "value": "iApp\u624b\u518c_1.0.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d4c81e9-1951-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772797321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797321, "uuid": "68afd070-6990-4036-b1ae-76d3b00e438d", "comment": "Malware payload", "value": "5805fbdfe3b47a684d1209b532ec474e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797321, "uuid": "e6611882-d27c-496e-ac2f-ed63cb8762b7", "comment": "Malware payload", "value": "6eecfb2434b394751e7297e063c24d5ed0d40175aee5f93293ce9cf27b1492e8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797321, "uuid": "26af6d99-8253-4741-8525-8980278d93c3", "comment": "Malware payload", "value": "c2caffaebe4c614107921a486224f8141e48ba84", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797321, "uuid": "17bd2f2e-cb74-4cf6-88da-a6eb2a6b4487", "comment": "Malware payload", "value": "b3f41041f08bfcf628634efe6f3ad75673940b0ea8485fbdfc6f2afbec3ad85147433784d125037ba86a529c76054d1b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797321, "uuid": "bb37fe15-971b-41ba-9d3f-ee1da59f5ab1", "value": "T19F41A85B27FA397A5A9614A7442E9406D6794F510C068C10BA8D0E07685E6CC3FF9F38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797321, "uuid": "dc27b8f1-e3dd-4e95-85f1-a1313c50daa5", "value": "48:7jOgo7b5jag3L8GbE4+EvPbjrXecbtlaw6QRnpoQp8Owg/Rf6Wc9bE1vSnL:7jqjHG4PPrXecbuNQFKSRf69g+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772797321, "uuid": "d741a42b-3716-494c-9c43-c3fb24781765", "value": 2218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772797321, "uuid": "0f4fc5e5-8bc0-4646-9a81-81a5fbd92e42", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797321, "uuid": "7d1669db-fc0d-4c9d-a446-a020a267c1dd", "value": "6eecfb2434b394751e7297e063c24d5ed0d40175aee5f93293ce9cf27b1492e8.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af304913-195c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772802129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772802129, "uuid": "a9ce4e35-2720-4841-bc95-41db514c03ba", "comment": "Malware payload", "value": "d4ae86179acf0f243311f9da3c5329f7", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772802129, "uuid": "2880e73e-a4f0-4ff0-ac6f-fdc4528702c6", "comment": "Malware payload", "value": "6ef32b6c01b2199a6be9339006b58f6af5ec288d9249ebf649ef6e2eb7a34d57", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772802129, "uuid": "1f5df80e-378a-415e-9ece-f8c9fc1832a7", "comment": "Malware payload", "value": "4caaf3a2a4e59e75d4f3ccdfe6ab5fff4bb8862c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772802129, "uuid": "a426b641-7bba-4725-9fc6-7ae589974c5d", "comment": "Malware payload", "value": "e0b5a8964565e2c652f4fa00144ac52a31c9f70ce36e98f7e1487837a518314b26e954db8cb2ba3f26e023e4b94e4411", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772802129, "uuid": "4068267d-25ec-4859-837f-0107cb76294a", "value": "T1BBA633ABA5574FA0F7B081BE4986FC0DAD6DE52AC389AC063D7605B6010FF6047AF117", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772802129, "uuid": "bf4260ab-0c17-4f5e-bd37-f00d1de6943c", "value": "196608:1gFgz8EtXWxjlORgw3gtq9dF1wmh5pPCu96LcabKDYQTHwCl6VeFvHwot0n:1g3eGxROmw3gMLwmxCqUQ1Fvc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772802129, "uuid": "1525b364-1c8a-4627-9ff6-e63b0230ce30", "value": 9698801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772802129, "uuid": "ba8173ee-fdc9-47c2-8535-af53d7056ed6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772802129, "uuid": "bfef3410-38bd-4aa0-ae93-65761ea37c78", "value": "src_2.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc995e4a-1983-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819009, "uuid": "12240460-b385-4a8b-8769-d6aed9d65126", "comment": "Malware payload (Mirai)", "value": "38ea4d206fe17ad4889d0cfe43f5bd0f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819009, "uuid": "1e2a0cda-e8e0-44f9-8b73-86a9b549264a", "comment": "Malware payload (Mirai)", "value": "6ef8d8dc61e0f8b67932d5c3a086892c7b4b710f463acff061ebb6a633a6956a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819009, "uuid": "22211e3b-7f30-4b17-a417-aa3ecdf11e51", "comment": "Malware payload (Mirai)", "value": "952b155d019efc1acfaec7bbc33398183c755990", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819009, "uuid": "e9206222-95bb-4d23-a9c5-769a1f0e7870", "comment": "Malware payload (Mirai)", "value": "08faa50df9f39dd029cd3f305e878e0e9c02e6455d7fba62b5081e97e39a47bbdfacaec799a8985c60e8572193edc1a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819009, "uuid": "4d94f9e7-8766-4a8c-892e-662235d264ba", "value": "T1A6C3F80AAB610EFBE86FCD3706ED070525CC651722B87B767574D828F64A24B0AE3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819009, "uuid": "7673b053-bc72-4160-852b-bb3ec9962992", "value": "3072:ln6MWtgOKvr7B+6d2pIWvgdqt9au1Afb:ln6MWtgOmH86d2pIKkqt9m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819009, "uuid": "f094b50f-2819-40fe-84c4-647b0862f6f7", "value": 122496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819009, "uuid": "6a5a071a-7502-4331-9652-8430a23ace2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819009, "uuid": "7bec1259-f7bf-4664-a9b5-ca05abcf81fb", "value": "jawirbot.mipsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "018076a7-197b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772815152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815152, "uuid": "a454cca8-6e6e-4089-8bc6-876420dc0f6f", "comment": "Malware payload (Mirai)", "value": "57a5a0a348debd5d17e4fb35e71f6bfb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815152, "uuid": "dface75b-9214-40fd-82d4-45a2a7c8de37", "comment": "Malware payload (Mirai)", "value": "6f0ca1a298424961cca17b6052e52e935c95529049c69410f0478cd02ba6fb67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815152, "uuid": "bd1ea6b3-e55b-4abf-ba7b-e8276544131b", "comment": "Malware payload (Mirai)", "value": "9979d54c822ec0cfc5fc997a0f7ee1e71de33759", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815152, "uuid": "8b66b807-177e-4051-bb3e-97894a5f4e00", "comment": "Malware payload (Mirai)", "value": "713a7dc3126700e5a967964b7f420ada17509e4a2711072dd4009a3f53572636e7a95582d2d859bc8dd8b266fb2148a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815152, "uuid": "34f05bf4-e8ec-42ad-b391-4fb987b71013", "value": "T10E8328C1BA4BC0F5D90748304067F33FCB32D6394061D66EEFAADE65EA73642522629D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815152, "uuid": "39d26fd1-ba67-4e24-9ad3-e3fdb957409c", "value": "1536:8l8IhK59kLMSbBv7zTWAcanWC8f4TxdgoXF6hK8l9:8/hU9ktbhTWnfgTxddXml9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772815152, "uuid": "57a2e0b4-09c1-4ed4-890d-b668599fbbe2", "value": 87696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772815152, "uuid": "689abf93-a40c-48a2-8584-5ae0b5e9633c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815152, "uuid": "e43be93a-2c0d-47d6-99d3-97f50bdafe81", "value": "titanjr.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f1b94a-1963-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772805086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805086, "uuid": "05b41aa8-07c0-4497-8c41-00630547eea4", "comment": "Malware payload", "value": "f7c99599084eb2ee56dff574d5acb64f", "object_relation": "md5", "Tag": [ { "name": "abcknIe", "colour": "#31F8E7", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805086, "uuid": "de1aba8c-2691-4d3a-be75-672e8a8a96cf", "comment": "Malware payload", "value": "6f24eb5ee228dd098a9fe277ee1ab8c716e4f10696f44301d3e9d5b878f02f5e", "object_relation": "sha256", "Tag": [ { "name": "abcknIe", "colour": "#31F8E7", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805086, "uuid": "2c3b843f-4e0f-4de8-bfef-657df350f8fa", "comment": "Malware payload", "value": "2844ced9602e281b34377579c40ca3afb96e6a15", "object_relation": "sha1", "Tag": [ { "name": "abcknIe", "colour": "#31F8E7", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805086, "uuid": "0db3166b-f3c8-4f7a-9c33-b1c507569060", "comment": "Malware payload", "value": "4ad3aceff261dfa66e6ef2b211f797a941a6b58d1dd1d2586ab98b8ea0e97804f1e999d1d3362e21ca0d2e35033a8335", "object_relation": "sha3-384", "Tag": [ { "name": "abcknIe", "colour": "#31F8E7", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805086, "uuid": "b880b8da-55c4-42b6-9308-53e4c5c732c7", "value": "T13C6465F96076ED8AC7370E80E1043F179C299ECF667847F8B78815D1C19CA8C99E65B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805086, "uuid": "dfd2b78e-c44a-45ee-a647-f3852b6f12de", "value": "6144:1rKXd+mSf0sT0PepqepDDTLKtHws0Gw540HlEijWjYN2B+C:1WXd+1csRFlEijWjYN2Bb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772805086, "uuid": "f4ffbd25-2a34-4df0-a81e-77edc46adb18", "value": 327046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772805086, "uuid": "9d17ebd3-5202-41e5-8290-3e9326fc10cd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805086, "uuid": "d89df8e5-1245-431d-997e-ab988a53b8a9", "value": "abcknIe.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9140d64-1983-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819003, "uuid": "79b7089b-478e-4487-9dca-7a61d887ca02", "comment": "Malware payload (Mirai)", "value": "92e2bd3338014921e94f457cdf82d7d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819003, "uuid": "d2edddee-8145-4bd4-ba0d-1e90e85f6184", "comment": "Malware payload (Mirai)", "value": "6f547cbfc9fffff13a85cdc1e28519789925341bcc8e8b6b92314a39354dfeee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819003, "uuid": "01d94e3f-7907-4d46-8e5b-30130625729f", "comment": "Malware payload (Mirai)", "value": "a037ba58cc3b136a9ff78610570617f313fb03b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819003, "uuid": "92de1959-9cf4-4cda-8edd-d8a85a0123b8", "comment": "Malware payload (Mirai)", "value": "45c0485b48f3c58e8f4b6ac96c20d6e856674924efde8637585d7d2d200c75d274a55856e13db0e2f30d787ddd413182", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819003, "uuid": "4407f75a-a4c0-4903-8882-91ca9ab0b667", "value": "T18FA33B02F6F68DEDD8A1D174459BB126F430F43E5138F213A7E4F9129E9DF20992AB90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819003, "uuid": "a9395ae6-083f-4f74-945a-f365a736670b", "value": "3072:2T5ten0CcKoXPj2E60QBkJYzd1A7uhK0PQWyQOhRT:7z31riqK+yQOhRT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819003, "uuid": "caafbbee-1696-47dd-9d03-41de3f0e0898", "value": 107104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819003, "uuid": "b72aea22-c910-4ff4-aafd-54f40932d3f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819003, "uuid": "863771fb-bf51-4947-95e6-db5bfca7db00", "value": "debug.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e40ec3a7-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772808660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808660, "uuid": "4e753b51-b5b7-4bd7-9b3b-f6ce674ad4de", "comment": "Malware payload (PhantomStealer)", "value": "17e7538e56207ade239f702f6dbe700c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808660, "uuid": "8dba29d4-8b55-4cb3-91b5-7a6502fbaf5a", "comment": "Malware payload (PhantomStealer)", "value": "6fb6fdf5aecf2e7fb457a7d4a5d6b2c6cbdb211c40b88ae7acfa7ffe43a4139c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808660, "uuid": "b924aa4c-b3c4-47bc-86e0-2823d295e2e2", "comment": "Malware payload (PhantomStealer)", "value": "7a9381ff907d145fdf9dc0ee68041f46ddc6ef20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808660, "uuid": "fca57ae3-f291-4ed9-9d02-ef031f734b6d", "comment": "Malware payload (PhantomStealer)", "value": "e0885f0f687648a6a61dcc09513f90b81dbf48a0a98d02ee1111715213aae5096956c37313fe15b440e1df4f73e78c06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808660, "uuid": "a8eba5ce-1cd2-428a-b9bc-715375cef0f2", "value": "T1F26512582A18DE06D0AA0BF40A71D3B14BF85E9DA511D3538FE7BDEBB53A7012D412E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808660, "uuid": "e5f8a311-0b81-432c-bce6-b29f0dd78003", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808660, "uuid": "fe92e9e6-b0f2-49fd-b58b-393794ea6658", "value": "24576:Jqu2VUUK9v4m6Q6qXDBH6J0ACTGltGf6kFmdvA/Nvtq5dTp4SDUBOG:JeVUUQvn6QbDYJsuSxFMvUNl4O7B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808660, "uuid": "f25374a5-9e24-4eb1-b3c6-bbed17d44bf5", "value": 1510400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808660, "uuid": "a5004315-ca17-4e14-801d-1d4aa687e40e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808660, "uuid": "575f39b9-b428-43c9-b7c5-c22d510ea4d4", "value": "6fb6fdf5aecf2e7fb457a7d4a5d6b2c6cbdb211c40b88ae7acfa7ffe43a4139c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90e0389b-1984-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772819258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819258, "uuid": "49389fb2-e4e1-4319-803e-09d279f7c317", "comment": "Malware payload", "value": "f757c2ee0df5c6bc235e27e16ce06060", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819258, "uuid": "b3044b8a-fb78-4cbe-9e7f-195d330fd763", "comment": "Malware payload", "value": "6fef7da8d72d18a9f3ff9a0c16cfb54bd079e1bed0dc1b165562128e17527ece", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819258, "uuid": "74cffadc-1801-4809-b83b-48d5d4ee3c0e", "comment": "Malware payload", "value": "20bdd446928854de5bbc9d3e4c4990f9d96ec89b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819258, "uuid": "421da8a0-c11c-4e22-b948-8fea8825804a", "comment": "Malware payload", "value": "8d3790b7d56755a7adc56ba9be3d10d682d9041162c384fdf8cb9c97349e57fba974967a44a5f1fdd0b7ddcff5bc9b98", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819258, "uuid": "46dcde39-44e0-4ae7-bd2e-efdb56ffdc73", "value": "T1EF23F7881FB2644289B39A7D5FCF8412D269612303945C54FD6DE3E42FBB1B1E0F6DA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819258, "uuid": "3d8f2f91-dcda-4f8b-875d-dc645fc25fcd", "value": "768:hfNw0NMZOeP3RajpCBRmaDDLRBUokjbEDhhHK1LmbSoNbNXdYCF:hx23Zz/SEDhhHQLm3NbNh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819258, "uuid": "ef5b138a-5757-44bd-b2c9-af408d7354f2", "value": 46716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819258, "uuid": "b6c9af58-58af-40ee-b7a1-81c7ffb1333e", "value": "text/x-c", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819258, "uuid": "527f4db9-b028-4084-8a98-ccf276e93296", "value": "bot_utils.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2292b9d6-1971-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772810912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810912, "uuid": "16a4611b-a184-4f1e-b1ac-dece7167173d", "comment": "Malware payload (Formbook)", "value": "a5f537ed5649896d6192de2e0035ad27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810912, "uuid": "83692597-d2d3-4604-aaed-97a661f29174", "comment": "Malware payload (Formbook)", "value": "7005c47490258d2a3a4094aa32131e35559890228b695163fc85e2aabef7666b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810912, "uuid": "b13db411-9546-4888-a04e-e1c5d5e68a27", "comment": "Malware payload (Formbook)", "value": "1d011454a639f20575e48f147238f1e4d5f0d241", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810912, "uuid": "e8ad3956-f302-4e80-8725-2ee64491a232", "comment": "Malware payload (Formbook)", "value": "b2c74595e8d4a0c6373a2a49d499f9c4631d7f019ee5388d7922f8f3414f5a9d89d962dd8ce24be6af6ce006d3d19c13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810912, "uuid": "097e4263-bec4-445a-a204-d51be51e35fe", "value": "T18045CF0273D1C062FFAB92734B5AF6115BBC79260123A62F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810912, "uuid": "f7225537-0fde-4d51-8c78-c30fd435b38c", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810912, "uuid": "4c3d5e8d-d6db-4df5-81ff-3a55fa9a1bd2", "value": "24576:y5EmXFtKaL4/oFe5T9yyXYfP1ijXdahId8wE1H0NZrYlJS:yPVt/LZeJbInQRahId3jE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810912, "uuid": "aea10a4f-0970-42f8-af29-4f35f5a3eb3f", "value": 1275904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810912, "uuid": "52739b51-0699-499a-aa64-17877ea80546", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810912, "uuid": "09c7599b-9b2e-4b67-9667-7a57b42d59c2", "value": "7005c47490258d2a3a4094aa32131e35559890228b695163fc85e2aabef7666b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5643c36d-191a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772773633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772773633, "uuid": "925749c6-dfd1-405e-ae9f-0af99fce1dd6", "comment": "Malware payload", "value": "a33a8261eb76c717275012f0b04577d1", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772773633, "uuid": "535f677e-6395-4759-9e3f-3216445c0ff6", "comment": "Malware payload", "value": "7039b8402a2bb7dbe9c93c2e11e78220b027f45fba89b504ddac87ffbc6cd929", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772773633, "uuid": "ea6c2a05-12b2-4804-a755-ee0ee7ba4096", "comment": "Malware payload", "value": "dce1f757824e27b6020677daace6fb1c02298da0", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772773633, "uuid": "ef093cd9-a082-4d07-b881-a34ace32b5f6", "comment": "Malware payload", "value": "e742c4a3bbd0078951af684f163887497dc76fc899ee43814ca3f44b9df0850d13195aa2f94b629d06b0fc56a2546b25", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772773633, "uuid": "9ad6b1b4-ae3a-46c1-b482-c44dba76b148", "value": "T1554507C9D3668CBDD7109298CD3F27D2DEA9848F250A66BFB04984EFE55E2345730CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772773633, "uuid": "3a4b2f13-fbb6-4097-9728-29e05f2589b8", "value": "96:kwumhSrBdv66xsEPv9FC4Vykw4ft7CQcrhJPNMft7cQBEdzHaHHi2e1we6wLsiSt:krjkA1NfcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772773633, "uuid": "8ea7d013-6f01-43a7-a191-80516ce1a1b2", "value": 1263569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772773633, "uuid": "52044b06-a6ba-4989-bfa1-6b0ac8b4e4cd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772773633, "uuid": "0b101447-a81c-420c-8842-2ba66d10c4dc", "value": "cossro.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b7c82b5-194d-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772795573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795573, "uuid": "1558afdf-612b-4976-8311-357114eab345", "comment": "Malware payload (Smoke Loader)", "value": "881685494b9997cf7cb3e40ff066e479", "object_relation": "md5", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "chalx-live", "colour": "#DA62FF", "exportable": true, "hide_tag": false }, { "name": "coox-live", "colour": "#1A79DD", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "zadno-run", "colour": "#BE50B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795573, "uuid": "852a6c61-2c24-4c1f-b6e7-4672cb6712a2", "comment": "Malware payload (Smoke Loader)", "value": "7046e174e0f51284f119a0061ad816e066a5f5b24c775f8cfcd613240c4a6912", "object_relation": "sha256", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "chalx-live", "colour": "#DA62FF", "exportable": true, "hide_tag": false }, { "name": "coox-live", "colour": "#1A79DD", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "zadno-run", "colour": "#BE50B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795573, "uuid": "45a47683-fdef-4afb-84ed-3cb809c71d44", "comment": "Malware payload (Smoke Loader)", "value": "98441a3afc50f2e9b88babeadedd074d3cc8a7e2", "object_relation": "sha1", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "chalx-live", "colour": "#DA62FF", "exportable": true, "hide_tag": false }, { "name": "coox-live", "colour": "#1A79DD", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "zadno-run", "colour": "#BE50B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795573, "uuid": "f159d0cb-1426-497c-a3d1-2407bbed8dc2", "comment": "Malware payload (Smoke Loader)", "value": "f62a5b571b331dad5645ea74e62ae2d36b1fb8b3e35e3c986b57135cb38e2e7db9622fd20084cb9194fed1e79b19b7df", "object_relation": "sha3-384", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "chalx-live", "colour": "#DA62FF", "exportable": true, "hide_tag": false }, { "name": "coox-live", "colour": "#1A79DD", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "zadno-run", "colour": "#BE50B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795573, "uuid": "dbe1fd56-71f9-4dc9-9531-72a8a6df816a", "value": "T19D96AE067EE840E5D0BA923489BB5252FB75BC150B31A3CB2690B67D2F73BD05E3A711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795573, "uuid": "0eea254c-5024-4444-8a84-3152bbc7f36c", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795573, "uuid": "2c3de022-806b-4a19-b835-f6e6c43aeb0f", "value": "98304:r/nsPSK9GZw2TjfnpKhBnpbCqOMMEJ+O96GKIBezvvSXbSgv:reL9X8pOBnpOboJ+ObKIBezSXO+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772795573, "uuid": "6889f071-b5c5-4e3b-bf41-7c8894507481", "value": 9177088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772795573, "uuid": "9ec08584-f17a-4270-a741-aba7792281c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795573, "uuid": "2ad11326-daf1-412c-835f-342a06c84846", "value": "recuva_professional__technician_(2024)_full_espa\u00f1ol_[mega]_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ed9ef00-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772809698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809698, "uuid": "b362028a-8a66-49b4-bea4-4cd6fbf4519e", "comment": "Malware payload (PhantomStealer)", "value": "471ef5ae5168d846eede11b57555e076", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809698, "uuid": "801f48c6-7dae-44d9-a903-808dfb7b4be0", "comment": "Malware payload (PhantomStealer)", "value": "7058f96bcc11886647b2b264535255fe6422555b0cf878ddd2bec4c4a9e1d126", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809698, "uuid": "afc44a7f-718d-44af-b944-4c47c1e9a01d", "comment": "Malware payload (PhantomStealer)", "value": "ef1bdb8bbe29f927146178be51952ccec3ef584b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809698, "uuid": "816dc971-f309-4d5e-baac-0b4557ee97a0", "comment": "Malware payload (PhantomStealer)", "value": "db0e8f3749fd766bb1cec3d50e758e262c8ebd502c9928ff6b46d717716264bc72a8d719c284d75ef1ca89c687d3e252", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809698, "uuid": "71295205-88d2-425a-bd30-8179bb3099f7", "value": "T15265230832EADD0BD4C75FB44B70E27A67791DD9A416D2064FD67CEBB8393E12980287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809698, "uuid": "e329d2f9-f79d-4fcc-b7db-e4852adae8d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809698, "uuid": "45dbd210-727d-460d-8db3-3d8510c2e323", "value": "24576:G/Qkx1oXk2oqi3oHZNpT5QyVMmIMExcnwf1oTAss2hwaT5nLEze8iN9l3N9ZVrTe:G/Qkx1o7HdZ1KxuwfYAohrTBz8iNBTV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809698, "uuid": "4581c52a-bfc1-4810-a64f-0927eff8904b", "value": 1536000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809698, "uuid": "07dfd427-aa40-4da1-b437-f46947826328", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809698, "uuid": "0d0565ed-6e18-43fe-8f6d-94a56d38b36a", "value": "7058f96bcc11886647b2b264535255fe6422555b0cf878ddd2bec4c4a9e1d126", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb72f9b1-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1772810820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810820, "uuid": "1d332cca-9db4-45dc-b4da-db3a22c5c652", "comment": "Malware payload (DarkTortilla)", "value": "03dd7349f692dd0a8c2723809ad21faa", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810820, "uuid": "c414f467-4b04-4ed0-a241-fabfe8886edb", "comment": "Malware payload (DarkTortilla)", "value": "7157165f0ec7acf431db00aed0a0afbf01a2314396797399194ef0e80f6b2f54", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810820, "uuid": "f0baa57e-47bb-4978-9c7a-03c43c51492f", "comment": "Malware payload (DarkTortilla)", "value": "b943fb9bfdfb2d40918d7da656b3ee82cb04e566", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810820, "uuid": "a02cb36f-e850-4d29-8667-a1edafbfbd8a", "comment": "Malware payload (DarkTortilla)", "value": "9a8b6e9e43447290684f54308f1b96a75b6d734edf6683080d71dcf7736dc1a43a5e2f22247e49cbe0fdf7bea645bd12", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810820, "uuid": "818a732b-37f4-45cf-ab83-92fd2903c8c9", "value": "T12335F1125E832B68D2690F7CC06708AC37F0E1679227D71E1EEC41FA9FA2FD5C926915", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810820, "uuid": "ad068721-5359-438f-b4ae-6e2f73b6205e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810820, "uuid": "449cec71-7cb1-47c6-8e97-a0c506c980fd", "value": "12288:urAkpfxeYVaXAdpr+8Esd4sEwRA8DV08T9i3gzAxcJivnlCypWNecZLmxii:urAE7dZ+8EsdfRA8DKKAxoivntWRu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810820, "uuid": "41bc95c5-f53d-4646-aa1f-2ffa56c40de3", "value": 1113088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810820, "uuid": "d969b017-357d-47a9-89dd-aded451c7554", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810820, "uuid": "2e4ecad7-18ef-4410-a58f-4f9c2377b450", "value": "7157165f0ec7acf431db00aed0a0afbf01a2314396797399194ef0e80f6b2f54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3d3db29-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1772809921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809921, "uuid": "df31d50b-a960-4ac1-b09f-b7c02a5c1044", "comment": "Malware payload (CoinMiner)", "value": "19bb0e2e2affaaa53bdaf27998d292eb", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809921, "uuid": "843b6e55-26a7-48e6-b76b-c6bb7a3c017a", "comment": "Malware payload (CoinMiner)", "value": "71a61ac678e6f0c98fa9a44639e9c0d3769d05a1e6a5a65f8b7247ee72357bb5", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809921, "uuid": "9d44c1de-e06c-4e48-a468-236c979310f5", "comment": "Malware payload (CoinMiner)", "value": "20600092e55f83bef39c783072e925b397c3064a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809921, "uuid": "1e8c5b25-9150-4464-bf2b-080943e1a364", "comment": "Malware payload (CoinMiner)", "value": "a7384634b4de763b0db77db3828d21510199656661b6dcda5b19f55d6ee631a7c718da2076c70391001c4991430fd729", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809921, "uuid": "6507bea4-30b6-413b-96ba-cd9b2f01bd19", "value": "T15F3633167BD297B0E21129B08E643FB106F1EF682F79929718E0775F5C707A1863D2CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809921, "uuid": "3c5312b2-5ed7-42ea-873c-ef265364f22b", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809921, "uuid": "acd741ed-a37d-4b72-9919-321cb661df15", "value": "98304:MH5OV+mPOPF5mL4+3paqGfibiVybtotnqwNUCcUg0NG:MHUVLJLxZaPKGVybtoAwNUCFgeG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809921, "uuid": "c5487368-37b9-4521-9af3-46cad9fb688d", "value": 4900424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809921, "uuid": "31bd3534-42c5-41f4-9bd2-1ff379809535", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809921, "uuid": "dbc2c3b6-2746-436f-9651-e5f7568abc98", "value": "71a61ac678e6f0c98fa9a44639e9c0d3769d05a1e6a5a65f8b7247ee72357bb5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b11157c8-1942-11f1-a769-42010a9c0008", "comment": "Malware payload (PupyRAT)", "timestamp": 1772790965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772790965, "uuid": "752d1925-bd87-44f3-82eb-a27daf807895", "comment": "Malware payload (PupyRAT)", "value": "807d93694cc6a6830530e5f0b0e698dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "PupyRAT", "colour": "#E000C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772790965, "uuid": "71c9d5f7-2e8e-47b2-bb07-0a94a333a716", "comment": "Malware payload (PupyRAT)", "value": "71f77bca1b9dcc9aa16ddcc58d185a9f5d31ecce1fd9154f29c50343d00ca193", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "PupyRAT", "colour": "#E000C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772790965, "uuid": "64ba4a91-efdd-435d-9632-d4431b087e83", "comment": "Malware payload (PupyRAT)", "value": "d905e1eb88a647046a8e15d84b9df0c0e56f3e24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "PupyRAT", "colour": "#E000C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772790965, "uuid": "21c209e5-4e69-4a5a-940c-8d70e907af3f", "comment": "Malware payload (PupyRAT)", "value": "7590c6f335f09c0d3d42f425fc0dca7f0fba56ae2580bd44a349ee5a7bd3e956d544c8172b413c78eb80149d36d51a35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "PupyRAT", "colour": "#E000C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772790965, "uuid": "d88fd7b8-3d00-4d48-ab8d-55c3fff4f90a", "value": "T155F53321F8459F3EC8B24A70984352F7C5353A1BDEBFB76F372440181A66A2B485FB94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772790965, "uuid": "0b567b47-cce4-429f-9781-61fc47508797", "value": "98304:MBGNlg8xkJVM+sdRsEoQqgOsAslwrvJIx/f:zNDbH4QzOs5wr6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772790965, "uuid": "c1d22207-6481-495a-9827-0c22a548fd2f", "value": 3414160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772790965, "uuid": "a4f21d52-605b-4c37-bcd1-63e1843dcaa5", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772790965, "uuid": "7c0a6315-fd9d-42f5-8358-29774c810711", "value": "systemd-adf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "297b4e00-193e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772789019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789019, "uuid": "ab986701-43a4-46d5-9acd-20ddb8f5ebf6", "comment": "Malware payload (Mirai)", "value": "793d3fc7c96a3dcec6ae3cbe0ba59c84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789019, "uuid": "6713e1f5-b7d6-4011-8dbb-26b2620df981", "comment": "Malware payload (Mirai)", "value": "7222546863d729c20a91b4e641f244f398669b72d00dea9936da7a7411dcc706", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789019, "uuid": "87dbfaf3-2904-47ba-a2a1-46df8e41fb63", "comment": "Malware payload (Mirai)", "value": "761879ee3c8e1fcbf7475bb8e335ff2eba1fd286", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789019, "uuid": "1e45dd75-0177-461d-99f0-deee78a34e21", "comment": "Malware payload (Mirai)", "value": "f10b1edcddf7b422cd6311013576baa9074e3ad78d288545456947c2f892f0ae3b0159a2cc734b8943c7b7008bf5801d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789019, "uuid": "9ad1cdec-831f-42f2-b99a-91c0670e2cb8", "value": "T1267339C1BA4BC0F6D81748704127F33FCB32E5798065C29EDF6ADE26DE276426216399", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789019, "uuid": "544f6cb6-f6b7-4c20-97e7-d886fc514d18", "value": "1536:EqI7PU5XRoGf/GIsJPvP7KLWqIdVV0ZpAtzery2w9:IWoGfav73XdVVgStZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772789019, "uuid": "e6aed483-eaa0-4940-8223-84ad7a8df92c", "value": 76304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772789019, "uuid": "abf0b499-8112-4ad9-9e61-96d0c7c116b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789019, "uuid": "7482402d-cea3-44b8-bca7-dbbd731c4d3d", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b979239-196e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809612, "uuid": "c0e79bb0-be4e-49ec-bc09-22ae9306a2d1", "comment": "Malware payload", "value": "af69f4800ddd8cf7c57ad985c26f2fd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809612, "uuid": "410d2148-fdc1-4eb3-b104-4a1431d80c4a", "comment": "Malware payload", "value": "72432d3b5897e1bef0687404130d51b5d95ff1ae5d0b5fe13f1938ebd96d1446", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809612, "uuid": "d1121a9f-2483-403a-b24e-f96a5eea4c92", "comment": "Malware payload", "value": "91495e63b9555dc5910cbc833110bb3e43ec4db6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809612, "uuid": "e13a2dee-e11f-4d56-ab7c-e7809ddcf511", "comment": "Malware payload", "value": "bc7c767a02a6800c7adb1c67e3e043b42f3c34693faa41663084c19bf5c002360876d8dac2ba1c74ee9008b3fcec7152", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809612, "uuid": "f17a3d58-193d-4d5c-b259-d52f0c9eb2db", "value": "T18145BF027381C062FFAB96334F5AF6115BBC7A260127A62F13981D79BD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809612, "uuid": "bac70863-efe7-4293-b39d-f946881b7289", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809612, "uuid": "245c5f0f-4c62-44a7-b0bf-6ffa88d50548", "value": "24576:L5EmXFtKaL4/oFe5T9yyXYfP1ijXda0dBbrnVUsXGl:LPVt/LZeJbInQRa0LnVUc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809612, "uuid": "db7b3c19-6a44-4c5e-ab7b-67a08de2fce3", "value": 1255424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809612, "uuid": "8e404011-3de4-4229-aa4f-cfa678f3b632", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809612, "uuid": "7e646b05-0ce5-44c4-89c6-d920cf5bfb31", "value": "72432d3b5897e1bef0687404130d51b5d95ff1ae5d0b5fe13f1938ebd96d1446", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03d9a575-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819021, "uuid": "896daae1-a912-4b28-b9e0-91f3f12cc600", "comment": "Malware payload (Mirai)", "value": "eda2f567c168832cdb87b146e990a59a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819021, "uuid": "30021a58-e5d0-4f3f-8e52-3337c0efe3bd", "comment": "Malware payload (Mirai)", "value": "7259f636b271375cfd8125378ed9cc436dbbfd80ed937dc0a790df378ec5946a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819021, "uuid": "ca31780a-4a90-474c-9620-e2096c2afd13", "comment": "Malware payload (Mirai)", "value": "8cffb4c3a51ddbda5127870e40b71213b2a8c22b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819021, "uuid": "5053df9a-58ab-4952-8816-8233b62b6d58", "comment": "Malware payload (Mirai)", "value": "a21ad62941f81dbffb8b203c5ddc30195196ef03f775ba349fae0bc60bc9c34ec3cee58c9f61c17313a8e64ef0e5abbe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819021, "uuid": "0289a745-3d90-4709-836f-93cbd6141809", "value": "T156334B0299BC2A2BC4E0A77711A74372F1FB2B954194E64FBD660C4FEF583501A7B6E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819021, "uuid": "7ab49ff3-8630-4d6b-aad9-93bdea7fb637", "value": "768:Y5erW8odLUY5tPktaTt0syt7SJxg2ZZqSwfUtlohjzR4zVkGMIZgTydwM:uK1ILhtaaKsyt7KyaZqSASohh4mQdwM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819021, "uuid": "d86edb37-0304-4fb0-926e-9980a6ce5ea7", "value": 53884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819021, "uuid": "3212f095-b0f6-4cb6-ba71-83404ce459a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819021, "uuid": "ef982110-f654-4ee8-9822-1469b0d0f643", "value": "jawirbot.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a135ba57-1960-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772803823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772803823, "uuid": "3de6d29f-ee57-4cba-a69b-2177600bdd5d", "comment": "Malware payload (Formbook)", "value": "8308412c49013ec7a23a6748cafd6ec2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772803823, "uuid": "fabbd189-14c7-46c3-9bf7-adcaf6890e30", "comment": "Malware payload (Formbook)", "value": "72653dab5599f11197a85e5ea526af71192dd8bfef42d1b626698baafc48585a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772803823, "uuid": "9c62e18a-a39b-44f8-998c-8cd5db8247c6", "comment": "Malware payload (Formbook)", "value": "73f801292b9f2fa417a7b1042a2f358ef989de6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772803823, "uuid": "9e351694-c169-4253-add2-7ed192409751", "comment": "Malware payload (Formbook)", "value": "42ab8f70d3b117a90b3bffb5c70f17c1bebf5a6e2b024ff3007daf897e7841343dcb82eac457b9c72457bc9cdfe10863", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772803823, "uuid": "cc3a9d35-b1e4-421a-a39e-f7ef3ff71548", "value": "T12B45CF027391D062FFAB91734F5AF2115BBC6A260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772803823, "uuid": "f7a6d190-a360-4993-8a9b-add697c63372", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772803823, "uuid": "cffc6ec3-446c-475f-aba3-42778d41ac06", "value": "24576:Y5EmXFtKaL4/oFe5T9yyXYfP1ijXdamJSC2/6KAoQo0TK:YPVt/LZeJbInQRamJL2CZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772803823, "uuid": "748c2f31-98a8-4b2f-9bfc-618c2d118418", "value": 1244160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772803823, "uuid": "b21257e0-3f38-4b19-bee3-217c204eb1f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772803823, "uuid": "b2921408-3617-49a9-b854-fea96208b0b0", "value": "72653dab5599f11197a85e5ea526af71192dd8bfef42d1b626698baafc48585a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da90d8ff-194a-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772794471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794471, "uuid": "c4258bfa-91e3-4004-a028-5636b0540f7b", "comment": "Malware payload (Vidar)", "value": "498295ab887d8c5ab07b8ec06328b20c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794471, "uuid": "4c628308-ed27-4f14-af59-f326fe1fd737", "comment": "Malware payload (Vidar)", "value": "726d59fa03667955293d626677e326018bbc3763197f3adbdfb80e65364677a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794471, "uuid": "c51e6036-1a16-49af-af60-541e53168440", "comment": "Malware payload (Vidar)", "value": "78f015a06c03e3a9f7a543ac75e27d2091ed8064", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794471, "uuid": "90266b7f-7b1a-4075-b827-a71bd1b2dc46", "comment": "Malware payload (Vidar)", "value": "ce1a139509d0ee6aec31fe068a39a473016d98b555586af310d27e6703c44b32240718ef1a5d7152ff3f095bbd9a701e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772794471, "uuid": "d569cf5d-4bcb-4e82-86bf-e6a05b16f8f5", "value": "T149959C43BCD024B5E5A9D2328AB112A17B31F85A0B303BC72F55A7B92F7A7D41E35394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772794471, "uuid": "78ccfe0c-c51f-4f2e-be55-29064576d525", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772794471, "uuid": "bc0c88c3-9e5a-4bff-9426-008fc4eac599", "value": "24576:qb370KFUxLUQfcSPIozJ12RBFiC5OkEvDuR0CqW3ma68ZzOcsYgtbPAURK1O:qD70KFKLT38Dgd/vDuCI3msMYgtXRK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772794471, "uuid": "3a2ee5c4-ad3d-43dd-a1ef-1a06ff630fc8", "value": 2011136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772794471, "uuid": "2ff8015a-f22c-4b51-b09b-fae1595c3842", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772794471, "uuid": "cf0becc4-0bb6-4c92-b75c-1a07a542c408", "value": "498295ab887d8c5ab07b8ec06328b20c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca91227-1957-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772800111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772800111, "uuid": "82c2fd07-b2f3-4bc5-8c48-14430487b4d3", "comment": "Malware payload", "value": "c0e4398459345ee5afa2ae477a733574", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772800111, "uuid": "de48e2c6-7af5-4c77-990a-f73be91c6033", "comment": "Malware payload", "value": "730e9e0bd0a41438d7d7af227f1441b4f9d8a54988e0add3a2e0fbd7312cc163", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772800111, "uuid": "0dc2118f-38ff-40ce-bb9c-60edeb1b2527", "comment": "Malware payload", "value": "50c52f69c6ec64aafaf093bf708452a8ef6c0615", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772800111, "uuid": "c251e265-e0b8-46e8-9592-f82c8a9ec3bc", "comment": "Malware payload", "value": "27ef47e799e0bc20812fec701bd65b80800c716a0faf67f5aa86edabcb211fe754710b5d3f224126ce53624c7d8425b2", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772800111, "uuid": "80c1736a-68cc-4f74-af3f-93617b6efbe5", "value": "T12B642351EC9C307BD9234DF3AD1F99CF5E6D7AE52D68D85CC214EC0AE2B992ABC60500", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772800111, "uuid": "2e23acb8-2b2d-47c9-a1d9-d0033fba40d8", "value": "c72d40c71bcbf3442320a9ed25ba079c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772800111, "uuid": "a54e5188-d0e3-45a9-9f75-df0bd788404d", "value": "6144:G+R1G8O0NiIPoLt21g1Mauj/zlcQAcDLjoiOlDcXPcIQLwT:G+R1VOkRPgtb1yTzlcQfXjof5acNS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772800111, "uuid": "a3144971-422e-4a08-b0a6-aba0ba01daa8", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772800111, "uuid": "824eab7b-dad4-412b-915b-29b15111b39d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772800111, "uuid": "aa5a10c9-9b48-4942-9e1c-94deed981d1f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cff13459-1934-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772785004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772785004, "uuid": "b558cf02-66d4-4d61-867b-bf0e3a727925", "comment": "Malware payload (Mirai)", "value": "ca71961966f17f85f9690eaa7257c2fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772785004, "uuid": "8d234006-4e37-4800-8436-6207a1de9c2b", "comment": "Malware payload (Mirai)", "value": "731f3adadeaa4d1f6991f85ee37ad082219c5f2fab61d70491a8054dc1c85e4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772785004, "uuid": "c1fcf6bd-92f0-492d-b34c-594ed47b51ca", "comment": "Malware payload (Mirai)", "value": "73d423002b5cd4f7dfab5432e60eaeac76e13bfd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772785004, "uuid": "9509098c-e705-4806-b97d-77476f0cbd5a", "comment": "Malware payload (Mirai)", "value": "bfaf3f9660b6700c644625b95704849fb307afb658aadcb11104593be133b1f6a61570946f2f4d72a09eef6efc63b96b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772785004, "uuid": "6ebf70c7-1e40-4094-ab4c-34fac5d58606", "value": "T12AC3F705A9429F11D4D731FAFB9F429933536FA8D7F97102D9209F6023CA99B0FB2612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772785004, "uuid": "9d018cfb-00c5-45f5-b29a-81ea1b9f5e2e", "value": "3072:Q9dIRpVxelpK2I4bTAaGSRpuHTrh5OAtFZuSP+:QgRQK2hHAaGSRpuHPeAluSP+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772785004, "uuid": "def890b2-b7fb-420d-8bc5-744edb9bcfc8", "value": 126760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772785004, "uuid": "15fe4e84-63e1-4e4b-8da8-885fa1eeb270", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772785004, "uuid": "4fb86cb0-e4a5-4006-9109-c57084e2bff7", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdcd9ac2-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810341, "uuid": "aba6c4c6-d2b2-411e-b608-129db0cd6493", "comment": "Malware payload (GCleaner)", "value": "a20bf2eb2895a773f0e86cba43dafd09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810341, "uuid": "89978136-1429-4a74-bbc0-8a530d99ef6c", "comment": "Malware payload (GCleaner)", "value": "73a42370876f7d34ac575a433d828aceb4215bebcdcf95f24ace7bfdeed1c89f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810341, "uuid": "ced5bd3a-cd85-492b-91c6-4680e33ea6bb", "comment": "Malware payload (GCleaner)", "value": "9d28132ea933c54fc04155f0a2762ad26ea7270f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810341, "uuid": "d4edf019-8814-4233-85ca-752b65ce4016", "comment": "Malware payload (GCleaner)", "value": "8ef2d13f2a474d237f28d0a3c8c3a4c56d1b14296a2897afd8bf0f63a76364d4f783331a140903b05d6468df17de790b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810341, "uuid": "6a505ebe-0afa-420f-a253-a87312a47bd8", "value": "T19B05AF22F2E14537C12B3A7DAC5B7E9CB939BE1129385C462FE91D8C4F3674938251A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810341, "uuid": "9ff30ad6-2dda-488e-b0e6-6a1f2dd1e582", "value": "fe4280c06246cc873fe89746dadec91e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810341, "uuid": "2063d141-1341-4eea-b67a-13ca2d9e3596", "value": "24576:2lluEBpPj6o4CPbE9taCbWIW4JCnUPdoJwr:2lwa1Vy4hwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810341, "uuid": "69f70964-2adb-4abf-b6d3-c2c5c5aa8a7c", "value": 812032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810341, "uuid": "1e0b5cd6-d4ce-45b8-ba22-538bd457e0f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810341, "uuid": "60400424-f9ee-482f-b3c0-06fc1ac62e1f", "value": "73a42370876f7d34ac575a433d828aceb4215bebcdcf95f24ace7bfdeed1c89f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf4c3b3b-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1772808625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808625, "uuid": "044fb88c-cd13-4e73-9475-364070e18439", "comment": "Malware payload (njrat)", "value": "e6e7cbc85d0fa559ebb3b867b44a2581", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808625, "uuid": "923d8c5d-c981-47f6-aedf-94385ca4ffa9", "comment": "Malware payload (njrat)", "value": "73c8d621dc10c0b3041ffa4b7621e7cda88b6de5dd65e62545fe036c88f3c4f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808625, "uuid": "d775e7a4-00d4-4984-a180-3f6eaf55e169", "comment": "Malware payload (njrat)", "value": "259389a5e1e602f0e67ecb968a0e22544b8737b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808625, "uuid": "b646ca0a-690e-40b6-b9ad-4bd48ed9eb2e", "comment": "Malware payload (njrat)", "value": "dbe8f3e45f1148df41b03902269756ed5b2729913ab8dd9da092de2c31d0d2459b9e5e30a176d76b99e365d9c8e9ff96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808625, "uuid": "25521ff6-5d02-41ae-8d7c-7f3e600fc559", "value": "T12A25CFE52705C801D8A75AB44836E7B76673AE5E9C24C20E6EE2FFDB7D32342140758B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808625, "uuid": "49aa6404-3af6-4b96-a348-cc4e1d58b7da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808625, "uuid": "1694b8bc-7d6a-411d-905d-21d16747d33d", "value": "24576:Mqu2VsZjLRbT4f/3/taEMQdGYE7CZqiP9Sz5A/:MeVSbk/Fa8dpE7CZqi05A/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808625, "uuid": "40e380ab-bc7d-4025-a7e1-f1a69fcdf552", "value": 963080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808625, "uuid": "74c46f23-45ea-4e5c-82b3-8edb4c231bd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808625, "uuid": "b4e7c3b4-e3cc-445b-887b-fc936bda0fac", "value": "73c8d621dc10c0b3041ffa4b7621e7cda88b6de5dd65e62545fe036c88f3c4f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e694389-1972-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811523, "uuid": "443d3670-028f-4616-8e58-bf7604b550cf", "comment": "Malware payload", "value": "8f0fa30247dfc24549c180e82a95c4e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811523, "uuid": "d154e5d9-1a51-4e44-97cf-232aa28ab69f", "comment": "Malware payload", "value": "7420fe4f02d903f52391f022a113aac16af8e814dd30b813c6a46e10dd4587ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811523, "uuid": "6e6fee84-6641-4c00-8361-40c6ff8063ff", "comment": "Malware payload", "value": "75d0c14f637f9de546cf4143176b79a55526b3f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811523, "uuid": "9513eb85-bb8e-40ad-a483-d3b94e2954ef", "comment": "Malware payload", "value": "294e1be394ab630c7f547077b293f2ef46de7cc82fc47a77e9387a5f5f69cf0e663dd84a39451edbda64a09ae9799bdb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811523, "uuid": "d267887a-cf7b-4f1a-a348-20fd964eea1a", "value": "T1A238338477EC18DBE41652379152DA0EEB49F00E52D7C68B93E015370C97BE9EDBAE20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811523, "uuid": "b73d8e05-0e45-42dc-9492-3691ce432782", "value": "c990338f8145dc29c6f38fb73cf05c77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811523, "uuid": "c8d13c91-4ed3-4e2d-ad94-78d23cbb9952", "value": "3145728:QTRTIgYRPSC++6y9UBr/dKUfslsHmjekOeSqjZId:a1IxaC4y9Uh/QUgxePlA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811523, "uuid": "1ca826ed-500f-4d04-8052-4d49a4f9567e", "value": 104456403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811523, "uuid": "5790349b-c908-4417-a0ca-624d5abc732a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811523, "uuid": "331f0e31-a6f7-40d8-8437-795558e653e2", "value": "7420fe4f02d903f52391f022a113aac16af8e814dd30b813c6a46e10dd4587ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a17277f-1961-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772804187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772804187, "uuid": "55fe48c5-755b-4e60-b7c3-1e5cc181d0a5", "comment": "Malware payload", "value": "bf9a800e1453da4dc0312913a4a559db", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772804187, "uuid": "4989f301-e736-48a6-b7c7-e6e5b501af19", "comment": "Malware payload", "value": "744e8a3df80d94db5aaec3b7bdf630d680068dab28d65c07386bc82b44078bb9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772804187, "uuid": "e55966ee-be3b-402d-91e8-0c4c0bd9478e", "comment": "Malware payload", "value": "ac7d25f2d3d7d38b248ba46a4e3527cea3a019c2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772804187, "uuid": "d9324c68-c29c-47b1-b91b-745b45d5edc5", "comment": "Malware payload", "value": "7d010b7e9aef33518cb9742027b509a2523a5d1eccfd0de5a21eaafa07a635d9354a55d70024b13fecb40f68699163cd", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772804187, "uuid": "60a501a3-48a1-4cc0-b895-a1a47bde85dc", "value": "T1F8E33A5EFB424A54C64C4A7FC663414886B5CBA6B027FBBB28D85DF17DE3CA84E4B050", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772804187, "uuid": "2fa92b7e-d9b8-4776-aa7a-c7673e6aeae6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772804187, "uuid": "c7fe6b94-a5cc-4645-bd9b-547bb94a0c98", "value": "3072:PgNsOFSqxaUKCM7MIfBRH6KCYt/vazOeAyhEqv7/bcNN+cegEA6IIL:Pm8U0Z6BYazgyhEqj/bcOcQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772804187, "uuid": "98235222-e135-4a22-ba14-120f9fc6b82d", "value": 153600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772804187, "uuid": "27c4371c-4086-40a8-abf5-664825f0bf0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772804187, "uuid": "038ebda9-47b9-46e9-bf22-9c987b56968e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "487d523c-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810976, "uuid": "a67e2c85-76b1-4c51-904b-ed4784100c51", "comment": "Malware payload", "value": "1c89198647c009a3d5e821357b7063ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810976, "uuid": "57b39181-be4c-43cc-ab62-6329f6a90571", "comment": "Malware payload", "value": "748235adce984e855dd6888c4774b1944bfad24ce5022f2c2600dd113c3d1ef7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810976, "uuid": "1922398e-20c2-42a3-9e13-2af17ce6dea6", "comment": "Malware payload", "value": "d6bc0bdc95005bb5c2e375cda7dd008e67c0c935", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810976, "uuid": "f3c33ca3-f246-4407-8be1-acc4be107146", "comment": "Malware payload", "value": "2df7b124e93e766225eb0f281749843b34acad838572dc7d87230a63937c0090478788a6fd4815343b554aee68d552fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810976, "uuid": "f9f779bd-592f-4915-91bb-7076f049e3c3", "value": "T149C4220533E1CD9BCA622C3A5AAF5807FEF4C4937474120B23689A5C3E723A76944B92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810976, "uuid": "07fff9ee-d24c-4628-9408-a9f687e6999d", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810976, "uuid": "e5521f50-67b6-4394-a7a8-e5ee2938474f", "value": "12288:C1yDJU0VKlW6aXPCNeUxW6lmmnxwxDsZjL:C1yDJUzHafCNeUx19xw5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810976, "uuid": "916aa953-2c05-4fb9-8197-b852e11fb23b", "value": 557952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810976, "uuid": "88349ff2-f7ab-4b52-b834-a292930641ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810976, "uuid": "3f330b5d-d963-4440-a8e8-6e932c00e023", "value": "748235adce984e855dd6888c4774b1944bfad24ce5022f2c2600dd113c3d1ef7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "483042c1-1986-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772819995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819995, "uuid": "e28e8078-f8cb-4448-bba1-0968b8f3e51f", "comment": "Malware payload", "value": "41ccbd80c43d4d54d5511c297235e4e9", "object_relation": "md5", "Tag": [ { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819995, "uuid": "1a43af47-3761-4714-ac53-ea25ed65a433", "comment": "Malware payload", "value": "74aadf8374a2b3be8c275179a68d9cb2e4623197d87b3a7b61da1d4a0511adad", "object_relation": "sha256", "Tag": [ { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819995, "uuid": "daade911-1a79-47c8-9f26-082495eb0644", "comment": "Malware payload", "value": "fdbae94d1b3ed27c02214aa42a044d3e2469d633", "object_relation": "sha1", "Tag": [ { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819995, "uuid": "79ed40ce-57c3-4dc1-93f2-2606f5154932", "comment": "Malware payload", "value": "6313be06f87c5d39c93ea7919f35c07ce59632a3cd6a5663f123e5c99505353f16e2072579ccd9370383e01bda908d72", "object_relation": "sha3-384", "Tag": [ { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819995, "uuid": "d9ed8f9d-9723-4a6c-8141-98a44805e8b1", "value": "T1C8757B03BCC064B5D5E9D23289B512A17B30F85A0B3177C32E65A7B92FBA3D45E35398", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819995, "uuid": "ebe135d6-c0b0-46a5-8bde-da5162cf568d", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819995, "uuid": "5c93f729-7870-401d-bbdd-dee15c4b0159", "value": "49152:M+o3zeEfP+GmbXmAa8AdR/PSiEMYgtLcK1:OOGQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819995, "uuid": "1e05b973-d5bd-4284-9775-b924ceb7f715", "value": 1665024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819995, "uuid": "c0d7a74b-3708-4ee8-98c9-f032a367f2b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819995, "uuid": "abca4147-ceae-47ea-8dae-ef1691f89995", "value": "Pro Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec107ba8-192d-11f1-a769-42010a9c0008", "comment": "Malware payload (AISURU)", "timestamp": 1772782044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782044, "uuid": "44405fa6-871e-47a4-a0ad-5a92c51d351a", "comment": "Malware payload (AISURU)", "value": "97335ec368b037969046950c823e3061", "object_relation": "md5", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782044, "uuid": "3b887b44-6cb4-4283-87d1-79246b802a74", "comment": "Malware payload (AISURU)", "value": "7500925a26cecd84ebed2914855cdf0812a18661e1bb6f3c91dede36f34bd7f3", "object_relation": "sha256", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782044, "uuid": "f576d342-c777-4168-a868-5ec69d7c8bda", "comment": "Malware payload (AISURU)", "value": "ae12dc40fd94ec5adc1dfc36743f0d8621d86e91", "object_relation": "sha1", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782044, "uuid": "ec0f9328-1cfc-4923-b8c2-d066cb11985d", "comment": "Malware payload (AISURU)", "value": "f9859da60148f7411b09ba305c56c6f560bff24d6c506b511ca4cc575103bdf750f3f8ca1b0b9af0a7fdd3529c511f0f", "object_relation": "sha3-384", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782044, "uuid": "ffc8d411-1b53-487e-bb06-77e865273a7a", "value": "T110C30859BD819B15D5D626BEFE0E528D33131B6CE3EE7212DE145F2027CAA5B0E7B002", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782044, "uuid": "12f8910a-9f4a-4d9b-b8dc-aa7c5de1586b", "value": "3072:jv/Itvfw1nYsSSIr+Chk/qLtGkaXQkgJn7cZ5gKuxU4pMY:zItv6nYsSxr+r/m4kaXQkgJn7Q5gBU+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772782044, "uuid": "c86e0283-8834-49c0-b509-002299a8ca40", "value": 126076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772782044, "uuid": "9c316915-e918-4321-9554-e83a1a9bb226", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782044, "uuid": "5b788bf4-924d-441e-96bd-7c98bd6d19cc", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3c1f4d6-1966-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772806404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806404, "uuid": "b21d3372-5ac2-4be3-9d0d-f63379d7d1c1", "comment": "Malware payload (Mirai)", "value": "bee43e7ecd9b50619e66ddd6e6eb9679", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806404, "uuid": "17fd2a9c-be7d-4765-b23c-307d4c3ca5a1", "comment": "Malware payload (Mirai)", "value": "75093b62b12a21069b8276a6ffee3e5b21da5335d56133f0a32177f48f4bbbf5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806404, "uuid": "5f6f1ca3-894b-4e29-9135-ca29c8dc412c", "comment": "Malware payload (Mirai)", "value": "10bd1e88f64c6ed433cb2523487e762e8a3ba417", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806404, "uuid": "58340e8e-0b52-460e-b44f-1b5aae7e7fbb", "comment": "Malware payload (Mirai)", "value": "eb58276f6f04b3a05fb561991a541f88c70f4849169dfade61672fdfd2aca4d80f40f08e4f84bed2aa93b00c3aae78bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806404, "uuid": "07d7ecb3-e0ad-490d-aa5b-c8c721cba6d9", "value": "T1D0E3F7C399267EB7C2C6EBB566E7DA7007D3EC151B430A49B1AAD9F40507DCCB809368", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806404, "uuid": "ceaead4d-9b6a-4797-888a-3f2596b2f4aa", "value": "3072:4Jpg4+qQgbxVjFFWytTffwqvhGvaCvLTi4eVlOmn3IkK:4Y4+qRlwyhfwmovaCvLTi4eVlOmn3IkK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772806404, "uuid": "d7beef44-8be1-4069-90cf-c7874df927a6", "value": 156503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772806404, "uuid": "d1e76dee-f3d0-4c25-ad9e-01acfd961321", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806404, "uuid": "50e4ef70-ee06-4051-bbbf-bae08b5ada5b", "value": "s-h.4-.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c682a1e-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819197, "uuid": "0e5736d1-e8d8-4c9d-afe1-0adf9f706181", "comment": "Malware payload (Mirai)", "value": "f0e43a721d05a73028a7dbf558ec24a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819197, "uuid": "3a34f715-2a69-4d94-a619-57273ce5e9e7", "comment": "Malware payload (Mirai)", "value": "751d3ac1d15ed058359245ef1dbbae79f528d0d7a1a66abaf2c0daf013ac38e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819197, "uuid": "0df76d70-7d4d-47b8-a1f8-237cb2599839", "comment": "Malware payload (Mirai)", "value": "a97304b64a5f8441b15e13c94cc539b6b57b6048", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819197, "uuid": "62571355-aaa6-45bf-a1b6-6c12c9c518d8", "comment": "Malware payload (Mirai)", "value": "210ee10f0b48bab51a6716ec0ae350372e381ecf6301e3ca8ca417ea2a837a453c6d78379f622fefa21179b2831c4d3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819197, "uuid": "2c92b804-bc05-4ddc-a23a-cfeac1ef2fb7", "value": "T10073090277080F43D06329F0267B1BE097AAFDA518E5B684752EFEC59271DF22186FD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819197, "uuid": "0540b1f0-863e-4c6e-8a09-861a0b4a00ca", "value": "1536:SpC0cTUCVdEX9X6A01wvVfATaN4Idfa+4aQWlOC3sus/Br:StVXcJyWT64IM+9par", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819197, "uuid": "bbbf1ca7-7486-4d8a-a5a6-a96fa48fb609", "value": 74984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819197, "uuid": "ab15a751-1745-4c1c-a908-cd6f47d30f3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819197, "uuid": "84a2ed63-d92d-4681-a5cb-0b7f7d41be03", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f204221-194c-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1772795176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795176, "uuid": "411f3f7a-873e-4598-9792-296c60305392", "comment": "Malware payload (PureLogsStealer)", "value": "11fe7cf6ed5ccf962279868b9d5b4cf5", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795176, "uuid": "461e4cbd-a88d-446b-b500-855aa247a8a3", "comment": "Malware payload (PureLogsStealer)", "value": "7576a22aada711e4a6bb71be740e31a2b303fbae1882af1be2fe2a5e4582e0d7", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795176, "uuid": "a6a5cb40-bdbe-4bef-9b4c-ba0004383449", "comment": "Malware payload (PureLogsStealer)", "value": "bbecfceb3a8140aac98f08ee435321c932aba0cb", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795176, "uuid": "7a4f6f66-b614-4faa-8ce5-5a4b682010d4", "comment": "Malware payload (PureLogsStealer)", "value": "b73f8ecf6c947cd2e4a83d082f3723766b7d2aa3b02d5e2c2435094f8c5e9c606f261c7589ef09da10ea6c5120301178", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795176, "uuid": "2b47eb7d-4bdd-46a1-995c-daf59d5a13da", "value": "T1CEE6333494B9BA45C84C3430AF289F9F4DD2BA309F55534E784F95F9A632A0AF35BE10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795176, "uuid": "4b15e46d-ac48-4b91-8f9d-2406eece44b5", "value": "393216:BzMsY7coi2dTbBjI+5kINnGdBzOZjiH5Sb:BzFYrB7HNnGdBzOd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772795176, "uuid": "ac4914b7-b5f9-4004-a782-17bd75fcb571", "value": 15089664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772795176, "uuid": "15490a73-0377-4666-8472-ae70dbee9c51", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795176, "uuid": "7792ebb5-a30f-49c9-8f58-0d687572ac76", "value": "Installer.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dc8348d-196a-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772807978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807978, "uuid": "351cff7b-fe8f-425d-8ae9-a61c9d6b0442", "comment": "Malware payload (GCleaner)", "value": "87add7207c89c9631f942f8a079cfbfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807978, "uuid": "94148752-af3b-4442-ae71-1c61bcabe251", "comment": "Malware payload (GCleaner)", "value": "75d535f099446c4802b40ab1309cde32045fa3de81a498be0336fe65b342c1bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807978, "uuid": "b1306e9b-7214-4db6-8c8b-841454ba9aa7", "comment": "Malware payload (GCleaner)", "value": "dd5f1d20ea384007649e44f9392eadb76318b8f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807978, "uuid": "2ff97032-b1a4-486a-bad2-4f4b72eeee11", "comment": "Malware payload (GCleaner)", "value": "dae2b3d8ea3b9c2584129b7fa835ced2d617fb777f2ac7792f5c92bf385469f00e4e952bda5414f3eaf5ee04590d56cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807978, "uuid": "c49ae92e-1c50-43ed-94fe-93158c56809b", "value": "T11136E0FDA1B2C62DC021E4FD9C3586C750751E60693DF4A8A3780DC6BB1657638BC2AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807978, "uuid": "36a7355f-41eb-4cf1-9cc9-a237148606db", "value": "e5f32a93ddcf3aa9009cd70911b0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807978, "uuid": "ca93858a-7798-41b0-9332-58a73b0ba2e0", "value": "98304:99CexzfMnLAFiJKdK5tEvV2PhCoQuS/JvB4:9RX2uK5trY04", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807978, "uuid": "a7ef2843-c013-4479-bfdb-ad7641e37332", "value": 5019136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807978, "uuid": "c330b7a3-75eb-48f1-a825-8b0eaa00247f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807978, "uuid": "9fde7ed1-01eb-4b54-beca-ee1afb81b703", "value": "75d535f099446c4802b40ab1309cde32045fa3de81a498be0336fe65b342c1bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88941640-196f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810224, "uuid": "c4d0b1af-f3a3-45fb-acf0-03b19e36137f", "comment": "Malware payload", "value": "624fd30610dd77a351433335cc7b4074", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810224, "uuid": "659224b6-db53-4ec4-8416-5b8f01992a3e", "comment": "Malware payload", "value": "76913282eeb9e5e008feb01ec78efbc11e396275bb9aedaf08f6070e7675633a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810224, "uuid": "b5c859dc-2084-4209-84f4-829d07a3230c", "comment": "Malware payload", "value": "7cc379c734940db3cb03ce943ea8fd300c7567cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810224, "uuid": "6a2cf22c-7a6f-41d7-917c-fa95c402161e", "comment": "Malware payload", "value": "34964bc565d8c1d354321ba1f63a6ecbfa428793e65d4ee96a186101ee499ceab2c200b8c091b2a650d5a0759427cd62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810224, "uuid": "337a0926-691d-4ac7-8e9e-2d16f82efb02", "value": "T13494E516E650B4A5F89309713D39A256782D3C3A2680ED4BB38D9F663771A83B0F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810224, "uuid": "e4e6acce-73f6-490c-ba4c-45c3623aa417", "value": "7da084ed8a1375364beb941624e30357", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810224, "uuid": "f272f56e-a062-4458-bba6-4a4647d12f52", "value": "12288:xxL2aACLfKZTESyJ+A5P9rlGOixO7VBrkg:HXH+A51xscN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810224, "uuid": "b95260ed-13d8-4c57-a14e-582601fbaf09", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810224, "uuid": "a6851d68-3f44-4036-8e17-64a7fc42eea3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810224, "uuid": "d68899a0-987b-48ad-bdda-678013c34be0", "value": "76913282eeb9e5e008feb01ec78efbc11e396275bb9aedaf08f6070e7675633a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8ca4290-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772809527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809527, "uuid": "2b45822b-8c34-4297-aa41-6fb278e9a3e3", "comment": "Malware payload (GCleaner)", "value": "d596c81e1a942d067f630b9ce156c229", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809527, "uuid": "bbd4611b-5d00-4dd7-a4cc-1f3823e64f33", "comment": "Malware payload (GCleaner)", "value": "76a0805eaa63accbec2603d0bf273b46cbcc0d0781aad29a7e4cd4492b275279", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809527, "uuid": "862c4eb6-2a72-4ad1-835b-42aaeae1a661", "comment": "Malware payload (GCleaner)", "value": "1247641ff74053506e57e6e3c4cbe44bf879c201", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809527, "uuid": "2c656be9-0d35-409f-9899-dcbd2514d0ae", "comment": "Malware payload (GCleaner)", "value": "79811df25c6162af1986a484a5ac412fde5a401b4cb801813df9a1b00fde541402c4caa31fe8c62f0a77b281c49481e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809527, "uuid": "a7ff430a-ca2f-4ff8-bf85-6252c585746b", "value": "T12946D04997A4CD20DFF045B98D9A60D49817A860B80CFFFD2AD6F1D9CC1572110AFAEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809527, "uuid": "9b051740-e5b5-4bd0-b251-25ff39b944af", "value": "345624d13ffc2b7f296b9d2972b1c0a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809527, "uuid": "392f02ce-641a-46b7-809c-e541ead6072e", "value": "98304:xiZfokiUogoPlnj/kagyBuApgBn7VWwSxuXLA:xw9ClnjMS/gJl6u7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809527, "uuid": "8375b9ed-513d-4c14-90f5-95ef094045cf", "value": 5843968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809527, "uuid": "8111b1b8-93b9-4321-89cb-dea43ed7b8bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809527, "uuid": "7e48d60c-ee72-41d9-b0bf-275af7c4499c", "value": "76a0805eaa63accbec2603d0bf273b46cbcc0d0781aad29a7e4cd4492b275279", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b3146ae-196e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809746, "uuid": "01bc3689-c182-4e27-8ea8-9dbc1ee2358e", "comment": "Malware payload", "value": "f26ad026754a3778c5ba39955295be09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809746, "uuid": "dd8e4395-894a-4d04-9c69-24f59b907865", "comment": "Malware payload", "value": "7745d6448da651735512324f972dd104355f940b0c758a9d7c386e3c559ff621", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809746, "uuid": "45075602-cfce-4ad2-a59d-7870814bebfa", "comment": "Malware payload", "value": "7a70706a9bbbd9c0e67db5b44955bb201df758c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809746, "uuid": "55505df4-0bde-4f4f-9656-ea4681a4b096", "comment": "Malware payload", "value": "e42a5d2a7984dcf6f1f7f495c4365fb2b7b8454c4628bdd70bc30908b1cb7694bbb790dda995e7846beb252335936182", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809746, "uuid": "da010ee4-7836-49d4-885c-b359730cf771", "value": "T170F49E23B1B15733D262DE789D5AD25C9826FD01E92898457BE41FCB7E3834D382A393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809746, "uuid": "9d433b0a-9460-485b-ac9a-8e1d41d6e7ef", "value": "5343399a39928268750ade4858cbd1d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809746, "uuid": "0a3e1a5a-9e87-448d-8cbe-2263d7c58df4", "value": "12288:Z2d0/V6Chk61Wd0Mv6jE/h/AkW4hpH/oAi2wuzakbtS0TijUz:86N31WB6YJDl/zwud0mi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809746, "uuid": "6e36ad3b-9659-48b1-8349-56a921f905ef", "value": 783872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809746, "uuid": "2574eec9-e870-4b65-a162-dc77cb3e907a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809746, "uuid": "279ae16f-6b98-468a-bf50-c1d799f7a7ad", "value": "7745d6448da651735512324f972dd104355f940b0c758a9d7c386e3c559ff621", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ace1d1c8-1950-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772796971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796971, "uuid": "5b187168-cbfb-4ca9-84fe-1b9852490da0", "comment": "Malware payload (Smoke Loader)", "value": "4a986f0d8f67b8e3f493af67da28ba70", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796971, "uuid": "0bbb5373-88e5-414f-a2db-04d5efea3b4e", "comment": "Malware payload (Smoke Loader)", "value": "778664b87ac10a5e543c2cda87aab48917a21162109131360845b9c10e2f826b", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796971, "uuid": "35adf9c7-245d-443d-bcce-749e09b48102", "comment": "Malware payload (Smoke Loader)", "value": "0174442a4676ec63185af18c9ed4b5fffb23ee86", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796971, "uuid": "4dc13582-7aef-4925-a6c4-4b91ec7175f6", "comment": "Malware payload (Smoke Loader)", "value": "128b992d61cab202b5d8edd6704d1f150793f9ef52778e0bf3921ff614b77ddba8619b21d1aac675eb26731e2b1bdbc5", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796971, "uuid": "86a9eff5-db83-472d-bf2a-29074dc95697", "value": "T144C501DB2001E8A9ED791A71A68CC53111B77DC21E14029B62E1FE973FB2947297FB07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796971, "uuid": "b9260b96-72b3-45bf-9d74-42fabddc533c", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796971, "uuid": "a761bc72-2fc7-4d9e-8589-ce55b929acc9", "value": "49152:iUzJy37Ps3OJPpAcL3uBtS3XhMXA8bq9fI0oaVRVACsrr6KU:A37oO3LsAMgjVzwr6KU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772796971, "uuid": "de2aad8d-e49d-4038-bc76-804d5d340ef9", "value": 2742784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772796971, "uuid": "c91fe165-2f93-4076-beca-8d8da752143a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796971, "uuid": "fe6b7a73-9f53-4ce2-9e35-9c3a1710cc3f", "value": "4a986f0d8f67b8e3f493af67da28ba70.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90e586e1-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772808950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808950, "uuid": "4f450b94-e61b-4de3-ade8-7ae82e7eda86", "comment": "Malware payload (AgentTesla)", "value": "01f027885ef7d70cf68573e62bcc75df", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808950, "uuid": "d38399de-0646-4057-b56d-837cba3e079e", "comment": "Malware payload (AgentTesla)", "value": "7816da1a3bd1ea03e6607b8dd6b7eae59f4fb9a907a760e5b43b27f1dc3a6d32", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808950, "uuid": "95852ad2-b091-4f74-97b5-6022aa3f3624", "comment": "Malware payload (AgentTesla)", "value": "79ed58a2df81477d19e5fe2886b04d9c6a599831", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808950, "uuid": "4800f493-c99b-44b4-8a6f-35e98dedfd4a", "comment": "Malware payload (AgentTesla)", "value": "1ac17a4f8c4a3cd734d097b8d76957e11040d645d1adf2844e0112bf15eaffb50b1db1290e05a106c04eaec272d0f8fd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808950, "uuid": "befa5ea0-b864-4abd-baf1-b97f728bde6f", "value": "T13184F1D034A090A7EABB6473D57A5D3207A36E2E76D8130F33A4732D69A3152471FE1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808950, "uuid": "413300e2-33d4-4e8c-ae7d-0657a12eddba", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808950, "uuid": "6387dce1-1875-4414-b70a-501156c8e110", "value": "12288:1wyaXgD8Wq7BQ4hWfrvXUXKqkHV26d5UDh4:1XaXgDjqjMZqkHnAW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808950, "uuid": "14b4ec8a-7301-4dae-9b2a-26b0ddf655b1", "value": 403157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808950, "uuid": "fc01dbf0-474d-4006-aa3b-99a1eac0c679", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808950, "uuid": "04071296-03dc-43ef-a9e2-a9c8d031c5f0", "value": "7816da1a3bd1ea03e6607b8dd6b7eae59f4fb9a907a760e5b43b27f1dc3a6d32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71a4c587-196a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808038, "uuid": "d1c46885-6f99-4305-a298-63135b8d1e3e", "comment": "Malware payload", "value": "54d726e453d1d5e53447d5ec6c5cb877", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808038, "uuid": "6baba935-670e-40f5-9616-3b458a0c2e07", "comment": "Malware payload", "value": "7851d886d5bb344e86893e2d924d0abf86250f18bc559a39da81658098036150", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808038, "uuid": "bf8c42bb-fd11-4dd9-a11d-7d389e1fb373", "comment": "Malware payload", "value": "ec83c8f57a3b020310e34154a5127b9e1af56ffb", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808038, "uuid": "273eeb3e-0046-4fa9-b455-e1ab521c764a", "comment": "Malware payload", "value": "d48cb8528a46ff5e50783b8d3334c674265806bb2cab10c3deea1078851f9c9e25c8efee42fb6303a8dc9d3ab1d26126", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808038, "uuid": "34084818-d276-46fa-b534-a05f899ebf8c", "value": "T100922A3DDCB8F9E086BF70C1E9E72A6250847B128FB25CB8D40A1C6807687D6DF2611D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808038, "uuid": "34bf1cd6-e7cf-4fe1-82ed-46f80bfbead1", "value": "384:wc2KqBczrhoFxhxtBYs8bJgDOtRVAYN5M3XUI/kXKMlNJTXlXf8YmKz9OIqscKcb:bVdW7BYsEJkOtRS1/QltXf8JKzFdc1ga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808038, "uuid": "d6c6c4bd-cc96-480b-a927-e99f5492067a", "value": 20638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808038, "uuid": "f2110b44-ce9f-413c-acaa-a65eaae05d47", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808038, "uuid": "9c05c753-92bb-413f-a398-c42c7625fdbc", "value": "Participants-2026.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8c343d0-1928-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772779891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772779891, "uuid": "6818c535-50c9-47af-a5ea-3e6d308f44b7", "comment": "Malware payload", "value": "07b113ed8039481d36f611c55c24f6e8", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772779891, "uuid": "740b2cd0-7fc3-4aa8-b432-5c1935e299d7", "comment": "Malware payload", "value": "78570320045cf05f9297839bac1378d953155ca5fddc0cd53ce2844edaca29c5", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772779891, "uuid": "b113ac3c-06a1-4e59-af1b-22e097962cbc", "comment": "Malware payload", "value": "4c91fc7406eaaca1ffbb4cd709edad7979cf00fd", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772779891, "uuid": "b0930ffb-2250-441e-9a50-0db9b576bd82", "comment": "Malware payload", "value": "52b381c88d88f3945144587e55d17918f75af8636ca8abbcbfebb46713fbbcb8956d87b48cd080ca2d19131b9e877f8f", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772779891, "uuid": "d2c750fb-0842-4cbd-9d42-def609c3398e", "value": "T10414BE142CDFE0158AF48511FDBDC561ABE7711BC9202C0339BE64F21F6B764AA21E9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772779891, "uuid": "383e6ec1-4d8e-45d6-88c9-86c706fd4e6f", "value": "3072:x4YKKPYg9ZWR7cDXfV4KpQlEuE30mMVdS8IUy5PSJa7teInvjIww/:xbKWfWR7c2KpQy3FKMbQInvjIww/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772779891, "uuid": "034eded0-6698-48c6-9e86-adad966b7cb5", "value": 200358, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772779891, "uuid": "24e6527a-f3f4-44b4-a32d-7776e2fbee37", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772779891, "uuid": "737819ec-027d-47ec-a93a-c134dea2cd88", "value": "Protected.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5432ae60-1968-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807130, "uuid": "4467c34d-46c7-4375-95ba-d2c4653c72f5", "comment": "Malware payload", "value": "25e0e6d9017bc2fec0ea67d61fd1a1e2", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807130, "uuid": "f9901206-a311-4ace-8f5a-e9d3ecd7ba3f", "comment": "Malware payload", "value": "78a21ccf48427922d139518c553cc922a5ab446ee5f58a9e22f8789be5bb4751", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807130, "uuid": "52c67097-bcf3-4c92-bdd9-eac8e332dbb3", "comment": "Malware payload", "value": "264e6e7220925a33fd900f5571cfb28319b96fbf", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807130, "uuid": "82cab325-1331-4513-9985-815a4c1d4fee", "comment": "Malware payload", "value": "340aabab16ea0196778b6a673caae84ed9adfe97a332dd6eee345706b3fd38c2eae2b35ca5aa5af31c28f5c85693f330", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807130, "uuid": "87299d5d-5971-48a7-b5be-26ff810cd941", "value": "T1F3763332E15D0AC2E43EC27B90B1178587AA121EE193D07A91427FC5B2E3BCF54DD99B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807130, "uuid": "0585e96d-8341-4459-9ae0-67fb1826814c", "value": "196608:F5bUuU+HB/OGUElHaXU8Y4FCPjSLjmHXUPZftY:F9LU+h/PUElUU8Y4F+SfmEPBq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807130, "uuid": "6cb5cea6-7879-469b-b41a-b4310683f08f", "value": 7829662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807130, "uuid": "d64b2570-bdff-4963-b662-ff7186233b2f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807130, "uuid": "3b3fafbd-a07d-48f4-b189-6b2172441c83", "value": "78a21ccf48427922d139518c553cc922a5ab446ee5f58a9e22f8789be5bb4751.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5da6e75-1969-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807777, "uuid": "2982019b-44c9-4146-bc1e-3fcdd901c382", "comment": "Malware payload", "value": "f8ca4b89700bca149f19efb1dbb8b4e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807777, "uuid": "edd957e1-c3ca-4017-96c5-5fe42c7b228f", "comment": "Malware payload", "value": "78b44149af6b83074d2af8162554e076c02790dedf81391b5d3441d4d368bec0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807777, "uuid": "7142cb41-b443-4b23-a03f-093985a7f61a", "comment": "Malware payload", "value": "0896def747bef94379b9cf55f016cc81c5e52b05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807777, "uuid": "fd8b62e0-875c-4b36-9529-ba938b81afde", "comment": "Malware payload", "value": "1a753c8ef709af56a20b29c23c77087811faecd1662bd0c8c8dce087a63620319c99cd46ef012f00b99c73051fbc43f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807777, "uuid": "6c2c9e6f-258c-4f63-9b76-30d2afb15b45", "value": "T18335120DB756EE92CF184B7BE953110441F3C566D522F3A7EACE2CF20E6A719844EA43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807777, "uuid": "12089f16-ae1b-4a96-a540-657f4613dd1b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807777, "uuid": "52e0a5af-03af-4ca8-823e-15a325c9511a", "value": "24576:Og91FIoroFozje+Ir0elo+oEDhAnajxFgdzgO8zt+1D9KZ9RGAa:OgRzroFoz6wQDhmajxwgOm+yE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807777, "uuid": "9ea5c1ea-24a1-4271-9134-61a0a02b97d7", "value": 1093632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807777, "uuid": "40ecb229-bf4e-4bf8-aa79-a3c1d01906cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807777, "uuid": "a3400316-bb15-411b-bb5a-ffd3aa73f367", "value": "78b44149af6b83074d2af8162554e076c02790dedf81391b5d3441d4d368bec0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad0f1ffc-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810286, "uuid": "8c6a23dd-2cfd-4d75-aa47-f382e5490bce", "comment": "Malware payload (GCleaner)", "value": "e6798a0c4bf9ee03aae21b9125d47c7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810286, "uuid": "0f090886-f124-4039-8647-4e25b4f9fa21", "comment": "Malware payload (GCleaner)", "value": "797f74d4251722972b3c15bd670ea5058569d922404791357826379d13a7ace6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810286, "uuid": "1dad8da9-5d84-467c-82b1-82c839d2f09c", "comment": "Malware payload (GCleaner)", "value": "985044d6e9294b8f98d950b704e098a8da90e4f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810286, "uuid": "7e448eff-049a-4b88-a678-230a4bca3712", "comment": "Malware payload (GCleaner)", "value": "8af1273ec9d371c7240dbe2a78b3426b939f8b8f0ebb31976f2aa1816c06d7228a87f98a7cd9d15e5b008293f5bc8ae0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810286, "uuid": "69fc8976-0735-4f88-a5b3-18654d84d9f6", "value": "T17B558D22B6934433C17216399D3767D86C2BFE132E38984A6FE91DCC5E6CB4178253A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810286, "uuid": "6673d63a-d7a6-4062-8358-487bbab09d1f", "value": "0eefadf8e9087d6d95cc4aedf30a5018", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810286, "uuid": "868acc0c-7ba9-4013-b93f-b18fb9ac4006", "value": "12288:QVLMD7V2wGymFSmu4eDCQi0628ZhcPaGfEdERlSdpgdICRgi9HwmQ3OjmlSy8aRR:QVwXV4HSmYq7MPPfEd+epghSaiV8UD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810286, "uuid": "167b0aed-f286-4c06-8622-6f3210747d5e", "value": 1280512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810286, "uuid": "29405990-7ef9-4e1f-a76b-b2b43eaf6d98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810286, "uuid": "0ddc57fc-6e10-4513-a95e-51585c0f6037", "value": "797f74d4251722972b3c15bd670ea5058569d922404791357826379d13a7ace6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c85e369-1969-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807600, "uuid": "21883b85-3c81-4790-af29-7c427642f36f", "comment": "Malware payload", "value": "237f28025897e43c55e3c9542079c3e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807600, "uuid": "2fbb249e-0867-4591-b65c-99e632177b09", "comment": "Malware payload", "value": "79c1faf5182ef6f6bdc54c60d7f44a46b9153d88ea921919b6e1b9262b7a7628", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807600, "uuid": "20a4d519-3dbe-49ef-976a-b5750d46c5af", "comment": "Malware payload", "value": "75ed7b4bdbb49e048a9e898754c861f397d296cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807600, "uuid": "5f15249e-d7d3-49da-bb16-aae8d6dc63fb", "comment": "Malware payload", "value": "15987d0faf91d325cb420461818a7b69a2ea8a0f6d15961c0b60088de89ca1b1d7994a0e00e7669af77025efcc4e9c2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807600, "uuid": "0c6b4c45-9235-4af2-8552-a9c4519f1bc7", "value": "T12FB4E1113988EC82CD121C30197DE6B6773BFEA56D2B8A07318DBB9F18B365E5A47704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807600, "uuid": "94d7eb97-e585-425b-a278-1706e1a44cea", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807600, "uuid": "5d7a3d87-9482-4228-9fe1-70dfe3761ee1", "value": "12288:i0vCWhX9kSkMfYirIn0X/xSL1C7BdHlBWaexPT:sWhRkRmIn0X/xoo9pLe1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807600, "uuid": "ac7f8c32-b428-40d3-903f-e4e77330e70f", "value": 500960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807600, "uuid": "cad96b28-efed-47d8-bc8d-ed5609d4a7db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807600, "uuid": "ec759bc1-973e-4f6d-a203-d3755ebb2faa", "value": "79c1faf5182ef6f6bdc54c60d7f44a46b9153d88ea921919b6e1b9262b7a7628", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8109ca9-196f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810304, "uuid": "f9784d58-b240-4989-9e1d-018b52139099", "comment": "Malware payload", "value": "78a9b2794da45cc3d274de2de371ad2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810304, "uuid": "4e59bae5-4f00-43b4-a81b-04e01680086a", "comment": "Malware payload", "value": "7a24bda55309e3e626df6071adc29350dd9482e8dbf6550b368a9134495a2a01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810304, "uuid": "a86b8f12-ba32-45f7-9856-60caf18d6510", "comment": "Malware payload", "value": "90312cc1581b49a8f134eef97e765f58a22812d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810304, "uuid": "ed9cd57c-6e3f-4fd7-83a5-6ac846039b34", "comment": "Malware payload", "value": "c303d79120d9cf58cad9b396329d666aaa3b396c4297856418944179de544a11533594c297fbee3860ad0b2928574659", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810304, "uuid": "0724659a-f67d-4175-9c62-5e153f578a2f", "value": "T15925F0145F872B99D62A4FB8C1B210A473F0C6A79307EB6B6EFC00F55F62B89C907165", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810304, "uuid": "19784228-62f6-4650-a897-08c12dd4f0f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810304, "uuid": "fe70b1f5-1b1a-4fbc-8417-121344984664", "value": "24576:NJ6kP7MjfgJ0IGkmI92eDKLXng07ehN3:NJWj7k79G7gGehN3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810304, "uuid": "b51e129a-229e-45fb-b5c6-0b951417cb3f", "value": 984064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810304, "uuid": "0f506968-0db8-49ac-bd5a-146eb8c32274", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810304, "uuid": "44ae0d88-70c5-44fd-aec1-c96157f040b6", "value": "7a24bda55309e3e626df6071adc29350dd9482e8dbf6550b368a9134495a2a01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0a249bb-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811177, "uuid": "15649a62-1636-4540-a987-1d08f60c7a71", "comment": "Malware payload", "value": "8b51594391c3475d1b05feba8fa6b917", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811177, "uuid": "8c092653-ee13-4679-b77c-3143d10ccd03", "comment": "Malware payload", "value": "7a2aac7994b92265b807dc01378eea1cfd8247e4fcb5b800b26cc75a056443a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811177, "uuid": "88ee55a8-a9ac-484a-8cbe-f2169e7efab0", "comment": "Malware payload", "value": "9a8f80bf5ba2997b1ebf8046bb9d6031d51a20c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811177, "uuid": "aa2cc535-dd7f-42d2-b85a-ac42d6e2034b", "comment": "Malware payload", "value": "fb8fb24eabb27afa48cf33472cfbd1cf69bbb125c311abb5c219d9a74bf04ae502de36137955e401694caf31e21aa73f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811177, "uuid": "ee2a96db-c422-4f6f-8c4f-cd1e70bf3b7a", "value": "T10136D9BB8E384C89C6C7F1F69381D6700DEAAE66A4E6E0FE51D109401F437506F61EB9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811177, "uuid": "c78de23f-7acb-4357-afbf-659fd0fee93f", "value": "d512f74fd5e290f01bfc48029b75487a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811177, "uuid": "11c5a883-35cc-4fd2-83be-f557247f808e", "value": "49152:DKJTSeUPUuw42rhDjVZXyBBOAZm+KHqZNjDo8xw:DZGNd+KKZC8xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811177, "uuid": "f6530648-da64-4b06-a3a2-21eda1dff53a", "value": 5225472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811177, "uuid": "9573ceee-3102-4408-bd0b-ff2f0ac0e95d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811177, "uuid": "abbeaa56-4187-4919-ab08-d996bbd8e77e", "value": "7a2aac7994b92265b807dc01378eea1cfd8247e4fcb5b800b26cc75a056443a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35f61472-1969-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807509, "uuid": "c4811bd6-4d89-43e0-b506-6466c37ae2f8", "comment": "Malware payload", "value": "cca3f083dba3cfae9b45f243c10adad0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807509, "uuid": "a3ffa654-afe6-42f0-9ed0-04d7b5f59c0d", "comment": "Malware payload", "value": "7a6e204bd9e3f075c2a12d1803a0422c62183d981e8dd70028b9fb4fbd5cc0a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807509, "uuid": "5bda6e64-a8bc-48d2-9c38-f56cc19c4f8e", "comment": "Malware payload", "value": "272a4db69f34e42e5e5d4f1dfa1c505f70a78c40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807509, "uuid": "d1606ec7-950f-447e-9f85-af7e1e91c28c", "comment": "Malware payload", "value": "2b44a1c7950e634650267e1b0c3e3c5f821e23c6138e7cce058599885006eaae7b329a37d598e715893c99e2cd9c1e9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807509, "uuid": "30dccae8-9315-4d6a-af75-a01b1e1056e7", "value": "T1E4A328A3CC762F58C628D5B4B0B18F796B93AA6081475FBE1567C27480C3D8DF6063B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807509, "uuid": "eefdb55a-28ae-4184-999a-d3af416d5468", "value": "1536:7NufPeqU2CVKCsNV7lsLPC9z+NzWuBx/3RhyXAQ:YbU2RC4kPCtSzWu3/3L1Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807509, "uuid": "e81051f3-33a6-49ca-9e74-c924e42eb9ef", "value": 105056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807509, "uuid": "95d61bd8-7f11-4f72-9968-746eb214dcb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807509, "uuid": "376911b0-5b51-4d61-8ce1-78d935b03cb3", "value": "iran.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8afd51a1-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811087, "uuid": "6ea8b724-668f-4929-a7ea-5b05b5e4d25d", "comment": "Malware payload", "value": "fa67261e67db3f9ad51e1af6dd1ed2b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811087, "uuid": "1560e449-861e-4254-b385-561cf5af5f6a", "comment": "Malware payload", "value": "7b058239412690f2e0342b9fe0ae2d2c3d714d53910f11c1fd63fa19a2400467", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811087, "uuid": "3977bcd5-a64f-436f-aaa1-acf09f74fe6b", "comment": "Malware payload", "value": "340f2e88965fb0590889c31a76abd91dbd687141", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811087, "uuid": "f3ac8e79-c8d4-4966-9daa-ee0c7452f777", "comment": "Malware payload", "value": "d974969fa32cf66be332c3139d3b45dafba03c7ef417c8506efe8db8246382698e35a93194c7f1745b6884e184300ad2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811087, "uuid": "0d471fb0-4992-4193-8095-093864d82322", "value": "T181C423082BC4D933CAA51D3556A785DBF9F9DE613029420B2730CE3DFDA7BA1A94D381", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811087, "uuid": "3d03519c-af28-4158-bfac-a58c6a70ec5d", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811087, "uuid": "175f8fa3-d4b0-4d66-bea7-44ba428d3aaf", "value": "12288:R1yDJwVJ2ieB0msm8EJygtMDoGbAzlTfYz2+:R1yDJwVA/Bom8pgtMDBEzlTfYzz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811087, "uuid": "c3c4911c-ab22-4d28-b8a6-1f87bfdd3091", "value": 573768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811087, "uuid": "7533ce25-0933-4700-9bc7-ebc24797367b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811087, "uuid": "1c59131d-4303-4ea2-8ae6-7b6fa1b710a7", "value": "7b058239412690f2e0342b9fe0ae2d2c3d714d53910f11c1fd63fa19a2400467", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5db2dd33-1969-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772807575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807575, "uuid": "854b7ef7-129d-4ec6-8e0d-575776358f76", "comment": "Malware payload (AgentTesla)", "value": "58a5510031e3fa7be13b79460906c39c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807575, "uuid": "6d75eb19-fd8b-49c3-8a28-5ac6ef040081", "comment": "Malware payload (AgentTesla)", "value": "7b57e193677da69c6ac93c7d2e2dfdafab85037ab0272c74fc4d22b0014ff893", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807575, "uuid": "39e2d3bc-9d45-46ac-b84f-d56aa61e5b2f", "comment": "Malware payload (AgentTesla)", "value": "438ca85adc491210b27d9f28b10d0d76436a0687", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807575, "uuid": "281ee484-d122-44b1-9827-302cd09309db", "comment": "Malware payload (AgentTesla)", "value": "2c699f5c02d2cd1833462d19f84c1b88c6086dee3a4ad9d14d3c3e597d518c52a614e0c057dfb86cb9e5f18920af7abe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807575, "uuid": "590196a7-b803-46a5-b87e-aff2756da4ee", "value": "T1DC35020DBEB6AA51C19C5B77D413610C89E78027F2A2F29B4DDD39F04E64789C84EAD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807575, "uuid": "a759de2b-2ca8-40e2-9508-8ebf180dfa0f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807575, "uuid": "77b423c0-fb32-4c4c-9c6c-48328975cd3b", "value": "24576:E6hCuiZIY29onXop5Y104jnnCW9c3SR7akFbSDvTr:xhvifVnXop5Y10Wc3Q7DGHr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807575, "uuid": "5109113a-430c-4728-8be4-fe4fde15b72f", "value": 1068032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807575, "uuid": "0a58f320-5e70-4c07-a85e-efee26c385bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807575, "uuid": "3e9f82a1-b4fc-4e2c-8aaa-2ed5b0fb83f6", "value": "7b57e193677da69c6ac93c7d2e2dfdafab85037ab0272c74fc4d22b0014ff893", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69940c2e-194f-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772796428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796428, "uuid": "43ebcdcf-aa57-4908-9dc6-44a85e48d693", "comment": "Malware payload (NetSupport)", "value": "b9043f6a14295f52de2956a99efce107", "object_relation": "md5", "Tag": [ { "name": "94-158-245-153", "colour": "#0E67A3", "exportable": true, "hide_tag": false }, { "name": "cdn-westford-computing6-net", "colour": "#460872", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ink-approval-com", "colour": "#8059F3", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "westford-systems-icu", "colour": "#A494F3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796428, "uuid": "9eb3b7f0-b1d7-4b89-bb0e-44e7be81d8bd", "comment": "Malware payload (NetSupport)", "value": "7b7f9471d21d46c28456eb336ea96686e7206e4bc0951efffcf259ea54cdb831", "object_relation": "sha256", "Tag": [ { "name": "94-158-245-153", "colour": "#0E67A3", "exportable": true, "hide_tag": false }, { "name": "cdn-westford-computing6-net", "colour": "#460872", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ink-approval-com", "colour": "#8059F3", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "westford-systems-icu", "colour": "#A494F3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796428, "uuid": "ea650fc5-5c32-4144-a768-2e6ec80712bf", "comment": "Malware payload (NetSupport)", "value": "27498fa7b7ea30c934f86139313bd2c396953942", "object_relation": "sha1", "Tag": [ { "name": "94-158-245-153", "colour": "#0E67A3", "exportable": true, "hide_tag": false }, { "name": "cdn-westford-computing6-net", "colour": "#460872", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ink-approval-com", "colour": "#8059F3", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "westford-systems-icu", "colour": "#A494F3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796428, "uuid": "e38e210e-28ad-4f41-b244-0466c8bb9804", "comment": "Malware payload (NetSupport)", "value": "5b688659dd4fccbee81c9b4c7950ebc69dab5e0fe2861e8c2c3360f49879654d9ef75a77309a673fca5620a72676965a", "object_relation": "sha3-384", "Tag": [ { "name": "94-158-245-153", "colour": "#0E67A3", "exportable": true, "hide_tag": false }, { "name": "cdn-westford-computing6-net", "colour": "#460872", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ink-approval-com", "colour": "#8059F3", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "westford-systems-icu", "colour": "#A494F3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796428, "uuid": "625e494e-f93f-44f1-89b1-6c8135885d95", "value": "T168B5331654162888C421A1702E2BEFDA0336F4BD5D468519F21B5EBD43B3AEE9CE3F1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796428, "uuid": "907cbf2f-df8d-4d25-be6f-8533ed249728", "value": "49152:pjJebOxvR9jVnaXQL4ZWKbYomh8eQAfFwaY0kgo86FPbSRM75q5Kqr2YyNgvn:ntR9jVAY4xORfaaJkweH5+5yNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772796428, "uuid": "a6b7c5a5-53b8-4179-b513-a95a491092af", "value": 2365431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772796428, "uuid": "491c9569-5790-46be-8200-751bb7131455", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796428, "uuid": "c706d84c-314d-4f07-b8e3-e15beb8966b9", "value": "Giggleliftguess.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae986cab-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772811577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811577, "uuid": "bdd60a77-d89a-4cde-83b1-f08eef32253f", "comment": "Malware payload (Formbook)", "value": "4d9beef9d221dce889942776a9b69bfc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811577, "uuid": "223fac77-9752-4528-acf1-134120a7c1b5", "comment": "Malware payload (Formbook)", "value": "7b98cf43bee8fdd9576f0441ef5710b91bd3a05cca78066c9e4f0e3a07d3c411", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811577, "uuid": "a9584c2c-5844-478a-949f-81d8a183e020", "comment": "Malware payload (Formbook)", "value": "d8d426b74f57561be188e9de2ce4509757eab9a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811577, "uuid": "3696aa19-b1b6-4d7c-affb-d4cf597b0e71", "comment": "Malware payload (Formbook)", "value": "9b5954ab4084b55eddff6957fb4688c4594c16843916c4a81b14b6f8bbfe3ed523c1de4eb57b9134c96782ceb6689adc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811577, "uuid": "b2b60389-a129-480a-ad40-dcd7cc01030b", "value": "T1EBB4E009B349A4FED51AC578C6831912FA723CC64B71AEEF0B944A796E226F45F3D700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811577, "uuid": "09c82e96-505b-4246-8048-52a991eddb45", "value": "c71d9111a77fb9217f1e372fa1b6214e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811577, "uuid": "e2aea582-65f0-4ba7-8df7-3c2700c86e95", "value": "12288:twO/jk3vsBSzpRwUu0XWewn+h/A2zet8MztBY:twuBSdqlFAetnY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811577, "uuid": "f406a62b-54bd-4a1c-8102-2be444420a85", "value": 499304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811577, "uuid": "3b0c57b0-b4e1-40f5-8f55-d4f47bdf4871", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811577, "uuid": "807f46d7-510f-49e1-bbac-09f91317af6e", "value": "7b98cf43bee8fdd9576f0441ef5710b91bd3a05cca78066c9e4f0e3a07d3c411", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94066243-18fe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772761710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772761710, "uuid": "86d8bc50-54f8-46b0-9d88-62cf51e2408e", "comment": "Malware payload (Mirai)", "value": "e91dccd6d2a98519cffd0143d8111a54", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772761710, "uuid": "dc18a16e-720d-4938-8b90-13c241842555", "comment": "Malware payload (Mirai)", "value": "7b9ba082df5fd5dbcba73175f3bba57ddccef25fce1512c0708367bbd0fb3859", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772761710, "uuid": "b369a710-371e-4b16-b8ca-c49a07c1cbba", "comment": "Malware payload (Mirai)", "value": "ce55c60fcd0bf51daea58c29498919a4fed11403", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772761710, "uuid": "cdeb8e48-2fef-4008-b844-a337d254214d", "comment": "Malware payload (Mirai)", "value": "c16422ccc915757c68358fbf942fa0e8fd02c2f693eda3082b81033db65fb962ceef44d1d76c92bd111b62a8457ed77e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772761710, "uuid": "95b23b53-122c-4003-86a2-2f26e356e7d2", "value": "T1B3041905BF110EFBD89BCC3B45F9270529CC581A62EA6B36B934C858B54B25F1AE3D70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772761710, "uuid": "23ee9734-ccee-4d9f-b5b4-f82a71942d62", "value": "3072:t60NrtUpT/5dltGgXGGP9M4S8lrXwU2wonacrI40fCtZ1SD39rsJj/s9fx49SY2Z:t3nEr5dfHPq7UToac8uF9X0V6B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772761710, "uuid": "10a1f15a-3d4a-4eea-902e-0462d1026e95", "value": 179916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772761710, "uuid": "10721917-e12e-40ab-82d9-398ea17a013b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772761710, "uuid": "a1fd3fcf-2fe5-4167-8818-e626b6806ba0", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ef94df0-196d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809215, "uuid": "6d77fade-74c6-4071-8b83-ed58a98dded2", "comment": "Malware payload", "value": "8f0cad4337137fc9434f1f4fce278ef1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809215, "uuid": "d95b0b1e-11c5-47f4-9f36-13b661b5da96", "comment": "Malware payload", "value": "7ba7a9f45087733f3fa825456a4feb4b6c79710ee2c9dd65c54d8455c5bd0c0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809215, "uuid": "11e50c53-1bea-46fd-8296-34a3d65519c0", "comment": "Malware payload", "value": "f1a58437c382cbfaa5ab5e087aad242e675ebb85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809215, "uuid": "205e5499-9c67-445c-b4e4-9f2a619a0ce2", "comment": "Malware payload", "value": "ba5443cf0579fd746bb59605202d60281bd47e8434fa369eee216a005e1d5bc939b986daa92d853023468caa81f37d35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809215, "uuid": "ab564362-40b8-4846-9461-60f83b250780", "value": "T14245BF027391D062FFAB92334B5AF6115BBC79260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809215, "uuid": "b8737c45-32de-418d-a218-ac7552c1bae6", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809215, "uuid": "3a8a6d18-c7f7-448b-b14d-be001950aaf9", "value": "24576:05EmXFtKaL4/oFe5T9yyXYfP1ijXdaMjPRTmmMoCej8:0PVt/LZeJbInQRaMNT/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809215, "uuid": "09ab0f4f-7492-4f04-bf4e-8231c25b9899", "value": 1170944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809215, "uuid": "f9988c6f-423f-4c14-9a53-af216aeaffa8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809215, "uuid": "2e3bb937-f2d4-4441-a7a0-f89807042730", "value": "7ba7a9f45087733f3fa825456a4feb4b6c79710ee2c9dd65c54d8455c5bd0c0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95c25c0b-196c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808958, "uuid": "23938b5e-52f8-48f5-8536-ad863565de23", "comment": "Malware payload", "value": "c135b9255bbadcdb9caf4d2effa0ff9c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808958, "uuid": "1309e2c3-b943-40a1-8cfb-5be13a81eeb2", "comment": "Malware payload", "value": "7c0d1a9f2480add073c0ec9d8ee3de476e226a87bf92106c256dcc8fdd94cf4e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808958, "uuid": "b3ae4d18-0722-4b27-8214-3d1d07c5e86e", "comment": "Malware payload", "value": "082019a036d2d1d64842113a0bbb8864678d867b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808958, "uuid": "a6ff54f7-814f-4ffe-b8e8-d09de5726bc2", "comment": "Malware payload", "value": "42bd9d976f9ef8b52c6f87dffef8cfd589313ae2fae80d51b7018f95d5ff7ddcdde95e76871e84e37bcc48c0f6eeaf2a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808958, "uuid": "13545aa4-6852-4e52-b864-6fdb6660ddfd", "value": "T1E305D02ABA5D18FDE026C471D25106679631B8C60B107AFF81D42A353FAAFF11F3A749", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808958, "uuid": "47e0500e-4dc0-4576-a952-cd1e336bc1cb", "value": "a76586583a0e36ae93bb6cccae05bb45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808958, "uuid": "e12c15e0-0784-4254-9b4f-ec2ab7871898", "value": "12288:0ovf7cvH5VHhuNojggxCnSrn09+DUwTQ1szDU8SM8f:0ovzcP5TsIggxCngn09SP2szTSM8f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808958, "uuid": "289e99f1-5f62-469e-9e67-6e7ccb8ae627", "value": 811832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808958, "uuid": "de6e1070-080d-4a89-92c9-579adeb8fd8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808958, "uuid": "6f5d6745-4aaa-4e4f-988e-492f541d3eb1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4106734-1970-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810807, "uuid": "2c979bd3-86a0-4327-a217-8a7f2886e390", "comment": "Malware payload", "value": "b7ea77e6a6e4e4812564b7d321714d25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810807, "uuid": "f04144a6-c984-4b33-88db-b371baab9019", "comment": "Malware payload", "value": "7c24bb9ac305a9f23287f62c4267c107dea42b420bef11219e22ff288c077bd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810807, "uuid": "38d22042-d611-4a5f-9d05-e2c03d601c5d", "comment": "Malware payload", "value": "92747292d0ae89d867ad14def8a7f0521370f2ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810807, "uuid": "4510f065-75b3-4a9e-8b07-b910bb02955a", "comment": "Malware payload", "value": "8710362a6058c5fa5577754d99d42a38f0e869e07082930ced7e0af07870591774b68e3491eaa563d9f2434841c24afe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810807, "uuid": "e87553af-64ee-46ab-a512-5f101799d9a6", "value": "T132C4230122E1DA7FC8630EB14BF72DABF6F4952320389797B3524A8C7D63351B509395", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810807, "uuid": "fafca544-4697-46f1-886c-e67bb642863c", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810807, "uuid": "b38d4de3-d9c8-4955-8553-2b09739a920c", "value": "12288:O1yDJy0Yz3/MEZPclMS/nxwhrbG1ppCq4aDyt:O1yDJEznyPxabsnCRXt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810807, "uuid": "49f57c32-322f-48a4-ad21-f882b60b0092", "value": 562336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810807, "uuid": "399bf676-34d5-422f-9dc3-fb7d4cd256a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810807, "uuid": "caaf8e53-8b8c-4cf8-9740-08afdd6e2716", "value": "7c24bb9ac305a9f23287f62c4267c107dea42b420bef11219e22ff288c077bd8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0044be92-193e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772788950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788950, "uuid": "ce87f298-6dd7-4b77-a473-348699187d86", "comment": "Malware payload (Mirai)", "value": "96145ee6dcb8648c2f4ad1469c90313b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788950, "uuid": "d9626816-52ef-4648-b6c4-ae739b1e51d1", "comment": "Malware payload (Mirai)", "value": "7c42fb189cc6b9d2c4fb1ff06af42b540b0c195ea135c0d57f21c6641611425b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788950, "uuid": "e78d7de4-23d8-4de3-8f9c-e5bf41a3af2f", "comment": "Malware payload (Mirai)", "value": "cee8872e243f03884e408ec2e2e03906b5d8f298", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788950, "uuid": "3eb653c1-c323-4159-a2cd-193addee13e6", "comment": "Malware payload (Mirai)", "value": "8fcdc1871e3cfd2aaa6e52b11b66e68eaeb05f0ae47d3e55052de1c8a55051b4bd519f05eae8eec8e51ab6ed4149c0c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788950, "uuid": "41216c16-4a3b-4268-9db4-0a493045a623", "value": "T1EA03F15BCA56DD4B8BA4E830B86C64CA66D322B8E17E7967381A1278F6427040D71B89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788950, "uuid": "de987749-7dee-456c-9027-553fb5e2b6ca", "value": "768:+G5CGcO/u4yEVLgSAWLax+xn/VV34uThJhmS8SOd3dXonqwNEcs3Uoz1s:jkGc+TK37Ex/VV3r6S8SeX/waZz1s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772788950, "uuid": "f88ab894-2768-4f0a-82d6-8506fbca7a11", "value": 40036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772788950, "uuid": "7a84fe93-f569-43ff-9503-dd5a5be36a9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788950, "uuid": "1d9b2c59-ed68-41d8-a6a5-27e35aff8fea", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82be880a-196a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808067, "uuid": "97059c9f-c5f2-4fe4-a7df-4ea4e9f62f86", "comment": "Malware payload", "value": "c969c30f8e92eeb81e16aeba75f06933", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808067, "uuid": "8fea8ff8-687a-476a-a0b5-cf114b65288c", "comment": "Malware payload", "value": "7c5e075a5861f56e6fdeab4aecc37d2d2d0d19c384464a406a67000ff2b27737", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808067, "uuid": "d1e8d8e9-24b0-4a57-ae1e-81e912bbd11e", "comment": "Malware payload", "value": "1df79ee08d3d7e4773f75eddcba403c7d6f47373", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808067, "uuid": "2f44b280-51a3-4849-be1a-bffb7ac4de0a", "comment": "Malware payload", "value": "a8730d0b568765c990327cba92219bb020574778789fee8a5a966eac8b0506186c2f0cab82ee3043d562f5890d36c682", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808067, "uuid": "1ff922a2-1f55-438a-896c-763f77fd8e71", "value": "T1B435E00723D44A68E5BD977991BA04E113FFBB479732EB1CAC0A51EB0D22B41DE41B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808067, "uuid": "d2d289cf-fe7f-40ce-b95b-4d838509efa3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808067, "uuid": "1f9e2ed3-5361-453c-9340-48b7b5fd35cb", "value": "24576:5mfZNC8ZHKJCX0fI8mVS7ZXng07ehlmqR7Y:GZWWgI8mclgGehH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808067, "uuid": "2171b742-0958-4d12-b0b5-b28e44f441b0", "value": 1139712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808067, "uuid": "388797c4-53d7-43c5-b355-1445abaada5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808067, "uuid": "460415d5-d2e1-4109-84a1-c5578bbc63b1", "value": "7c5e075a5861f56e6fdeab4aecc37d2d2d0d19c384464a406a67000ff2b27737", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2c47286-194d-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772795692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795692, "uuid": "1061ef65-4f55-4729-86ca-be48c9ec6f2c", "comment": "Malware payload (Smoke Loader)", "value": "8985e6332c78355fd49efcd46700fe37", "object_relation": "md5", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795692, "uuid": "590b1bf2-4023-4d54-b343-0bdc617e4f21", "comment": "Malware payload (Smoke Loader)", "value": "7c90cf45e068bd9b227b648cda33de1bc0e5bcaa4c3a0ff74147851458f13d32", "object_relation": "sha256", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795692, "uuid": "1107df90-5bb9-488c-9725-fb99b078489e", "comment": "Malware payload (Smoke Loader)", "value": "fcdeac22ea222c3ce1247d30d1caa77da94b8b6d", "object_relation": "sha1", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795692, "uuid": "d8dc2c06-7943-4d4f-bf5f-e47b256bce8e", "comment": "Malware payload (Smoke Loader)", "value": "aa94a2aa4c0fcec119fdc29351e2232a5b54528e3f4f919351a1feebc2871ddccea9ad1b66e540e495f4c5a3e9b304fb", "object_relation": "sha3-384", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795692, "uuid": "7b5c2c7d-208b-4567-9788-5fb855ea6cb9", "value": "T1E777CE17B7D840A5D0BB8234897B9716E771BC110B3196CF2254BA6D2F73BD05E3AB22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795692, "uuid": "c908b211-240c-454b-ae53-f55629f1e228", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795692, "uuid": "3e1390dd-8d47-4f83-a3a0-f80fb04a8898", "value": "786432:VyYdZwvM+6TNHZkOMghYglCnBSDf/1g0755f:ldxPNGOlh7tg03", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772795692, "uuid": "96a4cd74-d33a-45f5-9eb2-ef554f2efc74", "value": 34123776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772795692, "uuid": "894c0ec9-b9df-477c-960c-d504fb6d7c6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795692, "uuid": "96cc4f0a-47b3-4436-8592-740e31c93fde", "value": "source code of carbanak backdoor discovered_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61649e7d-1969-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1772807582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807582, "uuid": "1b7b4ee2-05eb-40a0-8283-4e3bea7182e5", "comment": "Malware payload (SnakeKeylogger)", "value": "1627f9b4673de692a3f3aace72627a8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807582, "uuid": "a1e76e5c-3973-4f26-be45-6ea3b14334be", "comment": "Malware payload (SnakeKeylogger)", "value": "7d1576c37e098589686ce1a2757ea442f06776417caf6371847f5e41ea76fef5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807582, "uuid": "fa180cdd-7831-4b74-849f-6bcefc95d473", "comment": "Malware payload (SnakeKeylogger)", "value": "324b045fd04c8ce11d4b51691bb8e19f2ae77055", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807582, "uuid": "3e5fc441-c66b-4fbd-9bb1-734a854bee32", "comment": "Malware payload (SnakeKeylogger)", "value": "b841530671867532254c25f32d4dc85dc68d6a0014b878bb1df5eaf2674a57c2f4326607dc1092dc2b9c34c90b7655d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807582, "uuid": "667bf577-4b8a-4d7c-bcb8-3a20d1c7b277", "value": "T1A4552262239EDE86C6A507F51E36E33213B04E6DF512E3169ECA7DFB34C63824918607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807582, "uuid": "51635a57-f0c1-441d-bd88-a9f96f2a0246", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807582, "uuid": "df0ed162-57ca-41e4-bad8-782d501afe34", "value": "24576:7guQWjsbaBsOe68s8rufH0lkv9Nyf3O+kgDUgMSuZC1QYPzgPrc2VFpm1b5FVicv:Eu7YX6l8CflvoeIcSuZ7YPzgzlHpa5F9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807582, "uuid": "d1bb2103-b273-47d9-a2c9-9ba2983f1bcc", "value": 1336328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807582, "uuid": "94a71e6d-f8bf-49d9-a66d-919562222887", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807582, "uuid": "9c7e85b7-c3b4-42d7-b6f2-1376aa3eb4f7", "value": "7d1576c37e098589686ce1a2757ea442f06776417caf6371847f5e41ea76fef5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aa9c1df-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811006, "uuid": "fea4194e-02f0-405f-889d-0d440a137770", "comment": "Malware payload", "value": "4632d6acaf7b075b2a65c5a09b9914ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811006, "uuid": "6859bd86-04c8-4652-8324-71f4ddd4e565", "comment": "Malware payload", "value": "7d5fd8a7a997230c9c0cc1213b72b0e38b4f041e907da3bb24158fa200bcc5c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811006, "uuid": "fe6f9425-5d16-4bee-a655-d0965e5bebf7", "comment": "Malware payload", "value": "6ebf42bff0a6a8be1590a122ef8670dcef61d3ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811006, "uuid": "fb8918b1-638e-41bd-a152-360bc591b952", "comment": "Malware payload", "value": "5e225d3405da6f24cc70e0bdcd79f99b96805ab8cdefe3b1fd257adafde042b360e611469a5bec2e2de6c63bba65e08b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811006, "uuid": "cd855301-c823-4b63-9795-a3936cd41353", "value": "T1EA352313B276E413D19ADB39F638A9F989EABD54E0327B0F430C3F6878B95811135E85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811006, "uuid": "90e44608-e54f-47e2-bee4-3a368e581cf4", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811006, "uuid": "bfe322ef-721f-4990-bf3b-01f7ff3d56d0", "value": "24576:uAcCMAMWE7Eakp7GAfojvhwZc5drzQDG5/3WVd3ij1:lPMAMp70iAgjvV5d4G0VdyZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811006, "uuid": "b0b9daae-d3da-4059-8f89-953c09e236fb", "value": 1159080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811006, "uuid": "73831496-7bc7-41a9-a2e2-ab5cff7370f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811006, "uuid": "34c80e5b-be66-4c76-98a6-ae8eb592bcec", "value": "7d5fd8a7a997230c9c0cc1213b72b0e38b4f041e907da3bb24158fa200bcc5c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfd976e1-1927-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772779420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772779420, "uuid": "47cfc646-6424-45c0-8564-0f161553ca47", "comment": "Malware payload", "value": "3bce9bb391b088517cabc9307a45dd45", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772779420, "uuid": "d3be925c-2a5e-41c8-927d-b98367bf2c81", "comment": "Malware payload", "value": "7d68ff23ba4173e1cfe98e2b1e43c96ade9ebc3a960a72a09b52f3e3c25f309e", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772779420, "uuid": "1b95efd7-2dfb-4086-b562-6aa7fd017641", "comment": "Malware payload", "value": "f0c205846cbbd5a976911ea295b0773fb02e3ad2", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772779420, "uuid": "1f5324c0-480b-4cd2-a01f-28792613641c", "comment": "Malware payload", "value": "cd122da55c18a93b0bd61155ae653a9ad8748b00b4d77fa577b292660403dcf646efd6c51643a1284b3522fe8157d367", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772779420, "uuid": "6bec0e30-60c7-4c4f-a0c1-171c7885bd53", "value": "T1F171C30A2E9CD88FC50B1177146082C6F735428E0A4DEF2FA69922208DE19072B46FEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772779420, "uuid": "701df790-efed-43ac-9bc4-ff14bc724dd3", "value": "96:si+sSpkkEZw9P7FUbxqtSLgjuWfWtX2RzoWKMiAJm:RkEZkFQm2l2RzoWKMlJm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772779420, "uuid": "9356811f-4d88-473f-9294-8203e6e8037f", "value": 3545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772779420, "uuid": "5bc2d362-2119-49ac-85ce-4bc3a41e4d3d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772779420, "uuid": "3eb7faa2-aa4e-413c-9bfa-fc73794d5e34", "value": "7d68ff23ba4173e1cfe98e2b1e43c96ade9ebc3a960a72a09b52f3e3c25f309e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf2e5082-196b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808598, "uuid": "23ad8804-b544-4c19-aeae-28d880c2f104", "comment": "Malware payload", "value": "1f3581497b6b7b23ef55794372456240", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808598, "uuid": "00ee9916-2cc6-4101-ab71-f57d19744657", "comment": "Malware payload", "value": "7d86697c7aced31c8871e4b317107f030eec350b3c851bfb3eb68046bc67d257", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808598, "uuid": "12fab582-fb2c-4055-977b-ef0a6b593795", "comment": "Malware payload", "value": "abad24464bf4ccc588165f635215e0a93aba1bbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808598, "uuid": "970ac070-f76d-4f93-8042-c6b3cbfecb50", "comment": "Malware payload", "value": "93e3285f15ebd17f609a8a9b2715da8f585e18a4510b6b7c4d5400e47bb602740ef0f74c7abd756b143ce609934f0a17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808598, "uuid": "4718cf85-ecf2-4ba5-b0ce-8aca884eaacb", "value": "T12394D516EA60B0A5F89345702D78A257392D3D392680ED4BB38D9F5A37B1993B0F530F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808598, "uuid": "ace6a0b4-ab28-446a-84a0-8ace7ce12cf0", "value": "6fd1d641f42fe17f68ee62ef7da6689c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808598, "uuid": "21e53d8b-790d-4ebf-9916-01fdbdba135d", "value": "6144:PHs8Y5usJW/Vbas90xTvmpbx5CIVREsz2COkEQuvELrvJCv/vB1YjVPhQ2f1HXgI:fsV51Wkc0xTvmpbx5CIVO6+dx6SasYA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808598, "uuid": "99b1f70f-6e1e-451a-b674-6512015d0eba", "value": 417792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808598, "uuid": "79a3657a-b419-401b-83e0-6beb88dd7cd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808598, "uuid": "f0bcd125-43cd-4e32-9434-62f8fda1f9a4", "value": "7d86697c7aced31c8871e4b317107f030eec350b3c851bfb3eb68046bc67d257", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1a3ffe1-195b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772801676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801676, "uuid": "02bf8b9d-eaaf-41c4-a992-42ff970967f7", "comment": "Malware payload", "value": "8f4e621d8a5dbaac3f4d027a19c9511b", "object_relation": "md5", "Tag": [ { "name": "FrostStealer", "colour": "#039E85", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801676, "uuid": "a0858675-c705-444f-aaac-511bcf04be32", "comment": "Malware payload", "value": "7dd04ac73feb0bc13f2840a7df23a65a775c5394fc2b037cfb486eb6e4c0628d", "object_relation": "sha256", "Tag": [ { "name": "FrostStealer", "colour": "#039E85", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801676, "uuid": "7e9e48c4-345d-408c-a677-cfd51a7cd5df", "comment": "Malware payload", "value": "476cd2c06d6171c65ee51fcfc9b04d5e6bd56914", "object_relation": "sha1", "Tag": [ { "name": "FrostStealer", "colour": "#039E85", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801676, "uuid": "907afd01-fa22-4279-a44e-e017c60382a8", "comment": "Malware payload", "value": "b3d132c7d24517f0dd72a782068e05de17fa7f23cf7ee122c01745f02aa7b18aa569ad590583b17597756b1aa1163a0d", "object_relation": "sha3-384", "Tag": [ { "name": "FrostStealer", "colour": "#039E85", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801676, "uuid": "3e77f2cb-34bc-43f5-a2f5-3068dacc2e99", "value": "T1E5A7334C31F987AEC39E60B24526592F8E0D381B1186B6EDCEDDE3D3F2D15426E7A052", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801676, "uuid": "307376a7-e466-4877-be41-da6c228d86e5", "value": "786432:zUsrYh04u22PfKJ/Y2Uq7GdUu0roJLXIptvMaPEiLJfq08z9ymo+sbWz:RrYhFKP0U8AU25XIptvMwEit+9G+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772801676, "uuid": "9fe81dfb-b9fb-48ed-85f9-c586257b5923", "value": 46024614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772801676, "uuid": "634a83c8-97f1-4d2a-a033-90a9c5d6331c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801676, "uuid": "d4f5387a-0143-4c4c-a2b7-30249ea5f07e", "value": "dist.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a9bba7e-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808537, "uuid": "b1c1982f-3d49-4215-8070-9efce4871165", "comment": "Malware payload (GCleaner)", "value": "1f614aa03b71784c17f7918423c4a61e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808537, "uuid": "a295c04b-b913-4bfe-84ec-00dc4a940759", "comment": "Malware payload (GCleaner)", "value": "7e10356e1973aa9a143df94e849d2e4a15a700ebb47f2e6177b6e527e5c9acaa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808537, "uuid": "81c63cbf-4e42-4e6f-a5dd-bfed6d00bc88", "comment": "Malware payload (GCleaner)", "value": "589ab7fe8e415f41249cba695df8b8d19b2397cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808537, "uuid": "e4662d35-3b1d-4d77-906f-356ad94e5677", "comment": "Malware payload (GCleaner)", "value": "b15389de5ea994e4a55fe632b46dd825e6077bdcc56a5e090f09ab454176c04614cbb57ec0625ae4fbdce5988008d436", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808537, "uuid": "72e4afaf-75c0-4a9c-93c8-a5edcbe7dc5b", "value": "T13116E0E170E35167DC756A3CC54EF5C44A0A39648F30E8AC9FE6CBEDCA69C84587A132", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808537, "uuid": "5c0a3473-63b2-451f-9b7e-239307e1389c", "value": "099b2b7fa2a0044e2ca25418be2f8a70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808537, "uuid": "fd1bfc3a-2b6d-43f5-a659-d2aa52339064", "value": "98304:2teTbNm2o5CBE2kiB9DkiC73qkIrPVnXmXTDehV7:2wm2oeE7O4qrOT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808537, "uuid": "2091acf0-c24a-4719-b1c8-c8d6b3ae3791", "value": 4345856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808537, "uuid": "e1794436-7753-465b-a512-00a39873dcb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808537, "uuid": "dd4e2e60-007c-468c-8d26-9d1b29d99139", "value": "7e10356e1973aa9a143df94e849d2e4a15a700ebb47f2e6177b6e527e5c9acaa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bad3668a-196a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808161, "uuid": "1dfb4717-8c9a-4566-a7ef-2b1b76f4d9e1", "comment": "Malware payload", "value": "ddf006aac9d4a7ee3d492c85a152b789", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808161, "uuid": "d6a6ac10-d9cb-4fae-a81a-070b3f7b00e8", "comment": "Malware payload", "value": "7e52b86d3a300523af18b87223dd50d104d76b1e32a664910cda4d90917e495d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808161, "uuid": "c54ad47d-2932-4294-b123-fa33008becb2", "comment": "Malware payload", "value": "383121e031e95dc9b544a8401f9414164a24c129", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808161, "uuid": "f3dacdab-8de9-4b8a-815c-17e223b97507", "comment": "Malware payload", "value": "1fe7bda9ad6e5d57eeada28ff5c3fc8d27cd118e2e25aa59f66bfd6220de73405c08d74abc18e62dec8d29ab09070cbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808161, "uuid": "fb6b9e13-6566-4794-9436-37b7ee8c22a0", "value": "T1BEB4D847EBB550F4C8B6C0388AA26237F971785D5334ABD787548E171F22BE0A93EB05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808161, "uuid": "8523269f-4879-4d42-a2b3-3791d7847800", "value": "0a8241508ebbe65c17ae6ec3be86cdff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808161, "uuid": "b991f69f-3405-4bff-87d1-6e424122e6ad", "value": "6144:xnLdxFsMwu9hQ6n4hsc10pUDZq36TutqTASyACfts3Ehto5Ro:xnLf6HCcepIZqqWa3Mtg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808161, "uuid": "cef5c131-90a0-4523-a13e-8bddb2c2dda6", "value": 537088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808161, "uuid": "094c04b4-6bbb-4923-9c61-c9e5b517353b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808161, "uuid": "1df70946-0e5d-4984-8839-6655160258b5", "value": "7e52b86d3a300523af18b87223dd50d104d76b1e32a664910cda4d90917e495d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc1f1737-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1772811707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811707, "uuid": "29511006-34d5-4013-b29d-25e54704a7b5", "comment": "Malware payload (GuLoader)", "value": "51bbd1b8f4012bfea73c4a2743ff5d26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811707, "uuid": "94c26c2a-f057-499b-9dbb-e325025e00bb", "comment": "Malware payload (GuLoader)", "value": "7e72540284e2469fd10a11a46338a02fc1a25f7e681211248f95dbf01c9a6d8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811707, "uuid": "62c8946a-d009-46bc-8bfd-a648bcf3c88b", "comment": "Malware payload (GuLoader)", "value": "4faafe20f920ed4a008bf6b36afdb3581c473da4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811707, "uuid": "317abfb6-83b1-46b8-8432-27e747d70b77", "comment": "Malware payload (GuLoader)", "value": "1313e6c55bb703eb48c7f604dd45db660504339a98d329399dc46703b567223954180c09ec3689f7ee78f4d3ff98b89c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811707, "uuid": "b1bb1029-5049-4215-85d6-9a2525f2e525", "value": "T177B4E091F696DCE6E8360372993B5E352763BE7E89700B0F269C72196DB33920027D47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811707, "uuid": "985c37fa-ba6e-404d-8761-b8bf2e17108c", "value": "5f0c714c36e6cc016b3a1f4bc86559e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811707, "uuid": "91e28a82-f91a-408e-b26b-46329b9572c7", "value": "12288:jnqpyMcdbTjzibDzCDXPV/s92G8vEE/FEC4VP4:jnqpydj8voP+UvE4CP4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811707, "uuid": "1fc89c8d-5d11-4d57-b563-4f1c0de7223e", "value": 513576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811707, "uuid": "41cd4eb1-d397-45b2-b501-befb1b7671d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811707, "uuid": "55a5a914-6887-4e07-84ac-f098f39bb21c", "value": "7e72540284e2469fd10a11a46338a02fc1a25f7e681211248f95dbf01c9a6d8a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25d257a7-1953-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772798033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798033, "uuid": "961eea6d-df0b-4246-832e-83b05ff6a8ef", "comment": "Malware payload", "value": "727585c3c84c23aa20d7c7d75d285ac1", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798033, "uuid": "bd404c9f-326b-4eb2-990b-c1f6e725bc93", "comment": "Malware payload", "value": "7ea5dbbd329ee4655116152a123120a56a343309be1b360ec36e36c76553094e", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798033, "uuid": "ef1768cb-6d6a-4323-8665-11e5b57fdfee", "comment": "Malware payload", "value": "c00fc0289869bf584931fc137fff3c527e92e739", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798033, "uuid": "6b5f1d46-93d1-46d0-b76f-252955ee80e5", "comment": "Malware payload", "value": "ffd5af2bc7c2de3312075cb890595499112d5d76e91365eed7777d8fe2a0d80548297afa8f83a3cf6a452cd409d3683f", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798033, "uuid": "8e89bcb9-7590-40f9-ae56-0ded3e55d935", "value": "T11CF21B90B9FA11C9F1D2395DE874E0643D1EFF0E06F59D1C63EA6A8E8D0336C59099E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798033, "uuid": "1d642e8a-154a-4f75-937b-dcf75fbe0482", "value": "192:sQUtiwhbuC52Zb3QDc3N+dbTPadmj8CwD5BqFY594HDYJORtNlFh:sQCTIp3Nc/PMD0tnFh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772798033, "uuid": "6a163f96-8059-4010-94ee-5f8e8c063bed", "value": 35845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772798033, "uuid": "0c988e92-77db-4a5b-bf8a-654a4b2e693b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798033, "uuid": "54fbc7d3-240f-4c94-bdf3-1faa0fe3d9d3", "value": "727585c3c84c23aa20d7c7d75d285ac1.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9cf5ade-193d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772788940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788940, "uuid": "742d4e9d-5aab-4bdc-87b2-f1d0f0bbd3c4", "comment": "Malware payload (Mirai)", "value": "785188c7a47372fd697ecfe16eb04fc5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788940, "uuid": "3e6cb8c4-5265-4cd1-90f6-f1d4aa93d51c", "comment": "Malware payload (Mirai)", "value": "7ee8d200e82863efdce56d079e13ca7069e3d955b7930d13d0b8652189cf5244", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788940, "uuid": "19a299d1-c77f-4fa3-b342-4948c881cb8f", "comment": "Malware payload (Mirai)", "value": "d6067e620b34dbc401e0ea5d49e13b96c26c7d8b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788940, "uuid": "e5dd8a48-f108-4b31-b433-dfd225fe0d16", "comment": "Malware payload (Mirai)", "value": "0a65f7dc8831c5bf17e7ba15aa93585de719de2423d176aec1deed8add82580b2faa7f024e6b1ed1fd6d3967f19c4666", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788940, "uuid": "e6c034f9-be8c-400e-b387-f87be2ba9470", "value": "T1A313F1292306DA65CF64A8381DBF0940DFA90F79C1263E36A518D83D91B055FB3BEC89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788940, "uuid": "71181184-41f7-4e0e-9095-0dbc5eef29ad", "value": "768:ZfG9274mM6q1eHs92/Z/3aYbgd/MCDmdxoDJA+9TIDvkTyhkU9q3UEL5W:Z+9Y496qkHsgB/3T80jouRDcyhkLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772788940, "uuid": "a9c74344-32b1-4d0c-bb5e-9d00c1d18cfc", "value": 43876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772788940, "uuid": "9cb0463a-0457-4bd8-8e10-909cda362821", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788940, "uuid": "b2c9cd48-2dc6-4283-9364-b153945d77c2", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4704854e-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772810114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810114, "uuid": "d74cc783-f91a-41e1-ad4f-b7d594f5d020", "comment": "Malware payload (PhantomStealer)", "value": "49cb8b82e670dd3abffafd3c4ff52e58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810114, "uuid": "de4fd2ad-911f-4e90-9926-60cdc4fb6de9", "comment": "Malware payload (PhantomStealer)", "value": "7eed819bc0cbdfa57b6cdb37b8fb475ce77ec098dfe640b3cbc52d66edb6e3e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810114, "uuid": "3bcaa746-eb4b-49fa-bbf9-53ef22ffa639", "comment": "Malware payload (PhantomStealer)", "value": "bb0f02ff294e4043e51bb2b85347f0055600c4c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810114, "uuid": "aec05dac-08d9-43d6-abfa-7b2a886e57c8", "comment": "Malware payload (PhantomStealer)", "value": "1ff94331ecaa296d273b45a56356e5e03efa6fd9a7a8fa16c12f03254b2d9d20f8cac8ab353f7db6892b4121fc4c8891", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810114, "uuid": "561dfacd-e604-48b2-9d54-c9386a206aa2", "value": "T1B4652354224ADE03D5A70BF41A61F1B447B92DDCB831D25B9FEABCEBB53A7801900397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810114, "uuid": "00ab00be-4ad5-4cd7-9fde-109a480290dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810114, "uuid": "1b82c2c9-7e0c-4984-975f-ff77c6da6407", "value": "24576:Q/xzYQhBrNPrkVfw/3g/NDvjzZegX0p23LER/bU6QXcxBWAjcZI6q2kEd4DDDDDi:Q/xDbVh/S9vjzMgXil/bUMLLAd4DDDDu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810114, "uuid": "ddf25722-b637-4786-b415-4ea324550613", "value": 1534464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810114, "uuid": "9ead8114-3fda-4cd6-b5a7-729ada6f1366", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810114, "uuid": "a31398ed-fc07-453d-a694-564e70c7a164", "value": "7eed819bc0cbdfa57b6cdb37b8fb475ce77ec098dfe640b3cbc52d66edb6e3e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29d8f001-1953-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772798040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798040, "uuid": "041b13ad-c726-4af2-b935-a39c6e482ee8", "comment": "Malware payload", "value": "a9459870c3f29c5c093085169903e499", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798040, "uuid": "4c1d7754-1ad2-4292-a894-f78a394f192d", "comment": "Malware payload", "value": "7f9f9dac738ce6b64f9acf0df6720eeffaf8ee9f864d94a0bbad2d340e6f9ff7", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798040, "uuid": "ea592982-59fb-4f0c-8254-416924c73d3c", "comment": "Malware payload", "value": "548ed60f54a9ff07e996e14b74f2c4d10c73cc4e", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798040, "uuid": "fa7d54b6-c9df-40d6-bc88-16d13b5b905e", "comment": "Malware payload", "value": "75216e66b0c88e059d88c071301eb5528b4efad608778f9a9a4c0e71c2217abf0526941d56bef4e4ac43970d44524a69", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798040, "uuid": "4ebb4fda-a7bd-424a-8881-caf544f2cd01", "value": "T1515583ADE87C7A26A5C14A3E0A0F62749D8AD827361477362C9F11F71731C299BF4DB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798040, "uuid": "9f50840f-fae2-4224-9d5d-ca807eea0667", "value": "384:IEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEY:z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772798040, "uuid": "a6719e81-e2a8-4311-b7fe-7d2ff3c77b2f", "value": 1315052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772798040, "uuid": "ceb8fa71-93d4-4fa0-8f7b-8ed2826576b8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798040, "uuid": "d83623ca-65eb-4157-9c37-95830dbfd9de", "value": "a9459870c3f29c5c093085169903e499.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "924b079a-1984-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772819260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819260, "uuid": "9045bd64-b1b7-4610-b558-ec01b59e1ffa", "comment": "Malware payload", "value": "54062239612bfe1227ce93f8a030a732", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819260, "uuid": "ebea67f3-d74e-408d-a07d-121f77f9e874", "comment": "Malware payload", "value": "7f9ff654238fffe330750d60d8060b55eb3ff699e3de31f2536e3d10d78ee166", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819260, "uuid": "745bdaca-488c-4951-9d76-0827cee63810", "comment": "Malware payload", "value": "ad89d728d1fb179c779b86ad5ed49013ef735623", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819260, "uuid": "b0d88893-70df-4581-ba18-ae08aff53b0b", "comment": "Malware payload", "value": "6cca43d5d1631b07187993202644902549656812718f494f2bbb4284d44026041ec7fd7e3a612206adb4c4731ab25c1e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819260, "uuid": "e9d07b85-92ee-42a0-a419-2729f8bdc3e9", "value": "T179513A85F35105317FF26E9675B4D404B188A0A2AFC25E25E4EC78F98A8FF0A24D1E63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819260, "uuid": "ecac93b2-57c8-4af4-be9f-5b3224d39378", "value": "24:vuOS1aIOSvOSpOSHOS4TdkaUoOS5oOSXOSSfOShOSJOS5aDg9OS6OScmOl:vuRxRvRpRHRMPR5oRXRgRhRJRgcR6Rde", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819260, "uuid": "a855abe3-bfa1-400a-9b08-d96ae32182f9", "value": 2583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819260, "uuid": "4ec03db9-15e9-4f2c-b87d-29b848e14e23", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819260, "uuid": "6e7f84c2-67c2-44f8-af82-5ff98f14d7d1", "value": "sora.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ea400c6-190b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772767097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772767097, "uuid": "6c05e683-88dc-41a3-8d65-f438fd954092", "comment": "Malware payload (Mirai)", "value": "389b35caf751497f377103983eb27268", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772767097, "uuid": "0660dd1c-8326-41ee-9196-2ccdc8dbff1b", "comment": "Malware payload (Mirai)", "value": "7fc132b9b986683ae456c4d31b98427008584d9b0ff05684804419c7bb5ae585", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772767097, "uuid": "95b8f8eb-3501-4ac5-8dc1-0d4fefd4dbdc", "comment": "Malware payload (Mirai)", "value": "fd388e6d3d88dd8b295e2baa35b9804a32aabe5b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772767097, "uuid": "a04ecf9d-12cd-4d45-848a-d6f9ef1631b2", "comment": "Malware payload (Mirai)", "value": "ffc7e1e39de37a1a841c2f0d30a441693afd854149c5ecc93a8b68f6e2a155a78e0b57528d8be7758be8a9bc17d32dfd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772767097, "uuid": "aed2d550-ff33-4aa2-a9f1-78314108970a", "value": "T146C32902F98584FCC0CAC1340B6FB63AA976F1DD1238B2EB67D4AB123D4EE615E1D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772767097, "uuid": "becc134f-e777-4a8e-aa62-feaca007a929", "value": "3072:e483TghM/1weZbcnITO1yosFAIxnJdhgpDb7BeyPBupmzQUAdojgaR/XN:eH3TghM/1weZbcnITeyosFAIxnJdhgJZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772767097, "uuid": "718ac02f-739f-4c23-aef9-6928a5608372", "value": 125472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772767097, "uuid": "2536cf3b-7b93-44c7-b14d-1378a7e483f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772767097, "uuid": "998e7a40-bf93-4bb0-8485-7c947000968e", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7489ccd-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810383, "uuid": "11df6ad4-576a-47d3-8189-06ef02918ab4", "comment": "Malware payload (GCleaner)", "value": "0375c2ea4975cbdfc11682ffaf38d6fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810383, "uuid": "7cec3a2f-611a-4e20-83eb-511366a9d307", "comment": "Malware payload (GCleaner)", "value": "7fd9978668f7ded87449a05a15803da67c6ea46f8cd0c7b310db0baf34b2044e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810383, "uuid": "b4f0a06d-f274-4684-b25c-55fc37d97b86", "comment": "Malware payload (GCleaner)", "value": "659f36cd2d8a82b4354eca994b076966a0a269ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810383, "uuid": "66d51c63-90a6-4aad-9bf8-6dfc2b6d605e", "comment": "Malware payload (GCleaner)", "value": "7fefc4f2bc15f8994163bafcf11b89dffbed749db2e45946f2418d9793bedb999c7ea99dce25551028e769a64744b6a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810383, "uuid": "8415483a-af80-4007-8309-456950bc5aa1", "value": "T1DE059F22E1A1453FD1EF263DAC17965CB4257E102A28E8762BD4DCC84FFE695FC121A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810383, "uuid": "e723ea93-4c7f-48c9-b515-9358b97bdfbc", "value": "fe4280c06246cc873fe89746dadec91e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810383, "uuid": "f0c2b4cb-2648-4847-8d79-40b4f215de63", "value": "24576:SlluEBpPj6o4CPbE9taCbJIWO4h6UYECZx6R7:Slwa1VnWB3CZxy7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810383, "uuid": "1e8f4094-d086-429e-89e4-f57eb551ac50", "value": 829952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810383, "uuid": "832e3b54-7361-420a-a749-0a8f367c14b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810383, "uuid": "8a23c41f-a036-42e3-9c3d-670c3922ca1b", "value": "7fd9978668f7ded87449a05a15803da67c6ea46f8cd0c7b310db0baf34b2044e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69b6e72c-1969-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807596, "uuid": "e4c4c401-b17c-4b1b-a2c6-d3abace9cf50", "comment": "Malware payload", "value": "6e149f4fd5dfe9a843fe101ae93fc170", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807596, "uuid": "41679788-2243-4833-b217-6b3b394385b5", "comment": "Malware payload", "value": "7fee635fdba1b376944aa5096888578773c21061f62c9c8478e5e9316ef3557e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807596, "uuid": "37ead002-e850-4db3-9735-daca7daca994", "comment": "Malware payload", "value": "74359de21dd026fac6835aa4b554008b68b43906", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807596, "uuid": "f3665a1e-628d-44f2-b919-b7049f35d61d", "comment": "Malware payload", "value": "84cd8cc2f3001f0b5cc514f5f98e53d1df79fc59ba3c4e7efe1cef1a6465b8e89186157cc37d3136872a8b1106f546c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807596, "uuid": "a1a992cd-b147-4965-b495-f681de22ec92", "value": "T1A7D3F8C7F900D9FAFC0AE7374853080AB230BBA545925A372257357FED7A1990477E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807596, "uuid": "afa84adf-7b3b-4617-b7ff-20fdfcb1b8af", "value": "3072:qNbul4MGHJLqHy5Fut5K/cwpifdDounVoQV1jbiGLD3rQtJ:HHy5ct8/cyiWuVosLD4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807596, "uuid": "bf15600a-3873-4cae-9c1d-3cebbf1b7207", "value": 140064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807596, "uuid": "ef3823e9-f9ad-4009-92de-ffa00178eec1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807596, "uuid": "d6873479-8284-43de-9be7-8c10f193f6da", "value": "iran.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3204537b-1968-11f1-a769-42010a9c0008", "comment": "Malware payload (Kaiji)", "timestamp": 1772807073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807073, "uuid": "341169ea-7f9d-4d68-a2d6-286d030c1d5e", "comment": "Malware payload (Kaiji)", "value": "6c529490f5d61b5983dea7f6769f3ec8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807073, "uuid": "bca65cac-d324-454a-ace8-c29652580e2f", "comment": "Malware payload (Kaiji)", "value": "801805c8171e354e001039ae6639c35ecf3c1ab72de936c6f21f77d87a36e9e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807073, "uuid": "58b4cb16-9460-468b-961f-90f3982e3f40", "comment": "Malware payload (Kaiji)", "value": "f45677fb0113c91513cb5b21d93d9ba40e8b13a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807073, "uuid": "7685f9dd-4cd1-42a1-b808-9ae074e336de", "comment": "Malware payload (Kaiji)", "value": "5c9c2c7e1ad7cd272b5f6e0a768a931f44543900979b4db1ff1f5319724a285c4148cc1c018278d8bbe0dd8c46b4ef4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807073, "uuid": "80b74970-c3c1-4d85-b550-d2c4aabd4be3", "value": "T1E5365B65BD5EE462E6C833783B7193D4323EBC489F4192235610FFAE99F67688F12112", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807073, "uuid": "2c1db404-a376-415d-8826-7d8f0f98000f", "value": "49152:7H+5dH9Zq/34LCFNoUAFKVCs55EN2q3OY2NXxB1:r+5dH+/34LCFNoUTVCsvEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807073, "uuid": "a74205c6-7e2e-4e19-b002-e0f7c10e9ec3", "value": 5177344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807073, "uuid": "f621f247-7f81-47f6-b2fb-e2a7956ac249", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807073, "uuid": "2a19fa85-3e2b-4a16-a55e-e03df973254d", "value": "linux_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea3bbd87-192d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772782041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782041, "uuid": "056e3a07-3a4b-4b0d-a55f-0a640f3fea66", "comment": "Malware payload (Mirai)", "value": "ebbd361c3e6943eabcb322bba5da8197", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782041, "uuid": "5dfee0c1-be2e-47e4-89d6-96644ac206d3", "comment": "Malware payload (Mirai)", "value": "8033721d48f43261486b402afc26f22e0de686f21d94ad46f2f11ebda780defd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782041, "uuid": "dc436aaf-6b3f-45ef-809d-7e8667695deb", "comment": "Malware payload (Mirai)", "value": "08c01264b7a871b3ac5d55700030334d4e8ef22c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782041, "uuid": "d8138826-aeca-4fb9-9892-6a849734e37b", "comment": "Malware payload (Mirai)", "value": "0e448a4d6ce512d7445f83c7c6039e9d89e5791236fd3d37228db34f7aff454a35d225d49913dc3561f5fe88f6e09a5b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782041, "uuid": "c8e6019d-caa3-430a-b301-4f0495fbe907", "value": "T1CFE0CD7EF4175428B55A5D48F919D4409D43DD130320BD68AED7CD72F1485987033BA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782041, "uuid": "e57947a1-116c-4061-9e6f-123385a0fcd8", "value": "6:zXeVfgkOYPeDywuMFXWR+XdI3gHd0LSflbhgkh5ty:zOSJaf6/XdI3g97fldgWS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772782041, "uuid": "debdf27d-618e-43a7-8a6a-67c5bb8a843a", "value": 298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772782041, "uuid": "c22ec72a-6de1-4d1e-9815-f4cf892d209e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782041, "uuid": "c68c7a6e-0132-4ffc-b6b4-b19f4e063d09", "value": "v.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68373066-1967-11f1-a769-42010a9c0008", "comment": "Malware payload (Adware.Techsnab)", "timestamp": 1772806734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806734, "uuid": "fb3ef845-5cf6-4993-9589-c6a5d36d7d7e", "comment": "Malware payload (Adware.Techsnab)", "value": "58d1832d01c32e7876626de2d4941c63", "object_relation": "md5", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "wiosyrondaty-com", "colour": "#68F1E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806734, "uuid": "ee89a4bd-4f2a-49c2-b0c0-56e8a5e2d825", "comment": "Malware payload (Adware.Techsnab)", "value": "80624d79d9e9324b175135fecee698ec50e09d537343301a9e62868f0ab3946f", "object_relation": "sha256", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "wiosyrondaty-com", "colour": "#68F1E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806734, "uuid": "0d0fcad1-75dd-4be5-a833-0e5a8b917978", "comment": "Malware payload (Adware.Techsnab)", "value": "9135ef9b946ee2f9de295bbe4247b658ca5db693", "object_relation": "sha1", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "wiosyrondaty-com", "colour": "#68F1E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806734, "uuid": "ffba6900-1952-4d2d-b848-10b3ebab7cdc", "comment": "Malware payload (Adware.Techsnab)", "value": "50cbc2224c0366027e1141babb6b60b91fc80eb09c5a8c42145a831e238986fbe82e9262187f32393ad5f08bf99f1848", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "wiosyrondaty-com", "colour": "#68F1E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806734, "uuid": "974da276-4a86-4303-945f-0754d051495d", "value": "T1E53364F77622F5FED2B55749788E7014BB32846DA75A178880A4FA3C9031693391CCBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806734, "uuid": "740c1c31-fe38-401a-b9b2-19131bdaa8b7", "value": "768:TY1/yeV3sa5qOUet1A/p/H460XSZ7493tYi9+DXwjlKr7GVpS89YGOSPvIoN2:k1/lNqOUppwSZ0aCZcrKzSsYG5IoN2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772806734, "uuid": "5c789c69-9466-4742-8cce-294302e3cab7", "value": 53921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772806734, "uuid": "6c768778-e3c9-442e-8ce6-045761e2c5ac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806734, "uuid": "4812e176-8d7d-4145-a874-e763bc0c50e5", "value": "80624d79d9e9324b175135fecee698ec50e09d537343301a9e62868f0ab3946f.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66a1e77d-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819187, "uuid": "d87adb7c-8213-4abb-a9e6-f16f28d062e5", "comment": "Malware payload (Mirai)", "value": "47cb98cd4bafa8eda0ed121d94881e4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819187, "uuid": "fbab78e9-84d3-4684-979e-ddee685b80ca", "comment": "Malware payload (Mirai)", "value": "808503d28a98dfe8dc3de3ba47444c60fc95315ba63d1f44d2848533cfd320e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819187, "uuid": "66762c7c-0f02-4f2b-b0e1-a169b0c428de", "comment": "Malware payload (Mirai)", "value": "bc34787514432191fc320cad1b3553ed1e66945c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819187, "uuid": "e463cfcb-129c-4407-b9f3-8902769523eb", "comment": "Malware payload (Mirai)", "value": "1c1d1eaf55da99d80782e5e2467c6983e71aec38456ac6a363c5a34eff3389efa0b5886a4becaf0853fed8096dda61ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819187, "uuid": "f0423d06-eeed-44c3-9641-d73800da89ea", "value": "T1995319C67A43DEB7E95311F002F3AB325A31FC3A092AD9C6E775FCA269115D0A50636C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819187, "uuid": "5fec0af6-67a8-405a-9970-943f1a32e2eb", "value": "1536:Bfm2PcWZeMAqkNo966o2pELGvTaDC+OfHlU8NRc8juBCKSfXbU:BfmMjZeMj9R9p9sdOC8DRjPU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819187, "uuid": "88f5b277-97d2-4abe-be13-b0681348a3d6", "value": 63580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819187, "uuid": "11170dea-29cc-4626-8975-3d36719278fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819187, "uuid": "28b91150-9346-4972-8018-07531ee71927", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fabc777-1971-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1772811068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811068, "uuid": "8d055c9d-a065-4138-8365-655317eb2503", "comment": "Malware payload (GuLoader)", "value": "bda5cc053c4d9eb09f6dd1c45892fb4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811068, "uuid": "223c87be-732d-4974-9185-ace059b1ec9e", "comment": "Malware payload (GuLoader)", "value": "8086b646c055109fed8ab642f07fd97920a86e2bef8b5eef34d7e2323add328e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811068, "uuid": "2e8d7ccf-ea16-4658-8628-283b3310ae82", "comment": "Malware payload (GuLoader)", "value": "0d262ec7663f8900d7cc8f7f75147166b3b57ba9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811068, "uuid": "df1a2952-f690-4b51-bca0-1f7a682f2280", "comment": "Malware payload (GuLoader)", "value": "3aec19965ae1f82e5d50980f4828f8bbc848427209cc06ce5a6e8f01316a4f5b3f77eed441fc8bb67456c6504ac7c158", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811068, "uuid": "60523eb7-ebf6-45a0-a7b0-201d9d67d0a1", "value": "T10B352312F372D813C596EA74E63659FBC6EA7E64D0226B1F470C3F6470B89C21136E98", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811068, "uuid": "03e7b8e8-2be1-49b4-aa96-b897cfa4e92a", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811068, "uuid": "d233344b-b272-4402-8bb1-6b6a6bb1bcbd", "value": "24576:sAcCMAMW4iMsxnl2cV7GAfojvhwZc5drzQDG5/3WVd3i:7PMAME/ViAgjvV5d4G0Vdy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811068, "uuid": "c79fcab0-a412-482b-bfd9-17a1923ba576", "value": 1139816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811068, "uuid": "83d4867d-113d-480e-a342-b0c9b9fc3ab9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811068, "uuid": "8de2a9b6-b587-44b1-8b02-ff6f069a3d09", "value": "8086b646c055109fed8ab642f07fd97920a86e2bef8b5eef34d7e2323add328e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39039ccb-1951-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772797206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797206, "uuid": "b09e6104-4313-463c-b53f-61482ae02c81", "comment": "Malware payload", "value": "c948a8ed521b9aca99af99902cc77e00", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797206, "uuid": "632f679f-8ab2-4f47-bfa0-05e903ed7e22", "comment": "Malware payload", "value": "8166a1653ba8463930ce5649e8daf25c40f992e45b56e3e4c9aadc84ae043a6a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797206, "uuid": "f98521c3-0a09-49ec-b86b-2e1f762a2683", "comment": "Malware payload", "value": "183b756dfa942eff3b194905bacd9e4108747441", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797206, "uuid": "ce602fbb-af25-4211-8702-14c428a8b57f", "comment": "Malware payload", "value": "1c5c8e96dfdb3d2cf82bbee33d87b0bff42b4042fa55325c4b8e795528b4d6b4caefc5d7dccf34ac75c986e3566b7c5c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797206, "uuid": "6d27bf06-7b93-4f38-b9f0-c982dbc937e0", "value": "T185356BD16EFE5AA9E5AE0FBFE52E631F671853500B00CEC390705D5F9CA25C250BC8A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797206, "uuid": "41f3cc80-5d92-4fa3-abf3-e216fa2613bf", "value": "5ee244f813571fb94ac91f129319c18b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797206, "uuid": "f0fd2f53-e6ce-4c8c-b246-e70005b5d2b1", "value": "12288:ks+QJNZQsOPAXFaiv4iGjAkyL8gbeGLcCGwwTYdQrdtFpk3Up4:kkJvQ9AQiXGA86pcCGwwTYdatzk3Up4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772797206, "uuid": "a3a1303d-803d-4630-bb6e-0c02cddf05a4", "value": 1129096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772797206, "uuid": "383667c4-78d1-48f6-be91-5c23fbb6dccf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797206, "uuid": "4c3a1ade-786c-440c-b7e5-c9cc47721c02", "value": "SecuriteInfo.com.Win32.MalwareX-gen.57671255", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a61044f-1943-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772791142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772791142, "uuid": "f3751934-15de-41a5-a61c-044766bbc93c", "comment": "Malware payload", "value": "72821546e363315c5419a4c3f9836361", "object_relation": "md5", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "gologpoint-com", "colour": "#C1A767", "exportable": true, "hide_tag": false }, { "name": "josehpjon-com", "colour": "#BC3BB6", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "quicrob-com", "colour": "#CC0988", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772791142, "uuid": "e59e6534-bf21-4988-8299-e26ba0953ac8", "comment": "Malware payload", "value": "81b397f8cb62f501ed5192aee4f989e925c8c55f1f87ca152e33a31ce89910eb", "object_relation": "sha256", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "gologpoint-com", "colour": "#C1A767", "exportable": true, "hide_tag": false }, { "name": "josehpjon-com", "colour": "#BC3BB6", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "quicrob-com", "colour": "#CC0988", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772791142, "uuid": "0e96629a-c594-46f7-be93-8bd6ac490b0d", "comment": "Malware payload", "value": "334919e95e7e6be57a5cf678eaaf42fc7825dd9d", "object_relation": "sha1", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "gologpoint-com", "colour": "#C1A767", "exportable": true, "hide_tag": false }, { "name": "josehpjon-com", "colour": "#BC3BB6", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "quicrob-com", "colour": "#CC0988", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772791142, "uuid": "400d737a-c97f-4433-89cd-f4c7fa2b8325", "comment": "Malware payload", "value": "0f1ce49804cfc29f4a88fcbd5a71bbf666874fe72a6aa3babbfd90f8a695b9bf0b2b339c064bddd001896594c8655158", "object_relation": "sha3-384", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "gologpoint-com", "colour": "#C1A767", "exportable": true, "hide_tag": false }, { "name": "josehpjon-com", "colour": "#BC3BB6", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "quicrob-com", "colour": "#CC0988", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772791142, "uuid": "3ca35f21-78cf-424b-a96b-8d99efd32fe7", "value": "T15F512508B5A38C3041475B9EDCFF5808A1AB44CB410A1D65F89DCAB91F33B388B7B65A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772791142, "uuid": "a98b4457-86f9-4850-b0c5-770e43bb6291", "value": "96:0RTQUhNQ8eCrOJLn9NQDvZg8YRaxKiUTzgqxaybAlR2ooInF5z:09Q8eCrOTNQzZg8Ycsi+z1cybY2ooQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772791142, "uuid": "cffe2847-2156-4b7c-941e-03d54527af02", "value": 3165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772791142, "uuid": "6de3289e-8d4a-47c3-9b5f-f83977eb4753", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772791142, "uuid": "64154a5b-c170-4081-a1dd-dc04d10f9589", "value": "81b397f8cb62f501ed5192aee4f989e925c8c55f1f87ca152e33a31ce89910eb.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33a9b849-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772810082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810082, "uuid": "54ec5327-f5a7-4dc5-a3e0-18f79d6df879", "comment": "Malware payload (Vidar)", "value": "8fc5d2f4cc1fbfc5157cd90d3fb9a0ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810082, "uuid": "5acc1410-ce5e-4dd4-be14-b481ad170aea", "comment": "Malware payload (Vidar)", "value": "81c2df0f2ad75cd87e2197d64e0d4e2bb7f8040e9fbd53210fd09efdf17819ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810082, "uuid": "b87bccb1-0ea6-4e73-a18a-6f5437ebbf3d", "comment": "Malware payload (Vidar)", "value": "abc1c44e438743013d0305c2e1cf91dd8bdb6ede", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810082, "uuid": "90f84745-7ec0-4485-b9fb-08e8cc71268a", "comment": "Malware payload (Vidar)", "value": "2b6b6741d968c350e84d0c38939bfcc0a1ade98f7dd90bf450e9b775027a260a0fd351f5aa9d24460786151ed8daf006", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810082, "uuid": "218f73d0-7949-42e8-ba64-65d01d60ca0b", "value": "T18D241203406DF35FE24A757E1FA7BBC222B2C7384B4F03D63855C8D6922E56885927A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810082, "uuid": "0dd20040-8608-43cb-b24f-92fc87c7c131", "value": "ee53c10aff1d01eafea53328179e33a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810082, "uuid": "d3fb5eba-c559-474d-ae57-d86b2e13f790", "value": "3072:7nipVcxzhGwxvWeGJgwU3PrsKw6wYQyKBWJrZ0zBTAUZpjvE33WlwzYMO:rU4hGwNQJZU/AKw6EBWf0zCWu75O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810082, "uuid": "ff4f63f8-a642-46de-910a-f1aaddf5d0a8", "value": 217088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810082, "uuid": "cf2d0903-ffb8-46b0-960e-3fee1fe34387", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810082, "uuid": "881436a6-5518-4d5f-8852-281bab91056a", "value": "81c2df0f2ad75cd87e2197d64e0d4e2bb7f8040e9fbd53210fd09efdf17819ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2d44ad9-1970-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810832, "uuid": "91afb3c3-0017-40ae-9f5f-d6d1f312743f", "comment": "Malware payload", "value": "115e06509f5f993a77755f3d7b0e04cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810832, "uuid": "aa47a3ab-7b89-425c-893c-ca0a7a0a8bcd", "comment": "Malware payload", "value": "820d22ce2b5b492ff35f337f0833fd23eccee622592467acedf80726b01110e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810832, "uuid": "1ea3fe38-0621-4da1-a35c-b5b43e76ad15", "comment": "Malware payload", "value": "faf908487f75dbc117abde86a8e950adc22344b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810832, "uuid": "03eb1a63-afe4-4afe-ae47-372b5a5e36a8", "comment": "Malware payload", "value": "f70634355ba63baed28dd93cfa897bddf39e29b785fd1d828c7696a8a9f2c468f291f07bddcb2662504da2e498c91820", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810832, "uuid": "52b0774d-c788-46cb-b79f-4ef551490b7d", "value": "T174353307B376EC13D086E9B9E73999F6CAE6BD60E561AB0F430C3F1874B96C10522C95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810832, "uuid": "fe25be83-d19e-4eab-b7c1-467764ca4180", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810832, "uuid": "5cff1732-cfc2-4399-8615-712317260cfe", "value": "24576:XAcCMAMWUiJyO4N967GAfojvhwZc5drzQDG5/3WVd3i2:wPMAMuJyOpiAgjvV5d4G0Vdy2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810832, "uuid": "61bb3fb0-c72f-4550-8b1c-6779c9eb43fb", "value": 1150456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810832, "uuid": "16483e58-8e66-495b-942f-273d4f154bc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810832, "uuid": "12e133ec-ff59-4746-8d93-2f66f51be4ba", "value": "820d22ce2b5b492ff35f337f0833fd23eccee622592467acedf80726b01110e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ca8d5f9-1972-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811439, "uuid": "c9dfe32e-3266-4cb8-9abb-8f59e4df38b8", "comment": "Malware payload", "value": "dd9d763147ad72f4d465e08e0c9bc01c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811439, "uuid": "163da7eb-7fb4-41af-a94a-a6b5bb9c2e3f", "comment": "Malware payload", "value": "826e5886e0c3288e29cfdc539058da95711b1ecadb8ce0901308b2672d79c70f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811439, "uuid": "81aa9e76-baad-4f80-8e5b-8bd156239b28", "comment": "Malware payload", "value": "0c9e07342824066c306831e046c711a9ca4db9ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811439, "uuid": "b6ab465c-4368-4d40-9ee6-7d9207e5813f", "comment": "Malware payload", "value": "04137a56e784819a12c8aece27377b190acf7175ab922a74d5de5af200338a97adaf3bd6b96897d46cfe8811697f09c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811439, "uuid": "c9e5e0b5-66c8-4517-bf4d-567453ec9e77", "value": "T14B35F12417A5DC07C36E4B3658A0F57897758ED6B011D25ABEDD7DEB7B2AF000A82343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811439, "uuid": "4ccfefc9-92c9-43b2-bb29-671049af335c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811439, "uuid": "99a9ef46-8e2e-414d-9d55-fa151ce6c439", "value": "24576:/5ZbuZOrq7IQq5N3hhzPL+h9CAroEE8oEcI5aO:hZbrq701h7LS9rpfoIU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811439, "uuid": "5bd6f29d-3959-4a3d-aea6-4259cbb3ee6c", "value": 1152000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811439, "uuid": "279e84cb-6632-4807-bf68-1e549ca30216", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811439, "uuid": "aa14cb5d-239a-4470-af7c-c93049e18158", "value": "826e5886e0c3288e29cfdc539058da95711b1ecadb8ce0901308b2672d79c70f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82299cd5-1969-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807637, "uuid": "d569f30a-0267-46ef-a49f-953fb1c10f4b", "comment": "Malware payload", "value": "8f6e2152deec84c001500443a17b2818", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807637, "uuid": "c6e758a5-8ca4-492e-81c5-aed683c5eed4", "comment": "Malware payload", "value": "82856be3de7d1e41e0541975c9c67547d5d5b35f8c07f22f7c4e6bef4b17916e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807637, "uuid": "ff52b0fb-b0ad-4546-beeb-ea227d18a643", "comment": "Malware payload", "value": "87d7d4c372263a873034b6538f14684c92ea87ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807637, "uuid": "5ae4afac-c48f-4bc2-8979-606879940461", "comment": "Malware payload", "value": "e6717231796a4073330d06ba6e77e405b8e618de78e0bde5994ff2a0f94bf968592319a9c26ed6744c03680bdfb4f3bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807637, "uuid": "49842509-731a-4102-aef5-65b4dcf13ad1", "value": "T14D94E612E650B066F89709702D79A596782D3C3A2D40EC1BB78D9F5A3B71A83B0F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807637, "uuid": "54370156-ddf4-4587-b62f-6f61f2740a4c", "value": "a7ddde1cd2a07b46f901483ce887cb69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807637, "uuid": "e1c54148-e228-43bd-aa09-c522979000bc", "value": "12288:Yg6OnycF8sD0irj+muWeGOdFNF9VQiBFnYIFeTHP3EzYEcPqLa+Lsk/A9eiZPbu8:ZVnrDx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807637, "uuid": "1dce5d9a-8758-46a6-a278-b19c3cfe93d4", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807637, "uuid": "49a7ba44-b527-4378-b6d3-acd2287fb00c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807637, "uuid": "6d9a2760-bfb6-4671-8707-649f7520000b", "value": "82856be3de7d1e41e0541975c9c67547d5d5b35f8c07f22f7c4e6bef4b17916e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc5af4bb-196f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810365, "uuid": "1df790ee-cb30-4736-bf3a-a11cd7565d62", "comment": "Malware payload", "value": "1399404c315a16d9d6f6ed14bda916e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810365, "uuid": "56ec475b-4a8f-46ec-82af-ee0ab60d543d", "comment": "Malware payload", "value": "828a2d50d08bbaf068cf4ebf7997abf928b83f5ddc7f5136b4a53f2f1cc00a3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810365, "uuid": "afd84ec4-e62e-46dd-bbf8-414fde5952bf", "comment": "Malware payload", "value": "1fb86d7c98531ae5dc4d99dd7c5e6435ada145a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810365, "uuid": "244afb02-c238-4802-a375-da85e32ae6f6", "comment": "Malware payload", "value": "91c35b4e3ef60728d360213ef716f83b407161552284d9c84f598ce6e60d8b83d8643d38c0c1699b7da9f23bfa107733", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810365, "uuid": "ac91d57f-4dba-4af2-95a5-a3a66659724c", "value": "T151D42BBDAC60E362F60DD0BAE286E7535F5178010236AA9309BED72412058739F577FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810365, "uuid": "7277bc20-2fce-44a5-bb57-9d5246817496", "value": "33ae1da8e7325d3e73d4a52bada9dc7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810365, "uuid": "0cc2dd20-43bc-4954-930f-19592d578da3", "value": "12288:71Z9H0I0Lqf0h0ewjUKlg8SIt14y0qSXWdH3ROr:71bH0IlJXgBIt14y0qNdH34r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810365, "uuid": "b4441b1b-7c00-45b1-967a-55cf48c701a8", "value": 615424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810365, "uuid": "cd31a255-2997-43e0-afa7-d5adbe976422", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810365, "uuid": "01deb123-06f3-44d0-9f27-a9bea08a69d6", "value": "81c2df0f2ad75cd87e2197d64e0d4e2bb7f8040e9fbd53210fd09efdf17819ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfe062f0-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772809914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809914, "uuid": "c6eb07ff-8ebc-4adc-bd49-f6ad2e2b7a4e", "comment": "Malware payload (AgentTesla)", "value": "de7ba41f5efa4567e88354cb10e14ca6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809914, "uuid": "6a6ae67f-2679-40a4-aba1-525089596096", "comment": "Malware payload (AgentTesla)", "value": "829928d9278b1af0adecac6cb2dacad68d68495f9b3a25cd38c481b935a026b3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809914, "uuid": "4c223444-621e-40a4-a216-41bb5c6c236b", "comment": "Malware payload (AgentTesla)", "value": "863a909418a77e32e7177ba15fa3ee0da1df0a71", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809914, "uuid": "9ac3394b-97ee-4a43-bf0d-ceb8477c587a", "comment": "Malware payload (AgentTesla)", "value": "9a8f9bc07c55da248b29863121ba40ae9c3ac8ad659c00a2d32101aced2251ed991dca1888e77f3ac71bce5075a1f1b9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809914, "uuid": "c064463f-2de2-4822-9abc-b6a6cac5f53f", "value": "T15F84D042F3C0ECE6E46554B3E82ED7101957EF9AC0AA431B325576166CA33C3259BEC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809914, "uuid": "d270bef0-5fcb-4e1f-8080-2ada4eb76860", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809914, "uuid": "c91b83ab-eda3-42b7-a6db-541986fd8c1b", "value": "6144:ygORaJ1dhZ3qeD2SPzPRqPkV07SBnsHa/RUJXW+plcxHOK4e7Hq:ygd6k5Z5TCV/ckKW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809914, "uuid": "9526fd1c-0b4c-489e-bd8d-12837290f3fa", "value": 379616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809914, "uuid": "fe4a21b0-75f7-4987-be7c-9e87b71e42a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809914, "uuid": "8fc3206c-11af-4d73-953d-052efa5bd018", "value": "829928d9278b1af0adecac6cb2dacad68d68495f9b3a25cd38c481b935a026b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca2e5b2e-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772810334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810334, "uuid": "d79cf6a9-7c98-43de-8eb8-0c0d8b25bc97", "comment": "Malware payload (AgentTesla)", "value": "578bc83a14505641d9924050ad1e72b3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810334, "uuid": "338a07c3-16a0-438c-8e8c-c6317df5e84b", "comment": "Malware payload (AgentTesla)", "value": "82cf55fa23c0c2493080bf0cbf52165ee502a58c782f8d85cfbbb5e601f8b6b3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810334, "uuid": "9006b847-1f95-4019-a69d-9e339a2f94c4", "comment": "Malware payload (AgentTesla)", "value": "50f959dff85cfbb7b59676b5b99689d3941b8123", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810334, "uuid": "0e4bbe2d-2778-49fc-9de3-efaa91dd62ca", "comment": "Malware payload (AgentTesla)", "value": "2044355f19f1b234840c6c7b453e3f86b2e96fa47ae09692feb9b8fbc95307874e29c49a01643c410be63c05c2af3144", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810334, "uuid": "05dc2ca2-0fed-4f42-b0da-149cb3748845", "value": "T19B15CE1123E85A69F4FF9B3898754528CBB5BC27DA32DB5D2A4540EE1931F40CE62B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810334, "uuid": "6ace784c-ba12-48cf-af1f-362b24968458", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810334, "uuid": "51dd39ec-c395-49dd-a522-dd1ec4ad0f2e", "value": "24576:m9J8dZ+8EsdfRA8DHaP3HizHXdnfbFGP:RBDAuHRrpDo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810334, "uuid": "f52c6065-4de4-4acf-bc7b-3c2a6881c9be", "value": 922624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810334, "uuid": "8e625e3e-95b8-4edd-9cba-aa8c33181031", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810334, "uuid": "8133f789-50b0-4788-8907-e8ba4d6f4bf4", "value": "82cf55fa23c0c2493080bf0cbf52165ee502a58c782f8d85cfbbb5e601f8b6b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4fbebb8-196a-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808125, "uuid": "e9105135-4ad6-43da-94df-9ec46e3d8cf9", "comment": "Malware payload (GCleaner)", "value": "d18328d3e087fa157f7f304980fa0aba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808125, "uuid": "3377c48f-7d28-472e-83b0-6417bbf055b2", "comment": "Malware payload (GCleaner)", "value": "82f4605af6c1753438732ad64b73b42ac32129fe307440045bf45d1a77c67551", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808125, "uuid": "87feedc7-21cb-49d7-a11d-7a25bff63770", "comment": "Malware payload (GCleaner)", "value": "1e4e184487ae91d8b76bbb7272de2d57df363564", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808125, "uuid": "b3bacfa7-e826-4709-9020-dfbe5710c97c", "comment": "Malware payload (GCleaner)", "value": "c655b2c4b3a24cc4daf75febd039dbd9538271e55d029b274a9e96ff8c8daf77599465742f428707bb18829cc4f581d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808125, "uuid": "227eb78f-7f79-4d1a-a9af-f900b052f175", "value": "T1AF06E0D171E360E7E0A853FBBBEDE675080AA8C0B92F595CBB524EDC4D1400BAE54367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808125, "uuid": "d6ad2990-a8b0-40d2-9baf-9e1b35e27c98", "value": "e5f32a93ddcf3aa9009cd70911b0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808125, "uuid": "8ce34bb1-44dc-4712-9626-02247866f3b7", "value": "98304:39Cexbej6bN9JuarYOga6UB5+fkLzyvTI8jB:3Z1bTIarYwB5+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808125, "uuid": "385a823d-9f1b-4042-adbb-df7786226bde", "value": 3887104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808125, "uuid": "fb01d94f-b6e7-4369-96d1-d0ceb5d37ada", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808125, "uuid": "8e167f42-c7ac-4a06-aa45-40e56240a56e", "value": "82f4605af6c1753438732ad64b73b42ac32129fe307440045bf45d1a77c67551", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ea72039-193e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772789028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789028, "uuid": "ab5db5d6-5566-4fb9-88d2-8dfc365d084d", "comment": "Malware payload (Mirai)", "value": "2fdaca6e5291bb3a2229138573ce9612", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789028, "uuid": "067523e5-946b-49e7-bff2-6ee6490f7d58", "comment": "Malware payload (Mirai)", "value": "83112cfe7bb572362e7796e142d89de2205f32af9f2d27e4ce851b60b00045e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789028, "uuid": "9f0ff2b6-58bb-4990-ae9e-971f240e1352", "comment": "Malware payload (Mirai)", "value": "928d356fbc46ee11fbdbf856589f257d67de8ad5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789028, "uuid": "15164cd9-8c7f-4be0-8d09-60cd6b929066", "comment": "Malware payload (Mirai)", "value": "e22c79b9007514ec9ee6b660079e6452e8954c4bbf67b22a946758815c31425e7302b7658447bd97bfb605feabc41cd7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789028, "uuid": "3c7e770e-d5dd-488b-ac67-d9d5e93d30dd", "value": "T1EA833945FD814A12CAC116B7FB2F428D372617A8E2DE7203DD296F21378B91B0E7B951", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789028, "uuid": "d035b37e-5f89-4869-bbc3-914c5cb84d32", "value": "1536:4EGpD2xTM1LLWew7q+vXvZnYk6vB1yH4xhvGwK:4EGpDWTMVWew7qofZnOs2k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772789028, "uuid": "7f03ade8-4fd9-475a-9138-cdac1dde9d85", "value": 84056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772789028, "uuid": "cb4e8c34-3ad5-4bf7-a8da-d698cb2dfe14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789028, "uuid": "90a8a60a-349a-493e-9768-ccbca55b813e", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "902fb550-1968-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807231, "uuid": "8be10edc-7ec1-4a3d-babd-aa3ab9a648ba", "comment": "Malware payload", "value": "acf5cd1a9c51568a2c3dc8caee74fee0", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807231, "uuid": "86dd3c3b-02cd-4c06-a837-a64205445e17", "comment": "Malware payload", "value": "83632e48cc722a8cb988bc4c04d0e301ce8ace08111b9781675c62e5e6757d56", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807231, "uuid": "2cf9828a-3685-4d9d-ab54-f081fb3e9603", "comment": "Malware payload", "value": "e1e77490edf625217c9ae14a0244462482ee67f8", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807231, "uuid": "b9d5d4d0-66e5-422d-94f3-ef83e598a170", "comment": "Malware payload", "value": "4a9ba3c932720a0cca3397fd8733c706577220b38a5145701c9239a08b73c727c3ebdae7e67ec0839010b94e4470acfb", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807231, "uuid": "3f9de5df-0452-475b-8575-2bc06eac3af3", "value": "T15A32E8192EAA05B66583B3A9E8FCC205601F91CB532BBF10B4DC51843F61A2F5BF6347", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807231, "uuid": "65f57b7d-b007-4ef1-bff3-3adef03201d0", "value": "192:YlHjTiCczaDAElrWGn1sA8vtDbbqr1yz3MiuCX6Lrifs4yJrbGHpE7MIyFay9:Ie9wGytn9baRp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807231, "uuid": "97457a53-dc29-4161-a1e8-7da147ae6f4e", "value": 10919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807231, "uuid": "b240b13f-cb9b-4d32-9ae0-c131fb0aacf5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807231, "uuid": "02e24cee-bdb5-4072-b0bf-e65ec88c4355", "value": "83632e48cc722a8cb988bc4c04d0e301ce8ace08111b9781675c62e5e6757d56.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "054e6aff-1961-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772803991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772803991, "uuid": "e4f8d610-70d6-4d62-9f5b-d25916fc9b05", "comment": "Malware payload", "value": "7d6c3a08a8b2fddad8561a9b112cf45f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772803991, "uuid": "e4d79f70-57fe-4d2d-a954-d4ba5d036caf", "comment": "Malware payload", "value": "838bf411fbcb685ac17afd2e802c8144e9c04a8e04828d2c30e67fcbd0a5bc8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772803991, "uuid": "7dff8a76-a670-46ae-93de-c0c0bb703fcf", "comment": "Malware payload", "value": "ed2e284da19ccdb8a71097a5ce03eb07daadceb9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772803991, "uuid": "219d147a-6191-4225-a1c3-805775b40e43", "comment": "Malware payload", "value": "dda76a806c9d34643e328b144ebef0c6a30059288048d994e5a06c8e23975ce627f222f5bb131fd9c6abc68dba166764", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772803991, "uuid": "325d9205-e2cc-4413-9328-b8a789b9f483", "value": "T14823F1C3617FDEE8CAF6593E1D2798C8B901C4157B0A0BDF45DB36E8ADB46C22E11960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772803991, "uuid": "467875bf-ffd8-4a88-a7a4-4015f68763b7", "value": "768:BYlu1gzShvupCJk8hRIE3kpNwWa0xeKyxEy2e0bQ0EST5V4w:jSzSxupEl3kpNTxe32Thth", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772803991, "uuid": "5bf6bd34-d1a8-4de4-ad31-4a2e6435d631", "value": 47776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772803991, "uuid": "e50ff1cc-8612-4407-8154-a656ac108b44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772803991, "uuid": "0c143fe2-6969-4f10-8544-842dc68369c2", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b17ff36-1936-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1772785640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772785640, "uuid": "ac7552c9-9a85-4510-a2d5-c81ffb45ec5a", "comment": "Malware payload (Gafgyt)", "value": "4b67c8e016a7296c6bdc657433835a3a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772785640, "uuid": "e97ed7f9-d75e-41c3-9229-449089c129a4", "comment": "Malware payload (Gafgyt)", "value": "83b01a2854cb4cdcf0e99fe6ee3c15f47cb72c4ccd17e30ab73825883b3afba2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772785640, "uuid": "9ed6736b-16d7-45bc-be9f-76771035e688", "comment": "Malware payload (Gafgyt)", "value": "805a5c39456a56a095f28a74a9a8e0ea780248bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772785640, "uuid": "393d356b-8eb1-43d5-ab2a-2eb058395278", "comment": "Malware payload (Gafgyt)", "value": "ec98791fd0c68d08e4c40ffe30d969ce56c6cf06471d1724749781d8ee36d2242e2ae97dbef6cf81012daed46e7339d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772785640, "uuid": "e2a09ef2-68c6-4002-8d55-854c6724b882", "value": "T17EE31B45FC509F26C6D221BBFB4E428D772A1768D3FE720389255F203B9A95B0E77242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772785640, "uuid": "362c5b7c-03f2-4061-8607-acb35123ac25", "value": "3072:5JeBiqSN2QfJnwwAkyrVJO9s82Q+UIHU:bewDBwwAkEVJOW8BPIHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772785640, "uuid": "e3f88d2a-9148-4753-a8a0-5cf44eb52def", "value": 146112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772785640, "uuid": "36422ae0-a4b1-4781-b279-31bd8ddcd232", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772785640, "uuid": "dcd6a0ae-6ba9-42c2-a26e-426aa08128a2", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9368d998-192d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772781896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781896, "uuid": "44af16eb-7c31-48e1-a351-8f689ff57baa", "comment": "Malware payload", "value": "11021135f57127561d82c07c03edb586", "object_relation": "md5", "Tag": [ { "name": "api-devx-help", "colour": "#8AD189", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781896, "uuid": "bec4e5d7-a76d-4f06-8fe4-d61d30770129", "comment": "Malware payload", "value": "83e9fdf06a347b8528f69055f491d43da83cd365a3de24dbfada9626a3bda6fe", "object_relation": "sha256", "Tag": [ { "name": "api-devx-help", "colour": "#8AD189", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781896, "uuid": "35ce86d3-2c1e-4009-aa87-90ec22f16f5a", "comment": "Malware payload", "value": "3124462a0c563e45093a3a1b1874ef4091c1965b", "object_relation": "sha1", "Tag": [ { "name": "api-devx-help", "colour": "#8AD189", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781896, "uuid": "6df1565c-f967-48d5-8ea7-3c265d9c4736", "comment": "Malware payload", "value": "e704e845bf10d4ce44e27604c980ce261430572ff7e5485799cfb79fa8d79f1b69f21b8024a8cec527d4fc7c190cface", "object_relation": "sha3-384", "Tag": [ { "name": "api-devx-help", "colour": "#8AD189", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772781896, "uuid": "7dd7bfde-b503-454e-a54e-06ab2d59ecc9", "value": "T162183322B7E5C57AF0BB0B3294F1A7544A7A7ED51E34E20F7308924E4D71A80DA38767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772781896, "uuid": "38308885-d216-41c9-88da-33e80b2ecc0d", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772781896, "uuid": "2e70a322-6486-405f-a045-116e92a80071", "value": "1572864:v+e4h7TL9BHeLLQfvxvhKDLwCXiaBcSrufGanp7GgtcQ3AsERCjqTe:We4NGQfvx8PwCyaBcSruZkUECWq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772781896, "uuid": "a5e3d3f8-6479-47e1-8608-3f7d107dad5d", "value": 89334073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772781896, "uuid": "22dff767-8669-4371-96af-1c607a863795", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772781896, "uuid": "4f53f2b5-9f1a-463e-bbb0-a9050d1ba80b", "value": "83e9fdf06a347b8528f69055f491d43da83cd365a3de24dbfada9626a3bda6fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df65b90c-196a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808223, "uuid": "9545b7b6-cb18-48f0-96b7-733a7923e77f", "comment": "Malware payload", "value": "d5faedaec7867888d88cc8d2c4f7da82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808223, "uuid": "8a8ff361-ce1f-44d2-9d1e-74f6f7b0b5a9", "comment": "Malware payload", "value": "847d82e3a694345cae6df528f1bfe086fd95b87d628cc4968e988ba7e17ed255", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808223, "uuid": "22a63970-d5b1-46f3-94b5-7d57b03aa4c3", "comment": "Malware payload", "value": "06f73ed207aa559d6f56cf77555f33f72be3820f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808223, "uuid": "aae5c466-8a69-4f00-90e1-347c5a40bbba", "comment": "Malware payload", "value": "cb5a71785bc2294b6f30cab16c9731a3b2ff0f5850b5791750be56836a0ee571940361be934e3140830ff1a638921da4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808223, "uuid": "a7aba4e5-91ac-4518-932b-8cf2503eab56", "value": "T1A9B4E611FA60B525F89346707D79A296782D3C362542EC0BF78A9F8636B0593B8F431F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808223, "uuid": "d90dac8a-d184-4210-9dee-746df68d5654", "value": "1b621fe6b02dca2ac366757d042e13f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808223, "uuid": "ede0f74e-b4c9-4edd-a5ce-e922b8af502d", "value": "12288:tpam9OCGE63owiaAyAtJIXuF+wFzXRWht9Kf2DjjGFIF/JBVG:+6KgJIXC+wFzXEh9jjGFIdJBVG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808223, "uuid": "c88a57cc-1c37-43a9-b76e-e3770ac490a7", "value": 503808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808223, "uuid": "627eabc6-cee9-4a54-9519-bc2e9ae6dc54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808223, "uuid": "3fcf640d-3981-4278-b543-835a851d225f", "value": "847d82e3a694345cae6df528f1bfe086fd95b87d628cc4968e988ba7e17ed255", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef6eab8f-196c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809108, "uuid": "0ae5a652-a00d-4392-b258-599d2b264c0f", "comment": "Malware payload", "value": "8d71acf0765d5ab9158d083ef62e5cb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809108, "uuid": "bf2e5e73-51b0-495b-ad31-748fc0a51560", "comment": "Malware payload", "value": "848308f9609745e901cfe9d88964ecde888484d2d309b89526cdb39273bbc3c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809108, "uuid": "4688e4e2-fb57-471d-aef2-d0077b3dea74", "comment": "Malware payload", "value": "ee04999a3c2c745d4efc81baf801fe9997af48e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809108, "uuid": "a89510c8-9f2c-431c-bdc5-033e00616e65", "comment": "Malware payload", "value": "51f719836bd8fd288897a73ac3063c4e70f47c63bc5e396fe6b8b5e1ec3462df56dc17f13d15ac24dedf09a5556ae8a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809108, "uuid": "d7f2566f-ade6-411c-95e2-760696a92f5b", "value": "T19594F612E620B126F89345703D78A246692D3D3A2651EC0BBB8DDF5A3771983B1F931F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809108, "uuid": "ca9e27b5-c392-4c30-8109-524139bfc076", "value": "fb4aab39824a1caa5dbf4ff2c0c1e6a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809108, "uuid": "e27c528f-b4d2-407c-9608-40c730d3d703", "value": "12288:F66kIDNRwcxDbDOMNmu/OGeNsNY9lAVwPgoI/XfHP3aVx4Mot9shABflDLiRDqvq:3DoVeMowRDq6TN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809108, "uuid": "43b7beaa-ce1f-48f8-a641-907b0fc6bea0", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809108, "uuid": "675979b1-f4f4-4173-9830-0e564e22193a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809108, "uuid": "d1706a42-7cb8-49e4-89e3-841f27c27046", "value": "848308f9609745e901cfe9d88964ecde888484d2d309b89526cdb39273bbc3c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6af51704-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1772808886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808886, "uuid": "91249b37-dcfa-43cf-8372-76de89db5f01", "comment": "Malware payload (DarkTortilla)", "value": "2b3ea935f81e3de4a896a09df6a14a6b", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808886, "uuid": "8d08406a-b765-46e6-965e-5ce4c12688b7", "comment": "Malware payload (DarkTortilla)", "value": "84ba9c511c0b30ad8decd242e3066a18ef69bed549bc29761b70d5473c2092cd", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808886, "uuid": "50394b77-9154-4237-a583-9452ac08d5a7", "comment": "Malware payload (DarkTortilla)", "value": "de759ca979ee142913eff1385acb7da51eeb54a1", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808886, "uuid": "9f317c60-9035-4728-ab58-af0d09da57a0", "comment": "Malware payload (DarkTortilla)", "value": "fbc90259123000bfcfa48c15921689c3c915b284242751e79bb483c21c20dbff5c88e5b7a0c49bb90b6ecbf95905dfb6", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808886, "uuid": "9a3cc2cb-31b7-4bbe-9570-3d691fd6a2a5", "value": "T12255012B1DC366A4C4904F78D3B910E963F0C65B1115E7BF6AED42F0DEA2B4ED9131A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808886, "uuid": "96c5f84c-2449-4286-89cb-6cfdf6871da4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808886, "uuid": "40172213-8469-4979-ab19-a4527beddc86", "value": "24576:ThpLT/4PPH7caoc7KrxRri1N4Mtwa9Zvl51KOb9JblNB1:vLzswaoPr2N4uDv5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808886, "uuid": "b8488057-83d9-497d-9c52-19c11d30ca56", "value": 1320448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808886, "uuid": "e35b9883-f21e-40b0-89cb-7d9f4a9a2d13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808886, "uuid": "f09d6067-e9d0-4fe1-b298-0037da2e1810", "value": "84ba9c511c0b30ad8decd242e3066a18ef69bed549bc29761b70d5473c2092cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea1bb977-1968-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772807382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807382, "uuid": "832257cb-2f9f-4551-a893-67280d9f0792", "comment": "Malware payload (Mirai)", "value": "f823d435762735379a17b06ab68ea0d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807382, "uuid": "ba68de7c-4912-41f8-895a-9ba8832b6dea", "comment": "Malware payload (Mirai)", "value": "84dc78acf07c09ff8547999bce9a5da80cb330a2d1d227908c4421182550f461", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807382, "uuid": "cfc6d60f-e7b4-4b0d-a8f7-7a0190534e49", "comment": "Malware payload (Mirai)", "value": "2d7ff71328f0e484a6b5e7faf7a4b0c5eba2f3c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807382, "uuid": "28b15b98-dea2-4858-8fd5-672fa1984d1f", "comment": "Malware payload (Mirai)", "value": "a4c31f030bea528bcd6b2f81bffa08ada8b8b78430eaf7d315b0ba44d81518a9af8e14ca85120875940d347d7ed78085", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807382, "uuid": "6dc5bb23-dc3e-43f6-adbb-b8920c099804", "value": "T10AE31AC1AA56FEF3D5C39FB502A3D61006F3DC155B2B8E45F3ADADF04A1A5C8B10A258", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807382, "uuid": "6fd76f82-555d-45ad-8f6d-b2f00faae12d", "value": "3072:csv81eNAImYKr8ooRuRszav5KGZbiobf03mc3BkU:Fq/8ooRu6zav5KGZbiobf03mc3BkU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807382, "uuid": "b9d1efd9-999d-4bff-8e7c-4d52327b484a", "value": 153840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807382, "uuid": "f5ad8723-4f7a-4e57-9ee7-3680da201de9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807382, "uuid": "43516e25-3038-469b-a6fa-83150856ac56", "value": "x-3.2-.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a4a67a9-1967-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772806657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806657, "uuid": "39291f59-98f6-406b-86fb-cb7e554c19a0", "comment": "Malware payload", "value": "56ac741cf003c2973d0279e0cc9e96b1", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806657, "uuid": "12ab9724-c866-41df-83ba-e689f5c304d8", "comment": "Malware payload", "value": "84dffd306e8bbdf1c1eaf39526dba36c8c442c673348c63445e848aec737e0ba", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806657, "uuid": "c971519c-0d70-4b16-ae0d-c739717c5205", "comment": "Malware payload", "value": "5c156be40c97133464e03ddb644a897ea3d87fb5", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806657, "uuid": "bfe82ae3-8746-401b-aecb-1d7d27d374e4", "comment": "Malware payload", "value": "449a39b70196690a11b409ec416a62a60cecd81cc09eb0a6f532b8cdb619ded193a9aba7d1e67c84e0d9285e54ad6476", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806657, "uuid": "8067e436-66af-4772-8c1b-af47197522ad", "value": "T14976333AF1746986E95BA43BF1E1094243AD331DE557C43AE5F07CC8B2E078A68CD19B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806657, "uuid": "2e1cc9c2-9620-4db2-bd22-83a8d85c8acd", "value": "196608:+ZftcqQuVgiVT2VrOSOR8A0uU+HB/OGUElH6XU8YYlbHXUX:+B+qntTAZOR8ArU+h/PUEl0U8YYlbEX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772806657, "uuid": "b274cd55-c665-41a8-b866-f79c696d1099", "value": 7758047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772806657, "uuid": "bd93a4ae-8580-48a4-863f-01dda9dcc10a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806657, "uuid": "a6e96c90-48bd-49c1-bc58-62ee6b60d40d", "value": "bkmsiqop.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "843fce9f-1951-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772797332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797332, "uuid": "27fa0bf1-d357-438a-b3f6-b595f783af67", "comment": "Malware payload", "value": "31d7ecd1dce2db8d4ce4aeed3390da05", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797332, "uuid": "7cb815e7-4889-466f-83bd-02b8acadb0dd", "comment": "Malware payload", "value": "85b51d61dc468c5e252b094a2e08f079e32a4a6df39522c1b02ebd483c13d31b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797332, "uuid": "3b896eb2-8962-42eb-b4b8-e9eca60660a2", "comment": "Malware payload", "value": "09a515e1906b324bd2809d1ae166320a58cd35f8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797332, "uuid": "18708abe-636d-4084-8174-6632a6692401", "comment": "Malware payload", "value": "06f9be5a71a0c1f92be51d8f3f79581bd45b0aad138f2f8d19759120d0bfc9e5f0deb032a3c864f53f8941eac640e24c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797332, "uuid": "ff877aee-ff6e-46e4-88ce-16b26b4810d7", "value": "T1E45196451ABA3A268AB3555B852FD409DD3986170C068F10BDCD0F032F7E6983ED6F68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797332, "uuid": "35e6242d-529f-4093-ab08-e45d0ee96bf4", "value": "48:CjOKzDr7b5PA7g35/zGbELybf2cbtl+i26MRLpoQu8peL/Rf6Wc9bE1Tmo:CjZ1PJEf2cbCifMZu80Rf69gN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772797332, "uuid": "851ca8df-6a34-4204-b113-1efca26a5855", "value": 2520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772797332, "uuid": "fbf57fbd-93c0-4aaa-9774-97c6aaa58a9b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797332, "uuid": "34e1ac3b-157c-42ac-957e-c3014e109b7c", "value": "85b51d61dc468c5e252b094a2e08f079e32a4a6df39522c1b02ebd483c13d31b.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e5227a7-19a2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772832111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772832111, "uuid": "12553936-906b-483f-9eff-7a566e56ba8f", "comment": "Malware payload (Mirai)", "value": "ccb89b37e830f822e5d3711621ba8845", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772832111, "uuid": "e79b61a8-59e7-4342-b064-424ca8fc217c", "comment": "Malware payload (Mirai)", "value": "85f14e5b653e95e442a16eddc38bf0e895a47fb26c1ecc4f23df54cd5c7d3608", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772832111, "uuid": "7a1edc2a-c364-4b7f-95ff-65226a687d17", "comment": "Malware payload (Mirai)", "value": "36c27c1456e3714c4e4e431167f5940081e0885c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772832111, "uuid": "3f6b74c1-c809-427e-80ec-a64b24a1289a", "comment": "Malware payload (Mirai)", "value": "0761d430b0a78ba11044c85915118461bf5ab59c74591247eb104112906f3de399bc8ae4f036aa1bded2866fca00383f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772832111, "uuid": "59d21f23-b74b-41df-bb30-a5d6a50ae1ca", "value": "T1BCB32977A61C0B43C49B55F02CB77BF28F69ADA312A611C0A209FEC05B73AF12551F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772832111, "uuid": "1889504d-8098-4434-979c-a97320855fa0", "value": "3072:X3FM0rpGAJluQs2c+GCbid/mm/Qcud9HnirNb:X3O0rUAJAQs23GCG5mm/Qcud9HnirNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772832111, "uuid": "81879755-1e01-4d89-a438-9d19a572d31f", "value": 118004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772832111, "uuid": "a3f52c06-41d4-4baa-bb31-3327c1945845", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772832111, "uuid": "75ff213c-2daa-4f22-a2ab-5825a7fed149", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e97a617d-1975-11f1-a769-42010a9c0008", "comment": "Malware payload (NirCmd)", "timestamp": 1772812964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812964, "uuid": "70548f2d-dfdf-4844-9eed-e60349535890", "comment": "Malware payload (NirCmd)", "value": "570dcb09980de944815a0dbd7c4bf440", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812964, "uuid": "abc8c9b7-661f-4dc7-a5a9-3bf2452303dc", "comment": "Malware payload (NirCmd)", "value": "8638caa95e7b012e1ba8425c7d6de94c1e97a6f807caea1c85567a12f53d6f18", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812964, "uuid": "ebaf643b-f3dd-4e1a-90f7-847a57eeddd5", "comment": "Malware payload (NirCmd)", "value": "8f4f0e34d6c8b4b52f561bd6a8ff2fed57ba05e3", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812964, "uuid": "1c051500-7121-4501-98ba-b346c456a4bd", "comment": "Malware payload (NirCmd)", "value": "91b8f4031bc61ba3186a2d81577b43e2b9b56a3bc2253d2a66738c1da24379a8c5f435a042883aa4e2f029db0e861853", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812964, "uuid": "3d43e13c-2328-485c-adfd-4decec0d47de", "value": "T147A52342F8C485F3C4511C331B65A7616A7DBE202F268EDBB3856B1DE9614D0EB31AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812964, "uuid": "7f219d82-eb68-41c8-a482-860cbd63dfb2", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812964, "uuid": "78892919-4c56-4f34-81b7-5ea1bbdc7317", "value": "49152:ABRhTpc8iYM5pF9UBB6jdLXsuuX4/cqZIiQx6lSONx:a/TFM5pXUBB6BLXTuoEXx6lSONx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772812964, "uuid": "d5a28e8e-81d5-412a-acaa-87d82c178363", "value": 2110512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772812964, "uuid": "eac8e362-8598-4553-b3d1-a47c6b2e0fa2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812964, "uuid": "ae8e13ec-cec4-4999-aa4e-1a0c20d5ad45", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "facc4e11-196e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809986, "uuid": "089180d0-881d-4a03-9541-a77e28ad0de7", "comment": "Malware payload", "value": "2146c659f9d9630fdd74b8c5f67cd0a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809986, "uuid": "b9a60ed2-6860-42e6-8a7d-6f17b7b95e58", "comment": "Malware payload", "value": "868089f83d51fd0662de97ce98471e2813acef3a1c4e1f317f19012d4e9e5e4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809986, "uuid": "a431110e-9b8b-4bc7-bf04-014ecc1a5788", "comment": "Malware payload", "value": "5f96f495314812a04f510622f146d1c2f2b862fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809986, "uuid": "83ace606-b453-41b8-98fb-88d134d2aeb1", "comment": "Malware payload", "value": "bd5d2d1e0980d07e966c856965263643c66dd480766ffb5e53580572286477e30dc1dbec3027782d98590460df699075", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809986, "uuid": "038380a1-fbea-4355-bcdd-fd08840af556", "value": "T1A694F526E760B426F99344712D79A256282E3C3A3681ED4FB78D8F4A3A7058375F431F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809986, "uuid": "070f4d69-023e-4648-964e-29d57c329845", "value": "2513ea0abe63c8049ac23cf37fd47295", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809986, "uuid": "7700a744-5201-4484-a3b5-6d5b2b9329d5", "value": "6144:N5wbH+V1DPYmPdJXN4D4bHVn5nTCMy1JMx7GDUhE1HfymWI4h5JBgkMg:sbeVN4D4bHVn5eJv1HfymY5DRj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809986, "uuid": "a51d8f2a-36c1-4982-a725-26a472f634d6", "value": 417792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809986, "uuid": "77c753ac-91d8-4aab-8dcf-151f8ca9daf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809986, "uuid": "d0db2fe5-f654-48b0-93e0-cd2d912acc82", "value": "868089f83d51fd0662de97ce98471e2813acef3a1c4e1f317f19012d4e9e5e4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20d0be7b-1974-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772812198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812198, "uuid": "5468f128-1ad1-4769-ae84-aa8e05f7064e", "comment": "Malware payload (Mirai)", "value": "3d34a6b35c2b1d35897cd1692966645e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812198, "uuid": "61310cef-bdef-48e8-ba02-9a2ec32cbcee", "comment": "Malware payload (Mirai)", "value": "86808d452a5247486788f89b5a87cb03071d6404e6877cffa6fcc87dc03b0df7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812198, "uuid": "b064ee8e-a63d-4727-9161-615f3a37f7ef", "comment": "Malware payload (Mirai)", "value": "9ab12ed5e78b2e0df133e4642c96f86855314432", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812198, "uuid": "6b38e822-14ae-4ef2-960c-660ebbc1e577", "comment": "Malware payload (Mirai)", "value": "a62161dd7f68ba365ffa5c6e50501f3f3ddea2d9644d833fc5222e56796a8d87f5de289d01ac8af7b720cf5202641af9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812198, "uuid": "240df0c2-9799-4f07-a5bb-0aad30bf2655", "value": "T13B043A45EB404B13C0D627B9F6DF424633239B9497E773069528AFB43F8779E4E22A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812198, "uuid": "7b9634af-5b42-4b2e-984e-1ff038e7812e", "value": "3072:v8Fh7MtehGB9ewa0WauwBrrWgtwy7X3yaooOM/RXiIkYS:qh2eheQwa0WauwBnQy7X3nVOM/RBkYS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772812198, "uuid": "1e62d642-422e-4a45-a904-62c0a60e2420", "value": 183859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772812198, "uuid": "f6b8cee7-2b96-40b7-b6d8-bbacf2ceb5d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812198, "uuid": "3bf47c06-578f-477c-92ee-cd4cbede0a4b", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f03801b-1984-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772819255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819255, "uuid": "b9937a10-f46e-4443-90da-e4f0ebe7c9de", "comment": "Malware payload", "value": "783268eeb0f8ee7a64691b8cde6bb53d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819255, "uuid": "5cd1942f-af67-44a3-ad74-29c468a0c5aa", "comment": "Malware payload", "value": "869c4b03c1c6cbf686804b3dbef55240122de0075ab21850f6d9d4cf3b44a240", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819255, "uuid": "fb7dc6f6-e3e0-41ee-9bc8-14359e15cb1e", "comment": "Malware payload", "value": "e205fcbe4c66a4a680f958bbc00d0eac03d5b4fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819255, "uuid": "7270d647-8d55-4ae1-b503-12b7735a16a4", "comment": "Malware payload", "value": "ef215585e03c1586db16d308cbac102de587268d6feae073efd56df1a41278a34356876b52ba649c239e1352c5a7aca6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819255, "uuid": "2ff9efbb-017c-472f-94b1-46911beffa93", "value": "T18D923A81E943D9F4E81242B11436EF6BF530E27D1048EA46D37B56B2A493940C6BB7FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819255, "uuid": "b66e3612-16f0-439d-9f3a-040eee392b5b", "value": "384:fVTuQw50VoldMrHtRpQjc1p9DQel1HF8r3yVF:MQw50olWLajcFQelRF8LyVF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819255, "uuid": "a16a58cd-952f-4489-8921-3f73a7a5d6e3", "value": 19952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819255, "uuid": "210dc984-8b2b-4330-9495-2aad4cb22bde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819255, "uuid": "96c48a15-3e17-4f0b-9184-31932b12bd6f", "value": "violetx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "055b1dd1-196c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808716, "uuid": "645eb8e0-11ba-49b2-8265-60b306e56dbc", "comment": "Malware payload", "value": "9bd9056c8a3798ecc7cd2624e460d9cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808716, "uuid": "6f3e2ba2-2cce-4ce4-b576-625e626e54c5", "comment": "Malware payload", "value": "871f50c83ae5a8620fded1cbb226df9636bf55abe90ebddd61a39015585f0268", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808716, "uuid": "6c2cb764-cbca-46b5-81d4-3f21085c0ce4", "comment": "Malware payload", "value": "1f02125f72201021887bef2f0e0000eff1f68aa5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808716, "uuid": "a4f2856c-39e4-4f16-bccf-2edfcd30f027", "comment": "Malware payload", "value": "e516c1f4206e348bab2d41840eb84d3532515115838646db70e219c3f2631d8e2af5c6822cced12a5891eb1dbd7ef72f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808716, "uuid": "c254e861-a257-49cc-982a-c78674fd5316", "value": "T13E45D04627E84958F4FA9F39297464144BF9BC279939E72D2A4840FD0C72F45EA22F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808716, "uuid": "7913a3bd-db8c-403b-ab0b-783c02030563", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808716, "uuid": "848bf8e4-400b-48f9-a5b7-c6a4762b143d", "value": "12288:ufDDKyKMr5ZeGszIMjy1j89CFnLT/N0HPNI0iAxxrKXBxoo1C7I/hPkg+CaHmL2e:2jhpLT/4PPH7caoc7IRkWaAJXA1BPgP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808716, "uuid": "4656a681-d4a5-4d86-a863-a2154f82b235", "value": 1188864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808716, "uuid": "2da35717-d666-488a-aa9a-7347010321bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808716, "uuid": "40d73162-dc9e-4e3b-b138-a50f67d803c4", "value": "871f50c83ae5a8620fded1cbb226df9636bf55abe90ebddd61a39015585f0268", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "102b437c-1968-11f1-a769-42010a9c0008", "comment": "Malware payload (Kaiji)", "timestamp": 1772807016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807016, "uuid": "30dbd907-b0e9-4dc8-95dc-e806c54f4ed1", "comment": "Malware payload (Kaiji)", "value": "7dc6a0892cd5887cc00ed7ac3bfa9996", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807016, "uuid": "dc96da41-063b-4bf6-bce3-f3114fa28ea0", "comment": "Malware payload (Kaiji)", "value": "875d10dc7f2e41023cbf1e34a7877722d739cf239f475c53d389b3c69d126206", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807016, "uuid": "58ad3dd2-b1ec-41af-9eab-bf95e4a4767d", "comment": "Malware payload (Kaiji)", "value": "57e5723f2ed114ba55451b6e5371e5464e8e7540", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807016, "uuid": "77adb219-32c2-4497-bad6-252b4d2fc2f0", "comment": "Malware payload (Kaiji)", "value": "3577d4d0f7561169e0b8125c7f4b08547069e396168687b85019448a8a56e48227fcd00ed1986f07951feb1e3a131329", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807016, "uuid": "acd471de-40dd-4d38-89c5-605515056f5b", "value": "T1A0A5337F5DFA6EDBFE3B251969D9A484E0E704B20FA528466EC05608737C2E0CF31265", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807016, "uuid": "e89a0c33-1f81-4efa-8070-8d62e67b94c2", "value": "49152:ZjNz0wE6WAsByYLmnNXfOssMRq3hk+8mDyH:1N1l6aNXfOKwx/8V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807016, "uuid": "6bfbd0d8-2853-4a14-8717-c3e2541055f5", "value": 2083124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807016, "uuid": "443aae07-5269-4132-9bb7-6c624b114616", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807016, "uuid": "acb44598-b1a0-4fe5-a561-ae4f5e4fc6c1", "value": "linux_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9773503-196d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809555, "uuid": "437c274f-3062-4668-810d-674eff05de44", "comment": "Malware payload", "value": "04cf3dd040ee62b942daa32b098b3a56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809555, "uuid": "381e87ad-efbb-4705-84dc-68bc81fc397e", "comment": "Malware payload", "value": "8845ef3a6073b6063817e01607e3ba49d99bed413529e6ad2623a390a27d8cd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809555, "uuid": "3eb4c790-426c-459f-a2ca-3dcb695d5a80", "comment": "Malware payload", "value": "650245c908d1eb7e37cde62e3f364653838ae585", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809555, "uuid": "e6bab88b-8800-408d-a3b5-347640be53ea", "comment": "Malware payload", "value": "b9f928a50a41078b5b7cdabbfc724b9fbf90e385575407098d8e17da1ef8690b18d3540d8f4205982b2c7a51a74dca8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809555, "uuid": "86d3bb2f-b70a-4800-8eb9-c276cb948196", "value": "T178C4AF91F715DAABE56B0ABA8CBBC4302567AC1E86D2111E315DB22825F331211DFF4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809555, "uuid": "07790eec-608a-44e5-a542-ee3f2990c2ca", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809555, "uuid": "d4a89764-ec48-4c02-9d26-3c220207f8d8", "value": "6144:owq3NpQ3wDIywUF5ykHERIe6M1thQuYnx8hPEMwMdozvn1O7CLF2jtM0OtTq+f5q:ozcae6utMnkRdAv/h2jtM0OtTVBSp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809555, "uuid": "b6447666-bd10-4e91-a206-8ee0352d27ab", "value": 567840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809555, "uuid": "c0a5603f-ec7f-4743-9abe-ee9f2fa1f817", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809555, "uuid": "400b0fc3-246f-4e82-8f28-5a924b55efed", "value": "8845ef3a6073b6063817e01607e3ba49d99bed413529e6ad2623a390a27d8cd3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7826daea-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811056, "uuid": "e0f16231-1f89-45ee-acc6-bc309b3ff9f7", "comment": "Malware payload", "value": "be8c6bb094a54637c4b66e22bfe14e24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811056, "uuid": "ef074f1e-3c24-4061-9f6b-c1b1ae8b3389", "comment": "Malware payload", "value": "885d9e7b8aab053be49501f03ec67a4c6d6f5daf45cdc232ceb67fafc0aee3b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811056, "uuid": "eacde669-33ca-4cff-b376-6e8b95496b04", "comment": "Malware payload", "value": "f7cd13dd48eb8c7e2b8671dfdadd06ab688d93e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811056, "uuid": "d80092a1-29fa-46e6-be64-ebb00219d99f", "comment": "Malware payload", "value": "f8ca0daa14df18449a9067ff46e904b4e33234134adc0e57bb5b41aba68488844289ff12f0a912c76088eb722210eca5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811056, "uuid": "cde01e89-fa44-4a01-8e52-19f265e83f61", "value": "T1C773E626AB57446BF141093182958BFF4ABD6C33316A202FEFD09CF73CB059A8545DAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811056, "uuid": "ff550aa0-55a1-4ce1-bd1c-6df20a0b45c0", "value": "c4b8b0aba9f9c876ca624bdbda64d516", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811056, "uuid": "1386e909-0593-48a8-91fe-19884258daf0", "value": "768:oepnjAK/y7yXdQxlVfnHKQtV7eSHs1Iqzy7NIaH/f74tFGXnedGiB9G12uZFHQzi:oepnjAK/yGtQNqydHjq6j4tu/2uCoI/y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811056, "uuid": "233fe2f2-34f8-4194-b0bd-4b7b1a5d99b8", "value": 77842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811056, "uuid": "c68ea2e9-1ac3-4c7e-a8e1-75663ba90975", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811056, "uuid": "61f386c9-4b4c-4cb9-be7e-b67aa47c2379", "value": "885d9e7b8aab053be49501f03ec67a4c6d6f5daf45cdc232ceb67fafc0aee3b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29b3d028-196c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808777, "uuid": "0254b323-f647-4673-9530-8ead9a9d88fe", "comment": "Malware payload", "value": "93a0d0182053dadaef253310bf8c78a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808777, "uuid": "82fc8166-b24b-4db2-843f-21a0e9e6c32a", "comment": "Malware payload", "value": "88c39c5585b2dcb585724f878a07705243df1f14f8d6b54f81b112cc1261af74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808777, "uuid": "cefcdfb7-fb34-40c2-8a7c-7e8113baf175", "comment": "Malware payload", "value": "dbef4eecd1e8310191be846c9a5d2bbf6852396a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808777, "uuid": "59bddb6b-e778-41d0-a403-74c077542f9a", "comment": "Malware payload", "value": "0700d2c33a3b877dcde2951bab0894872f2ce666b2c7079b95606fc168dff348763b81619574c86156b08731083a3ad0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808777, "uuid": "037687f2-0577-4d1d-9166-2173fa18c3df", "value": "T1D643F8013B974361E41C257680EF052447F1A7D226B3E7EB3E9C639D9E033A36E52BA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808777, "uuid": "7dfbe83d-c9ed-4552-9070-b94649930059", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808777, "uuid": "5f34e133-1fc9-4c77-ba2f-1458cc154d81", "value": "768:34NOwj8HdrxozXoqi+rgzQCiJv1T3rbqS0ayq8ZMaqXhSCA2Gar:oOPHjojol+rgcCiJd3nqrayqQMRbtr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808777, "uuid": "98305f9c-0fc3-41f5-8165-284d8eea9d56", "value": 57856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808777, "uuid": "87d9be9b-ffde-44df-867b-39106584e9d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808777, "uuid": "fd6324a2-e54f-408e-b75a-dfe0cd08d245", "value": "88c39c5585b2dcb585724f878a07705243df1f14f8d6b54f81b112cc1261af74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f85ef5e8-1983-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819002, "uuid": "eb56dcfb-8627-49e1-9d8b-3bf7c9098d7b", "comment": "Malware payload (Mirai)", "value": "c09b6bdaf5394952a0548e09bb9ccbbf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819002, "uuid": "4d9da027-cb40-448d-8e8a-94bce2881178", "comment": "Malware payload (Mirai)", "value": "89047c4d5133421e773e5522e4891e36c68cf06cb72cf0f9495b92cd77a3dc13", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819002, "uuid": "bd411361-1468-4bc6-b219-98a7ff260729", "comment": "Malware payload (Mirai)", "value": "208e8a1ee317b4d95244fe94c1017118d02ec45d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819002, "uuid": "d6f3d36d-cb62-493f-96f3-643cbf6dce27", "comment": "Malware payload (Mirai)", "value": "14b87e0b6f7c06c7fd36b060b0667b8b323975f71ce43e9e419a3334898a5cd8cb72ad9962a52f2b4bd70133c7752f67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819002, "uuid": "7ef37f53-0074-41aa-a7a0-aa9a0ed16529", "value": "T10EC3C85E6E219F7DF368833047B74B25A75823D636E1D685E26CE6001F6038E241FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819002, "uuid": "02301d6d-b593-4bf8-bdf1-4a7f1ee2b39a", "value": "1536:GZlDgu2haCVrzs2lBChIT0VGZ70C41rHQ0MHFBef0oO0BpoC4:qgu6tXs2/YVVCmrHWHFR04B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819002, "uuid": "4bde9909-b87e-44d6-9235-b15dee6af0f8", "value": 118400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819002, "uuid": "79828734-9d3f-40a8-b965-7bdb5928de7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819002, "uuid": "762421ad-e348-4361-9051-07d5770d42eb", "value": "jawirbot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3b0691e-196b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808632, "uuid": "8be5ffe8-5813-4c03-adcf-c8f6dcc959a1", "comment": "Malware payload", "value": "e41f4f74b05ccf18d3a10a390b01d66e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808632, "uuid": "46b1b486-e5f6-4f91-aec2-aa0fe8061bb8", "comment": "Malware payload", "value": "89b72ebde221120ed45ec704b9d5c14d68bf693e2910658283fdeb91a9219ab3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808632, "uuid": "aa4aa86a-119b-4600-8961-54227381c2ec", "comment": "Malware payload", "value": "adfdfe2190c3091f95e62e1b1f5b4d4b973320e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808632, "uuid": "4be8720d-beb5-4ad2-9c95-56289045ca27", "comment": "Malware payload", "value": "3b09a4407f06a287eef82414838b9cec85bae3325c369906da11330f0a712c2f5a58c853db21738f2f640481cc01463c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808632, "uuid": "020fc45d-397d-4fa8-a36e-1ff43405e68b", "value": "T14B55C00273D1C062FFAB96334F56F6115ABC7A260123A61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808632, "uuid": "b8829e32-6655-410c-bea0-3929129ffbfc", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808632, "uuid": "bb0e22b3-956f-4e2f-9f0f-8d9591e1cc45", "value": "24576:w5EmXFtKaL4/oFe5T9yyXYfP1ijXdatT7tH6T4FzzPU6ORSMK:wPVt/LZeJbInQRatPtamHU6r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808632, "uuid": "3de747a3-37c4-458a-a712-4c25947d4335", "value": 1402368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808632, "uuid": "16ecc893-278b-44e4-8d75-3f582500522a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808632, "uuid": "3debe127-1918-4f44-8e6b-aa3e7df05264", "value": "89b72ebde221120ed45ec704b9d5c14d68bf693e2910658283fdeb91a9219ab3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff8fdd88-1983-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819014, "uuid": "fab75f07-a2d1-4ee6-b260-d3ded9684bbc", "comment": "Malware payload (Mirai)", "value": "37d167e2e1d0a1a1223a506913dc8220", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819014, "uuid": "983cd4fe-99be-4933-bca2-3d8b85b813d8", "comment": "Malware payload (Mirai)", "value": "89d1cf0d80f26f4a506d666e0ffc7df7f344511da9e62c20fd39efa75850dd39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819014, "uuid": "b1900800-67c7-499e-9cd5-93960a56caf2", "comment": "Malware payload (Mirai)", "value": "f19ce4e5137cdac0c0a3abe8a4aad02348e80cca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819014, "uuid": "9ec9fdf1-9a49-4e8d-9204-77978b416148", "comment": "Malware payload (Mirai)", "value": "cab7e678cfc636a9157e62c83b0abfc80f55256f47be13353f9158c869f885cfea5bd8bceff3651a4830ebd174fe106c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819014, "uuid": "3ee8e6d8-95a6-4887-a19f-50b17c40e35b", "value": "T158E30D8AAF713EFFFC1ECD3301D95646214D565A12A86F7B2A70C528E28A14F49E3D4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819014, "uuid": "35355b8c-7476-4327-ad10-51f576459066", "value": "1536:2BFkgl6O0cn3q1Zuk2pMQmBz8l72GaC7u5xnXNkXrG8FKpcC7cFnZ/vIAJqY79t4:6JINopaC7PacC7Anl3wLNuFBwl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819014, "uuid": "9bb441b0-85c2-4f57-803f-5711aa0a1d63", "value": 156348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819014, "uuid": "6e4294a4-c0bd-411c-b401-5a9817c8dc87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819014, "uuid": "4e41b33e-e361-4cf0-8ecf-66688db76272", "value": "debug.mipsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c57349b-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819250, "uuid": "aec9919b-6eb3-448f-bcdf-cd4e4fc6a15d", "comment": "Malware payload (Mirai)", "value": "8bfc6881a1ea4cfdf6008e1b0736ec8a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819250, "uuid": "faef2d56-bba3-4e46-b5ee-05cfcb57b144", "comment": "Malware payload (Mirai)", "value": "89d2cf74a5deb6dbf61e1410b6b9ad2672ab6fcd9851b984d8c0af39a8fa491b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819250, "uuid": "20744e3c-d277-420b-a1e7-68cc9b81c448", "comment": "Malware payload (Mirai)", "value": "6882cc34b7b2f877722e19aaffdfe057009964fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819250, "uuid": "6d1f4793-256c-416e-8449-94ebd250c9f7", "comment": "Malware payload (Mirai)", "value": "02fe1bce7eefcbdb0f03a408e88922c8beb9557094cebe259ad82505e81f84980755bfabd9d356ba90f370ca5ffa9ea8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819250, "uuid": "8dad85c1-b278-4c63-9e3d-79856f544f82", "value": "T161A34AD7F800DDBAF41AC73B44975906B230E7A10E8217B67353796BEC391E91827E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819250, "uuid": "1a6b262b-e02e-4050-ade6-9866e1369674", "value": "3072:ZgFlfGbGNyb7IFQn+F6lB7XsnnicydZwPJ:ZUlfK3UQ+FKhuicydsJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819250, "uuid": "d6e9c324-df86-493b-9f24-b434c54f370e", "value": 102992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819250, "uuid": "7ff6dc3b-ec1d-4215-a845-2dfb26c787b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819250, "uuid": "66ec093e-ab13-4ad8-89f9-9df5f08ea5d3", "value": "violetm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "947cba7d-1964-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772805520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805520, "uuid": "b679ba3b-02ed-4992-a16b-d569805805d0", "comment": "Malware payload (AsyncRAT)", "value": "322291e44783484067d04f34af2de3ec", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805520, "uuid": "5363986b-dc63-4fb5-a438-8df40392396a", "comment": "Malware payload (AsyncRAT)", "value": "89e52fa31535e46b5f08becbe1c591aff709036554856e6d250a503719081705", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805520, "uuid": "19d85e23-b8b2-4276-9a24-7df83c5788fc", "comment": "Malware payload (AsyncRAT)", "value": "2e62329fd4f8a02e59aeebabd6653052c0e9d524", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805520, "uuid": "63095075-2030-422b-a95d-ad7b97f95e7c", "comment": "Malware payload (AsyncRAT)", "value": "caf4eb1532ce81d4b5efadb089c09e676ada38dba5a1310800d05f9f6179091398bbea518585a165ec6b7a25b428685a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805520, "uuid": "8edaca4f-f216-4fe1-ba40-6d9b087806d8", "value": "T1B124C041F6C08472DDAD183804689B368F7EB860CF6099DBA3C45BA99F742C1DE35E5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805520, "uuid": "c8b8ad0e-6a69-48b8-8037-ee5864b11129", "value": "3e1b9abc7b12e5ae445d7539e5dd133e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805520, "uuid": "1973d4d5-d4d4-46a8-b2b2-ba09065e9a44", "value": "6144:LTC3PMP9KgSWHMcl8sG77SXlCKZmWVcP8E6F/6N:XCfMPxnL5lCKI0EA/Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772805520, "uuid": "dd961d41-b139-4af4-8251-b7b610f516a3", "value": 213272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772805520, "uuid": "72639fe8-53a8-42a4-ba1b-b1c762f22bca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805520, "uuid": "12895a46-196f-4c8e-9ab3-2b553d95652b", "value": "SDL3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c05d2be-1974-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772812217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812217, "uuid": "2eacb841-b0a9-423f-bf3a-8dabae359760", "comment": "Malware payload (Mirai)", "value": "c793fc330da9d17ade538c1ee9c2227a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812217, "uuid": "6f019a62-fd98-426c-943d-044d2161bd13", "comment": "Malware payload (Mirai)", "value": "8a4c1bf89270c38f910c2a24d554175c876a7a1e25a86e5b7def2b2b905cb4a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812217, "uuid": "87f32fef-9db5-4678-8a70-9f1211dc6d1f", "comment": "Malware payload (Mirai)", "value": "2397ab77ffddbd45a5c1c9704a74b538b73dd201", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812217, "uuid": "0377e2ae-dfd0-4c4d-9a73-dcbeb207fc93", "comment": "Malware payload (Mirai)", "value": "81bb896d13c95470d9290ae30b12bdcc0b3f242fa365a0b4727819fca76628a9f2652da09f5320b5037722cd9652ec36", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812217, "uuid": "47a2c0fb-77de-47ea-9033-1362aa31ca9d", "value": "T156C38DB3D8296FE8D110D9B0B4B48FB82B63A58541472FB965ABC3B41487D9DF500BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812217, "uuid": "58b296fa-5081-4d3e-885e-466a16b78bcc", "value": "1536:kmM4DRZqJO8NUz0Bg/Rm5eKUFEHzr3mRjiH+6VIF0/HfZa2W0Q:kmM4DvqJrNUMbVu0xH+TF0ffZa2V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772812217, "uuid": "812a5d98-76fe-4ca4-9a09-f3c028e5780d", "value": 129096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772812217, "uuid": "78119ba9-9fd9-4ee8-9ab2-0149cf55ed7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812217, "uuid": "3b615759-ee71-46a8-9042-b007efe74819", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bcd6551-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772811330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811330, "uuid": "83ca3652-b4cf-48e8-9e66-5e4e8e8c31c9", "comment": "Malware payload (AgentTesla)", "value": "0795bfa8a65f7b8f59d493ac23ae29bf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811330, "uuid": "302e7bc4-99b7-4c5e-815a-d3e6ca6c51a0", "comment": "Malware payload (AgentTesla)", "value": "8a83917310bca7fa86b7532e0a3a50db2e9055c25501f348c738daf6262bb303", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811330, "uuid": "85b89447-55e2-46ca-99fd-e605919bac02", "comment": "Malware payload (AgentTesla)", "value": "dfca5a89365aeb4ac591b8e87b6138cd1c6a9a99", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811330, "uuid": "c6e1c24a-2fca-451f-9f3e-86022e51bdc2", "comment": "Malware payload (AgentTesla)", "value": "3096cf8ff9c849e0c62c5903609fc5936bc61ac87e149ef6362ff2ad2052f2e640c25b8afc3690cdbba8123beb630143", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811330, "uuid": "3116462e-6a15-4555-a865-c0c8a6eef3b7", "value": "T1E135AE027391C062FFAB92734F5AF6115BBC79260123A62F13981DB9BD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811330, "uuid": "d0c2576a-1990-4e47-b6ed-41571f04e791", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811330, "uuid": "7e5e4e37-7931-41cc-b69a-1e3710008580", "value": "24576:S5EmXFtKaL4/oFe5T9yyXYfP1ijXda6mBQ2MqMhw2GE8q:SPVt/LZeJbInQRa6mBHXS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811330, "uuid": "70358188-13d7-4c01-b3c0-127046a4e07d", "value": 1146368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811330, "uuid": "1f806913-998c-419d-ad8e-b057aa794faf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811330, "uuid": "f0e42101-866e-43ff-a671-5f750980bbd7", "value": "8a83917310bca7fa86b7532e0a3a50db2e9055c25501f348c738daf6262bb303", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b465f82a-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772810298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810298, "uuid": "bd30c951-e857-40c4-a319-cbb9e606659d", "comment": "Malware payload (Formbook)", "value": "7a71b7f9a9d70d2a008ecfc3bf171129", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810298, "uuid": "63ad92c0-2b70-4593-a9b7-69d4e5e9a1ea", "comment": "Malware payload (Formbook)", "value": "8b18785bba5bd6332ad6ce55473d550714793d27104cd04e8507b9cfdb1019e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810298, "uuid": "1f2b3f21-c12f-442c-8cbc-86b11b328c98", "comment": "Malware payload (Formbook)", "value": "d68fbc1ec50aa997706e190dfb5d883a4ff8e4a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810298, "uuid": "1e92a8aa-4ada-42e6-a211-ce8e8c5be385", "comment": "Malware payload (Formbook)", "value": "988e611b54857af301120bbb617fb9dc1a580f2d09ea79bef8c9ece5c70bc9d4b0a9e4bf1c307f43aadc3750651257e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810298, "uuid": "8e7ab804-e3d1-4d25-b18d-008ba212c545", "value": "T18D45CF027391C062FF9B96734B5AF6115BBC79260123AA1F13981D7AFE701B1463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810298, "uuid": "45dfc394-a91c-41f0-8a88-61a6c1085c67", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810298, "uuid": "8ad4b39a-9fb6-4738-88e8-5ea68d353b4d", "value": "24576:05EmXFtKaL4/oFe5T9yyXYfP1ijXdaqNr4rjXp5EOIZ:0PVt/LZeJbInQRaqNqvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810298, "uuid": "166dda3a-8cbe-4053-8d5c-6bce63fa4284", "value": 1280000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810298, "uuid": "ccd4e0cb-8cb7-41df-8a02-38cb4d8600ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810298, "uuid": "1e3640c8-322e-43bd-9dd8-e39be8069dc8", "value": "8b18785bba5bd6332ad6ce55473d550714793d27104cd04e8507b9cfdb1019e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "555dceb3-196a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807991, "uuid": "c1d4ede4-bafb-4703-ace2-9f06e836cf69", "comment": "Malware payload", "value": "5341d490828908e8058a1e4438e2afbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807991, "uuid": "75579644-4c88-4084-b8f6-213bcf81d3db", "comment": "Malware payload", "value": "8babc82a9c0bfb6b4ef92362e0be5f8fe9cf98bb2e459609e92107283193e5ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807991, "uuid": "4f7bf572-61f8-4c0f-ada0-a6891fb8c5b8", "comment": "Malware payload", "value": "4cb7ae0971810253652239c07e29ba2e3030d729", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807991, "uuid": "cd1b2bde-3c74-4057-bd8d-971f399b0c03", "comment": "Malware payload", "value": "ec9a5df38f0eca9f4b7114eace3a9bf6162a64b1fe89dd8a7f21d10a7b754ca9f81e0e903f3d108691495725420ad111", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807991, "uuid": "a2f95136-7900-4984-9c2c-3d16b7ff1750", "value": "T101D63300D6E012FEDAB3143CB8D15595E974B4B563B1C6DB4BE8D7A16EA32E04C39B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807991, "uuid": "209e64fa-0585-4d07-b77d-8546b98b5701", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807991, "uuid": "ab291122-364f-4453-96dd-9980e25fcfee", "value": "196608:K1NFtxaBlgKqFpoKzcntFlCt3hm6/m3zXMCHGLLc54i1wN+MCyPIcu9KYK39sI3h:K1NaKju9C3+jXMCHWUjXdcuI3/PGTAI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807991, "uuid": "fac57b03-524e-475f-94ef-267c404fd6ce", "value": 12734555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807991, "uuid": "de719fd4-bfb0-4dd7-aedb-fea74f010ec4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807991, "uuid": "d4f147b8-e693-457a-9571-83ab58a41670", "value": "8babc82a9c0bfb6b4ef92362e0be5f8fe9cf98bb2e459609e92107283193e5ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "730e38e5-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819208, "uuid": "69fe4b5a-ed88-4e97-b4a7-2ed86db558d5", "comment": "Malware payload (Mirai)", "value": "d8a3898b3e7b41ee2523791faa329a7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819208, "uuid": "af4d49a7-d99f-4de4-baff-523035abb6d8", "comment": "Malware payload (Mirai)", "value": "8be8b1d15d2a9bf1117ba9bcf99796b404807e111168f7b001607e88bff95c31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819208, "uuid": "2d21f060-ebfa-45bd-8d60-9dd85a61c58c", "comment": "Malware payload (Mirai)", "value": "ebe68af5f8420d595f16a301e6bdd3bcf758d389", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819208, "uuid": "7e8903e3-52cd-47f2-8bf6-e7054f44e73b", "comment": "Malware payload (Mirai)", "value": "c9db56f5ef91bf290c3847c76b0aa39770ee8c11f6399c914cb0433427ed8233e3f4ccc8a64798f831db4db8eeb3f09f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819208, "uuid": "7d5e289d-fb29-4598-ad4f-296afdaa9f31", "value": "T11503F646BA828E16C0D51575FE0E218DB713473CE3EE6322DE246BA9278F5B70B39C15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819208, "uuid": "d28be584-4139-46d6-9eec-7852065b53db", "value": "768:k9nhLHEDcotRh16nVy0KQ+VDQma5IIEVgIiI6b0B3qaR3rVPHdd:k9nhLotRhQnV5cVBjISiI6oB3qa7d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819208, "uuid": "dde2b787-a9c2-4b08-9828-91714843c632", "value": 38176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819208, "uuid": "d5913a76-cd99-487f-8fe6-f2d66f58560b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819208, "uuid": "72e09412-d92f-4cbd-9f72-5fc86d98c3d6", "value": "violetarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a870d2ef-197a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772815002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815002, "uuid": "3e71fdda-a338-4899-8fa2-c6c6e268da0d", "comment": "Malware payload (Mirai)", "value": "45609dff74b0ef26b64d3ea9480b4f6d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815002, "uuid": "1f26aaf6-ee1e-4f4d-9cd6-0883811703fd", "comment": "Malware payload (Mirai)", "value": "8c67a60301ec32183b034f2da1f6e2cb837c91c9222124cf8d99c2bd49873a8d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815002, "uuid": "2540c8b0-036e-4c9c-b9f3-ae7340d982d1", "comment": "Malware payload (Mirai)", "value": "a424286b91475559a940746dec142f15e6611245", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815002, "uuid": "bbb46b85-6678-4f98-a3c9-440a48ce37c7", "comment": "Malware payload (Mirai)", "value": "24e0733a1212f15dc833d17ed94df5e17a3e0c078f0a5831a4a3dc4d05a6d77898f5b5d18c931fe6900082e6bb2efdbb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815002, "uuid": "b05f8ed5-7456-48e8-899e-f0383d1f211c", "value": "T1BD12BAB3F5F2BEB03C4950195A865E82E4492D3D0E687D427443BD1C717CAB8E1B5A3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815002, "uuid": "20b3a6bb-98dc-42d9-9404-cfc6383c86fb", "value": "192:oNOJ++FWXymrmECHxdm3wgYqIlPotECoY+rvJ29e:osJ++FWXymriHxdL+2F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772815002, "uuid": "660c4998-9d54-4dd2-bf7f-af6bc2f8b53e", "value": 9612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772815002, "uuid": "a65970cc-7741-45a8-83f8-d0c6203587ef", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815002, "uuid": "ade5bf48-0c38-4dce-a60c-43d5b0436a18", "value": "x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae0136cb-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1772809428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809428, "uuid": "c95e4a5d-ae29-4dcf-91d4-49a264f2b7b6", "comment": "Malware payload (SnakeKeylogger)", "value": "d2086866010f64786062d8afbcbfa8eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809428, "uuid": "52a416b7-6d26-4630-983a-6970c3b0a00e", "comment": "Malware payload (SnakeKeylogger)", "value": "8c7214863d5cb9c77ec74b55c27062828cee382fb207a1aac8c6ec1f95808f4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809428, "uuid": "6a3e6b8f-d6c4-4b7f-948a-ef913ccc671d", "comment": "Malware payload (SnakeKeylogger)", "value": "594dffc6e6ae55e05aa7b1e21e534164a29eeff2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809428, "uuid": "c87297fc-c3b4-4ebd-ae33-b934ef6a18e1", "comment": "Malware payload (SnakeKeylogger)", "value": "71679c2ef0a391cf9663a7c76407a9c1b941cd92b4987f28a2e138ad860868da1b4c5f6a2f66f6ce72eaa793837d3089", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809428, "uuid": "9a61a5e1-6987-4bac-973a-e8a621d0513f", "value": "T19BD4229686C29D95C2506371D836CC904A7839719D05B72E872AEA6FBC393D3EE13F0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809428, "uuid": "308d9881-50e9-4613-a3e2-cb12cebe41d8", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809428, "uuid": "fe1a3828-8810-41e2-8c00-33552722dfe8", "value": "12288:Yz7hU5I5yuNHIgzSFKxWltRohBfSTso93U+/Q2Lg6qgTgydF:Yf+iN57Gtene3bQ2+EL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809428, "uuid": "8e519352-5e19-432a-9ddc-f769ec914a0b", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809428, "uuid": "bd1b34df-b927-4131-abff-1b5a80eaea8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809428, "uuid": "70067e5a-3af7-48d8-a2b9-88cac5674152", "value": "8c7214863d5cb9c77ec74b55c27062828cee382fb207a1aac8c6ec1f95808f4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d036d485-195b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772801755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801755, "uuid": "5f722d57-5570-494e-940d-bfe9b63bd4a2", "comment": "Malware payload", "value": "d2c72104212b805ce981a097eb424c52", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WikipediaJsWorm", "colour": "#A0BBD5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801755, "uuid": "1a9a43b4-b473-40fb-bd65-adcd37e7c908", "comment": "Malware payload", "value": "8cb76c1cf4dd1bbcb32af03129ed1e62a6249a946dfcee7b3751d8fcc6169075", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WikipediaJsWorm", "colour": "#A0BBD5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801755, "uuid": "1b427d63-cb5e-4524-94ee-ce91c01c00ab", "comment": "Malware payload", "value": "42f400499ceb8b05c3719d06afc909c7883d23d4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WikipediaJsWorm", "colour": "#A0BBD5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801755, "uuid": "a09d8d2f-6fac-44d3-9443-9b0406043900", "comment": "Malware payload", "value": "50ddc26d179b2a4d99ae520e0cc76149744d581fe6cb5e1501c54a6f88b869b18be353074e7f0c2b88bfd3e5f2339204", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WikipediaJsWorm", "colour": "#A0BBD5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801755, "uuid": "c3d5d2ae-2f6e-40c5-8116-5d19bf8cae23", "value": "T100E2CAAC72239C6DDC63266BF19D735EE2601F13F5ACA0507A4C10486FE4C9ED146AED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801755, "uuid": "e19d4390-901c-4a0a-a080-3588e4a479fe", "value": "768:Hp/yCus7+KRzihuh0/zZp/yCus7+KRzihuh0/zzsF:Hpn17+KROxzZpn17+KROxz4F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772801755, "uuid": "be6250f0-6924-4692-93ca-b19eabb507c3", "value": 32076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772801755, "uuid": "463f56e1-3488-4b20-ace1-0425ca2367fa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801755, "uuid": "a91b4415-2969-440f-8ca9-b2197cb1237f", "value": "8cb76c1cf4dd1bbcb32af03129ed1e62a6249a946dfcee7b3751d8fcc6169075.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1e76ab8-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1772810777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810777, "uuid": "2aed1089-edd8-4274-8e56-b348cfc66fab", "comment": "Malware payload (QuasarRAT)", "value": "3dd5c4df8024954b7cf424e170baf7af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810777, "uuid": "e25a5c72-c5c4-4945-b089-1d5f7d96b8c3", "comment": "Malware payload (QuasarRAT)", "value": "8cdb00e3e157f21a13e73dd32f04c1a110c4a54bfb2b705dc9878edc3490e525", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810777, "uuid": "da49c74b-7e33-4372-aa44-2c5ff79e3e64", "comment": "Malware payload (QuasarRAT)", "value": "11c6d66bcd54a3fb8a3dd93f001492e88de25187", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810777, "uuid": "311f18c8-7567-43c4-ab52-a9e35e14d177", "comment": "Malware payload (QuasarRAT)", "value": "e1f0fa1803e86fe8f1f812f4f5b2d54367edf40ea5b34f4c1efff341884aa2c5384f2044f8fa66776e3941612f025c82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810777, "uuid": "8a3a8bf3-d86e-48d8-8cb7-f1630ce547ba", "value": "T1BEE56B143BF85E27E1BBE277E5B0041267F0FC1AB363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810777, "uuid": "9b51cbd6-7d3e-4739-9c76-a98c4b6796a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810777, "uuid": "4e5a7913-ba10-4530-92ca-483c58f88ee8", "value": "49152:ivIt62XlaSFNWPjljiFa2RoUYIl9RJ6bbR3LoGdxTHHB72eh2NT:ivE62XlaSFNWPjljiFXRoUYIl9RJ6t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810777, "uuid": "9253d3ca-bde4-415e-92ad-ed0f29630d8a", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810777, "uuid": "86267469-303b-4081-9b58-84064b161303", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810777, "uuid": "9e39263e-071b-4563-a41a-de915d2d868c", "value": "8cdb00e3e157f21a13e73dd32f04c1a110c4a54bfb2b705dc9878edc3490e525", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd67fee0-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772809937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809937, "uuid": "ae5e68e8-bc1b-4f47-bea0-a31e3d458a27", "comment": "Malware payload (Mirai)", "value": "6e063db1812473256e35b8358fb129fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809937, "uuid": "655a454e-c63f-43e6-90c9-2308db337263", "comment": "Malware payload (Mirai)", "value": "8cddf9679c83d10252ec7581586dd9dd333a6018210081dfec47a6324e1cdf9c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809937, "uuid": "8a4747a0-02c0-48dc-b9aa-9a321ecdf0ce", "comment": "Malware payload (Mirai)", "value": "dbc43adf60f1a005ca4b1aab55f23822787b3773", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809937, "uuid": "26ac57c1-b8ac-4af5-acee-fe70f803da78", "comment": "Malware payload (Mirai)", "value": "e585772c24b8d13aa661033d9ca3f3225dcb29d97658358526887b4e7457ec8b7eb531d74cd5c144df82714f4542ff1b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809937, "uuid": "6c17d4bc-ea87-4b26-99f8-72b4aa62c787", "value": "T1B8B3194AF9819B12D5C922BAFE1E51CD336347B8D3EE32029D14AF2537CA96B0E77501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809937, "uuid": "3bd4ce3f-4312-4048-81ea-570675463162", "value": "3072:4b51EVs47PgAO1XYrou7advNrjThUraCg2j9JWO:4V47PfO1IrV7advNrj+rJt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809937, "uuid": "8014ff52-b176-48cf-bc56-1da37db82e96", "value": 108044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809937, "uuid": "2f882d6e-6c70-4526-921d-ad077d13cd75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809937, "uuid": "f63fbedb-7758-441b-be0c-19aa7d577031", "value": "tul.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5afdde1-196e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809844, "uuid": "ab113224-5c26-4c3b-8617-feee21d0734b", "comment": "Malware payload", "value": "cbdcd537963097e1655420ad6757d057", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809844, "uuid": "4713f3fa-3147-413a-8cf5-040b1c809546", "comment": "Malware payload", "value": "8d0142d5594d2ddcf8f6918a02e77a54e1d47e4d6e5c792399490f0248add965", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809844, "uuid": "25660a00-06c2-4ecc-905a-678135b638fd", "comment": "Malware payload", "value": "8968882c7f6e6b42a6308a783e2613c2ca6df45e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809844, "uuid": "cfcb4180-b75c-4d5a-aa8d-f77c9beaa749", "comment": "Malware payload", "value": "ff3a13358f1abd58072e5ddbc78b0b0fab5e31086c34eec6d01fc01a4ae059397cd8cf41a2f61461131c513e3496903c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809844, "uuid": "f13dfc3a-d82d-49ad-b99f-40cc2a94bdf4", "value": "T15985D0027381D062FF9B92334B5AF6115BBC7A260127A62F13981DBDBD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809844, "uuid": "34bf58e8-9169-4a22-8e43-61af6c9cfa15", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809844, "uuid": "3f3a331f-839b-4ac0-b234-16573ecac801", "value": "49152:uPVt/LZeJbInQRayFjKytswsRxlKNpFB4kP:0TYbInQFzqxlAvP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809844, "uuid": "4d9bb9fc-f5ee-47c4-8a39-2b8b48cdd6b6", "value": 1721344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809844, "uuid": "9b8ff51a-9894-4d6d-a3c7-df44d9db81d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809844, "uuid": "622b480f-322f-4c2d-be87-df3e841ac9cb", "value": "8d0142d5594d2ddcf8f6918a02e77a54e1d47e4d6e5c792399490f0248add965", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77c70233-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819216, "uuid": "f08c7df3-5f62-436f-abf4-34b881a7c8ce", "comment": "Malware payload (Mirai)", "value": "563f5a255a80fda7dd6d9ab4a2d48c27", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819216, "uuid": "91e4c504-d81a-4007-b074-4988c4192813", "comment": "Malware payload (Mirai)", "value": "8d47228c7aee256d63bc19e02f76df95f961067ab781931f1b905e7fad92d0a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819216, "uuid": "ba0a014a-c434-46db-842c-82c987c4cb69", "comment": "Malware payload (Mirai)", "value": "56da9edb2ae42f77051c7258c1797b7cca141f6d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819216, "uuid": "f658b36d-7a1b-4d54-a46a-37d3052ceeed", "comment": "Malware payload (Mirai)", "value": "0be6f18f5debc6b1ac57f330db5ad67d037bf0ffe4c4442604ff4ea25dc331a2721c9ea982e019335814748459e6d689", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819216, "uuid": "992bb04b-5eeb-4fff-a7a0-12f679dc49fa", "value": "T12A930A45B9819F12D4D621BAFBAE418933136FB8E3FE7111D920AF5023C69DB0E77612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819216, "uuid": "b0ae416f-0e55-4133-b42e-71b2f35ae687", "value": "1536:5TnuF1UvUXZiKyoFYpra1j3/pMfbhxf9lK/igCgBO797ZVYHyLs/x1HUL:wGvUh9FYpra1j3/pMfqxCgBO797PZu1O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819216, "uuid": "4e7c1bb1-d6e8-464a-ae31-7482b0296bea", "value": 97560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819216, "uuid": "7fc3ddb1-09b4-477e-a7ff-280d5be7800d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819216, "uuid": "6a18c7e8-1685-41df-94e5-071fb2bf9a59", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24be2bea-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772810057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810057, "uuid": "2ece716d-c1b8-4ae9-9511-958134e938a6", "comment": "Malware payload (Formbook)", "value": "4262eff5ecb4bf09150576b46bcf002f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810057, "uuid": "04d217af-1377-4bed-a017-401227bfe8a3", "comment": "Malware payload (Formbook)", "value": "8d4eceaa33aea3e283d479921a7b6e79a97258f0017b79fd5d05e079d446571c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810057, "uuid": "be44bc73-8686-4394-ad14-96816196c804", "comment": "Malware payload (Formbook)", "value": "387efcbbbb0a20ea626e2142263f67855cca9851", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810057, "uuid": "36eb61a5-d2f4-47a8-9203-e79b9107d7b3", "comment": "Malware payload (Formbook)", "value": "7c4060b2f3fa0f73126bc7393a378b30c21929600616b518b84047ee945f54c6e2f3922df31faef2b8baf1d634eda8d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810057, "uuid": "e3efa21b-c45c-41dd-9f51-12d82055d615", "value": "T14745CF027381D062FFAB92734B5AF6115BBC79260123E62F13581DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810057, "uuid": "b97f2b8a-219b-4be4-8729-4dd32c337fc3", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810057, "uuid": "19e75399-2254-4f66-a46e-6037aa385f8d", "value": "24576:Z5EmXFtKaL4/oFe5T9yyXYfP1ijXdax/85bYGRuN8y0i7crEGPedoU:ZPVt/LZeJbInQRax0lNRu8y/wr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810057, "uuid": "f4a996aa-55ab-4e03-8db3-77c6169a7822", "value": 1266688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810057, "uuid": "b92873b9-4ffa-4ba0-8d44-0eff5742623d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810057, "uuid": "21e5f1ed-e977-4e42-8acc-a80274971934", "value": "8d4eceaa33aea3e283d479921a7b6e79a97258f0017b79fd5d05e079d446571c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81381858-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1772810212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810212, "uuid": "94c74c1f-9eb8-47ca-b459-0b51d150cee3", "comment": "Malware payload (LummaStealer)", "value": "569a206d498a0bbcd3abb1c546e60e32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810212, "uuid": "9a0965c2-8ef0-4d4f-b62b-fbbc7a5d5e4f", "comment": "Malware payload (LummaStealer)", "value": "8d54680fb23876f74748a75efc73c624864bf826e5656b3f3aefc5dc105fc8d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810212, "uuid": "31a9f34d-ebdb-45a7-aacf-aec2e8c98bfb", "comment": "Malware payload (LummaStealer)", "value": "a51f21b47def76e028d44b50646d662d69536036", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810212, "uuid": "26d2a499-e464-4cc2-b6fd-4769608f384f", "comment": "Malware payload (LummaStealer)", "value": "781a1bd0d084f057518f997c3c5fc6feb5550951044d89e1b889f7e15e8ae755f6290474d4d351f16d10e412f9623e14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810212, "uuid": "dc7ff829-3027-4783-8563-4aa5d44802f6", "value": "T194D5110156D94AA1F2AA42B689BE96371B797CD49FE4C28F32C8363F0C705854F7532B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810212, "uuid": "92c5177f-2ab3-4ad0-806d-3e6562bc4748", "value": "49152:w5qAsSm6H9BWT/U4ia3dvIxr7O0bnfdPxBsw8MKpZPY6om67pwwH+h:Ka6H9BWrn33dgx3nfRxBVWQ6s71H+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810212, "uuid": "78512327-949e-4c17-9550-e2ba2ae9bb2e", "value": 2889728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810212, "uuid": "41c0b616-dda3-425a-8758-bc86a00556f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810212, "uuid": "2cfeaa92-7627-4a7a-a93b-a69189f6fded", "value": "8d54680fb23876f74748a75efc73c624864bf826e5656b3f3aefc5dc105fc8d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee2882d7-1972-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811683, "uuid": "58c0379b-47f9-437e-b1bc-536be7ace602", "comment": "Malware payload", "value": "4c588534abee22f3480556119d1a4e6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811683, "uuid": "834ebbe9-fddd-48a1-8f2c-2cced8431b2a", "comment": "Malware payload", "value": "8d7a02a1ba95b2695ea3890a8012548d9e6813c9c433c1bcd023bf3f1e73ad9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811683, "uuid": "7f6cc062-9a45-46b7-91e7-2fa7144552a0", "comment": "Malware payload", "value": "b367dac9e1ce1f182761c5c8da44745f8f9c1968", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811683, "uuid": "9c535821-8a0c-4530-bc03-e375f4f23d7b", "comment": "Malware payload", "value": "ad8d21d3da46c0927c937b2005ff317678022f28c2688f802e83db7b4c0818ba645fff6c282a7365dcaadfce6ef5a5cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811683, "uuid": "47c4e2d8-15ce-4e7d-8636-5e1a8d123514", "value": "T15B94C412EA50B825F49349B02D79A256782D2D363681DD0BF78D9F4A3671B83B0F532F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811683, "uuid": "0aa385d1-b8ac-4313-aa57-d680654c7a54", "value": "50448f3cd38618db54f6ffa11eaf5f3b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811683, "uuid": "4a8de7cc-961d-4f3e-b7e1-f6fc7069fa91", "value": "12288:LRGOj+hppmv1VmPPQtcHK7QDtnTeCPERXb7GySMYvLOd3t569:AbPP+7Anx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811683, "uuid": "d7934e0a-4a60-4a2e-ac37-b640ab9a149c", "value": 430080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811683, "uuid": "6731f4b2-53e0-4243-8a94-db2ceb5362d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811683, "uuid": "e9f6ac4e-7032-49de-86de-b9200a3b3fba", "value": "8d7a02a1ba95b2695ea3890a8012548d9e6813c9c433c1bcd023bf3f1e73ad9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "038080c4-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772811290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811290, "uuid": "1518fad0-1ebe-4850-b57a-3abe3a315712", "comment": "Malware payload (Formbook)", "value": "47705bcebd467eba998a337efe320770", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811290, "uuid": "922ed8a4-0bb4-4bd1-b802-74a2b0c674ec", "comment": "Malware payload (Formbook)", "value": "8ddf24152eb78df606522c0a2080bffe9b09b2fffe21ab4ce9bc4cdbf467a992", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811290, "uuid": "6126655f-44e3-47b5-a7ac-970b716e61be", "comment": "Malware payload (Formbook)", "value": "55bd14b16dfdfaa1a855218b523d661dd64e57b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811290, "uuid": "781f33b9-f50e-40e0-aac0-5fe8b0fb29aa", "comment": "Malware payload (Formbook)", "value": "e8d1160d3a8fa9e9bffbe64487311366f4ac3b66718e8588ddf1ae7c66508d42052dc6f93d506f71124e36c4bb24d2d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811290, "uuid": "19f9c91e-4fb3-4cb3-bf14-bcd0f06bb289", "value": "T17045CF0273D1C062FFAB92334B5AF6115BBC79260123E61F13981D7ABA705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811290, "uuid": "39e0bb84-a0f4-4285-9797-c3977d144c61", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811290, "uuid": "47476924-ec14-4bad-bd57-2fe90f0bab49", "value": "24576:R5EmXFtKaL4/oFe5T9yyXYfP1ijXdaofutV2f8er1digh8:RPVt/LZeJbInQRaotPxY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811290, "uuid": "f1a8cab2-7a5c-4691-b5fa-1ed0c7bc2c73", "value": 1279488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811290, "uuid": "9e3a8164-2cd2-48f2-8ecc-9bd3a4a5eb35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811290, "uuid": "a1248d14-2547-4a47-a91d-9d3a9e0c0a14", "value": "8ddf24152eb78df606522c0a2080bffe9b09b2fffe21ab4ce9bc4cdbf467a992", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25186a6f-18f0-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1772755511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772755511, "uuid": "57325414-a942-480a-b924-7d72736bfc4d", "comment": "Malware payload (Stealc)", "value": "700a76feefc2738aab348a823a949753", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772755511, "uuid": "2970ec50-52eb-42e0-a409-8f1f2118d482", "comment": "Malware payload (Stealc)", "value": "8e11b66836fc4afa3bf1c102f072857ffb3ec2faa227e2f94c48bcef1f20cb19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772755511, "uuid": "b737f0c6-5d59-4bd6-9565-e84669f3dffd", "comment": "Malware payload (Stealc)", "value": "d49ca4cb2b5eab8c518aef8a171331f9d299259f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772755511, "uuid": "7444eea1-648e-4697-9805-1b91b68c6049", "comment": "Malware payload (Stealc)", "value": "656313e1953aeba06646672e6a509d5988a33ce6dde5f2df36eeee13d4934f9914c88b85e80840602e6b240e171d36ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772755511, "uuid": "c4002488-6e88-4730-a0f2-fa81fbc98485", "value": "T133547D1212E468B5E12207365E3FC7F53E5AF9614D357E5D298BBE7F09380E2C129B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772755511, "uuid": "9793b972-cb58-4f6e-af8a-c5c66a7dde9b", "value": "bcad5afb62b59a3de8dc0f219fbb01fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772755511, "uuid": "07fe0916-8bb4-4122-96a9-ae1fa9385ba9", "value": "6144:Qeh/H+Zhyu8Jfc080/OmUMo4gW2UhgSWtAg+:Vh/ahy80WmUMo4xlhgFtAg+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772755511, "uuid": "5c72485e-34aa-4299-8aca-de7df6afceac", "value": 298360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772755511, "uuid": "1b3baa2a-5473-43f2-9729-dc9d2e22bb94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772755511, "uuid": "238788ab-1ca9-431a-9d69-40d73e6c4180", "value": "x8e11b66836fc4afa3bf1c102f072857ffb3ec2faa227.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c00961a1-1969-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807740, "uuid": "9dba1c9d-6006-4761-9a66-9ff638c83153", "comment": "Malware payload", "value": "8800576725cc5cdd11d25dd3b600a3ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807740, "uuid": "537a22d3-c848-4e4a-b0fd-3c04784d45c4", "comment": "Malware payload", "value": "8e59795e6d8d2f4dc5f0b7911b5969f225c8886e374a35d1d9ff04d24f552fd4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807740, "uuid": "70fd4596-2d4c-41ac-8a02-2e4fa3f35b56", "comment": "Malware payload", "value": "3893e43662c503535eb6bb36d485646433c46b73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807740, "uuid": "f1ba88ff-3022-4820-a76f-8a78cc8589c7", "comment": "Malware payload", "value": "073d19d3972a0796250872a6d8bd11b15338bdd2e9a8c45e649542a47dd5944db89d94111c753c0027f4aa6c7c2526ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807740, "uuid": "d4c228f6-5140-476a-93b0-c6e3f49bc22f", "value": "T10EF4230529A0C05FD77251B0ACF087FA2AEA7E5309928E4B739B7F5CB124790921F767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807740, "uuid": "85971269-5429-4c57-83e8-435a2179a2fd", "value": "24f4223e271413c25abad52fd456a9bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807740, "uuid": "55622581-702c-422c-b050-1137f92157d9", "value": "12288:RDHb0vUa4vG2TZHl0brdPEWuBhDoIB0ImkZZzY7PYgbLTQyXZ5nnMaU:RDHYvUa4v9+1EWuclImIzKY2LTPZ5nML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807740, "uuid": "630517e6-9d8c-4721-9d27-bb960f606c38", "value": 738672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807740, "uuid": "0615ee19-18a2-4af7-b47b-c7d135c875cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807740, "uuid": "99133b73-76a1-4cc4-a2ef-e7d9e9af9fd5", "value": "8e59795e6d8d2f4dc5f0b7911b5969f225c8886e374a35d1d9ff04d24f552fd4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46bf1155-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1772811402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811402, "uuid": "ae02f62f-3059-4ada-8d3c-967bfbf6a751", "comment": "Malware payload (ScarfaceStealer)", "value": "7b3a1c044988d30719204f60c325617b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811402, "uuid": "6f540134-5537-41e5-ba23-5e45cd13a144", "comment": "Malware payload (ScarfaceStealer)", "value": "8eecc9f79b03b29a6853441a08fd6ac28b77a509aa2ffe3b10174328cd9e7068", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811402, "uuid": "1221e72b-2800-473b-874d-e8fd3e9be13e", "comment": "Malware payload (ScarfaceStealer)", "value": "60a1dbfa7be60508aafce69e6cedaea6fdc67e44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811402, "uuid": "bed08b12-4fba-4796-b15f-e07f5ad4b23f", "comment": "Malware payload (ScarfaceStealer)", "value": "94c6da37c63e36d06a180529a877f288a6ad89e564d3889acd6d96c665fffa75861dfcb967bf38bbf2a0f961b7513977", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811402, "uuid": "3a66d47f-9519-43d1-85f7-ad6d3fab6e22", "value": "T1EBF7594262EA04C4F9F7DA359AE65217D673BC166F3081CF325C172A1F736E08976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811402, "uuid": "dd3ee050-5127-4dd5-b1e1-d9cb10a036d2", "value": "772ec87d3452991a9933a3ba0d9963a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811402, "uuid": "42fc31aa-b579-4785-b17f-6a0818dd6283", "value": "393216:5n1XQgPR2k3m5C507G9ITEc5eAlkLbQurxMWhAsIyNOPS0B4AycWsCYaxFzwW/ts:51XR7AsxYqt2oRGj5rs3wb8/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811402, "uuid": "884e9cd6-515c-4061-bccc-5fd7e6b49b94", "value": 71438848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811402, "uuid": "c5646a98-a30b-4e32-ae78-052d2e2471a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811402, "uuid": "57086873-16e3-4e53-b277-bcd938c2097e", "value": "8eecc9f79b03b29a6853441a08fd6ac28b77a509aa2ffe3b10174328cd9e7068", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30d0a0ec-1974-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772812225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812225, "uuid": "969a8335-441b-4e0b-9d16-c31c69ce6898", "comment": "Malware payload (Mirai)", "value": "6a107fdd75fcb5e4365483faae006c47", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812225, "uuid": "1976674d-6eba-4153-9508-2d54a03f1aa6", "comment": "Malware payload (Mirai)", "value": "8ef30ae2c8ab8c2f8d1e3a91f15cfed373d499e15902f1e2634cb3aba1d363fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812225, "uuid": "6c61d4ef-20c9-4dbf-8c06-98b298c24bae", "comment": "Malware payload (Mirai)", "value": "9f00f2d57cfb40f9e371a87aefca5cf64de1e198", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812225, "uuid": "5ecf2cbe-cf31-4afc-a8e4-b899781ea410", "comment": "Malware payload (Mirai)", "value": "2f16fc57d60dd2ad1ee54c9964e9dd47ca37737548b606634be593d26f2e551057673362bfc14b4c7e62d3f8ca8bbde6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812225, "uuid": "b5a5676e-2229-4b37-b332-59b8467ee387", "value": "T16014841E6A128F7DF6A8873047B74E20AB6D23D617E1D684E1ACC5105F6039E641FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812225, "uuid": "01592f7e-3468-457e-89bd-dd012f7aada5", "value": "1536:lAgcoS1qrywSAbwPqf+yDbPa61bNYKrnEaMzzMQ+RmdqHU+D7DsYOoHPancK43Nl:vcoSZiw+P62dUosqPL3NVeqNJx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772812225, "uuid": "7733d887-0681-4ca3-877a-692eaebe57c9", "value": 194276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772812225, "uuid": "38ceca1f-3735-4f90-98f2-e4e0ea69f934", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812225, "uuid": "225e31e3-7220-4e1a-9577-bca66b763fdb", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "911885bd-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1772810668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810668, "uuid": "8e53bec6-eb88-4fe7-991d-5fbb36bc19c9", "comment": "Malware payload (SnakeKeylogger)", "value": "8eca7856f7d2381898fcbf8bf0098994", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810668, "uuid": "3d37fd90-cccc-4ad3-b837-cd32fa353eac", "comment": "Malware payload (SnakeKeylogger)", "value": "907ef6a8894cb48e4c809ac5616237b59593bbdd104e7fec32e4599c0db45505", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810668, "uuid": "3227431a-1dc7-463c-94d4-3c6bc573f6a3", "comment": "Malware payload (SnakeKeylogger)", "value": "d0a46b9d4b89091a7bf3fce004e6121caf3c68aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810668, "uuid": "1e2b9f00-597b-4d65-ab57-f639211e59dc", "comment": "Malware payload (SnakeKeylogger)", "value": "7d71dac2ca7bf859143c2859f4485eb82acf696dacc0a24c4ad5949ef7a8b5b55d6314d3363bc89b8cc794d8f0d4eb67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810668, "uuid": "ae88848d-60a2-4cfb-8203-5c7c37ffef71", "value": "T17AD4239249C0AE54C5546370C432CC6086783A709E25767AC32EE6AF7C713C7AEA7B5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810668, "uuid": "5e4036b8-906d-4123-b473-4227226ee100", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810668, "uuid": "14e1596c-f80f-4d68-8ceb-d673af7c8ae9", "value": "12288:Vz7hU5I5yuNHIgzSFKxWltRohBfSTso93Uz0LK1d51FYllLUg:Vf+iN57Gtene3xlKg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810668, "uuid": "22d89036-0d24-4504-995d-e3a4b33c641f", "value": 611840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810668, "uuid": "3d0b488b-85d8-424a-bb40-bab28128bc2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810668, "uuid": "35f8e2c0-5c86-4699-bd35-a03723e0d6a8", "value": "907ef6a8894cb48e4c809ac5616237b59593bbdd104e7fec32e4599c0db45505", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9716cfb-196a-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772808186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808186, "uuid": "d071441a-5bdc-44ef-abd2-9dc96634908a", "comment": "Malware payload (Formbook)", "value": "4aa57aa8fa0325887f9a5eb4f133d949", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808186, "uuid": "2117c973-6733-43ac-84f6-6f12cc51a51e", "comment": "Malware payload (Formbook)", "value": "908de3fb0e63cedadeccd5db42063e2b84ce91dbaa3935e17b37affd8018fd5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808186, "uuid": "b6fded29-5d2e-49c6-a52f-7f3140be5f15", "comment": "Malware payload (Formbook)", "value": "220efb9d6c2ff2f5b7e646d2cba46b0060735a94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808186, "uuid": "b047c4bc-8334-4fc6-b1b4-99b7fb444b74", "comment": "Malware payload (Formbook)", "value": "ec0221727c23d6f9444abcace7348013e5aaaf60d8fcea7b618093e2e2181f7312be80fd7aaadd0956c453fae242e928", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808186, "uuid": "f15cf722-8593-49a6-a564-0e2c1c661f92", "value": "T16C35122062AFCE22C2A51BB784E2E63053B18F49E053D247AEDD6DE77947BCB4941347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808186, "uuid": "31bb547e-3a79-4368-86bf-583b9d09e22b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808186, "uuid": "fb1f87d5-52b3-40da-ba28-d5e3ad6e52a3", "value": "24576:FplguQT9YOp5ob5ZwKwY7yFbzaH0+j6/4IwPHa1X17hVict:F4uO9p+NZwK/7y9mHRmQBm1NQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808186, "uuid": "492c0e1f-2b82-4ee7-9546-d05d952eb815", "value": 1091072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808186, "uuid": "aa264b92-0110-4fd7-a7af-e9c0acdc0394", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808186, "uuid": "2debab21-b6c1-47dd-b17c-14d1d0a3849a", "value": "908de3fb0e63cedadeccd5db42063e2b84ce91dbaa3935e17b37affd8018fd5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8982ecc-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1772811620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811620, "uuid": "6ce31511-bbce-4bc0-a510-de93b9534bff", "comment": "Malware payload (a310Logger)", "value": "7079cd9f21e84b423b8ca0a204d13f9e", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811620, "uuid": "1cb54ec7-ef52-4889-8c85-b7422a8cf010", "comment": "Malware payload (a310Logger)", "value": "90a3ef988d6a911ad74db85cc4a68bf8365bd1f6272bd758210728d1b4eda493", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811620, "uuid": "dab555ed-f164-4439-9f60-214625d1569d", "comment": "Malware payload (a310Logger)", "value": "46e19d4991f4c2cf41875e027adb059fa46fd371", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811620, "uuid": "a517dc8a-ae1c-4fc5-beff-3c202345a66b", "comment": "Malware payload (a310Logger)", "value": "61db73f5933f43c6774a83c00eb661a885c4126d2506bd067e3b21e3720e3cd5cca8d602a4d3dd67027197c523b64399", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811620, "uuid": "1601a47b-dde8-4381-8204-acc392b5ab34", "value": "T1BA35D0061EC32B94D1984F7CD2A610A823F0D65B5252E77F2FDD12F0DEA7F4ADA06462", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811620, "uuid": "63d845e7-3384-4905-b6ee-d0964e86ec4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811620, "uuid": "9a7a5b7c-6775-41d9-b02e-5078b7dca442", "value": "12288:DJjV+VJLiokGOuXJxNB3+MLi6qvL5vknNUKMCM990+lLUfOOuhhKtkCP21KObApf:D7oNOYwMWVkMXs+lIf0hQtde1KObEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811620, "uuid": "c71c6cde-0d32-4d00-ad4b-0b942fd25110", "value": 1155584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811620, "uuid": "717460b9-ffcf-4d34-a474-266427b8db2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811620, "uuid": "384b2795-2c04-4490-b9b0-96bd99261891", "value": "90a3ef988d6a911ad74db85cc4a68bf8365bd1f6272bd758210728d1b4eda493", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fe01903-1974-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772812196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812196, "uuid": "406822ac-16d6-4024-a1fa-e29c64ab0f33", "comment": "Malware payload (Mirai)", "value": "44c4dc4c89ce5f267e1b6f10493653b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812196, "uuid": "c1409983-b15b-4c44-b5de-0b3f3de0fd72", "comment": "Malware payload (Mirai)", "value": "90f05f640c1188739e8a0e8ba0d99b8ca8170cad625d860c794853c7f8ba278f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812196, "uuid": "6ef3b769-7a62-440a-ae2c-d401a77455ba", "comment": "Malware payload (Mirai)", "value": "9039116d15819ef4dba9f16054b85b1b11c8a8ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812196, "uuid": "521a5856-ce70-4673-bbf7-a27b271ebf1c", "comment": "Malware payload (Mirai)", "value": "f0c83aec3e655ba8ada6cbddcfa1c8802d8669830838ca7437fbd89460d94d5b5c9ec8bc6fe024d9083126274df6f15c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812196, "uuid": "01e9a42d-f647-4bc2-b47f-51ca677fda09", "value": "T150933B5AF880DB16C6E5267AFB9E118C332207A8C1CE7106DD149F3577EBD5A0B7B602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812196, "uuid": "198e40ef-9611-454f-9e58-c0c472295a87", "value": "1536:U4J3XaYGxA5tUZFcWVE4blFlycjJMDcOvnaWceSdq4RgO03KiZDXVbmN+Hq7Yw8m:UQXxMpE4pFlycjJMDDaWZzM03KiN9mIm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772812196, "uuid": "f9909f59-eed8-453b-b014-efa9e445d414", "value": 91436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772812196, "uuid": "136a7c7c-1794-49f8-96d3-e2a28c2abb0a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812196, "uuid": "127aa72a-2560-4cc1-a19a-a214f6c27323", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd395c04-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772809883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809883, "uuid": "938ed66e-5939-490d-8208-789638aa1cd3", "comment": "Malware payload (Formbook)", "value": "a28bba168bbe49059bac3f1c4d823005", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809883, "uuid": "b3cdb924-2c9b-48bb-b3ef-68348bc45214", "comment": "Malware payload (Formbook)", "value": "90f194a38a34ee6212b02d0ac457911d2e9ca72c7940f36d434e259874e2bb2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809883, "uuid": "5e80ea4d-ac0a-4e23-83cc-7a6ca0ccf4b7", "comment": "Malware payload (Formbook)", "value": "16bd75b9e93e4f5f165e18f7b2f59d43d0197990", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809883, "uuid": "f213a282-4187-431e-9dd2-d9a561507357", "comment": "Malware payload (Formbook)", "value": "c6d00dfbbd0680d18c8614dde7e38b82d2a4f398f738505ff32701c7353c690d2c6d4816689327e0016f493129ae597f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809883, "uuid": "b79b30d1-868e-4731-98da-b6e016f20979", "value": "T19B45BF0273D1D062FFAB92334B5AF6115BBC79260123A62F13981D7ABD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809883, "uuid": "2d5aed22-d22b-4ce4-87c6-ec5e3de8dba8", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809883, "uuid": "08793f66-b3b2-4935-adf7-d16aa281e409", "value": "24576:y5EmXFtKaL4/oFe5T9yyXYfP1ijXdasmd2rTbHA0zylzl:yPVt/LZeJbInQRasu4TbgH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809883, "uuid": "a0e5e389-edfa-4390-9ea2-ca19ac5839ee", "value": 1261056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809883, "uuid": "9dbc1235-a96e-4af1-89ed-f61463806619", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809883, "uuid": "673ebd71-710e-42bf-8278-f1f2f0184a99", "value": "90f194a38a34ee6212b02d0ac457911d2e9ca72c7940f36d434e259874e2bb2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc6f43e-1905-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772764678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764678, "uuid": "0411cde7-5c66-4f30-b86d-6519dbbf6776", "comment": "Malware payload (Mirai)", "value": "8718f0e2483c058db8330e588e9a1605", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764678, "uuid": "20c000f6-f6d2-4cf6-9ed0-6031ae4c867d", "comment": "Malware payload (Mirai)", "value": "91621d0c2c33c6108dc9c6b49cd081a5bf3f6c50f3f75dbb6be80c7332f2accf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764678, "uuid": "e7d41603-5799-4e78-a699-4b487e43a21b", "comment": "Malware payload (Mirai)", "value": "b7f2927bf7966b255b7f9eb4071b2f15b20fc31c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764678, "uuid": "d12ce3b7-2ccc-4411-9a94-82e53dc12715", "comment": "Malware payload (Mirai)", "value": "822661409e22847ff33fe165f840ca452fed6d32a7ef69a46e70fd138c2db2f94c150e825bf4dd0c71a554f45b4d0607", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772764678, "uuid": "2482aed9-4f0d-452d-a818-7d4dc579e07b", "value": "T1D2C39E32D8396DC4C1945434F8B1EE711FA2A5C441A25EBB1AE5C97900C7DA8FA0EFF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772764678, "uuid": "82c0eb23-8e52-4e93-9dc5-974853189516", "value": "1536:iaZwsA5XjVZJK0twtfXd/GW25UhMMJNu5xWKQk0kaXN7Y+UKigHcYSQwKprlzwwD:if5Z5Z98XdmVMJa5aX7biySQHrMwES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772764678, "uuid": "e2c469a8-8623-4acf-a9fe-2b61699583d0", "value": 120332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772764678, "uuid": "5bc73028-4563-4909-af5f-de87aa9a0d99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772764678, "uuid": "31a2d23c-14ca-48b1-9c70-08b24a45a882", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c7a2ebf-1974-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772812190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812190, "uuid": "e5139461-9e7e-48c6-8088-16bb990acdfb", "comment": "Malware payload (Mirai)", "value": "0ccb9913a51bfe9ed7a22719dbb7a99f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812190, "uuid": "87092117-6640-46d6-981f-8f62aaaada79", "comment": "Malware payload (Mirai)", "value": "91aace515ca82254eecca8056a4c4c57b7f72c0d0ba7df4d7c6adcbdb994bdb3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812190, "uuid": "a07a441b-5b7c-4050-9e83-886ad49a7703", "comment": "Malware payload (Mirai)", "value": "6195762fab2e7c8f999c54a8f2a3ff6fd00386c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812190, "uuid": "1c0a88b6-f5a9-465c-ab62-7a4ae8f5632b", "comment": "Malware payload (Mirai)", "value": "814b0e16f9ab9bdd40166440f1d26e2c1e78a7ee67560b68b78f1e1d7205c8987324388bd97a1c5cfeaa7eb7ff72c66c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812190, "uuid": "4d403015-5523-437d-a702-40118bc79f7b", "value": "T113F3186277B60A27C1E4A57AB1F75333B2B947C914ACC60B3FA11D8D6FA46503113BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812190, "uuid": "fd7b2769-1fb7-4ae2-be5a-cc366c57a792", "value": "1536:jwoKXQtmrw8ZYYRD6NZ/NbQsgHjuVVQWeT6p2Q7cRwfw+HSRsytaJte3+Iq2hfn0:jFwPB6NZhhcWLgSfhyN3+bRz5YZ7i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772812190, "uuid": "a6bb5a5a-9970-410b-a4a7-602b7c4ae7d4", "value": 158892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772812190, "uuid": "1c22938a-0d93-448e-ac9d-ae3a6df4b283", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812190, "uuid": "6278e479-1df1-4c23-babd-b4676f520bae", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c3a80a9-1966-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772806311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806311, "uuid": "3ca1dfb7-394c-4856-92d4-ec1b4ef8f4e5", "comment": "Malware payload", "value": "8bc0d482df214d7c0a791fae220bf3da", "object_relation": "md5", "Tag": [ { "name": "172-94-9-250", "colour": "#CFC547", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806311, "uuid": "8afbb141-525f-4f2d-9abf-e3c73a48b5e9", "comment": "Malware payload", "value": "91bd5c7ce5da1747e2983a8addb4ffe8c015cc1d80f904a76c861e487e3c64fc", "object_relation": "sha256", "Tag": [ { "name": "172-94-9-250", "colour": "#CFC547", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806311, "uuid": "0448bb47-da42-42db-83eb-c3846cdbb73b", "comment": "Malware payload", "value": "b927110b5a1d67d59f1604f385890e663d0a2c6b", "object_relation": "sha1", "Tag": [ { "name": "172-94-9-250", "colour": "#CFC547", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806311, "uuid": "23a766b4-aabe-4cb3-8c07-8bac918fce73", "comment": "Malware payload", "value": "f2eb8799821eb216b0060b6c76651aeed8e845a7a5800ad278d354fd40b1e0d585009233ed14be3cb838d13114988605", "object_relation": "sha3-384", "Tag": [ { "name": "172-94-9-250", "colour": "#CFC547", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806311, "uuid": "3d90d42e-0331-48d3-953c-f94b13ebfda3", "value": "T1BAF19E11954C9318FB6BAF389112F7E752882921261A0A31F90C09EA2968FC4CF9778E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806311, "uuid": "c8135624-9b5f-4e02-b69f-dc52741ef634", "value": "192:RM3cnvZJBPv1WcP2UkrwbpyhLK1+KuSpU9W5:R8ij9v4Typy2CA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772806311, "uuid": "abaaa7a8-81ea-4cf0-8f55-5977bc6e8da6", "value": 7626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772806311, "uuid": "0ce0a787-fb28-4822-843e-bf1e952b67e6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806311, "uuid": "5c878345-3b72-4b7f-8191-f2802c7fb42c", "value": "xxx89413.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73d701e1-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819209, "uuid": "9ea1b41e-df65-4185-bebb-88c1dee0c54c", "comment": "Malware payload (Mirai)", "value": "5afcef057fe3b5fb199ffbed2ea25bef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819209, "uuid": "aaf44f43-162b-49f0-8913-c0648299a0ee", "comment": "Malware payload (Mirai)", "value": "91d59508c12a508cefe48a058ae04dc666f9444ca2369f5c5e6d5bc0ac22c514", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819209, "uuid": "e24e23cd-266c-4ebe-baeb-0103e570af4d", "comment": "Malware payload (Mirai)", "value": "60313c07713570c2111035cd7e362984e53d42c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819209, "uuid": "afa83747-2cf9-43de-875e-e2ee2c5df865", "comment": "Malware payload (Mirai)", "value": "1216e3da141699bfce454339a99251bd78c5fe90690c1085ed3f16ce4e43a04fc0f00d3e5070ef3d185ba75392793e75", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819209, "uuid": "abb2283e-3dbd-40c8-a5a9-2dec0f56496d", "value": "T161737DC7E743EEF6ED720031802BE7365272DA791024D68BD7B499369C26904F61B7AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819209, "uuid": "6bd9b81a-ee2e-4d80-afc2-763c989d4f1f", "value": "1536:AtvDnFJFKUKluQuGoS4a7yUSHWaJbunandHQILVHLgcUWeduy:kvDnBOluQkSly/jbgqikPNy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819209, "uuid": "9c1d2133-80df-42f3-b006-2978f9b719b8", "value": 78952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819209, "uuid": "f9b43561-c391-4824-ba26-44f8c19ddc7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819209, "uuid": "4faf0e54-68dc-46d3-bfc4-9b756bc1aecc", "value": "violetx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4464b27b-1985-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1772819559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819559, "uuid": "db932800-1cf8-411e-803a-8ca5f51dfc1e", "comment": "Malware payload (Stealc)", "value": "25ad1f920a80c66ee9678c55a9b1352c", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "80-97-160-190", "colour": "#FFCA15", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-4784", "colour": "#283905", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819559, "uuid": "bbe80029-8119-4f50-8f9e-0c5c2f0669a9", "comment": "Malware payload (Stealc)", "value": "91f9fda387f046c07b068c5bd16445f8d524ce6f4fc066e4d4899776eec2b510", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "80-97-160-190", "colour": "#FFCA15", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-4784", "colour": "#283905", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819559, "uuid": "7dc7eff3-3c1c-43e8-8726-ef8f1779085c", "comment": "Malware payload (Stealc)", "value": "f04bd65ed7cea4b0ae3f8d6057c8c1bd7c71e111", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "80-97-160-190", "colour": "#FFCA15", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-4784", "colour": "#283905", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819559, "uuid": "e0a16855-eb78-4a32-a29f-2223ac8509b3", "comment": "Malware payload (Stealc)", "value": "092ce7b388bab58a608537f04bac9c2becbb6d39faf30171bcbbc43058da4197947a6e856103bbde5888bf8872773756", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "80-97-160-190", "colour": "#FFCA15", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-4784", "colour": "#283905", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819559, "uuid": "d2176613-438a-4aca-ba44-e9252d3bfd9b", "value": "T1960633FE90876A457D458C2A5B3F6FAAE4332135EDED1B9736080B988250F26C87CF15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819559, "uuid": "753f5ae2-0814-4996-8b6a-494f69f13b67", "value": "98304:hZVRGHFN+XoH4VhpctOcKzBehHYaZRW4lOkR:fU8Xlzv1cHlW4sY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819559, "uuid": "4f72ce4f-d47e-46a4-9c2d-9d45b8eebaac", "value": 3732995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819559, "uuid": "1ae3aabe-38c9-4b76-8e6a-b79d2060b6bd", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819559, "uuid": "f313e597-912f-4e0d-a1b1-9906f9e9c59d", "value": "downloadsetup.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0281351b-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1772810429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810429, "uuid": "26ffc753-1a72-4827-bc74-00e2a56400f2", "comment": "Malware payload (Amadey)", "value": "e6da679301430c87a3d3187fa9f5b578", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810429, "uuid": "6e75ccec-3598-4d08-8887-964971dec4f7", "comment": "Malware payload (Amadey)", "value": "91fe640881d22c7dd821cdc76aa92e21766bdf05fb227bd55177acf9c5b87114", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810429, "uuid": "aa5e26ee-991b-4e94-9ed9-563f09ff835c", "comment": "Malware payload (Amadey)", "value": "87f9ced79cb77f0d265ffe59ee293142ab91dd16", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810429, "uuid": "77813bf2-7aad-4c4e-bd06-2123a5c2135d", "comment": "Malware payload (Amadey)", "value": "b1c154382c971dd5e6b3229eaf233ff080eba2e0a9c86f88c2373158a25e69012f197abc19837e4306b7c47900abfac3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810429, "uuid": "739643d7-481b-4b9d-ae49-ccb48a35a3ca", "value": "T109945B217916C032D66292711F79FFF185ADB8259F7109DB7BC00F769A202E26A31F39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810429, "uuid": "3c7787a5-b8f5-4351-97ad-9a7bba2cf4d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810429, "uuid": "f5100ed9-348c-4997-9c4b-a895030e103f", "value": "12288:oJHF0VKkWrb4QDwR4QWdyzsAlWZBR8qM:C346JuWHen", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810429, "uuid": "fdbf4b04-bf94-4fd8-9f81-e06abc6989f2", "value": 443392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810429, "uuid": "d120ed00-0d63-438b-82dc-f5cccb444cc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810429, "uuid": "2d787ac5-520c-40fd-b1ef-53c56b1448fc", "value": "91fe640881d22c7dd821cdc76aa92e21766bdf05fb227bd55177acf9c5b87114", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc1f2963-1954-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772798714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798714, "uuid": "70ea9d96-afdd-47eb-ab9d-76a4d618257e", "comment": "Malware payload (Vidar)", "value": "d1e897e45e42f293036f8ca251dfbd6b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798714, "uuid": "726decb3-b293-4be0-8786-d8ef2cc8b585", "comment": "Malware payload (Vidar)", "value": "928b819cbc327ba9d52090b4961d6194e5d3683152ea9ce947d734c5497bec52", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798714, "uuid": "b13f8c38-3606-463e-9b41-a61e7f82ece5", "comment": "Malware payload (Vidar)", "value": "97384e4a6d0759df5e9d85e0d864da1147924d45", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798714, "uuid": "51fde887-dbb3-4538-ae02-e8a1b8641341", "comment": "Malware payload (Vidar)", "value": "3bf0ba4707cbdb5e4082a314170efe8fb6c21cc6e9fbfe95b1aac1ac8060146c19b937fca05731a811a19b429bf62b0f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798714, "uuid": "1f1871c2-e5de-4de2-8757-aa8cccca77f4", "value": "T162242271BF0AA46DF5F0503905718282F617EC8F1FC0E61C2E552BB56B2E1950AE3A6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798714, "uuid": "c7ed322a-16f9-4629-92c9-6cef872a913e", "value": "ee53c10aff1d01eafea53328179e33a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798714, "uuid": "584e0ce3-b145-4ac8-8277-17b092af7aac", "value": "3072:o48mCtjMdioR5v95lv3gsuu9i04n0PfrheKBrdMp7baIbkK0B+KPjL8gzQ1GPh:dCxEigPlY/nOthdMUIoK0Bk0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772798714, "uuid": "f1fa7c8b-7740-4ad6-aa34-4845cc3b72b4", "value": 219648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772798714, "uuid": "b3031d48-e1ad-4967-9d7e-ecb834971635", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798714, "uuid": "1175c171-1463-44a2-ad07-6f37e80dce8b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7a8a906-194b-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772794949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794949, "uuid": "4480983f-65d6-46a4-b15f-a7e6a1225744", "comment": "Malware payload (NetSupport)", "value": "ba3e1aac95e5ced304071f2cc7e3b1f0", "object_relation": "md5", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "sonosuiteqr-net", "colour": "#5B0FC8", "exportable": true, "hide_tag": false }, { "name": "sonosuiteqt-com", "colour": "#50A2F3", "exportable": true, "hide_tag": false }, { "name": "tronantivirus-dev", "colour": "#ED7EA8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794949, "uuid": "cda3f9d1-b964-44a4-8cb1-138509a42688", "comment": "Malware payload (NetSupport)", "value": "931c3852833c88681d76de5013422fa20e192ff3d4e9561c893ff66aae276657", "object_relation": "sha256", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "sonosuiteqr-net", "colour": "#5B0FC8", "exportable": true, "hide_tag": false }, { "name": "sonosuiteqt-com", "colour": "#50A2F3", "exportable": true, "hide_tag": false }, { "name": "tronantivirus-dev", "colour": "#ED7EA8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794949, "uuid": "2a5c67d2-1cf7-4a78-bc77-6b991099c58a", "comment": "Malware payload (NetSupport)", "value": "fd0bd3f97042571f359e25ba1bdb73b3305244f0", "object_relation": "sha1", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "sonosuiteqr-net", "colour": "#5B0FC8", "exportable": true, "hide_tag": false }, { "name": "sonosuiteqt-com", "colour": "#50A2F3", "exportable": true, "hide_tag": false }, { "name": "tronantivirus-dev", "colour": "#ED7EA8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794949, "uuid": "f742b98f-1acf-4bc8-be6c-56f35c33aee2", "comment": "Malware payload (NetSupport)", "value": "8bdcdb8d99f2722ef0e6b9f51183bdcf6f40f050f101710684cd668586482018ac9dc830ab5942ad2f03bd7556014697", "object_relation": "sha3-384", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "sonosuiteqr-net", "colour": "#5B0FC8", "exportable": true, "hide_tag": false }, { "name": "sonosuiteqt-com", "colour": "#50A2F3", "exportable": true, "hide_tag": false }, { "name": "tronantivirus-dev", "colour": "#ED7EA8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772794949, "uuid": "341cca74-86dc-4cee-a21f-88ba064648d1", "value": "T1D6A5339A990D89DFC94B4F74C10B5E1AD33E3941F29E7081F6728252CC89B9F4BB8719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772794949, "uuid": "60ad262a-a723-4426-bbf7-754c12a4c635", "value": "49152:hbWKcquaFYrp7ZnuVnJTmm3F+WVcBdj3b2+3bw/0JBAThAnk1N96:hmquYSlu/VYj3b2+30/wBWV6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772794949, "uuid": "006e4baa-e93a-4567-bd06-9e8c9d2508c3", "value": 2214668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772794949, "uuid": "4cd391f6-57cb-4395-8dfb-d429b0c030bd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772794949, "uuid": "87f4d2e4-685c-484d-af62-1e046599ec56", "value": "ax.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5ab5adb-194d-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1772795778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795778, "uuid": "be3d095c-605c-4b2c-a88e-d9bce6e9af1f", "comment": "Malware payload (Efimer)", "value": "bcfecacdf8786ca32a905b0bc2c5c58a", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795778, "uuid": "5343274e-d987-4e51-bb7f-3620e8073686", "comment": "Malware payload (Efimer)", "value": "9388aca1d972b16549ebfe248087b870b00583f0d93f7483f1b53b3bb4e984bd", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795778, "uuid": "b8fb1de7-78a8-47cb-aeb2-4b3450c84481", "comment": "Malware payload (Efimer)", "value": "1db907a10c7130ac183f25e22482946de439c0e4", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795778, "uuid": "76179028-374c-4d3d-aae8-f08f997de6b3", "comment": "Malware payload (Efimer)", "value": "a88f28a298f8c6ff2e821604bcc04db5d5c2d61413f934a7e21637796af4831d2242c1a7f992d94890a14d561ae4fb63", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795778, "uuid": "3106ed60-9cd2-4bb8-9c94-518f6f4f74e6", "value": "T169D6331C95D762ACCAA2C13476E16BB4F4F5B4B81739CD5B5B6CD7B2BC030A0A69C10B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795778, "uuid": "214ce689-6e34-41e1-b246-e1ce5323bd8d", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795778, "uuid": "bb2ea230-0b86-4201-8924-49878511fa66", "value": "393216:l+jvPIN1mwZEADkaAqtGXMCHWUjXZcuI3/PGTAI:l+jnIn1S8AqwXMb8XuH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772795778, "uuid": "bb621a84-c27c-4516-8d55-b7a01ac9ce72", "value": 12622563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772795778, "uuid": "4131ab75-eadb-4345-a184-1f4c557f8415", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795778, "uuid": "0aef4c78-520c-427d-ac3c-86fe554e6ab6", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74127fa9-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811049, "uuid": "0ddab849-1d16-4260-9b88-0e080e4ea81d", "comment": "Malware payload", "value": "43094a7080475c6b027c3e4d787974c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811049, "uuid": "18d1b0cd-7d87-4a3b-ad6a-637f9c6313c8", "comment": "Malware payload", "value": "938a65fe31c9f0bd915fb266214492880f7ecbff2e541a2248660eb6d9a4bb9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811049, "uuid": "1b7f33fd-02d4-4c1c-8413-3085ea5fcde0", "comment": "Malware payload", "value": "facd3a12c9fd43b915a799df151d3a782c443b9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811049, "uuid": "a853dc13-3b2f-4ee1-8c7a-b2b87e9d1058", "comment": "Malware payload", "value": "2e7b3f96652963025e3c50c15ed3598dfbf1991f854c0d6ef29076634edd147314d4694d485336808c434aaa61d9e553", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811049, "uuid": "e2dcfdf2-6055-42f1-a778-b9c2757d049e", "value": "T167C4224255B4E513CA934EB263F75DEB7FB589022C3C5B066B01DF08BE23395A94E398", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811049, "uuid": "e90bce9f-18b0-439f-bb1f-2ab6e8c4904c", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811049, "uuid": "5d8de11e-2d5c-48a3-99c6-354d6f09c72e", "value": "12288:+1yDJXlu7DWcOHHGPoxMAM/SCM4pB1viw96Yvh7:+1yDJ4rPaMvMqB1B9R9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811049, "uuid": "fca979f1-3578-4d8b-823d-900c4cd1e19b", "value": 546968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811049, "uuid": "2ff478bc-75dc-4345-bdb3-2ae3b9a080bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811049, "uuid": "96ec5483-d1f6-43f3-9381-69a50cf618d9", "value": "938a65fe31c9f0bd915fb266214492880f7ecbff2e541a2248660eb6d9a4bb9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1fd8252-192d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772782028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782028, "uuid": "50c3b031-4aa3-4a89-b486-7bb8156c1057", "comment": "Malware payload", "value": "1539967d51c37e0b7664111df5cbf83b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782028, "uuid": "c8a504f0-7e79-4233-a2f5-e084c3263aa6", "comment": "Malware payload", "value": "93bfa9e434b5164320e1a71dce684ab6cb0d680622561e7cb5bc03238f29a03b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782028, "uuid": "94625236-587a-42ab-a29e-13ecee564644", "comment": "Malware payload", "value": "b3476774ccaa12ae34e54aa293584db234c75201", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782028, "uuid": "9eaf1da6-bfaa-4754-bde6-c3b08e6b3113", "comment": "Malware payload", "value": "8fdc2b8755a3466794a5ae3a856dab6a129752b93c5de138be5d8046aa9fe9a1f99d2a0e749f4af3ccdbca47a721ece3", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782028, "uuid": "8e610212-a8c4-437c-8a75-2fc1531c9afa", "value": "T15D161299ED93CF86FEB3C379A2250F82D90E92512D41AD77A7214A37DDC30C9B71A124", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782028, "uuid": "b9752667-30cf-4dd2-9736-980e7b81025c", "value": "98304:qMfCCvypJBfddcU27GS1y315kqCS3I9Ov9UOoyUOfRCUipfipzjZHO:qMXEddc/lc315kq73vUA5gpKpPZu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772782028, "uuid": "c43c1834-060a-45d2-8530-1652de98e360", "value": 4050337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772782028, "uuid": "ad1b5f81-f107-47f7-b70d-4358ed77d438", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782028, "uuid": "9f1d82a0-5cd1-49fb-a84e-0bb386df660f", "value": "LAKE MICHIGAN CU.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3008141d-196b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808358, "uuid": "8b86ee61-e5df-4755-add5-35e71d1ce3fc", "comment": "Malware payload", "value": "030d09022b42acb17979a2ddd9cb44b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808358, "uuid": "9fe9a7aa-6823-45e4-abc5-7d7c488ad24a", "comment": "Malware payload", "value": "94075c4cad842827eeb001b8ea7812c6734a7fa7cf093e0cb197aeb3b43073e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808358, "uuid": "908c5ed9-d2c2-4117-8bc4-762a8693da74", "comment": "Malware payload", "value": "5b3136a8aa8ff9cf86ca802a03293399526501e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808358, "uuid": "4b4fc7c2-4b79-4c1a-81d0-d1396626b7d9", "comment": "Malware payload", "value": "0fd780439b0d0da02861a25c9b45fcac064b49bd3ea97dde726920dc48e50062139859ef2b3f57def86cb3561210cf43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808358, "uuid": "65d7b3b4-72b4-4fda-916b-404cfeaa39b9", "value": "T154E5E64329DB0DE9DED267BC61CB5335A738FD71CA291F2BAA08D1212D536C4AD1EB40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808358, "uuid": "9d4145ab-fe30-454e-b163-7aff42ca3df2", "value": "e7bd7d531026c8b0f161dc4d7a60343b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808358, "uuid": "a0034b8b-73b2-4421-9ef9-11a5f28f6d82", "value": "49152:I6H2h0X1JsaR3HsMY/nh/Qxd87Ycn6WFbWu:I6wMsRhoY7Ycn6WFbWu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808358, "uuid": "0abd842a-02e6-4cd3-ba72-240885ea55c3", "value": 3227451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808358, "uuid": "d18587b3-785f-42fa-9814-f3193c9d7abf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808358, "uuid": "c9a3c5c0-f4fd-4e11-bc7e-59b46b29f599", "value": "drive-printer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c75affe3-194f-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772796586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796586, "uuid": "72456cac-5fc2-47bd-8117-2d67fee1e427", "comment": "Malware payload (Smoke Loader)", "value": "342c9652dffce8de46aa6f96a59a7c47", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796586, "uuid": "9da57e34-9c02-4216-a4b5-56fca1644634", "comment": "Malware payload (Smoke Loader)", "value": "941901880c61d3aba1060a23c5732970d7e3ad55a3bf42ad92f32e88763e7ccd", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796586, "uuid": "9baa84d1-1df0-48a3-b7db-3a787e9e6ada", "comment": "Malware payload (Smoke Loader)", "value": "cd7347fe21d69094fcf3d4d1b0f8d1bbe4f5ea14", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796586, "uuid": "f79fcfbf-c863-4816-b048-ce4ddb925da1", "comment": "Malware payload (Smoke Loader)", "value": "2aed1120c6d40f67e95a3ff5b298ed3803aa6fe6a377f9a0cbaf29c2dd64bebe61245a23e745d12639b4cbc24259dee9", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796586, "uuid": "64ac3c6e-ccb1-4a9e-ae38-c0ea0daa96f6", "value": "T16B954A0ABCD108E5C0AA977289B766A23B75FC190B3223D32E90B67C2F727E05D75754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796586, "uuid": "8cdf219a-9e33-4d58-b7db-4ac7f07eab29", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796586, "uuid": "850a308e-5fc5-4830-8021-9b18a1bce1be", "value": "24576:r/2+ancs/XxbwJ0DpHFb4GN9cXZK6rtPR800GSY7c:r/Docs/XxbwJ0bbR9cXZK6f80Wa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772796586, "uuid": "dd1baec9-cf5f-49d1-bc45-246f81135893", "value": 1966080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772796586, "uuid": "c8564c56-0175-4c96-a057-932f8cc051b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796586, "uuid": "cb29be68-ca7d-4852-b9d7-e54f1b32c08d", "value": "recuva_professional__technician_(2024)_full_espa\u00f1ol_[mega].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08dbd808-1971-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1772810869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810869, "uuid": "921f4625-0fc4-4802-b81e-711bec3ef9b2", "comment": "Malware payload (Amadey)", "value": "86bf33a76697c4f6daf329e55f92e9a5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810869, "uuid": "18db3fcd-39de-4fa2-b239-e8135157363f", "comment": "Malware payload (Amadey)", "value": "9450c8f5fb17a1faf510d3ed6ce78430b103ce4e54474e5f50a53c5cf9b414d3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810869, "uuid": "90ebf950-512a-4614-9749-b9ea54b75744", "comment": "Malware payload (Amadey)", "value": "6b8204605fe8fbe06db4e5fb844f6802f69a2083", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810869, "uuid": "1682899b-e188-4dc0-a7ca-5ae123b37bce", "comment": "Malware payload (Amadey)", "value": "897d613da5de3d117840fd2b58768992c49d6003d5d44cf5e572c6153a4cfb5733776cae42ba0581ad8d2023d872d5e8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810869, "uuid": "5c7a5114-b7f0-4126-b1e7-63ed9d86fbd1", "value": "T10C945B217916C032D66292711F79FFF185ADB8259F7109DB7BC00F7699202E26A31F3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810869, "uuid": "2ec8f331-7b67-48b0-893e-565815d6cb60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810869, "uuid": "acd577f9-72d6-47b2-a4ea-59b11f2eea32", "value": "6144:TbzHF0VKkWrb4QC1uwzV3ohQU1d+/mN9peVHzsAyuWZGUf/Sdfy9103T7fms4AOk:7HF0VKkWrb4QDwR4QWdyzsAlWZBR8qM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810869, "uuid": "2d65e40b-f576-4e0b-aeb6-7cd9ef949645", "value": 443904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810869, "uuid": "50519074-70bf-4ad4-b33b-9b2ed40563c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810869, "uuid": "537c776a-d641-4ad9-b1f6-cf4c31451afe", "value": "9450c8f5fb17a1faf510d3ed6ce78430b103ce4e54474e5f50a53c5cf9b414d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3a31f90-195b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772801760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801760, "uuid": "b3ee66cb-6962-4327-a5af-0858409b1bb6", "comment": "Malware payload", "value": "fcfcf495d9d208a3b3bd426b701d0ac0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WikipediaJsWorm", "colour": "#A0BBD5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801760, "uuid": "c0b68c97-0dad-4fbb-86a9-a86d2fac8177", "comment": "Malware payload", "value": "94c34ee97eb7d50ef9446c11cacea0bbb803235f3d9843e1b7d5ff60d7705d6e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WikipediaJsWorm", "colour": "#A0BBD5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801760, "uuid": "2f348be7-488b-4396-82ae-d55d42fb1471", "comment": "Malware payload", "value": "485a2338aff001b74ec33e46760dad4426d3b38c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WikipediaJsWorm", "colour": "#A0BBD5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801760, "uuid": "3fa18c04-798b-4f26-a59f-27d062a994c4", "comment": "Malware payload", "value": "943935416b86160cea9ce56f322844a24fcccff51b75e49ce12a66c997cd956859e331f85553b82106d6a656e6af74a0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WikipediaJsWorm", "colour": "#A0BBD5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801760, "uuid": "7f552424-c45e-45e5-8417-9c16e16844ae", "value": "T13BE2CAAC72239C6DDC63266BF19D735EE2601F13F5ACA0507A4C10486FE4C9ED146AED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801760, "uuid": "fbc96df4-0b00-4f5d-b146-8192fb75893f", "value": "768:Up/yCus7+KRzihuh0/zZp/yCus7+KRzihuh0/zzsI:Upn17+KROxzZpn17+KROxz4I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772801760, "uuid": "d4a1b224-3d87-4368-a4ea-6758c03ae70f", "value": 32072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772801760, "uuid": "1697090f-512c-4ffc-8160-1c57916d8bb0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801760, "uuid": "75c573c9-5e51-4cd4-bfae-e5e37268be5a", "value": "script.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e4546e0-1950-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772796839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796839, "uuid": "6d8e0537-4130-4d62-88b0-45b2958ff438", "comment": "Malware payload", "value": "cb88c0319d6463ff05c34df29702ba73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796839, "uuid": "5d856d70-4900-4f17-b77b-c21144897fc3", "comment": "Malware payload", "value": "950f25e039b0631aa95993dc69fa9dac93c8955d7e3222985e919d5d60d8e249", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796839, "uuid": "6e46a900-cb75-4864-88d0-afd945538ec3", "comment": "Malware payload", "value": "d504f2c9c7300bde5700a38e3f01b0398db16936", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796839, "uuid": "fed869eb-723b-4bf4-9629-bf49fe43ee37", "comment": "Malware payload", "value": "5eb43ffbb233ea39fc0d4e9918dfc30debad470d3fb65c46e26e94acb5ce816e39528c87ea4e352756e92be255fabc78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796839, "uuid": "d381519b-2df5-49c0-95d0-bc65f8d6111c", "value": "T1C745E57B72509A7EC16C823FC182CD42E53771B91B37C9E796D00269CA5ACD01F3EA66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796839, "uuid": "107b3ab2-1d29-4f7b-8cb3-e834315a5d6d", "value": "12288:qrlVvU14I1dl86fD+DUHA0ExVqBaBsZzAvx5IRcNOYJUyQdma6xxECh6l4lVzw:qfotD+DUHAXbsNvy4UxEuzP8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772796839, "uuid": "b04e424d-88fd-4370-b736-b684bcce13b7", "value": 1205640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772796839, "uuid": "1be4b7f0-2a5f-483d-b6eb-79b494be5a6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796839, "uuid": "f111f25f-8208-4620-9ea1-5ce46a8c1031", "value": "cb88c0319d6463ff05c34df29702ba73.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b5000c5-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819222, "uuid": "1b730a18-f01c-402d-a406-56c1ba7c2ade", "comment": "Malware payload (Mirai)", "value": "0e7c948d3bb8a04e6ffaae4518d31d6b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819222, "uuid": "33f8e4c4-fe17-4299-ab53-78ed1b6f698a", "comment": "Malware payload (Mirai)", "value": "950f9c24339f06a8bed22d2e8d522d59f25ed23554f14c6d4481ce8890b215fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819222, "uuid": "a0a30e65-90a4-4777-9af8-12cec22254ee", "comment": "Malware payload (Mirai)", "value": "c1176493bdf49ab7b68a12cebbbe8d9fd6d9117f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819222, "uuid": "9b3cbc9d-ae95-4052-bee6-6af1955085f6", "comment": "Malware payload (Mirai)", "value": "722e22270871b4386f933b70d86c9819c5fe06905c9276605f856bda7fc4fb4bc3f15e273d57a6032d705bb7fee3f4b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819222, "uuid": "1e013237-a3e8-490c-aae1-6d414577786b", "value": "T17B54962A7E21AF7FF26887310BF38B70879921C636E19746F26CD7181E6028D585F794", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819222, "uuid": "c0702462-d5f3-4936-be7f-f048b03c6dbf", "value": "6144:lHt5qI+SZ59xzFjbDkJsdcMWCxvmsFekuJ+gAfVlruXb:lHtcI/Z5fzFx1xvmsFekuJ+gAfVlruXb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819222, "uuid": "c211c823-3ded-4622-b997-4bddb788a84d", "value": 286939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819222, "uuid": "a3e7fa43-9b20-4493-8c46-c4823152c3af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819222, "uuid": "6fef6d49-1b34-4424-8e01-ff8fd6d20ef5", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ded7b072-197e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772816812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772816812, "uuid": "e71d77d3-9998-4ae9-ae1c-d3c0f09c7566", "comment": "Malware payload", "value": "b16cafecb81b4fdebeeb473049871715", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772816812, "uuid": "a927834d-b9ef-4a8a-aa56-c28c18549fbc", "comment": "Malware payload", "value": "951203b59712cb39ce4f35fdef0db671a82b1267df286f31ca93bb9b45e2c1b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772816812, "uuid": "ab57f6da-751e-46d7-b0a7-635172394240", "comment": "Malware payload", "value": "5e77fc52c84ffbe4229c65c66be3ff2f077e7193", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772816812, "uuid": "1586fef5-151c-475e-bd89-b8fed9224716", "comment": "Malware payload", "value": "e26ea9249f5ca622d5f277bbbcdb26d797c5bdb7765a856fce503fcc927364e517a7b0e014547819dbf761de51c5c1e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772816812, "uuid": "3cfaa2ff-e147-46d6-979c-9f5a171927ca", "value": "T175C58C07BD9089BAD0A9E2359CB543A17735B898073273C32E2766B42FF63E45E39744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772816812, "uuid": "f7041ee3-5cfc-4210-9f28-c3ebc93e5a1a", "value": "7ecc3b9e18c31c23f5275a91f6c533d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772816812, "uuid": "c557b6d4-cdd7-47d9-8e88-973957f65060", "value": "49152:QJ1bkBuGav3L1K1wGtTJwf9EdU0YgtUpFmw:LY31IJw1EdepF/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772816812, "uuid": "d750cca8-53b0-45f7-b3db-1302f248dfb0", "value": 2630993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772816812, "uuid": "fc18ca0a-9c3d-4894-9256-2c48872e777d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772816812, "uuid": "6f9c93af-ea58-4bfa-9523-90c33b85f0da", "value": "intl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cbbd5b7-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819224, "uuid": "61c9c37a-45cd-4e67-a2f3-888f5a2fc4c3", "comment": "Malware payload (Mirai)", "value": "3d9b2bca978b7bf9d4c89305f9a43fa0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819224, "uuid": "f262ddbd-4f7d-4932-a536-3c4fbf994db6", "comment": "Malware payload (Mirai)", "value": "953da7ca2082986e2fd411035a192603ed9190d9e9838f4ecc6dc8e63f2a7860", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819224, "uuid": "20ae030f-872d-401f-a575-4c886be03ed7", "comment": "Malware payload (Mirai)", "value": "5e81187e553b585e31a6d527b7e88d5db62136eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819224, "uuid": "d9fce8f2-0a04-4849-9ad8-b3842b26916c", "comment": "Malware payload (Mirai)", "value": "39b17492c53313f07eb19fba9f0c7d7ae05e4fa91a01db4c73847fd30eac93608d5d5ae3426071a506bfa07f592bad56", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819224, "uuid": "658a67e6-cdb2-4199-ba6b-df8d57016eb4", "value": "T1E5932A96B8819613C9C556B3FB5E429937170368D3EB3203AE348F71338E99B0E7B855", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819224, "uuid": "c5fbc77f-8930-4628-86b0-95dca914852a", "value": "1536:2eprTX9Qd3ieJkX4xHQh1RgnsXzjrAfT73b239bZHlKycmJWWl4OonZWe7S:h9E3QIxHQh1RgnsDjrYT7C1lXl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819224, "uuid": "b10370a8-4ca5-4533-889d-2e3683d1f064", "value": 96900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819224, "uuid": "26058d85-4f5d-4602-9eb6-23e982d113d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819224, "uuid": "b3b5c0ec-a09a-447a-84c0-b6d3d95170d5", "value": "violetarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d6618e8-1908-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772765914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772765914, "uuid": "6325d500-9c16-4441-a7da-71f1fed52f7e", "comment": "Malware payload (Mirai)", "value": "455f9003685b08a93fc7c973ca09edbe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772765914, "uuid": "23b4d654-fc13-4716-91c7-187e20e77c1a", "comment": "Malware payload (Mirai)", "value": "95a484f81ee370a6ab3432286b9052df39dab9b9b9a078bd854a02234b2d858c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772765914, "uuid": "9e362b5a-0eaf-4354-b5bb-e97192c51f02", "comment": "Malware payload (Mirai)", "value": "c5dca03cdf1145cc8053e2a3ebdf271329448d0e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772765914, "uuid": "21f941ca-757f-4ad7-b14c-f3e70fa47feb", "comment": "Malware payload (Mirai)", "value": "e78c5fe67ff7e173287026ff0629afabec6900236558e115b49572aaf8d8a37129e63c1a0359203a9e4d5a2faac1cce3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772765914, "uuid": "6afeeff1-8914-4c98-b90a-5e9a1d51e0eb", "value": "T162E30A46B8819B12D5D111BEFE1E128E33231B78E2DF72029D246F64778A9BF0E3B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772765914, "uuid": "dc63e318-768a-429d-8373-4e413333954a", "value": "3072:b8S5KURgw/PXuxMte/aSyuBwSQm9T+cDmbtZ:bj5KKZPXmMtwa9uBwnLcDmbtZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772765914, "uuid": "62111658-a1bb-4791-95a7-c50520296e7c", "value": 146268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772765914, "uuid": "3c3df620-476e-4442-b760-81358662f635", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772765914, "uuid": "4fa24362-2c74-4162-9892-e1380c80ab0e", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d40009d2-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1772811639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811639, "uuid": "237d3705-275a-497b-b617-4351b37c6813", "comment": "Malware payload (MassLogger)", "value": "bac18c4f83f6c7730d3582955de30b9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811639, "uuid": "4d68e2b3-c1f0-4338-8e6d-dd39d3377144", "comment": "Malware payload (MassLogger)", "value": "95a769c7e3b0b372e3e4d9534127d61fdeef9186ccc99ed88cba00423178da29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811639, "uuid": "f6479dfa-53e9-43e3-97b9-ecabe59e09df", "comment": "Malware payload (MassLogger)", "value": "8492dcd12c3940d1111875cce6b0e67f82a35f6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811639, "uuid": "2b0696f0-197c-4aa4-96a9-f12754a74529", "comment": "Malware payload (MassLogger)", "value": "88a19d2961b3dbfb142d8322a034214fe8dabff4054f822fade9e3b0345cd38b3442514eaa60b17d7cc06379fc27b370", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811639, "uuid": "5a0e20a8-1048-44f4-8334-e4b098f3b9f2", "value": "T10925AD0023E8DF65F9BEAB7812F4247503F5FA069632DB2F6E5990A95C25B814E43733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811639, "uuid": "7fe706e1-22ed-4f67-98d5-a1496880b16b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811639, "uuid": "7bb7b06d-1773-4f8a-a3d5-b07a304c202e", "value": "12288:Pveikl14kuQwVokGOuXJxNB3+MLi6j2YI1Qsc6F3lrK/CDNTIdGzXsbIoo:8GoNOYwMWgsjF3lesT4GzXiG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811639, "uuid": "88f42c46-0581-4f76-a6ee-2b1b06161713", "value": 1014272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811639, "uuid": "62769f07-826f-4db7-b7cf-615e5a040857", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811639, "uuid": "f7f7b45b-2ea0-4285-a1b6-6cd69978ee38", "value": "95a769c7e3b0b372e3e4d9534127d61fdeef9186ccc99ed88cba00423178da29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bea0569-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808431, "uuid": "e978e2a4-daaa-4d35-bc66-426ab0ef4a20", "comment": "Malware payload (GCleaner)", "value": "8ac32275c0dea252305217d388d50153", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808431, "uuid": "00e8e8af-2ee0-4b53-959f-dfcd71afbdc7", "comment": "Malware payload (GCleaner)", "value": "95aa2ca690f660464153fc3bc996dc54095d90bac10697402a1ec9b6d3a5934a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808431, "uuid": "e49095f5-398d-4c8d-be34-a651ca5625aa", "comment": "Malware payload (GCleaner)", "value": "53e3fdff25236f6538c9fa497380456d8e5c64da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808431, "uuid": "fdaec56f-db01-4a3a-a911-7697fd9f2aff", "comment": "Malware payload (GCleaner)", "value": "96ca8d8cad73fd4c9a4760a186519eb256f62ee88ac108e3ef956c762c67439415690a7d89574714460b1f40a05ba519", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808431, "uuid": "11b5277c-17ef-4946-9a2c-db7057f4c93d", "value": "T16E16D0433EF13D3DF876B63B89055D49BDA5B1412846483A61BA1BCBC13768CEB781B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808431, "uuid": "80c1be62-9269-4187-9af1-79d52985773f", "value": "336c69b6e8562d1c5231f219b62d7473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808431, "uuid": "2b28bb67-8608-4c06-8956-d12eba0174cb", "value": "49152:59t9uM199DrF/ZMPKhyNedIQnit0EfMhyozbVy6mte24TVBjisT:59zu499XlZLhBdIIhyq3mterVV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808431, "uuid": "df5899e1-b425-4690-aee6-9f5350c26eb9", "value": 4068352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808431, "uuid": "d7b123d6-3966-4f3a-971f-63dc72102289", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808431, "uuid": "876dbf1d-5e28-477f-8843-81892be9796b", "value": "95aa2ca690f660464153fc3bc996dc54095d90bac10697402a1ec9b6d3a5934a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8709bc7-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772809902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809902, "uuid": "c21fe613-d8d7-4ae9-9082-3452b0d47e4f", "comment": "Malware payload (AgentTesla)", "value": "05d0214cf12041ec0317172226e7b523", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809902, "uuid": "032dd5b0-e1fe-40c8-8f79-71c230f3a13d", "comment": "Malware payload (AgentTesla)", "value": "9630b6cb9757741f387b00aac49463112e3af8e212a0f807e637fbbd67533c21", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809902, "uuid": "56863056-f4c2-4bac-9821-c661588ac386", "comment": "Malware payload (AgentTesla)", "value": "c6931b4079df72e44564d4f04c6607a66a1d2b02", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809902, "uuid": "a49fa7d8-ba89-493c-8b8f-b23ee43ca5c6", "comment": "Malware payload (AgentTesla)", "value": "bfc27b0981c900916348cd84e771aa5dc1425fed081f40733fa889054488208e2b33b44767d521b7206e9a9965a9b198", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809902, "uuid": "9eabe326-3586-4f17-916c-51b1150e50cd", "value": "T14484E141F3C0ECE6E45554B3EC2EC7241A03EE6E8066872F326676166DA32D32657EC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809902, "uuid": "5303af75-d9dd-4c7c-8096-f2dacd539d47", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809902, "uuid": "c94cb708-de67-4cda-87da-ef819d6fe73e", "value": "6144:7gORaJ1dhZ3qeDHvSKc3+fY5PiykyCJBP2NUpoG2IhOGAM5UCBLSks5xw2:7gd6kHvS7+fJykRDiUp72IhOk5Uqk5xV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809902, "uuid": "ae32876b-7480-41b0-8eb4-7318ff92d95d", "value": 399176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809902, "uuid": "50ef9087-5aea-40cc-8c79-4471739a094a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809902, "uuid": "46241044-3d6c-41d9-a787-24745e28c8d0", "value": "9630b6cb9757741f387b00aac49463112e3af8e212a0f807e637fbbd67533c21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b511f4e-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810122, "uuid": "58870ad6-e6a6-42bb-94ae-24b8de66ce11", "comment": "Malware payload (GCleaner)", "value": "a9b5fa072de5b62a4cba639b5208e415", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810122, "uuid": "ede1b05b-204f-4d4d-8896-7c3951ddb665", "comment": "Malware payload (GCleaner)", "value": "964837fb79030ccdc3f45dcaabfeced8c33cd7d4a3838ade0e7efb209d5b93f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810122, "uuid": "43eddfad-5c51-4ccf-9151-76b9b74c3490", "comment": "Malware payload (GCleaner)", "value": "6e6d0402536afa43e75d0a96f56798c854beef81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810122, "uuid": "f2b3ee08-1fae-49f6-8f5f-674363ebc0b4", "comment": "Malware payload (GCleaner)", "value": "c7f76dc1047cc26b5016cccbdbef36b11661ba078925516e41b603542e4eb0f838faf8f024ed3643c8e26295561bb1f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810122, "uuid": "c90b9fe3-c41f-4a1d-8aec-55d957d269cb", "value": "T1CAE48DF1EAA0843FD1627938CC0BB2A594BDBDD02929640A7AE91CC8DF253F17535277", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810122, "uuid": "7453453e-3419-4fee-afe5-bae3fd1e86ee", "value": "c475b6e242f56325f64c2b76233f720b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810122, "uuid": "db9e98ac-1883-468b-9926-def753b28f7e", "value": "12288:/eM9gzhW/BsjB7V+bRO88pvnHU0rLu3yBYg7mKEMMi+KVL30bf/d/Z:2K3/q7gR8n6ipmKExiLVL30bfl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810122, "uuid": "5d572db3-88bb-4026-90ad-94a83ebe3ff5", "value": 718336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810122, "uuid": "890c1655-4a57-42c8-9491-e88ed2d61eb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810122, "uuid": "ccda2f14-7490-466e-b64c-e443c47c7ff7", "value": "964837fb79030ccdc3f45dcaabfeced8c33cd7d4a3838ade0e7efb209d5b93f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eba2f9d-1974-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772812194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812194, "uuid": "e1a02fc3-1bbc-4364-bff4-5321a68af8e5", "comment": "Malware payload (Mirai)", "value": "06de3b5ccae65d45a2a942ea4d3fdf94", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812194, "uuid": "bdb095aa-ad14-4b8b-9695-958e04f996a7", "comment": "Malware payload (Mirai)", "value": "971b2da958636436110aa3ed29eb3000f3b3645ece4e9e049397587eb4c07d23", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812194, "uuid": "4a072e6c-86ee-4691-9803-f7de7c93c04f", "comment": "Malware payload (Mirai)", "value": "cc3567fc2a744f5172e1beba059da59c06f2f54f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812194, "uuid": "12dfad92-3b4f-4c2a-96fa-cb703dc10915", "comment": "Malware payload (Mirai)", "value": "9b4b4b197fe1e0977964090890c4f3e6594261df1119a79092c2a5f2e24cd643a259e62ed09def041e5ad907794f795f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812194, "uuid": "9bbdedc3-4f85-41d9-b544-a768acad1f76", "value": "T1F2433C92FC9245A9C7C517B6771A978A336263A9C2CF7313CC080B5176C9A4F4E67F42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812194, "uuid": "8ed5984c-77e6-4586-993d-c46383ebf42b", "value": "768:bwjRWcVgYik7nshvFUhhyE8dGLf/qkZzlQr9JKrn4vbk9Mz2F30ntzgE:boRBVgYik+veKDk7qU5Qr9JKrJ9cOy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772812194, "uuid": "e7082319-9956-45c9-9f39-75778d007651", "value": 55324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772812194, "uuid": "d0f049ca-ac2b-48a9-a6d0-d497c3b8766b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812194, "uuid": "18b74687-ff30-42e5-a7da-d3dfb25e3bcd", "value": "titanjr.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32ef76cb-193f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772789465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789465, "uuid": "b1e897cf-9c66-4abf-822c-421e1205fd6a", "comment": "Malware payload", "value": "17b415e0c4ffd3962141a50b04d3d854", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Marker", "colour": "#9CA9AE", "exportable": true, "hide_tag": false }, { "name": "Trojan:O97M/Malgent!MSR", "colour": "#21C2EF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789465, "uuid": "5ace3310-bfda-4fbf-b1e7-034c40891027", "comment": "Malware payload", "value": "9786fd636d0411329aaae1e7a0fd4807940bf26753d826cab1817b7213fb51cb", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Marker", "colour": "#9CA9AE", "exportable": true, "hide_tag": false }, { "name": "Trojan:O97M/Malgent!MSR", "colour": "#21C2EF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789465, "uuid": "caa75bd7-7207-4da2-82a9-a00d9b150d29", "comment": "Malware payload", "value": "3fc373abe37d1ae320ff7e13f423bfe02f1c635e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Marker", "colour": "#9CA9AE", "exportable": true, "hide_tag": false }, { "name": "Trojan:O97M/Malgent!MSR", "colour": "#21C2EF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789465, "uuid": "0b8280cc-9183-4bee-ba2c-a1b3658501dd", "comment": "Malware payload", "value": "b88b3540511e919c90f41cab6c73a3d4805d95c6eb7ca521a62ac0bf60aa9f5e1a03c0bc6b6aca98960d6d1940aab5a1", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Marker", "colour": "#9CA9AE", "exportable": true, "hide_tag": false }, { "name": "Trojan:O97M/Malgent!MSR", "colour": "#21C2EF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789465, "uuid": "2541ddfd-5f21-42da-bb43-3b02b6de6929", "value": "T12F535004B296DB2AD0799D7008EFA3EA6738BD29DD26830731CB772DBC717A84D04B55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789465, "uuid": "1ccf127d-6e1a-479d-9b5f-0ccc5695f566", "value": "768:m/27Z1z8TJpMHFm0X/Sd9vDDw6IDNxz99ZQMyG3b4:xgdpMHFm0X/ILzIDN3LQMyY4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772789465, "uuid": "3baeed16-46df-42d0-96e6-c349dd70f7fd", "value": 63488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772789465, "uuid": "3ce1f8aa-7be2-465f-b6dc-0138d9cb81bc", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789465, "uuid": "8c687813-a855-4617-818c-00c7e489e6ce", "value": "\u5b8f.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62d16221-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811020, "uuid": "c9e5383e-ae77-4ecd-9cb0-3f3abd5fdc30", "comment": "Malware payload", "value": "f7dfde20f21213ea9d6f4b6c119b88db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811020, "uuid": "bc6e4ca7-d05f-4ec9-9949-ff0b5d346314", "comment": "Malware payload", "value": "9795a4ac63fd8bcd1fa60385a0cd99687f38c36b374553f5abf6be3319cf7a44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811020, "uuid": "61ef8d89-298a-4c7c-b644-8081a6d2fb49", "comment": "Malware payload", "value": "b863840488838f699269e7e3264b180b23810361", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811020, "uuid": "adb81769-517e-4edf-881d-96b4d2e67e3e", "comment": "Malware payload", "value": "c5287b945e9382c629bdf52571a1a975588432c9663fe6756130fa7db6356bfcc879a897b3f234dc52bfe231d6226429", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811020, "uuid": "f8452533-fa04-49d7-87a6-c2881104b1b3", "value": "T1837412A03120D823D6D207311AB213FAD6ABEECA689856474B547F67BD732F5910F327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811020, "uuid": "0b5a7d77-b6ed-47f7-8d34-8cfc09065d60", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811020, "uuid": "ca1ab838-b96c-4a1d-bb06-eee5080f607f", "value": "6144:KR+xXx+JFN3ItEH7w8oKSbvN6aXceakAEMxAwXW9ZlnT1UirZKiipkxQ:uc+J33FwzpvkygxcZ91UniXxQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811020, "uuid": "92163dfb-838d-41e9-8f26-afcf00dc8dc3", "value": 370064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811020, "uuid": "13287b79-049b-40b6-8004-2bb16b94fd5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811020, "uuid": "eef10b47-831a-452e-910a-502eca48633f", "value": "9795a4ac63fd8bcd1fa60385a0cd99687f38c36b374553f5abf6be3319cf7a44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f682d441-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1772808691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808691, "uuid": "3ad679f0-857e-4604-bc51-4768e45fdc5f", "comment": "Malware payload (a310Logger)", "value": "0ad86724d76dd9694e6ebaa080372f85", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808691, "uuid": "8e429a08-4903-48d4-89a3-aa1e14bbcaaf", "comment": "Malware payload (a310Logger)", "value": "97e0a32932cf367eeaae29e66537b06a09c160b6413f267dd9c47a7a12678771", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808691, "uuid": "b390e614-5f0a-4d99-b9c0-62ccb603430a", "comment": "Malware payload (a310Logger)", "value": "9318c031dee3588a57eeeaeb8b48d5e90c23bcc6", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808691, "uuid": "b5497379-56b3-4216-a208-db0504c6e38a", "comment": "Malware payload (a310Logger)", "value": "a45838b83f774ea74076830d7997f161ba47b1bfa26d0d2d14a58e4fc3ad4ac0fcf0816704ff7d72ea038bd862e95c2d", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808691, "uuid": "0e5d9264-8aa9-4e2b-99a1-a6100b9c7a2d", "value": "T18F845B23E620A12EF1A3C9F1B9A5A25728263D3A5698EC47F3415F5834715E3ACF131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808691, "uuid": "9b6798e4-a6af-487f-a144-7836f7e2d3ac", "value": "252c027bda7298291893ceb108f11214", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808691, "uuid": "51f5f708-160f-4779-841c-c16871f56973", "value": "6144:88d1/w5KA81IJ8GpF6nuTmOOUWT7xcBfbbNcknSrnGRyZXPFnUY:PjYKkJj6GmZUWHCbcSRyZXt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808691, "uuid": "28d82b83-da05-436c-970a-45e27e176f16", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808691, "uuid": "be8cec8f-d042-451b-b8c6-54cd52fb6d3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808691, "uuid": "15b07377-d69c-4456-818b-6a32e8f33a96", "value": "97e0a32932cf367eeaae29e66537b06a09c160b6413f267dd9c47a7a12678771", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1bc0e50-196d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809434, "uuid": "6ed05c76-661a-4d13-86d0-cfe2f9c2d72a", "comment": "Malware payload", "value": "8ca9cc70a8e1b3d05f46f5324f53e7b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809434, "uuid": "e80dae0e-d4a4-4307-8510-44669b8bd30f", "comment": "Malware payload", "value": "980a8afd4207945104916066dca2a447eec07cb1c5dda6b912c46fc7de2b92ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809434, "uuid": "b08b9bb4-3245-4f77-8de2-e99d8386267c", "comment": "Malware payload", "value": "1c3a8ba284e2cf406446140f5f9deeeb710ffdfd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809434, "uuid": "effb962e-d6c6-40c5-a880-5a490d73bd3d", "comment": "Malware payload", "value": "1bd523fcd1cf0f0d956e95f23e248a944aeda97199b1d1da5a0eb23f7554ec086fff60fdf95aff14bee429253cd38648", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809434, "uuid": "0164f396-8915-4e76-9a5d-793119c11ec1", "value": "T13A0523207DE0C167F652027258870BB25BE4ED9FC2E0A58707D47EACBDB9B648B12347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809434, "uuid": "930fb671-1e24-44e8-9eee-642f4d163c3a", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809434, "uuid": "2d0bf4a8-a5b8-4174-aff5-490a82bd9cda", "value": "24576:n3d3oAV86/wSzylCTsHJlsOSpMYWzAb76VAtuuWSgHY:n3+ko15HJNzAc0WSg4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809434, "uuid": "84159656-420f-4595-aefb-dd0c31829367", "value": 868480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809434, "uuid": "9184e56d-d8f5-483c-aaf6-b2e52d5ad274", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809434, "uuid": "b5231b2a-dab9-4d34-b981-9ef609d1568d", "value": "980a8afd4207945104916066dca2a447eec07cb1c5dda6b912c46fc7de2b92ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f484cdb-1951-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772797297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797297, "uuid": "fa1c4837-0060-4650-86ff-c9d7c6389579", "comment": "Malware payload", "value": "aa645f469b1478abcd64e68b0f4c87d3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797297, "uuid": "4788e4f6-5c87-4263-add9-603ea75464ad", "comment": "Malware payload", "value": "9811883ce6454635130a3e4fcbf28d6c3a5b67d75dbc8d2fff9627bf114e3593", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797297, "uuid": "bacd6365-c737-4b8c-ae3e-bde17470e344", "comment": "Malware payload", "value": "10ef7f93063c8d4d6036e75697bb7d5f06d221fb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797297, "uuid": "fd6df0f6-7a7f-4136-93c5-baf3226eae90", "comment": "Malware payload", "value": "4566a7ee2b02482b2edbb477983ba90ef3ec8f4ff722d583f47d800e90088c4c0100405164b0d78659aa309db489d964", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797297, "uuid": "73e0c71a-476e-4540-8298-b9ce3d6f0d59", "value": "T1FF41C85B27FE393A5A9624A7842E9446D6758E910C064C10BACC0E07685D6D83FF9F28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797297, "uuid": "2be0da97-665a-4336-a54e-4009f4f678eb", "value": "48:7jOgo7b5jag3L8GbE4+EvPbjrXecbtlaw6QRnpoQp8Owg/Rf6Wc9bE1TnL:7jqjHG4PPrXecbuNQFKSRf69gV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772797297, "uuid": "f1aeb8c0-492c-486d-97ba-1ec8685f3747", "value": 2218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772797297, "uuid": "50a98882-c357-4e08-988f-bce7641f3a6e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797297, "uuid": "3062b76c-75a4-4abc-9f37-cbaa42571648", "value": "9811883ce6454635130a3e4fcbf28d6c3a5b67d75dbc8d2fff9627bf114e3593.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c75d03f-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810875, "uuid": "105bab34-820d-4687-a1c6-8bc077e8026a", "comment": "Malware payload", "value": "e1185fefed8977c00ef271927d4ee3d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810875, "uuid": "33e31e49-c859-499c-8d2c-bd2035701c40", "comment": "Malware payload", "value": "981192451bad0a640489b57858a105079f386bd8f315496fe03aa825a07220dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810875, "uuid": "1402a834-9da4-4f71-9064-1395c3de8464", "comment": "Malware payload", "value": "8a72c49cb9386c8c8b4326ee6a84aed596d847cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810875, "uuid": "bd8c5345-2793-41b3-b3b5-e676ca7529c4", "comment": "Malware payload", "value": "7da7ae4afe72d1071a868c43af2fc552eadcfa5f2ea8816084bc340026972634928ce4b8ad47085146f58abd7b6a8fc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810875, "uuid": "57bba4b6-b6e4-42fc-adbb-312f412bea53", "value": "T126C423290584F42BE49A4DB335B700F3DBB4D5252839AB076B00EB9CFBA26E35D5D346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810875, "uuid": "bbe35153-fb9c-4f83-8449-a2184d2426e4", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810875, "uuid": "2ea11266-2022-491a-8ad6-17dd0cf16ae3", "value": "12288:/1yDJegGVIQtTT4EhLBwO2O1pPMagP8moUGwyZA/:/1yDJeggjtTsEhlsP87Sy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810875, "uuid": "efa0ad41-64be-447a-8b95-8cc9eda9b912", "value": 570744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810875, "uuid": "49024961-a76b-4e01-b43a-2f8579a6cb0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810875, "uuid": "a275beca-daf6-4d45-a3b8-a8d761279b87", "value": "981192451bad0a640489b57858a105079f386bd8f315496fe03aa825a07220dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22d51c91-196e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809624, "uuid": "98262746-63dc-411e-be99-68837d7225c0", "comment": "Malware payload", "value": "7dc1074626d53ef4b9bb1046c89c8156", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809624, "uuid": "e1306977-2786-486e-855f-03340f597972", "comment": "Malware payload", "value": "98b2e901887f8e660fdeaab0b74d7fd39d40ea143a5e2f521a12b102dce64d2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809624, "uuid": "9430f2cf-3f90-4b66-ba2a-f7164835ee07", "comment": "Malware payload", "value": "8122f1eb0a82d21c972a6b38c53558ad889b8889", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809624, "uuid": "136e1142-9155-4d7c-8759-ca6379e56edf", "comment": "Malware payload", "value": "bd3784ecae77caf00643eddf79c5daffc0e4211904904e748f11e0039fcc03fdae36574fb44dd7a43d1f72b23a663c36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809624, "uuid": "c476ead5-4a0a-4b4d-a07b-ce2c57bf6cd0", "value": "T1DA94E612EB60B0A5F89349702D78A25679193D7A2640EC0BF789CF5637B0683B4F572F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809624, "uuid": "22c30baa-2521-48d7-934c-db9f2af31eb4", "value": "955a5c5d966e09c0e64ce19515bfe6f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809624, "uuid": "7876a1c6-62c3-472c-ae01-18aa66e9a073", "value": "6144:XIDsuoNcD0VSEbEBEP0jfBjVtxyo8OcE1vk6q6JVx6+ocM11/3gR/:Y4uQoBEP0jfBjVtxyocEJqex6L33g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809624, "uuid": "48ec7f44-f001-43fd-a972-480ec2f5bbb5", "value": 434176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809624, "uuid": "d13c1dcf-5dcf-4635-883d-b44aa04c2780", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809624, "uuid": "3c260459-d3ae-4088-82cb-1d0d6395223f", "value": "98b2e901887f8e660fdeaab0b74d7fd39d40ea143a5e2f521a12b102dce64d2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "278e4bf7-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1772811350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811350, "uuid": "fb75e37d-ea02-419d-b428-cc6806210002", "comment": "Malware payload (a310Logger)", "value": "cbfbbda9c5f9abb566637d9447dc40ee", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811350, "uuid": "e2f97252-a159-4858-9f4c-c8059cab0fe0", "comment": "Malware payload (a310Logger)", "value": "99c6a7cffb112b1e7317601acbe137d21df605b662ae35f3d81806278e33285f", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811350, "uuid": "17d99ec6-a516-47de-86e4-b5350ab5faaa", "comment": "Malware payload (a310Logger)", "value": "858764d3ccaada09c4805b057b2be4df26bdf8a5", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811350, "uuid": "ead8eaee-152d-4a67-abda-6cec40b6b9ed", "comment": "Malware payload (a310Logger)", "value": "6ffc2555608c0bc6314269d0bf1952260de8ed44297e522e9d158535708caf3370e64b71a464bb6eaeaf0920dd1a021d", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811350, "uuid": "216274fe-7e0a-4f9f-82b5-7f3a01e82619", "value": "T12E4512985516C903CA584B742AB2F2B417785EEEE402D317AFDCBEFB7972A550C48383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811350, "uuid": "20a2bb45-c5a2-4662-b85a-e13540d0b08e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811350, "uuid": "90048038-62ce-40b8-98d8-4541643f9339", "value": "24576:nqj6fCHzbS1RBD0+zQn2SmS5mOWc8HocBTukHMLAq4YF:qj6KHfS9D8n2PSaDBTukn/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811350, "uuid": "ca04451f-a344-4e86-8508-43b908a809fb", "value": 1275392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811350, "uuid": "d1f041db-fd82-4bb3-84e6-0a9adc152dab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811350, "uuid": "b68e7eec-010e-4520-bc36-3e293a22c75f", "value": "99c6a7cffb112b1e7317601acbe137d21df605b662ae35f3d81806278e33285f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ce0f49f-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772809829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809829, "uuid": "ac674a49-cdc8-48ab-b2dc-d3645cd5f4bf", "comment": "Malware payload (GCleaner)", "value": "4c67d21342bb2ed10ae338ab0a682986", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809829, "uuid": "da0d681a-22a2-4c87-a893-c0825fc38c97", "comment": "Malware payload (GCleaner)", "value": "99d2644f964674af7bd5484371766adee4a13e4ffbcc8c7fa4b156849cac3f53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809829, "uuid": "9cf513e3-85fa-4401-909e-96e40d97d9d4", "comment": "Malware payload (GCleaner)", "value": "937159804a92c295bdec03971bf1815696d351f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809829, "uuid": "1df736a1-5ae2-49e2-b1e6-ef1c04b3f450", "comment": "Malware payload (GCleaner)", "value": "93647259b36e0780809c5ba24ced82d9d4893ff30fe2795faab3a8a1c5483ed25af1e378dbb00a5f9bb0b3631c13e8ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809829, "uuid": "5aa426d6-f2aa-4417-a067-cdbdb5cbb4b2", "value": "T19DE49E26F6D08436D1336D38BD5BB7E59C25BE4169E8684E6AEC1CDC5F2C38234252B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809829, "uuid": "9cd633a0-44b0-4f81-add6-62a0bf8fab55", "value": "c475b6e242f56325f64c2b76233f720b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809829, "uuid": "f109b229-4133-4221-ae96-74983b1cc0af", "value": "12288:5Q8mJu5T0Ns+MD77lUjVMQok3vQkilHjGYt:CJFNhu7lKLokfdilHjGY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809829, "uuid": "9fa4529b-0fd1-4ec4-9f30-a8881cbf9893", "value": 714240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809829, "uuid": "98762ab5-7a0f-4345-a04d-850cfc5383aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809829, "uuid": "cd5fc180-b200-421a-b4c5-900c0f31683d", "value": "99d2644f964674af7bd5484371766adee4a13e4ffbcc8c7fa4b156849cac3f53", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ae2484e-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808457, "uuid": "25b712ca-de75-4656-8821-d645808800f1", "comment": "Malware payload (GCleaner)", "value": "75802cf21c303fa07ce7ae7b93f6a17b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808457, "uuid": "a945b1ee-d608-4ceb-bdb2-eda8ea6e5f23", "comment": "Malware payload (GCleaner)", "value": "9a2994a7cb7d0e66a6a3237d64f4df5d602a4e9333ed7d5b3136b33d01f3dfb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808457, "uuid": "e4f8b922-120c-49e1-8624-3e41aaf5d3d8", "comment": "Malware payload (GCleaner)", "value": "4c50a39a98f80a0130c54a991d208119dff7e828", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808457, "uuid": "e3b35370-fb27-491a-9fbd-7c2cf9ca0046", "comment": "Malware payload (GCleaner)", "value": "1fc187f60dad374140078d6d62afe210c73e37985dea73d3537884c273c3b6902c69ef36e76b72377bda28ccf5968334", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808457, "uuid": "93b43485-d444-49ba-a595-698872a18334", "value": "T16D46E1E1A9BDA6F7D69325F3372A72894D1DBC421A64303C73911FC8AFE468116E01DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808457, "uuid": "5d11729e-c6c1-4063-8295-d740a1d70c9b", "value": "c243d5a6283f8eb7bff20dd0797e21c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808457, "uuid": "7d04d1b6-b47e-4e73-bd86-054935771d42", "value": "49152:eH5n2heQI+2LZGuqqWnQgQ39ND+lXlvfyD74Z7xkJInM5QGP6qvpDsFD7WrDC:eH5+7Ij4qqQgQ398lXl3jZtJMm8DkDT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808457, "uuid": "247e78eb-34ee-4553-9320-c88aa1d71394", "value": 5789184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808457, "uuid": "6d045d2d-a236-4efe-8550-3d0e2b13d00a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808457, "uuid": "11eff71a-61e8-4380-9d99-754748ead980", "value": "9a2994a7cb7d0e66a6a3237d64f4df5d602a4e9333ed7d5b3136b33d01f3dfb7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc495a07-1991-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1772825021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772825021, "uuid": "b4a745a1-251c-4fa7-a5e8-d8d79ffbd6c5", "comment": "Malware payload (ValleyRAT)", "value": "a878732a087a2eda836e1c649b073324", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent!", "colour": "#0D807C", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772825021, "uuid": "7077ba64-e560-4855-a290-8121af5a7e65", "comment": "Malware payload (ValleyRAT)", "value": "9aa07cfb51a90dc71c495b85bc65743abf79b40b1010b63de2f85ece82966ba0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent!", "colour": "#0D807C", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772825021, "uuid": "a139f51f-f716-4c01-b327-fef114fb1f24", "comment": "Malware payload (ValleyRAT)", "value": "94d494af0f5eaaf0a9c1cf4e002b36190be4677d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent!", "colour": "#0D807C", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772825021, "uuid": "06b66ae0-dcd3-4634-90c4-677d310d7d09", "comment": "Malware payload (ValleyRAT)", "value": "dda251ae0694d49714bff64a2fe3b36f8660997e45ea5397a2070cd1cad1624deee8b95811e021e919e328413abc3323", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent!", "colour": "#0D807C", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772825021, "uuid": "b3f3f045-2a78-405e-aaba-5d4a2e4b692e", "value": "T1E3C53310AEF90DA8C6DC123414DF5FB969E03D84686DFAEF8361C7E6239EE51801F526", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772825021, "uuid": "f91b172b-ff29-4236-935c-b58e89fa577b", "value": "6f5233a1c13a0b93e9ae102bb57391c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772825021, "uuid": "abf2abfc-2266-4636-b22f-efc01e2bb60f", "value": "49152:B3WcBswbJBdX7qLB3T6izdzBpPtcl4bLS2:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772825021, "uuid": "2869476e-d99b-4d43-b8ae-9beaa1fe98ec", "value": 2628608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772825021, "uuid": "dc41451d-10ad-493c-807c-0eff439de598", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772825021, "uuid": "8edd25fe-22e0-454a-a192-ce2ea9910a98", "value": "9aa07cfb51.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2aa3e56-194a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772794430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794430, "uuid": "a7ec98ca-d3b4-424f-8599-368ede316971", "comment": "Malware payload", "value": "c6b292b003d55618c54690c07faf18ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794430, "uuid": "a1a25655-1989-404d-92bf-dbc4efaa9b25", "comment": "Malware payload", "value": "9b153b3fda8915bc1e3de3969fb7d23414886dda0e0fb6aa915caaa01be370bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794430, "uuid": "30a60ec0-f221-42e1-8f97-09fb7d44f6c1", "comment": "Malware payload", "value": "69fd2bc250c4b7516c14347cdebce13bcf5a32b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794430, "uuid": "b2b30efc-5ee8-4b1a-b3a1-74af49770404", "comment": "Malware payload", "value": "398a3b9221f544e85200e087b799985db7f942868f89eab0d3332622d9e3cf492a7f9bd8f6b7384b78d4acd230a74128", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772794430, "uuid": "87025690-9179-4a27-80c5-345b8252fc2c", "value": "T158864C3137A6C53AF56116F12D3DEA6F002DBD660B74A4CB92884D1E99B46C34E36F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772794430, "uuid": "65a51d79-ddd7-4781-b59b-3a5798cc873a", "value": "c36661b1430f713b4102b6bf8db4ef15", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772794430, "uuid": "6e96e451-ef11-4548-8125-8ad724fb7d0b", "value": "98304:93JaWsfunVs5DMxxanw0HizxpB51ppx0txc3ej0SIRs:93J3O0KMxmfcLSIRs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772794430, "uuid": "dafc13bd-4b5c-4849-b7b1-55550589f08a", "value": 8084528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772794430, "uuid": "b8032d2a-02f0-49e9-9cdb-f2fb4ba741f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772794430, "uuid": "9c69e2ee-b9c9-4dfa-b982-20976c91b237", "value": "Win_Driver_SSL_support_v43.22.209.44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d4e84f6-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808944, "uuid": "e5586aa5-19ca-4e5f-bc74-3fe5937198c0", "comment": "Malware payload (GCleaner)", "value": "ccd734efaf40fe3cca0fff4fa830cc05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808944, "uuid": "8a568341-e9e0-4569-86c6-d3e04ad290da", "comment": "Malware payload (GCleaner)", "value": "9b8848def9de60fb7200b4f17a0de297b9d5321673bfed9ff00d67e1b54823eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808944, "uuid": "054dede7-204a-4287-ac47-de932d7d0385", "comment": "Malware payload (GCleaner)", "value": "49028413bf4e641d3f8eedcd93af3680d63ff207", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808944, "uuid": "70391c2a-a4a8-4772-91b3-d3203cd39aa7", "comment": "Malware payload (GCleaner)", "value": "18f77773eb849aa792ae8cf42244878b11f5ff87e6e3948d35816b73c011a35f3df101aaa13c2c392b3d76f25060b49e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808944, "uuid": "a2069ee4-d4c5-4813-94a9-7b0487ca9fc7", "value": "T1E136F155B2E859F4F22136B6EC0622984C187CF666CCF79BD7C81DD40B1A7D2622E0F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808944, "uuid": "9315b0e1-122c-4996-9c0c-4db05f9988a6", "value": "345624d13ffc2b7f296b9d2972b1c0a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808944, "uuid": "f3b60403-ea6b-4001-be4e-aad7be005b7e", "value": "49152:aiZHSok5VkPD6ew10o+2eN4Or8VNt1z330+JvZ8HsXQSlkXZD52ifQo:aiZyokbkPObt+2eCOr83DpJZ8HsJKnz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808944, "uuid": "190fa2fc-0c2d-4d13-8bd7-6ce9740177ce", "value": 5228032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808944, "uuid": "177654f7-2329-465f-8c7f-788a08f4975d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808944, "uuid": "bb06a047-aa8b-4a0a-bcdd-b9ef52666593", "value": "9b8848def9de60fb7200b4f17a0de297b9d5321673bfed9ff00d67e1b54823eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33b11b68-1968-11f1-a769-42010a9c0008", "comment": "Malware payload (Kaiji)", "timestamp": 1772807075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807075, "uuid": "60ffdc98-0f20-468d-a0cf-39f68e751bcb", "comment": "Malware payload (Kaiji)", "value": "883ce91107e2bdab7813315fc064e688", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807075, "uuid": "99ac06da-4271-4e9d-8363-3a85960e3a3e", "comment": "Malware payload (Kaiji)", "value": "9bb718bcf89a5064fd7f4a3e25c156d00b344740205e4be5eae47faedc1c720a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807075, "uuid": "fd66968e-a49d-4f40-831b-b4c1a36dc252", "comment": "Malware payload (Kaiji)", "value": "6f75389ea091f376f7520c136edf81a5c87cb27b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807075, "uuid": "dc794fea-2e4c-4244-9169-4beb71eb1eba", "comment": "Malware payload (Kaiji)", "value": "6ff6d9ab416fcc0d86a5380e9af9f426d8d4db4220c1722808cd7f81778a3793f1a322740b2db05eadbbfddb1ac06cb5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807075, "uuid": "cfb4b601-61ef-4b14-8784-808a1b5dfc76", "value": "T122463943F89095A8C1EED13086629293BA717C895F3463D32F50FBB92B76BD46E79310", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807075, "uuid": "359fe0f6-08c2-4e75-b611-5c0a113af2c3", "value": "49152:7Xa6xzZWhrb/T4vO90dL3BmAFd4A64nsfJPJ6TdXnT9aqeJaz2xNkapDnYRQoj1P:b2ONLBzSxtSTbElHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807075, "uuid": "2cff7bf6-47ed-47bc-954a-b469732f32b3", "value": 5435392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807075, "uuid": "4557adb7-3e1f-4ed5-a3c7-57096a8f7db1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807075, "uuid": "653db773-92c1-471a-8162-0aaa91d5dfdf", "value": "linux_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd2b02e8-1977-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772813802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772813802, "uuid": "c3fe88da-6ba7-48a1-8970-52da817ebabc", "comment": "Malware payload (SalatStealer)", "value": "f00792d02ceb7b4829ff39f833f2bbd5", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772813802, "uuid": "e083cd2f-691b-4669-9b70-c68bdcc00b19", "comment": "Malware payload (SalatStealer)", "value": "9c03d2476f5d46c9a49eb40c5a744ebba7ca8d4036924e426e652627568f87d0", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772813802, "uuid": "5fb094d7-6395-4624-8582-1132ce9f68d0", "comment": "Malware payload (SalatStealer)", "value": "a6d0e752d24f51926c591f0b9f7ffa7effa84b3b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772813802, "uuid": "c1458d24-d49c-4c84-8b6f-7fdefb9f675b", "comment": "Malware payload (SalatStealer)", "value": "833c1394ca47977d92ed81d0e26e190a91cd150911853867d0b177ab34dde3573e9e787d5e458538ed8e551f4556002d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772813802, "uuid": "63f66798-d944-4cf8-99ff-a831bb5bf925", "value": "T147062388F9832AFAC57765B508EFF37A86341D090416CDFBCFD98E55B76AB10091870A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772813802, "uuid": "8e2ebe0d-f9ba-4294-95d3-1d95bda24f34", "value": "4794687cac0beee76bb775325b829d22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772813802, "uuid": "089f75e2-6ccf-4335-b282-56c94dddedbf", "value": "49152:O4Rq9CH4M1zgaatvULCrE9a9RSyVxtKGIcj0s/WSoavxOW2AEcwrvZRd33Q1sC:8GhgaaOj9ErVxtHIcjjZoAfw9RdnQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772813802, "uuid": "3ee526dc-1b8f-4505-9c41-10cde987bd30", "value": 3686912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772813802, "uuid": "2e12d69b-64fa-4022-bd93-7d2d17fb18f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772813802, "uuid": "4f9ddf05-8062-423e-b34b-86be476d3a71", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34b423cb-196c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808795, "uuid": "42a95541-9ded-40ff-9712-8993c59a4953", "comment": "Malware payload", "value": "6c4c20e28821ba0f5c15353c27e24057", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808795, "uuid": "92c5c0a1-92d9-447d-871a-7fc7437a0f0a", "comment": "Malware payload", "value": "9c6479b504b071e6e81abd60aaa37b7c5e7cb11fffd47ab986d8cc966974fa62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808795, "uuid": "5aa8d732-07b2-4f9c-8645-c3780d6729fc", "comment": "Malware payload", "value": "b903122cc93751e680546d6239b044d632635dc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808795, "uuid": "168a354d-9f2f-4dd6-a815-f52773092400", "comment": "Malware payload", "value": "8a994bba14e1d7fb9873c19cc0897448617cf30a880e64dcd6a798ccd3eb4a1585b00886e5b967efa488ae451f611c5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808795, "uuid": "efce5a2c-f951-471f-94c3-442a86958536", "value": "T1A4350291371ADC03D8A24EF01A71D3F052789E9E9C01D2938EFBBDEFB57AA451941392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808795, "uuid": "2ef8281c-1b2b-431d-b9b0-f95919a4dafd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808795, "uuid": "5749f250-db81-4e98-90c3-98b63ff66c3c", "value": "12288:qqB+93e5+WAPVxrfs0SH5mvRtzdJgV6YdB47QFS8FhUxET9i6yzd2drUKyCnCj7Y:qaqu2VREQvRtzgLGYyhIVnp+Ihot8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808795, "uuid": "7450aa2d-007e-4e88-ac1d-f4ea4e289dde", "value": 1083904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808795, "uuid": "754cd352-d16d-4988-8c45-87a6dafff298", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808795, "uuid": "ae8486a3-17fd-4c22-a68b-16636e5316da", "value": "9c6479b504b071e6e81abd60aaa37b7c5e7cb11fffd47ab986d8cc966974fa62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "013e0714-1971-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1772810856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810856, "uuid": "fc15869f-e6ef-4399-8312-656c77beeb5f", "comment": "Malware payload (SnakeKeylogger)", "value": "226b7d2f03e76d0fa3ef8c2bcab96965", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810856, "uuid": "4e2f1536-d193-4cd1-8451-aaee9531f311", "comment": "Malware payload (SnakeKeylogger)", "value": "9c7c581cea57a0f2744fe0193db331e9191a19ad289adcfcd6678a2c3f4c15c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810856, "uuid": "199e484a-bc3d-409f-a477-cef87421b843", "comment": "Malware payload (SnakeKeylogger)", "value": "f4fa4f14468821807f3802d9e326d68353849f73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810856, "uuid": "49d5f149-fda2-4cf2-b561-9a1016bda3cc", "comment": "Malware payload (SnakeKeylogger)", "value": "f87d1636d923c615db600b178d3b06d43431750c6168c8c0966c26fc27d98ee59225f601b6c24e7963e18af7cab6754d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810856, "uuid": "328c2f6e-0762-4b7a-8ad6-ea6e68b55e3c", "value": "T1F2C4230313F0E52AEA661EB15E7B5543767EC7822925DB43F320EA8D78B3384D41E752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810856, "uuid": "9aa737d9-1ded-4830-99e0-961679bada88", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810856, "uuid": "f70a342d-00bc-4dac-9c59-62c7e10838b4", "value": "12288:M1yDJr4itaNw5e10++6nZOhfNFTnJ7QiK:M1yDJHtaN710XdNFLJFK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810856, "uuid": "0e743b3e-e023-4d3f-bf63-6f80580e705d", "value": 550064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810856, "uuid": "2aaaab6e-6418-44f9-b0c0-affb9101fd60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810856, "uuid": "e0be7704-2dd6-4bc0-b2d2-ff1134866092", "value": "9c7c581cea57a0f2744fe0193db331e9191a19ad289adcfcd6678a2c3f4c15c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a60f768-199e-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1772830253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772830253, "uuid": "f97e7897-9175-4ee5-bcbf-b9ca0f269e7a", "comment": "Malware payload (Gafgyt)", "value": "a3abb9e3599401dbdf178dfb3ec426e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772830253, "uuid": "7fb5b027-21b3-44ac-83ee-28b0baa360f0", "comment": "Malware payload (Gafgyt)", "value": "9c8c14784dc66d7d300088372243f04446544a55511c55ba45f72215a2f26e73", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772830253, "uuid": "747e76bb-f0fb-4ab3-b98c-b5f475378270", "comment": "Malware payload (Gafgyt)", "value": "efbda0c205217fd9d558220acddc151cbaf6319c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772830253, "uuid": "0b56e0b1-ce06-4e5f-85fe-46115f251d5b", "comment": "Malware payload (Gafgyt)", "value": "7e9d1f9cdac0de63801ddb67bf52d334557c9520a107b84606de55d246684ccec34fabf258f13346f383daea8a47c4bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772830253, "uuid": "5b7e9d99-0553-43ac-85f0-8bae78eb5d5a", "value": "T13ED3F831E804471BC2D227FAE79A429E3F361E9757D733155A38B9B02FF27891E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772830253, "uuid": "bc97eb19-52e1-40f2-afab-8b3094c48c91", "value": "3072:NHmSOBIJd+15kUr3HOmEUr6lcmP46aQyhYlfKINb:jOSd+j3HOmocmP46aQyhYlfKINb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772830253, "uuid": "3f61de8c-59b0-4162-a9ec-b824520c0bf9", "value": 132684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772830253, "uuid": "d83fc7ff-fdd7-467e-907b-3847d9032cf5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772830253, "uuid": "8db83d40-54ed-4e2e-a147-36dd6a9bc577", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baad1e19-1939-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772787116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772787116, "uuid": "5ae2a2ce-5566-431e-b407-78345e96f080", "comment": "Malware payload", "value": "cdec66ae72a9ca4a58a4036bb2b28e41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772787116, "uuid": "26486025-12b0-40ca-a4ed-830b198a296b", "comment": "Malware payload", "value": "9ce3c49bc6d4244ebe59a837e01eba842b766f68780e3a9d83d7827089f2db62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772787116, "uuid": "20136cb3-f708-462c-bd20-79f980517496", "comment": "Malware payload", "value": "7d6fbd91f9ae8900c0dcb6002fa0a368203b0c39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772787116, "uuid": "651a3bb0-5e6e-47d7-9b53-aca8f5f8f7f7", "comment": "Malware payload", "value": "3de9ff99eafa3258d1e71362c05e6d8315251d39142843e8d32eaf92456c9bd5bc8f39e79f8452cc121f89b64db41271", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772787116, "uuid": "98128efa-36f8-4e1c-819e-6affdeb316f3", "value": "T10F24A60AAF610EBBD86FDD3706E90B4635CCA50722A43B763574D928F54A50F4AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772787116, "uuid": "3d38cc1c-cb3c-4281-b32f-43b13ffcd527", "value": "3072:M47wz8e+Zbq8xl2uZQZ63PQG7HOrt4ua+49WXgFN:M47wu5qBuy6Bur5qEXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772787116, "uuid": "8c30aeaf-c3d3-4c68-a10c-5e029cb7c82e", "value": 228696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772787116, "uuid": "f28f7261-6d94-4bac-a73d-daa4c70cb749", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772787116, "uuid": "4c3a7f3e-9951-4a6c-8573-a967cdbbfdff", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca6a5c1a-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810764, "uuid": "f6165bee-782f-497e-8fc6-ff8078c65dac", "comment": "Malware payload (GCleaner)", "value": "09268341602700d2b7d2b349dde55506", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810764, "uuid": "e03bc098-f860-4f30-bfe2-f8d7c3bc8233", "comment": "Malware payload (GCleaner)", "value": "9d59ee45e20eb8a0309ca7f7c4b7eab579e2cc32360034beaef9736d07b4a820", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810764, "uuid": "561f931c-fab3-4848-8959-c962eaf17173", "comment": "Malware payload (GCleaner)", "value": "bd37ab122a0564b6e775def55c804c0d14d0ce9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810764, "uuid": "fdc171f5-6c64-446a-b96a-04c842df4df0", "comment": "Malware payload (GCleaner)", "value": "7cc9457cd9147c6866f7aaf4284c1364897579712d78b4ef7678621bc645266cf1bd55a6236cab0d7bf0b83dab667532", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810764, "uuid": "71a76319-b623-4914-a425-f27c83dd0692", "value": "T16805AE22F3B85833E1537A3CAD5B525F942ABD102D2454462BD5DECF4B38382392EE97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810764, "uuid": "ad8eba7a-9e2f-425e-a38e-06e3afe5ffcd", "value": "5343399a39928268750ade4858cbd1d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810764, "uuid": "20f5bfc6-1b51-4186-9de3-edcae6ddb453", "value": "12288:72d0/V6Chk61Wd0Mv6jE/h/xk+vGg3XjVkSB8PYi67o:G6N31WB6YJqCXjKSBiYi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810764, "uuid": "0869517f-df7d-4214-af75-1ccfda66348f", "value": 824832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810764, "uuid": "65427dbf-a290-43f8-b200-d0ac98393aa4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810764, "uuid": "b5f10133-7665-4333-b728-1200d07ba00a", "value": "9d59ee45e20eb8a0309ca7f7c4b7eab579e2cc32360034beaef9736d07b4a820", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "901f6be6-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772809808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809808, "uuid": "e4f318e7-56ca-45a1-ba4b-0543d5d2d087", "comment": "Malware payload (Formbook)", "value": "9682bb2d3838010a8877f03b1c9183e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809808, "uuid": "31ed7b57-9ca9-4939-92ae-0f12cc751ab6", "comment": "Malware payload (Formbook)", "value": "9d739d5982372f48923c38adda31baf327e0d7ecd6f568bed4899012a1bd9630", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809808, "uuid": "ed3b3aa4-e32b-46cd-ae24-87eaf4bc1642", "comment": "Malware payload (Formbook)", "value": "df99e8308b8474de92503c384787840920f9b499", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809808, "uuid": "b2c04eca-1638-445e-861a-e66c9b4c4904", "comment": "Malware payload (Formbook)", "value": "6cc572c44f5c66cfd6764ed18ff587ae1d34a2dc9292799dc3ff551e7088d11c1efcc600fb8d5d473d28929cd0703d9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809808, "uuid": "8f674ab7-73e2-4ef3-a147-22b32196ddea", "value": "T12645BF027391C062FFAB91334B5AF6115BBC79260123AA2F13981D79FE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809808, "uuid": "a8cad71e-6eea-4e39-833d-fa7c22f3a745", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809808, "uuid": "3005c052-bdce-4c4a-94b8-61314519fcb7", "value": "24576:G5EmXFtKaL4/oFe5T9yyXYfP1ijXdaUnC8zQIF9ts5/MgiRz43:GPVt/LZeJbInQRaUnC8EI4Eg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809808, "uuid": "defd197e-0fbd-4e76-bbc9-a25c4e99d0b4", "value": 1259520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809808, "uuid": "31ffcda0-e790-4ae0-afbc-f8f2bac9e9aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809808, "uuid": "bde1424d-ee53-437a-a819-bfca75c52928", "value": "9d739d5982372f48923c38adda31baf327e0d7ecd6f568bed4899012a1bd9630", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ca5fe29-196b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808406, "uuid": "6ebbd7ee-1af8-41d0-b0ce-245a3cd490c4", "comment": "Malware payload", "value": "dd9c36aabb1bc6496578f803dd658a4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808406, "uuid": "5a0af298-5736-478f-9e52-ca8c97d06c56", "comment": "Malware payload", "value": "9dc81909455bcbe708df0d51ac1db33aed33598e7c6f37063f20264a8d818e9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808406, "uuid": "7392ffc3-7e2d-485c-a31f-52e1b3662cf0", "comment": "Malware payload", "value": "33011b9436b0355b677caa7abd0a29d0d2ff1687", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808406, "uuid": "19835300-a4ad-4fc8-9b83-39dc3ab4a9d7", "comment": "Malware payload", "value": "13afa53c13f0ed4d6672e5587705376866020d7fd2e3bf4213c7af59de90c3f3d960b47c3b626b1c19445eaa5dacb4f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808406, "uuid": "1424cf8d-e7ed-4eab-bb4c-e415a654ffdc", "value": "T10625DF0523E95B68F1BEAB799174146087F2F917EB31DA9E7C8C41DE0A32B818652733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808406, "uuid": "0fb79144-1766-4657-a786-82cd88f0ad03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808406, "uuid": "87468553-f4ba-4b60-a17c-39d94d17274a", "value": "12288:cHy9o2tVX5rVBo83tUsm+u6cgJxPLX4DL1K0XGeglq7ehF4F8V5F4UWFI:L9oarVBo6tgNExj4D9Xng07ehaUOI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808406, "uuid": "2af10f24-790d-4182-8609-5a59c240168f", "value": 1049088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808406, "uuid": "4df0bd54-b6c5-4671-a0ff-f4b3b41ac796", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808406, "uuid": "c368e355-57d0-4e26-8d71-a189bb615f7b", "value": "9dc81909455bcbe708df0d51ac1db33aed33598e7c6f37063f20264a8d818e9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebb5cd9b-196e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809961, "uuid": "3e092fc5-9c0d-40d1-82b3-5bb1eedba3c4", "comment": "Malware payload", "value": "6aad7477c7d6b7e8acf8d686ab3fce51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809961, "uuid": "6775ac6e-0b8a-44d4-9c52-9cc7b1ce2a3d", "comment": "Malware payload", "value": "9e290c93e6bc7d18aae4b883b8e8f2ab118c5eef46cae9afd364df82023737b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809961, "uuid": "e3a977ba-1d19-44ca-9035-eba91cfbd147", "comment": "Malware payload", "value": "d303b927ac3009af4fd39131bfdaafac9b752b60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809961, "uuid": "67a2b1ba-a416-479e-a995-37dac309cde7", "comment": "Malware payload", "value": "72350f3cfc4013ce8950e2c0c8ce3fa076dbe36863be029f854f7f82e54b459bc4e3388b3db7f1a4872db43239a941dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809961, "uuid": "46755f82-6a21-4f9a-89cb-55bec80402e1", "value": "T192A401827140A27AD422C8B23EB75E968F977C259682211733A4FB3D3473992DF5B707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809961, "uuid": "c5019289-97c4-42e1-b3c4-d41160148f79", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809961, "uuid": "c0ff4a91-a810-4d9c-9328-5409b57abe47", "value": "6144:oNDlOiP+7wHtoS8CP/+wHQswV0leSL6kjjgeL6edZmaQprLQjNtsx:ol3f8I9Qsi0lek6kfrL6KmPxLsNtsx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809961, "uuid": "eb33ea86-72e8-49b0-b702-555db66aa5fe", "value": 449624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809961, "uuid": "7c56050b-25e8-4b37-96fd-4daaee2a30c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809961, "uuid": "c5558d98-0724-46e7-92a3-dc4b8c35ad60", "value": "9e290c93e6bc7d18aae4b883b8e8f2ab118c5eef46cae9afd364df82023737b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82c9fcee-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1772810644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810644, "uuid": "14d163ac-95fd-4760-a72d-12500bd4b550", "comment": "Malware payload (GuLoader)", "value": "eee349fc76ce8560b7cacf8bbf659567", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810644, "uuid": "b3da5236-3287-43b5-b517-5ba142ff538e", "comment": "Malware payload (GuLoader)", "value": "9e404757a4db3b2a4936ead7fbdc16d48593a1fc00bc14d788b9ea99da0e64b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810644, "uuid": "979e7749-2901-4866-95d4-a0711da2de59", "comment": "Malware payload (GuLoader)", "value": "7896b38a3692dcc6fda904673da7eb7707ed84b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810644, "uuid": "abb1dd14-4401-40cd-b18a-69e3fd76d17c", "comment": "Malware payload (GuLoader)", "value": "592a7d4a87c3d017f9bdb2f9ea985ced7e4ea9e181b2a8bff20b753e0aca2f1b7f1783218aca3be74583bacb5f62d539", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810644, "uuid": "79344b79-0d46-4882-b2c3-df86a7c90103", "value": "T17125239D21F210C7EF741631AE24CAD6D7365E21105A23B3F3807E09F56D1E6C92BA9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810644, "uuid": "ce2816d4-2ba1-4796-8d47-03ebf63ffbf9", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810644, "uuid": "690679d6-03ed-40ef-87aa-1b0df7767707", "value": "24576:9eYnv6BpAUIChGdAYONFwDEvlhisUb2gMEQg+yQtDLM:Jv6BnGKYOvLZUKgMNHyQtc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810644, "uuid": "f08f4d02-d639-4d23-be53-9b5489b1741b", "value": 1048832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810644, "uuid": "10735a95-7270-4f83-bdf4-b7027d864da2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810644, "uuid": "91f18d6f-23b9-4467-a6b7-8eb2b74f8a57", "value": "9e404757a4db3b2a4936ead7fbdc16d48593a1fc00bc14d788b9ea99da0e64b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bba67747-196f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810310, "uuid": "f424c3e8-6939-4d7b-9bc4-93e4f811e976", "comment": "Malware payload", "value": "4b7e74e44a166c301929608e98de85b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810310, "uuid": "3cb346d9-d0bc-4be9-80ef-0937384c2c56", "comment": "Malware payload", "value": "9e564cb11e49abe88efe7b2ef13fbc11179c7f02ed88c289e126b39906ae0aad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810310, "uuid": "ae8f9186-fdd5-48df-b8f7-3e8843e0e2fb", "comment": "Malware payload", "value": "f830592dfb5faf2566215fc4a5ea1382a336f880", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810310, "uuid": "4ff9b913-527a-44b8-bc53-cc29a42db3df", "comment": "Malware payload", "value": "400b90807f05bb00281d67da4d56413b0d1fb57594faa21f7ad35766915b2ad327914f9bf2a3e6ca815e2f898afde4b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810310, "uuid": "0bfe2a97-0e93-4a38-a30d-3f8cb47be40f", "value": "T11094E616EA60B465E89309703D79A657382D3C7A2680EC0BB78D8F5A3771993B0F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810310, "uuid": "d1aec666-1687-4dd8-b719-9339328d4b0b", "value": "fbc09c00e6d89ab0fa47e5a70783f521", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810310, "uuid": "ec487ba3-0339-49ee-8f74-bfb3989edb06", "value": "12288:IrtA4wVwtgMP3YLYh7YqoJZgk+iJJR9DSdgiy/lae4XkgEvbDN8P:sjP29Ds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810310, "uuid": "6de160ee-d2f4-4b5f-857c-c0914ecade14", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810310, "uuid": "98df06a1-4f3b-40aa-84a3-f16d346a965b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810310, "uuid": "07dc6fdb-a1ac-49d0-aaa7-b6280c75eee0", "value": "9e564cb11e49abe88efe7b2ef13fbc11179c7f02ed88c289e126b39906ae0aad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e006f7ff-196f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810371, "uuid": "17a48800-efd4-4872-9513-df68d6fa5b6e", "comment": "Malware payload", "value": "733bd92b7f3175580b322ea9ad6e6b04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810371, "uuid": "55711fb5-f232-4961-b90e-1576cc12f313", "comment": "Malware payload", "value": "9e82ffb9944fb58a8f2ea6c728ce6e3afa6560563666701d125b295fbf209bb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810371, "uuid": "2dc5ea5c-bc79-44a4-8a69-5eed33af99ff", "comment": "Malware payload", "value": "a12a9f7e06dcc01eb7c73f684fe35e8d48c59f98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810371, "uuid": "898721ef-fbd9-44d9-b992-7966f4f149a8", "comment": "Malware payload", "value": "e78e34ae7eee26412736fda233e4b8b98bc257263779813721aebc67ef475e997bb8db3120a8969ae5926309ec5b4e8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810371, "uuid": "9c9f61d1-f181-4a34-aa4c-4f29f812daa0", "value": "T19935F2215E832E65E2691F78C0A3489837F1F5175217D72B2FEC01FA5EA2FC9C92B452", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810371, "uuid": "8b5dba73-e9bb-4812-9471-5799967d14ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810371, "uuid": "e6bb4e50-828d-4c3d-912c-73dc722dfb1f", "value": "12288:dVOyLhXTFXAdpr+8Esd4sEwRA8Dk08T9i3gzAxcJivnlCypWNecZ4m:7VXqdZ+8EsdfRA8DZKAxoivntWR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810371, "uuid": "7422dad6-db5b-48b3-bac6-0d159143a03e", "value": 1114624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810371, "uuid": "519d1767-139f-40ff-988c-b31e0a86a928", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810371, "uuid": "c875c843-0857-4e70-b649-f1e25d015e29", "value": "9e82ffb9944fb58a8f2ea6c728ce6e3afa6560563666701d125b295fbf209bb3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "218f6052-19ae-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1772837110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772837110, "uuid": "5c87d153-4fd9-4a80-a6f9-fe0c286cfed7", "comment": "Malware payload (ValleyRAT)", "value": "d6b05ea8cfbf10b9707182f604686c4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772837110, "uuid": "1f6d638b-81db-43fd-8d0d-c32eedaa1b2a", "comment": "Malware payload (ValleyRAT)", "value": "9e92ca9e42081b0932a120476028a60cc4770522dd1c9b7394d697f3e36e5bd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772837110, "uuid": "daa6a4a1-7673-4514-89aa-a2443ac03b48", "comment": "Malware payload (ValleyRAT)", "value": "5a99d4ef95f3f37caed860842053cd074bae8422", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772837110, "uuid": "db74e3d7-d1f1-4d7c-a2d7-e012ab384e03", "comment": "Malware payload (ValleyRAT)", "value": "2a23a8f42cd5f3866c18d12c769cd5eb77810ce94e5b4f3b923e0d8e80cad18505df90043cf19917bdeb829f012161fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772837110, "uuid": "156a87e0-1a7f-4cd2-894e-8382937c24c9", "value": "T13BA633AA63B608F0FD66977E91F6C166F231B4A26395C34F129006531F33BE1587BA43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772837110, "uuid": "c69dd225-7519-4c48-a842-fd9ce7bcc027", "value": "20d446c1cb128febd23deb17efb67cf6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772837110, "uuid": "677881cc-6947-4136-a11d-07c7e60b0df3", "value": "196608:vkxc9VjA1HeT39Iig7auDXURuAGCTMQ4qZ8x5U42H3t3:8xcO1+TtIinuARuAWQ4qZ8jU42Xt3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772837110, "uuid": "911f5277-5987-4f35-b3cf-5ef532d64bc1", "value": 10093819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772837110, "uuid": "e46d5bc4-2b08-4ebc-ada1-349e96751169", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772837110, "uuid": "c8969b0b-a696-420f-b50f-30c23ef93d5d", "value": "PPT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26e66dad-1988-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772820798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772820798, "uuid": "bcb4d6d0-b2cd-4b62-9c19-da9a69312d21", "comment": "Malware payload", "value": "2d9b204b6c764465f4d23b868089595b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772820798, "uuid": "be326e90-d70a-40e9-9c0d-95e37b36afa0", "comment": "Malware payload", "value": "9f0cc147bf7561fa53a3c975b605a5ec19deb4457e627598f6b6d51502c46cfb", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772820798, "uuid": "48cbf8b7-ab37-4020-add0-f84016d708b9", "comment": "Malware payload", "value": "abe05685a01a6da529e255997d997ba842901ef5", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772820798, "uuid": "6dfad45f-9be9-499f-8958-95cf8bb20dd5", "comment": "Malware payload", "value": "a809267c9b4a3e4ce5e2492811f5b9b027ea4996bf862b0b43d42b06687e51d0f03f15544e67ad848c54ec7e12cb6355", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772820798, "uuid": "bc4e4cd0-d967-443f-8f39-db3c81f2b858", "value": "T11B2833C39AE1DD14D652BE3762516CE3623C8257BB8880BD5CD132830AFD5687FDE292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772820798, "uuid": "a4a5a8aa-03f3-4b06-8cc7-38197c1ba34c", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772820798, "uuid": "06c8701c-a902-419c-a218-992eb99e60d3", "value": "1572864:7YxcZYtslILUV5Ew+PFKT4foTuwwwXYPDwmjA8d+5ZW1e/W5JGWDPSln7:kcUxtKkoAPxkIIaJG427", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772820798, "uuid": "8531668b-f1f4-4d30-ad9e-8be7f9ff68b2", "value": 100910001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772820798, "uuid": "42012144-474e-4437-b48e-7c147706adbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772820798, "uuid": "6c96125f-e449-4073-a6ad-221d01d0c75b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43b6ab36-1940-11f1-a769-42010a9c0008", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1772789922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789922, "uuid": "cb35c000-eb3d-4dde-a028-cc7df1866582", "comment": "Malware payload (ScarfaceStealer)", "value": "9cee7daa2a1b21b951b778f76f85335c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789922, "uuid": "5346a3bb-57e7-42c4-86b7-9a8e9c349259", "comment": "Malware payload (ScarfaceStealer)", "value": "9f311013fccad98e6a51b11d46d426adf1848f9032aacb3a63502fdb5c8214e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789922, "uuid": "e90c8f03-f8d0-4a9e-8ef0-c87443e4fce2", "comment": "Malware payload (ScarfaceStealer)", "value": "feb912720d8006ef2b97e229011759787ffb54b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789922, "uuid": "4d9d9b31-ad38-4503-9939-9e98fbd20906", "comment": "Malware payload (ScarfaceStealer)", "value": "0d0069bb8f2a4dca6e21ef7a7e4e23a1cf0c035c02daf03ac17951aa38c83ca09c70e579400dfacebdb659aae4e8b862", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789922, "uuid": "4c0af227-d683-44ff-b825-3a4a0fc628bb", "value": "T1ECC623F945E152F481D34740618B839A75C2764E42FD5C2D3DD72C826A1ACAF228FBBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789922, "uuid": "44cf3af5-2a47-49d8-866e-d2828e79403d", "value": "8739de86cd836ae1476705562c069cc0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789922, "uuid": "5a272be3-ec54-4199-9f5f-dcc829055217", "value": "196608:tk+kv7EuoaqWMrRlmp6eRy/GZorQuehpsIr16QhYowZNmIg2Bqi+9xnFlhbIEZ:k7LJMrqp6eRy/korQu2psIrK3zjn+jxb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772789922, "uuid": "5788c712-77aa-4aca-adc8-3b514d7788ae", "value": 12518912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772789922, "uuid": "0636db74-208e-4d6b-9170-16e83817f6dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789922, "uuid": "41a5106c-a7fb-4884-9a8a-664a0f97c660", "value": "taviox_kiddions.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "904c2299-1984-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772819257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819257, "uuid": "52afc0c2-2677-4adf-9574-972f41bb56be", "comment": "Malware payload", "value": "fa578a66996690140702f28328f65ec4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819257, "uuid": "e30b6b78-4de4-417d-9d78-4510bfc5262b", "comment": "Malware payload", "value": "9f94e2df4306bb4aa9988ab18f975d0963d9fbd03b6a96a976687812f1b2612e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819257, "uuid": "7258deb9-53b3-4724-9f32-35ec8f1cbb59", "comment": "Malware payload", "value": "78559c8e560ace1492356ae1fbd489476cada18e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819257, "uuid": "5bfeafad-402b-4605-9c86-9ac7548a5402", "comment": "Malware payload", "value": "53acae7f7dfd848387cc652c29e44334265348d5f42d8c46388a15821d23532a34bc7b5884db208b9aeab6bcbab54815", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819257, "uuid": "fd1e74ac-19d1-46e6-977e-cd988fb54d6a", "value": "T1DD32E604CC51A453C77100FCF816C461F329235B6A0471A6B9AC5E780FBD565E0E9EDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819257, "uuid": "d2f03d43-3dc0-4ca7-86e3-44033d3da46b", "value": "192:waHe27n/o//f2IcxTC5FhgSyM0kV/u32wEdNypsWm4b8:waHe27YUxTC8M0cW3EPoI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819257, "uuid": "41505aca-31f9-49a3-8687-4f1fb0226f00", "value": 11185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819257, "uuid": "8181608f-4979-4e65-b23e-29c3796aac8b", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819257, "uuid": "f22450b8-71eb-4548-824d-131200e952c8", "value": "x86_tools.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27d9f6c6-1974-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772812210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812210, "uuid": "ba6cfdae-6e26-4ef6-bafa-bf351e20830f", "comment": "Malware payload (Mirai)", "value": "ac02f5c762f2936d0eba481fd6d5bf2b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812210, "uuid": "df4ff6b1-ade6-4620-92dc-965494675b3a", "comment": "Malware payload (Mirai)", "value": "a00ffe0dbb58cb90d39b35e2b133e390ec177bf0591a1d67083bec1a225da6f8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812210, "uuid": "ff79bd1c-5ad0-4179-9fe6-4514dca0353d", "comment": "Malware payload (Mirai)", "value": "74e7b376962a4d59acdd8707af7e98308f0eedf7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812210, "uuid": "8b21eb0a-409e-4511-ab6a-344eb4ddebad", "comment": "Malware payload (Mirai)", "value": "8abbfadcfe380daa3a694d545b8df3a4afd7e8c8f7d5c0b18e9f822754a2f766ba5d904af5744055e65ee86fc2310e35", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812210, "uuid": "fceb3542-573e-431b-8ff5-f26fb3ad0e62", "value": "T1624158CB27930E712D63A9A372B50804B185E1A594D1AF04E9EF7CF44D6ED257788EC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812210, "uuid": "d737bfee-db81-4542-b40d-e0aef499274a", "value": "24:vvyd/sl/s8/szld/sOCM/sG2G/sv/s4BHZ/s5/s5h/s4/sE/sjC19eH:v6GOLRGOMfR8AHKqQfTjuQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772812210, "uuid": "7d4f3f9a-885d-48f1-9709-8678686d806d", "value": 2002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772812210, "uuid": "41a605b8-7bfc-43ec-b1be-8f18da49ec08", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812210, "uuid": "14e811aa-4cfc-45c2-96d4-cad5f1585e92", "value": "jack5tr.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f76b1e78-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772811699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811699, "uuid": "6de0208e-e093-4f01-9009-4c3928103d99", "comment": "Malware payload (Mirai)", "value": "4a5a5b500a26471264171e76addc13b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811699, "uuid": "75190ac5-e2c3-4076-aae8-95d20735ed6e", "comment": "Malware payload (Mirai)", "value": "a069d39c3027613df89acf77c57d19fc05b1ddb8fa1429f3b9ce6213260e3d75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811699, "uuid": "a2142cf3-b081-431b-9eec-df5dae9b9b3f", "comment": "Malware payload (Mirai)", "value": "6c79a0a60851e2edc7f3321e93d99f9b7ffdad93", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811699, "uuid": "fa63b185-4620-4d65-9ac7-99affbe3b3be", "comment": "Malware payload (Mirai)", "value": "b637790b6040e38f5175d2308c4fb546ee231f57a6f1e5c116f9c83f504f04c993d34cf12f219f4f618979870406d664", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811699, "uuid": "c4e2ec33-4796-46d6-b95b-9dc80e6b03dd", "value": "T1A1E3B71A9F910EFBDC6FDD3302A9060635CC954722A43B763674D528F64AA4F4AE3C6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811699, "uuid": "091c8b0f-1a46-4074-afa7-8429342fe3a4", "value": "3072:6xjJw1Cc/0s6YAPwenUr48pzfR+JonCy:6xlw1xAop0YfRC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811699, "uuid": "0d9e9c3f-a294-4632-9a95-cb9a3dbad5cc", "value": 156680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811699, "uuid": "bdf17420-d3a5-438c-9181-7b16473c72b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811699, "uuid": "b336e2a6-896b-468d-be90-915f8f77ce98", "value": "iran.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ef616d2-196a-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772808061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808061, "uuid": "bbede240-0819-4527-ae41-d380456f2f8b", "comment": "Malware payload (Formbook)", "value": "2ae311d7d5b054bd15a031ba76a89c07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808061, "uuid": "658e40e7-d2d4-4dc3-8d7a-6836b10e0a85", "comment": "Malware payload (Formbook)", "value": "a0d08d72ad65dfb4671ee4ddf6e0e47cf97f64bddd5513352556a4169f08bb7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808061, "uuid": "0dfe33b7-3aec-401e-b865-124959be22c6", "comment": "Malware payload (Formbook)", "value": "18d0766838c235c8f818435ba3bd9db354e24620", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808061, "uuid": "cdde0ce0-1ff2-4f99-8e81-81474ca697f5", "comment": "Malware payload (Formbook)", "value": "010c64f8630a0a048671c73ea45a95caa69dc77094a8a140ccc74859fad200f650aa12110d358caae83895a4972c06bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808061, "uuid": "c325850d-a14a-4184-97b8-258f9b1ac425", "value": "T13E351258765BCD23C1A8077255E6C27053F58E88F233C28B9EDE2CEB7746F925A84706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808061, "uuid": "004e127d-4dff-48d6-951c-ea1ef29dbef4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808061, "uuid": "1b7ea3a1-a73b-4ac4-b1b4-11a557691e1d", "value": "24576:EBqn5guQaVUu0RzmIWaR03VXn40QEf/voHI7MZUreF0XKVict:H2uVVCSaq3VTJYo7//XKQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808061, "uuid": "0c9211bc-76e9-45c1-a1c8-193349737db2", "value": 1081344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808061, "uuid": "1127b0de-83de-442e-9039-68d4bfe3a110", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808061, "uuid": "fd0413b0-59c7-4cc9-82bd-2a6ab520ccfb", "value": "a0d08d72ad65dfb4671ee4ddf6e0e47cf97f64bddd5513352556a4169f08bb7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3198dd87-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1772809649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809649, "uuid": "c737e41f-b79b-4892-a909-f09d20e13abf", "comment": "Malware payload (a310Logger)", "value": "1c1b82acdf5063b71b020261b1b7fdff", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809649, "uuid": "2b5ee61f-814f-49ae-ad50-ee3d869f7d4d", "comment": "Malware payload (a310Logger)", "value": "a10cf7440bd463314251e811c1ee9f13ba57721d57b2dd5cf0ea72f76ce79d8e", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809649, "uuid": "a1b5dc24-e3a8-4706-b1d0-be63f95d19fb", "comment": "Malware payload (a310Logger)", "value": "c9d3c47471cdc77decf5a4f4335fbe7221c1d5b4", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809649, "uuid": "694dd73e-e0e4-4913-ae30-82a49d196c19", "comment": "Malware payload (a310Logger)", "value": "f42cd85b4159ba5e122cea086fd733113fac8a6a8b4368c9368675eaa981378c8f95109d070471dcdb34021dc5e3aa6f", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809649, "uuid": "28090ecf-4dd5-4841-b513-c209a7fc0a71", "value": "T17E844A23E660A12EF1A3C9F1B9A5A25728263D395698EC4BF3415F5834711E3ACF131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809649, "uuid": "5b4cc110-e3a7-4e7f-8eea-25bddd157cd7", "value": "252c027bda7298291893ceb108f11214", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809649, "uuid": "466cf64f-c0b6-46a8-8f31-49847767b6d7", "value": "6144:q8d1/w5KA81IJ8GpF6nuTmOOUWTGpsI4sDC8kmiheWaycRxvK/o:ZjYKkJj6GmZUW6lD4/aycRd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809649, "uuid": "eaf43562-5210-4082-b5fb-91b87a2e64cf", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809649, "uuid": "dfe4d45f-67bb-4831-9555-2e1869755517", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809649, "uuid": "9b868783-7f74-4278-b82e-0e3b99345fb6", "value": "a10cf7440bd463314251e811c1ee9f13ba57721d57b2dd5cf0ea72f76ce79d8e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "090b324c-196d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809151, "uuid": "42820390-ae81-4257-aae9-2730970044f7", "comment": "Malware payload", "value": "47599b54615ef56b426e4faeae49b6e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809151, "uuid": "8b4b6b94-8b6a-43f7-b94e-59a9ba01f6f0", "comment": "Malware payload", "value": "a11fda0cdfbdda4013f8d440b58ce58aeecc9ea09220ab87c6a08cf154951575", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809151, "uuid": "525ae37a-b017-4550-9132-d9b815d6b74c", "comment": "Malware payload", "value": "0a50beed34a72bb71acc15ecb716381efe17002b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809151, "uuid": "7b099d36-7cd1-425e-af76-08b9dede2696", "comment": "Malware payload", "value": "9d4f9202c2d9c2f93f295167aa4ee9b3966405f9aa8648f9bec21b5a45152408b222e1c4a7cc89adb1efaa30366475d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809151, "uuid": "f26b3dd4-8699-4867-9569-558115ab33bc", "value": "T18E74E04BE717A910C2868933D9F548FAEBB09D23A455043E3352BF1A4D398CECE1917E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809151, "uuid": "27e3caa8-e6b5-4915-99ca-1eb4eff080ee", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809151, "uuid": "083d0a1c-cf64-4dcf-8160-738dba65abae", "value": "6144:RNDlOLZLClTgEN7wbVniH2QgD/IAtExxJ7l43KVTeR0jEX0Nbdi:Rk8TgEN7+FiYD5tKv9peRtXwbU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809151, "uuid": "7cba7437-1733-4ee6-84b3-4ba329217ab5", "value": 351024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809151, "uuid": "7cc9f374-5ca8-487e-9398-92b121f163ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809151, "uuid": "de4e397c-cbec-41a2-8c7c-cc317663388a", "value": "a11fda0cdfbdda4013f8d440b58ce58aeecc9ea09220ab87c6a08cf154951575", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "416ddf9d-1982-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772818265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818265, "uuid": "5c212f48-3229-47d1-8ff5-24d7fe026463", "comment": "Malware payload (Mirai)", "value": "25d839c328b3c9d45bc26aba35087d7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818265, "uuid": "aeb8ab55-34a4-4198-9847-d2592ae1549c", "comment": "Malware payload (Mirai)", "value": "a14a1eb344f45734df1dbf26e91dd5e2b184d0a98829649db89831a4a38d29ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818265, "uuid": "51ba5528-886a-488f-8775-bc9a1d8632d5", "comment": "Malware payload (Mirai)", "value": "fb61ee8ee1778e0877667898ebdc6f6972550080", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818265, "uuid": "8b443666-e7f4-49b2-ac89-be8ddc32b011", "comment": "Malware payload (Mirai)", "value": "e373014b8225231fc3ffb8285afdc5700722dc8817a993fe0cf0dd7b20ae222a278fb587dd258bbdd88d5437526d4bf9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818265, "uuid": "8ec00181-ef21-4c90-8c38-5623f3f2512d", "value": "T1D9D35B0673180E17C5E349B02A3F17E483FEE5D121F4BA89691F9B6A4672E771482FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818265, "uuid": "086f420e-5ead-4757-a7a6-08a3b41682dd", "value": "3072:oWGIf1/UwfhJdU80rutbYUaDGMsMA9TK1t:oWxN/UUDGKbYUaiMsMApK1t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772818265, "uuid": "66098bcb-edc2-4471-8fe0-5793060fcd83", "value": 134840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772818265, "uuid": "7bdac09f-afd8-4581-95f2-d7f0b5ab2b76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818265, "uuid": "45a31a5b-3315-4ecb-8045-272023b972a3", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b3b1457-1974-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772812215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812215, "uuid": "b6930e2c-77e4-46ad-9ca6-d3ffcf8c75ca", "comment": "Malware payload", "value": "c1ab5f9f46449d4d9e1f6cb803a5c3af", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812215, "uuid": "2c0301a2-6ead-4c68-a63f-f06a5210d72e", "comment": "Malware payload", "value": "a14f3b15d998a9a37fc4949280c07c0d33deb16f31f50883ff63e9c3cac64ca5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812215, "uuid": "793c87ac-6f82-4481-bee4-065b874c87fd", "comment": "Malware payload", "value": "d7c423f969738992049d94e3e138544f4649df21", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812215, "uuid": "77e32d3f-5506-43b8-bfb9-5e22254b9e2d", "comment": "Malware payload", "value": "697109bb87f98e71697f1cbf610f9d7e9829d44c1c551d08004ac21b7406092fdbe9201c9f97f0f61f0b667ed656949f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812215, "uuid": "0ba7f2bb-2038-4372-b95a-d9704112df0d", "value": "T1F0514F9A42848BB1D70DC55EBBFA3274E94AA08357EEDE0CAD44882D4ED6D4C7286F40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812215, "uuid": "97522845-76f9-459e-bb59-d5f9818f5e8a", "value": "24:NQ2JMPlbiBXAuZ2EBEnE2EhEaLZbw0zJUfwzhM3G:NQ2JMPlbiBXAuZ22cvyVZbwUzhM3G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772812215, "uuid": "c7b8cd61-8428-417b-a8f6-779fcb16efe7", "value": 2907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772812215, "uuid": "190c36d5-6a87-41c4-9305-78a89218fbc9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812215, "uuid": "a74b8b83-6ca0-48a3-9d5f-db708ab1b677", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f04d3d5-1942-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772790800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772790800, "uuid": "cbfdd9b9-5fa5-45c4-acb7-a0fae1edd5b2", "comment": "Malware payload (NetSupport)", "value": "0b05c745d376413249d83e8ac635df5d", "object_relation": "md5", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "aoaoalsflfkfkfk-com", "colour": "#34764F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "notaoaoalsflfkfkfk-com", "colour": "#841C7A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772790800, "uuid": "deb25b4c-1de8-49e6-8d15-37c4889ae4ac", "comment": "Malware payload (NetSupport)", "value": "a1c5e242c03f26975ad4c9052fc55aaf9a2c89abc9b5f25fc018dbe432d25cb1", "object_relation": "sha256", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "aoaoalsflfkfkfk-com", "colour": "#34764F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "notaoaoalsflfkfkfk-com", "colour": "#841C7A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772790800, "uuid": "4b9d75e5-c31c-4b96-9b10-b00a2081d7bb", "comment": "Malware payload (NetSupport)", "value": "ea6685879689b75d8a142687da2889bb39d08ab3", "object_relation": "sha1", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "aoaoalsflfkfkfk-com", "colour": "#34764F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "notaoaoalsflfkfkfk-com", "colour": "#841C7A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772790800, "uuid": "f2f7c601-2dcc-411d-b391-1ca87e170471", "comment": "Malware payload (NetSupport)", "value": "03fd3924a2aeec4c669d79882af0d9bb052eb03afb8474636d8fb30f81de57188ac2c1bafc413c1ba1f5c4d57973fce4", "object_relation": "sha3-384", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "aoaoalsflfkfkfk-com", "colour": "#34764F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "notaoaoalsflfkfkfk-com", "colour": "#841C7A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772790800, "uuid": "e74b365a-62e5-4ef2-bfe5-cd5b4b3ac85e", "value": "T15EA16539E602582D067707AF48A15918FD8B843793860AC4B55C54AD3FF2B2CC65F57F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772790800, "uuid": "7483fa68-2dd2-41e8-b663-1808557661f3", "value": "96:VwSc7f9aA8Pwt0qF39XStWaE0+IqYQdOH43:VREVP8PwXFtuE0+IqYAOY3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772790800, "uuid": "95423282-591d-4620-bd6d-c33cf191f93a", "value": 4922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772790800, "uuid": "ec35f437-7f65-4caa-8fd8-bfd9f177c881", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772790800, "uuid": "4abb2876-714d-4f24-b766-15ee34ce437f", "value": "a1c5e242c03f26975ad4c9052fc55aaf9a2c89abc9b5f25fc018dbe432d25cb1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2f43ca5-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1772810752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810752, "uuid": "84aababc-23c4-420a-a548-5f5b2754d47d", "comment": "Malware payload (SnakeKeylogger)", "value": "c9e96fdbe55713faf592116326da9357", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810752, "uuid": "902375ee-3427-458b-97bb-9887cc200779", "comment": "Malware payload (SnakeKeylogger)", "value": "a1eac05b425841350c27d46607b35627c810d1454fe6037458f5b31739885c74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810752, "uuid": "6c48a572-3521-4ece-8c43-7eb70fdb69ec", "comment": "Malware payload (SnakeKeylogger)", "value": "f31e58c116d7304a5e27d1d1910f9a5455904cba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810752, "uuid": "ff4b6c84-e89a-4b70-9f24-3b6ccfbe8422", "comment": "Malware payload (SnakeKeylogger)", "value": "cef0a12bc9aa5be56f698cab70dddd0ccce9b86036d5fb95f9bf3cd171de5d2a4ca30b21a9afa0abe6ab393148cf2086", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810752, "uuid": "9d5a2bf2-2717-42f8-bebd-3516d5ce6846", "value": "T166F4235695C1F550C654A330C436CC95A5643870DE48B23BC3ADF26EA8B82E3DE7BB4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810752, "uuid": "06b0cbc8-de31-4d90-8d7f-48b523727f71", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810752, "uuid": "971c4386-0fe5-43c8-b85d-f1116c541c8a", "value": "12288:mz7hU5I5yuNHIgzSFKxWltRohBfSTso93UZDf93D6rrcjT5lsOXVxwC4FxYfcJoE:mf+iN57Gtene3axzjT5VYplmI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810752, "uuid": "52a47b91-7c33-4c41-b307-8c26059fb73b", "value": 751104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810752, "uuid": "a1f9f560-48fb-422c-9f0e-10ecdad7c182", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810752, "uuid": "6bb2e5ca-5729-4895-a567-0989d0d2df7c", "value": "a1eac05b425841350c27d46607b35627c810d1454fe6037458f5b31739885c74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9876601c-1969-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1772807674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807674, "uuid": "d75bc020-1143-4b17-a049-85987499b807", "comment": "Malware payload (a310Logger)", "value": "6ad6d3a8a59705019e6d536bfd652756", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807674, "uuid": "9e8c44fc-cab0-4f9c-ada1-477a1612a5ee", "comment": "Malware payload (a310Logger)", "value": "a1fefc51b7dcab1a07c1ca8cde18ed2f6a3c12c911a2f39f1697183c6593a4d8", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807674, "uuid": "2a84ff7e-1c26-42f9-a246-7f3e39ba437a", "comment": "Malware payload (a310Logger)", "value": "259495886a3d6b84efea7c63c18640fc352d50c8", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807674, "uuid": "a442b326-ae3c-43e4-b044-4c14563fdf36", "comment": "Malware payload (a310Logger)", "value": "52e23aeb72a32079c3d7a3c1188401030ab012b3847df4fd6c187326fc01dd20e30704e2ee8d18d3ca71c680accb9d88", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807674, "uuid": "eabaa4a5-e1bb-46ea-b7df-71b80cb791af", "value": "T1CA55E10B27D04A68E4FC9B75D2B904E543FFB70B5722E75D690A11EB8D22742EE01B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807674, "uuid": "8af36623-e8ae-4cd5-8cd2-4d3621d83326", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807674, "uuid": "73770640-dc41-4c58-b7ea-7a78e2df9f35", "value": "24576:CkfZNC8ZHKJCX0fI8mVS7spojZ6tm48YT1KObeH4e:tZWWgI8mcgOj94pxA4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807674, "uuid": "8ac26b66-3743-4765-9fee-404742b5f1e4", "value": 1368064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807674, "uuid": "7ca4faef-3625-4486-9097-f0594849aa22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807674, "uuid": "5ef49a14-6d9d-4783-a3e4-ce1d2d1e4e0d", "value": "a1fefc51b7dcab1a07c1ca8cde18ed2f6a3c12c911a2f39f1697183c6593a4d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "061da146-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819025, "uuid": "13ed4bdc-ae10-46e7-aefe-f56b9d840afe", "comment": "Malware payload (Mirai)", "value": "eec040b30fab92d7884315fb8b0b30f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819025, "uuid": "afbd519b-6886-4b9b-ae0c-a6b4e941e489", "comment": "Malware payload (Mirai)", "value": "a21679f3a94251932879bee5ebd5bf4b62d621f2c0e2fc7c48af5c6f4dbe5db9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819025, "uuid": "25f4e863-0255-47eb-a1fc-b1c5e72bb94d", "comment": "Malware payload (Mirai)", "value": "2753de5cac05850f23538251884bfe9e30b6c2c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819025, "uuid": "903ff8e5-779d-47bd-b42f-748bdfafc3c5", "comment": "Malware payload (Mirai)", "value": "1b39d7977fa51f53ea7c13c24f8367ad95e6c0128edf170d0e18914f1bf1ca28c6efd008a8af422692901b847c697c13", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819025, "uuid": "7dec72d6-139f-4056-ac00-d207e561c442", "value": "T1AFB309CFBA0D0283D5A34EB81E3B37E58F7DD62211E867425506EB8447B193A4267FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819025, "uuid": "4b908569-cd9f-45a7-b9d7-c2a0265301e4", "value": "1536:6yKLC6PPMuq8OFhEThhypPX6BFzXczSpPVbWBXOiExPzQEMK0rx2FVGyxFukBrvv:HoFh4X6BFzXJpPVCsxPzF0rOTukBrn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819025, "uuid": "192b21ec-6c4e-4a94-b8da-61f4c62dc270", "value": 116632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819025, "uuid": "ea4baf3d-c2b7-4a24-acd7-631a8669aabd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819025, "uuid": "dbb91e46-5a7b-41c4-a409-f4c073d06b16", "value": "debug.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01c3781e-193e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772788953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788953, "uuid": "faf878d1-5f49-4183-88df-a7829c545aaa", "comment": "Malware payload (Mirai)", "value": "24c83bb19ae14f542c69b6fb98a6c647", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788953, "uuid": "959c7628-443c-4ebd-9282-ed0539395945", "comment": "Malware payload (Mirai)", "value": "a2448162f057ada3ce90c5e5c36759b0d6c79d427b0a9d0ca7ff780c3f179d20", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788953, "uuid": "fb63f2e8-0291-4b8b-aa13-a73dff44f22f", "comment": "Malware payload (Mirai)", "value": "29c4f1652686ef8f85a9732f71d53167d31bf58c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788953, "uuid": "251861a2-328e-4c82-b4bc-6faedffcd64c", "comment": "Malware payload (Mirai)", "value": "f28807751709b552ea61ba7070db39743483ef4e644225ee8463493cf4c59e01b2b67f6dd9e53384c09363f6c21751db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788953, "uuid": "60719327-1d70-463c-815e-772c34a7a34b", "value": "T1C1834C02B70C0E83D1675DF02A3F27D2D3EE95A121F4FA88691F9B8591B5E335586EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788953, "uuid": "80b83671-ce05-4f5b-88a4-503c69da5c84", "value": "1536:E7ngrc+NYT7Lr0XfO02PFoqGIRnqURGSH8GxYpgwZD0Z:E7ngrDaTAXQcfUvH8uhZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772788953, "uuid": "8743951a-c86b-43eb-83f1-9f427e320823", "value": 83760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772788953, "uuid": "01777fc9-41ed-4163-bd6d-cdd211228870", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788953, "uuid": "c6559bad-7fb4-41e7-8d4e-1af83d12d1f2", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b45205a5-196c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809009, "uuid": "99377fb1-20ca-4f0b-8cfb-e822b65bbf5d", "comment": "Malware payload", "value": "922babc1b57f529e9e396e6f8c872923", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809009, "uuid": "1105d5c6-9dd2-4ae1-a99a-050b810709e2", "comment": "Malware payload", "value": "a28d0ecdb4fdd57c86c255e42d17dde0a7842a20d2e4317d0284d6a2cae2fe8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809009, "uuid": "342f8da4-8430-4818-8831-623b32a36c6d", "comment": "Malware payload", "value": "c07a7fc41f1f3743d225a6a9d2b1bedd331d9e32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809009, "uuid": "19488a1c-d134-4aa3-aee8-901aae4a6997", "comment": "Malware payload", "value": "b2751dd0811dd8ceb00160689dfb299675296c7b9d437e1a2620501c8742fa635ebcad4c270dfd22f382b1eba1725fa5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809009, "uuid": "5985efc8-ded4-476e-8819-8149a07b9260", "value": "T15AA63947ECA505A5C1EAD175CA769653BA713C885F3063D32BA0F7282F73BD0A9B9700", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809009, "uuid": "ab53b7c7-bd8e-4495-b01c-7ed7357f3406", "value": "98304:vChFJoq+K6l39Egtgqp89eZ87P3ijUcjsew5PSDYuuEnC:vw+9l39t9I3iFzwFuLnC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809009, "uuid": "6e00816e-38fc-41c8-aa8e-b7b505d02d1f", "value": 10051876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809009, "uuid": "48fb04a2-8c64-43c0-9a9c-714e26139b9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809009, "uuid": "8a2928e9-5a74-468b-862d-b8773c0e7a9e", "value": "apex_cnc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2df382fb-1971-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810931, "uuid": "08d3d206-f20c-4b08-a585-5df081d92ffa", "comment": "Malware payload (GCleaner)", "value": "3bfdead21ad128d612a6e1730dfcb0b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810931, "uuid": "ec9bb113-531e-427e-93fe-21d49c8fc79d", "comment": "Malware payload (GCleaner)", "value": "a2a813a9d7623ef6158aa19926a52d3ba7461dbca522bd2c117a3db969b101b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810931, "uuid": "27594cff-17e7-4982-be0e-b1d6c63bc460", "comment": "Malware payload (GCleaner)", "value": "2ff32e15b9e2779c29c6426a06aeb8ae2762927d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810931, "uuid": "8d230246-de73-4aa1-9786-a08e7f983af2", "comment": "Malware payload (GCleaner)", "value": "cc7ecb19e62130049a2197cbe8c0c65fedd346d89134a4241753bb9b6ae4b3247661bb8bdbace31c5c76131cf35e3cd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810931, "uuid": "d830a964-6f3e-448e-81d3-60e5ef469187", "value": "T178F4AF32A2A08433D1622B7F9D5B975C9426BE002D25D946EBE81ECC8F3D7C1793B653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810931, "uuid": "c5ed3bc8-668b-4d9a-9a22-9ffe6d255b46", "value": "5343399a39928268750ade4858cbd1d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810931, "uuid": "e206427a-8d8d-40f1-a8fb-4b504591b76e", "value": "12288:c2d0/V6Chk61Wd0Mv6jE/h/gkRWen31qbKqI:h6N31WB6YJDRWYqbp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810931, "uuid": "b5739839-7e46-4537-a24d-45a976684370", "value": 748544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810931, "uuid": "2bf16eed-60f1-486a-aebf-4ebac9c9b3df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810931, "uuid": "55fb11f5-2846-4fce-8d95-10a30bc185eb", "value": "a2a813a9d7623ef6158aa19926a52d3ba7461dbca522bd2c117a3db969b101b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5169650b-196a-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772807984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807984, "uuid": "55eb45c1-8590-4081-8b3e-e44c7a442882", "comment": "Malware payload (Formbook)", "value": "c18d900a3d4464d7af4b6fe39fcac114", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807984, "uuid": "f7ec20bb-7392-4bf4-bff3-28b59325fa92", "comment": "Malware payload (Formbook)", "value": "a32e127c2467bd9edcb529f6a06137b6b0c1ea2e68da68ac16ad22717673efca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807984, "uuid": "a79dba23-a895-451c-933c-8c0597ffcd4c", "comment": "Malware payload (Formbook)", "value": "994a33c12d11459fed7b5190c21b715ec2d9b250", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807984, "uuid": "8139d08e-0fb7-477a-b72b-370b66fbecb4", "comment": "Malware payload (Formbook)", "value": "653cf5c5870eb3aebbdd70568c3ce41690d21a08f76e3a559160827b07632a74ebc5b6e85d0168b935c5bafdb4aa7871", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807984, "uuid": "f0c0fab8-2e03-4d72-a966-8699147e61a4", "value": "T1DD45CF027391D062FF9B92334F5AF6115BBC79260123A62F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807984, "uuid": "56fa015c-7bd8-4980-8dcd-0721cd74e3cb", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807984, "uuid": "77cfc8cc-7168-48d4-8e37-c4d6d4febcc6", "value": "24576:u5EmXFtKaL4/oFe5T9yyXYfP1ijXda4zWfGA0/Z8pN2vhuNwO:uPVt/LZeJbInQRa4jAU8ypu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807984, "uuid": "32cee39b-be84-482c-9e22-c12a29cd66e8", "value": 1253888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807984, "uuid": "81afc9b7-1b58-4d4e-ab55-aa5c2de9562c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807984, "uuid": "8cdd8c4e-7dc3-4e87-8c48-fc813bff865c", "value": "a32e127c2467bd9edcb529f6a06137b6b0c1ea2e68da68ac16ad22717673efca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe86a64a-194a-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1772794531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794531, "uuid": "af2db89c-a25b-466d-b09c-4fec5a96bf7c", "comment": "Malware payload (QuasarRAT)", "value": "43429e3379ab6a6fa82e4452e8b34741", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794531, "uuid": "0fd36fc2-f8b9-4646-b75b-98659caebdaa", "comment": "Malware payload (QuasarRAT)", "value": "a342889b6129444756d089aacbd647b1fcb0273ed5894885e1641038a001a2d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794531, "uuid": "9c3310ef-365a-4eff-bf0d-f0e0a8b15091", "comment": "Malware payload (QuasarRAT)", "value": "5981d9286267a62787af15fe0494cde066516a21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794531, "uuid": "7197b1d7-cbdf-496a-87f9-37ef56abc3cd", "comment": "Malware payload (QuasarRAT)", "value": "7c946c23dc6789e405108f9378962cb2829e0586e05be6e8d8e9cae53d8268bd188312ae74445e6c271d205a0ae99460", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772794531, "uuid": "1889e145-3bf1-49ae-8f8c-8c87d9e3264d", "value": "T174D4022037FC855BE1BF66B998F126006679F663B623E74D088462ED4533741A9C33BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772794531, "uuid": "bdb382a6-c594-4d74-b6f0-19d52d3675c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772794531, "uuid": "4ae6a387-9955-40a5-afdd-79caeaa89b76", "value": "12288:cPRb9SoSjkqjVnl36ud0zR/6CtQ9PUHIG8Dl8gSD+37PWY1Y1+f7LfNfWwbkzzh3:cJ9ejkqjVnlqud+/2P+AlUDcPt1aKFOR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772794531, "uuid": "41b4a11d-abe9-493c-8520-20e1cc1e7b38", "value": 646656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772794531, "uuid": "cd5a32c2-cffe-4185-9e46-4dc035611375", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772794531, "uuid": "7492cdca-8864-45f5-acd0-f9b5200532cd", "value": "Sys.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1560f0b9-196f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810031, "uuid": "4f054f5f-5bab-444c-97a0-69987c563ad0", "comment": "Malware payload", "value": "3cc098ee762f55fc8e2332b42c4da753", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810031, "uuid": "26aeaaee-290f-4d61-b519-650a5931923d", "comment": "Malware payload", "value": "a350fd112ffcd6c01d5f23d198a031daf7a4343969790dbb43358dd5048fd023", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810031, "uuid": "ab20e88a-000c-445d-8db9-df4f782545da", "comment": "Malware payload", "value": "e2886c3803afb41cc07c078efd233b1e1899872f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810031, "uuid": "247fefeb-f497-4cc2-9c3a-bfc0771ebe3b", "comment": "Malware payload", "value": "d97e1a644b1cfa867073d12023cc55190be034af8abb82c2cd5a846b802773e2c80a0380c2b13fc9d8869167f587041b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810031, "uuid": "94e6d8aa-5074-494d-b288-89f1cd04e2de", "value": "T1C184F1C27240F3BAD46288727A7B4E9A9BA77C25669125073350F73D31738A1DB1B707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810031, "uuid": "6825397a-44ac-43cf-a240-60e87d6cccd3", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810031, "uuid": "9ffaaa3c-eea1-46d0-979e-6c6cbcc4df07", "value": "6144:iNDlOiP+7wHtoS8CP/zYVqBCzPZiQk6C1WdMMgy6HwlI6:il3f8IztCzBiv9U6Mga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810031, "uuid": "16f568fe-9b1f-449a-82f3-fb1998d6f919", "value": 400096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810031, "uuid": "e6fe76e0-de1d-44e2-9e73-529f00af84de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810031, "uuid": "eec88128-7ff2-424a-9b7b-3af68f1dc6a6", "value": "a350fd112ffcd6c01d5f23d198a031daf7a4343969790dbb43358dd5048fd023", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "409f1d19-196d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809245, "uuid": "82072544-be43-4f96-936d-dff027bd7c1f", "comment": "Malware payload", "value": "d91f4350947fc2a18063e7217d97cd2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809245, "uuid": "c9f60796-1d02-4f78-afaa-becbc8ab6c9c", "comment": "Malware payload", "value": "a35b8d862c26f4d664309383e529a93edd3cb4562356894e28cafec247a0f159", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809245, "uuid": "6cbc8c33-5b7b-4884-92ad-46f99237037a", "comment": "Malware payload", "value": "a5a6edc4cca8fa3206802a57c1177e2e27c58915", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809245, "uuid": "e2fa5cd4-2286-4307-be23-2bc76739bb61", "comment": "Malware payload", "value": "4776fe5986026526c84868881d5d12b27c1d48b13b7a07ee14e8acf6d3551652fb8e477f2a53fcf6365ae82ed07a0948", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809245, "uuid": "12a5b047-78ca-405c-9760-a81d8a3f560f", "value": "T1D545BF0273D1D062FFAB92334F5AF6115ABC79260123A62F13981D7ABD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809245, "uuid": "a36649f0-af79-475c-856e-f03fc20abc0d", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809245, "uuid": "0e847b94-9d3d-4623-b718-a10532a271ab", "value": "24576:D5EmXFtKaL4/oFe5T9yyXYfP1ijXdaBBH1RLJ3W1QfbO1a6EMD:DPVt/LZeJbInQRaBBHLLJW+fy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809245, "uuid": "c02ce615-cea6-4ae2-896d-b197d38a2f79", "value": 1273344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809245, "uuid": "26d185f6-c5d3-4106-8b68-af00d875645b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809245, "uuid": "97b5ba53-d538-4850-b8ab-fb8177eb8583", "value": "a35b8d862c26f4d664309383e529a93edd3cb4562356894e28cafec247a0f159", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8a9b7d8-196c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809017, "uuid": "08594688-14c1-481a-ac1d-6aa9b31fb1d2", "comment": "Malware payload", "value": "50a60b0dfd716a6991fc8ec837891379", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809017, "uuid": "2d2720a5-40bf-47e4-9e0f-4ee4957c40c4", "comment": "Malware payload", "value": "a39f1ef95667b114a57086c853357f8855833a1bfc18d37e93c04fdd4945ef45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809017, "uuid": "23c40f54-03c5-4811-b484-b146f7d8d44f", "comment": "Malware payload", "value": "30c496d25d4b3f1013fc15b124a2c97c5455aa95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809017, "uuid": "434c99b6-6fb5-4d7b-83e9-eafa19ff36e2", "comment": "Malware payload", "value": "276a35a216a31915b7dc6f3e797647a7b5110e4fff3e5e8b02af7211389c52ed0239cb3156ace4f7983fe2936941a366", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809017, "uuid": "4002b5fc-3750-4c7e-949b-c7b059808028", "value": "T1FC45CF027391D062FFAB91334F5AF6115ABC7A260123E62F13981D7AF9701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809017, "uuid": "ba8ea30f-0f9f-422b-abc5-7b95cd6d0ac9", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809017, "uuid": "20cabee0-44cb-4915-a932-c433db1e2a3f", "value": "24576:h5EmXFtKaL4/oFe5T9yyXYfP1ijXda23XauOWpju4cZPa5AaVt+W:hPVt/LZeJbInQRa23X1OWnYPa5As", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809017, "uuid": "a1425d22-5f20-4db0-8fb2-9eb8a09f00fc", "value": 1273856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809017, "uuid": "1c9d5b13-ab0a-4869-b91e-71aa55a64a0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809017, "uuid": "34048e10-d45b-4ed4-978b-151741cf80e3", "value": "a39f1ef95667b114a57086c853357f8855833a1bfc18d37e93c04fdd4945ef45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6624efe7-196a-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1772808019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808019, "uuid": "105dbd66-5587-4735-8eb4-5e04facf271b", "comment": "Malware payload (SnakeKeylogger)", "value": "fa81043715497768684f09e8e0bebfe4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808019, "uuid": "8ebfb3fd-b1de-4b90-8314-7dde53f61dc2", "comment": "Malware payload (SnakeKeylogger)", "value": "a3e1a46f918e6553e2aa5fa904b916f069807fabb8c230acfa90afc2c81044ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808019, "uuid": "add5e7c9-9a98-4f16-a589-38dd33a43af4", "comment": "Malware payload (SnakeKeylogger)", "value": "32c7d367f1f93ee5d2e075b1a4c09efdf91c7280", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808019, "uuid": "2befd602-1f49-49b6-923a-974f2fc51d90", "comment": "Malware payload (SnakeKeylogger)", "value": "c9f5cdcb5ef6c52f76c53edd4a39ff5b1895069497b23ca4156a5333d8c114e0a19fa3eacf73137d6c87f7455cb5c250", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808019, "uuid": "98b4b59e-18da-4a46-a017-7f8b2bd61b3e", "value": "T1E955221523DACE86E4E817F54A21F37613B4EC6E5413D2438EEB2CEB345AF920D54A93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808019, "uuid": "55dfd418-8d54-46c6-ab16-4f7d8e5afe86", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808019, "uuid": "bf3fb295-6e7e-475d-bcfd-4469c5e5f064", "value": "24576:TguQv5K30sL01gz0Eb0Xgyl63wdj+DEXdkbv2yKiHjeOY6ovVictW:cumr31WPafo3wdj+ZTK4js6GQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808019, "uuid": "142888eb-104d-4fb0-89eb-4e7579901d1d", "value": 1298944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808019, "uuid": "0c65d355-48b8-475e-98ca-3fcfa7af8df1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808019, "uuid": "a47c48cd-1158-4816-aa53-ee8594e69d09", "value": "a3e1a46f918e6553e2aa5fa904b916f069807fabb8c230acfa90afc2c81044ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49735859-196d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809259, "uuid": "607c1692-cbe4-430e-a2d0-d19e0af76d1e", "comment": "Malware payload", "value": "b266738ef3aee181e584299d9afb6c4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809259, "uuid": "7ebc9055-20a5-4ae7-a14c-9d015649325e", "comment": "Malware payload", "value": "a46adac4d1cf5bd0e5c1600ac510666628e821c4618b5c9566d0112b505b6b0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809259, "uuid": "97842f1d-0a53-4feb-86ce-81f90f11ce9d", "comment": "Malware payload", "value": "9ac3f11735d13d241a669deca4a1ca0b7c7888fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809259, "uuid": "e79cd4a8-4d95-47da-800e-c3d774d68a47", "comment": "Malware payload", "value": "abfeea63739fb5fbf2631e2f49003e62806f31813d1a5837e51214ccc5956d802d7126bc15f26ef08f32dc4a22707fd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809259, "uuid": "f69601c6-94c4-4cd9-aeb5-ac5b99c3fc09", "value": "T19784E157E717A810C2C88873D9F589FAEB70AC23B495143E3351BF1E593698ACD0927E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809259, "uuid": "b1b27886-998f-4a00-9f2d-87d836026b23", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809259, "uuid": "98f82759-bc09-4380-aa65-6e57f501c99f", "value": "6144:WNDlOLZLClTgENoiuIGqrqj5KflXKchT9nqBr21zAIaH8jvBVd0kTj:Wk8TgENoid9OeljTNqBr2A8jDt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809259, "uuid": "ce1af61e-fea0-43c3-a2c6-5ae7e06ded5f", "value": 393024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809259, "uuid": "949cb154-8750-4ac8-9b74-522398acd726", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809259, "uuid": "2e47b78b-73b8-4059-9bea-c1f507f0da73", "value": "a46adac4d1cf5bd0e5c1600ac510666628e821c4618b5c9566d0112b505b6b0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb2b8617-197a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772815141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815141, "uuid": "66fd62dc-c8f1-4e97-8329-06ed71b49c8d", "comment": "Malware payload (Mirai)", "value": "9d4113796f67feeb5274d50b6e72c3f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815141, "uuid": "02cf0dec-b5c1-4c0b-bcbf-589233735b6d", "comment": "Malware payload (Mirai)", "value": "a4889fcba22bdf46d61c86c20f5b8e19d556aaed0056b9ae303ea0e9a7904399", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815141, "uuid": "6a238937-509f-455c-b78b-0dcf8a0fd165", "comment": "Malware payload (Mirai)", "value": "9fbd15acea571fb9758445b1a3422c7f32360fa8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815141, "uuid": "bf6151a4-1fb3-49e4-ada7-3d88cfc06c11", "comment": "Malware payload (Mirai)", "value": "24032e50ae46b87e46b2530f11fde48b66ecc34f7c9ceab054b5e95147c18fffab2d504361719e1c8ccf2c6b37432e04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815141, "uuid": "d46a13d9-4860-43d5-bfc7-2fc12c2dda04", "value": "T12E04D815AB610FBBDCABDD3702E90B0139DC654722A93B363674D528F54F60B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815141, "uuid": "b4fa3e57-5c11-4b1c-b573-c72b1615e5c5", "value": "1536:9aZ8kNw6wHWYeImB/UQDhnxJS9WPoLfQ3o1UkGz4Z/8Yp+4NkllxX2pUaEHWPyp2:gZ8kNe2YeICcm41Qk8cklvX28EyQHJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772815141, "uuid": "95afcbd1-332d-46e5-aa48-fd429cc36577", "value": 178604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772815141, "uuid": "6bb8bf1a-9c66-4eef-bb9f-02633421d952", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815141, "uuid": "8056c7d5-16ee-4061-aaba-14f4881c53fb", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "506ff30e-194d-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772795527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795527, "uuid": "fded0693-e83c-45d7-9d35-29367fa63e6c", "comment": "Malware payload (Smoke Loader)", "value": "65624a57b509be323022c197f82e5a26", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "chalx-live", "colour": "#DA62FF", "exportable": true, "hide_tag": false }, { "name": "coox-live", "colour": "#1A79DD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-4876", "colour": "#776668", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "zadno-run", "colour": "#BE50B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795527, "uuid": "b131b88a-7223-4ac2-b6cb-bf0226351ff7", "comment": "Malware payload (Smoke Loader)", "value": "a4b320e7a8ea76e158403b5c4d6be07f5bc044a0cad500094ad6a4f8506d4394", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "chalx-live", "colour": "#DA62FF", "exportable": true, "hide_tag": false }, { "name": "coox-live", "colour": "#1A79DD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-4876", "colour": "#776668", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "zadno-run", "colour": "#BE50B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795527, "uuid": "36b89902-f38a-4318-83eb-0a9f99b26170", "comment": "Malware payload (Smoke Loader)", "value": "c8574a14607753a216895b03912a09322df3aa6e", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "chalx-live", "colour": "#DA62FF", "exportable": true, "hide_tag": false }, { "name": "coox-live", "colour": "#1A79DD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-4876", "colour": "#776668", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "zadno-run", "colour": "#BE50B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795527, "uuid": "64d56903-bf8b-486e-a0a0-1d9ab6a43480", "comment": "Malware payload (Smoke Loader)", "value": "54b3ff2602383ebfd924a42ab3788b5391b3b8db3aeb597adf21cb7cf1530b172a85dfa34eda4f8c8568b6a2e0867116", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "chalx-live", "colour": "#DA62FF", "exportable": true, "hide_tag": false }, { "name": "coox-live", "colour": "#1A79DD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-4876", "colour": "#776668", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "zadno-run", "colour": "#BE50B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795527, "uuid": "98da5421-5c45-4a8c-9da2-ff7cb17f0c47", "value": "T1D7F533814DE08676F7A16590D485EBB43EFEB36F04B1AA804781CB8AD73428375536BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795527, "uuid": "def8d50a-8df2-434a-9fe2-bcaf4305f6bf", "value": "98304:8U5MWd3DP+9ChM3QWCIPto9WWm9Da/kNG1:xd3b1g+9WlG1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772795527, "uuid": "7cdb7044-07d4-4dff-bc6b-b29f75cbc4f1", "value": 3367955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772795527, "uuid": "b2748711-97f5-48b8-b76a-f8eadf390c02", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795527, "uuid": "489ff34b-6be6-4bc9-ae60-bd8a461f4f28", "value": "recuva_professional__technician_(2024)_full_espa\u00f1ol_[mega].7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a183b564-19b1-11f1-a769-42010a9c0008", "comment": "Malware payload (CobaltStrike)", "timestamp": 1772838613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772838613, "uuid": "55ae2226-d753-44b6-970b-6122f4f079db", "comment": "Malware payload (CobaltStrike)", "value": "705d1e80956b88b75a4f1944a0d48436", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772838613, "uuid": "47606f3e-017e-4e6c-ba9f-7cc20b9d2d0c", "comment": "Malware payload (CobaltStrike)", "value": "a557d96f80d3cbe663dff79421902b556dff2cec54d7307a7f879cb20268b15e", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772838613, "uuid": "a1e25138-aa80-43f9-aa51-d91753f26875", "comment": "Malware payload (CobaltStrike)", "value": "ca7ab0373730c9ac645ec60585c4e2f8f4f5edab", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772838613, "uuid": "bf82dd77-6b92-4030-9595-54dcbd3cb34e", "comment": "Malware payload (CobaltStrike)", "value": "89edc9fc8ca4813b93baf34f888db2740890240d3f8b6aead66d373e4dfc70901d0d8abd34543a600a2c133883c2e942", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772838613, "uuid": "a8b5e17a-8793-4baf-8b24-0b0e7972c717", "value": "T13512C77161C4EDF0CCFED2B8DA66CF20D67170545251B70E16B659FA0E9B6603A2EE03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772838613, "uuid": "b3a1c669-ede5-463c-8be1-ced448d8014b", "value": "9b760feffec4fca9c313889f9a05ee36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772838613, "uuid": "ab717495-380f-4e35-bf65-df7e80cae443", "value": "192:HYqQ7SZtMe0QgCU9EpYb65GA/4kO0HJu+OX6D:Nj7Uupy6wKHJu+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772838613, "uuid": "13e76484-af9f-4a3e-9704-b57b08bd5a7c", "value": 9216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772838613, "uuid": "21c54568-1168-47c5-9913-3cbdaac3bce2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772838613, "uuid": "7e691706-7e84-4df3-89e6-66a5656edb0d", "value": "705D1E80956B88B75A4F1944A0D48436.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "123b6b66-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1772808308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808308, "uuid": "4b686d79-719b-4d3f-8fac-b34320c8b8ed", "comment": "Malware payload (GuLoader)", "value": "180e1a19f9e0c1c999d6cb3ca9c70c93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808308, "uuid": "565ab03c-5e04-4851-860f-493c22f4bdc9", "comment": "Malware payload (GuLoader)", "value": "a55b5e2ae0cba7d3a9f1bd2b21a930c3e221c1710cef08aa2351f7fa183ae1d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808308, "uuid": "80fe1ca2-ca83-4ae2-9f3d-a4566de449e6", "comment": "Malware payload (GuLoader)", "value": "6b8ee08ae0aa9209a3182276993dd335dc58b1e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808308, "uuid": "a3b20874-827f-45a9-ab01-6d5c4746af61", "comment": "Malware payload (GuLoader)", "value": "a3dcc26626bfde255171b210cf97ded0bfdf18323b5de119248eac2d6a0661c34c1fb62396f94be7a1e17fc01b813489", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808308, "uuid": "55126aa5-a96d-48a9-a2be-9989f98ba2ec", "value": "T16E252321D3D8EA08E4D01A355928ABF2CEB79C51148052870729FF6F7B37AF6616F217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808308, "uuid": "9579dfdf-8205-441f-b83f-b4a586a978f4", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808308, "uuid": "60963404-e5b1-42d0-b6fa-2bf6fc7b6e7e", "value": "24576:kfLGzkcZfAvLsGLe3vbtZWrlk5b8KIJ4LUwv/GOFlmuxqfyA:+JyfAIGL2znWBk5b85aXv+kmzj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808308, "uuid": "38543da9-3573-441b-b29c-cd02fffa3af0", "value": 1029288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808308, "uuid": "51aa41e9-b72c-4819-afe3-a00a33663e29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808308, "uuid": "6df93924-98f2-4bad-9451-b1ac7590357c", "value": "a55b5e2ae0cba7d3a9f1bd2b21a930c3e221c1710cef08aa2351f7fa183ae1d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3df6ad45-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772810529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810529, "uuid": "eb4c548e-4ed2-4e0b-9b69-4843da199090", "comment": "Malware payload (Formbook)", "value": "1a272b96d18b509604236fe5e5f7df2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810529, "uuid": "1083d32b-3333-4134-bb57-7fffd7d857f3", "comment": "Malware payload (Formbook)", "value": "a57f6ac44b32e089a4669b948526adfeabfcd481f0c7ab2dea82ceb60b32185e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810529, "uuid": "9d16667f-579e-42f4-b235-28b0198958df", "comment": "Malware payload (Formbook)", "value": "4f9d741dea95c6a7d3afc1815815483b3eb5dadb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810529, "uuid": "dfcaa515-0145-4d41-a2a2-1bdbdb14c0a2", "comment": "Malware payload (Formbook)", "value": "849b9b37a5289459ae975b2eb526785ac588d83a950b0a3ba000871e1e810829017e8ee5830fb967f38f910df2c59bc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810529, "uuid": "b40a3086-ae67-4824-a26a-873cd488c196", "value": "T1DA55CF0273D1C066FFAB91334B5AF6115ABC79260123A62F13981D7AFE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810529, "uuid": "f3ded5c0-dc29-4c43-a6cc-63e0deb799cd", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810529, "uuid": "bf5cabc7-b1c7-404c-9c8e-4a245b0c9439", "value": "24576:g5EmXFtKaL4/oFe5T9yyXYfP1ijXdaMBDPnydqYQG8p:gPVt/LZeJbInQRaMBnydqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810529, "uuid": "00db75ad-8de7-449c-afa1-4d120ce5be0a", "value": 1292800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810529, "uuid": "18d069bd-7320-4078-9a83-99f9bd2d4c57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810529, "uuid": "8fcd57ea-ce24-494c-b5b4-6c5ac1ba849c", "value": "a57f6ac44b32e089a4669b948526adfeabfcd481f0c7ab2dea82ceb60b32185e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "944e74cd-196d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809385, "uuid": "3f8b6665-c37c-422e-8a00-06667276e602", "comment": "Malware payload", "value": "ec2f9b2010be22a7c5b89a241a545b8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809385, "uuid": "0f035648-9d0f-42e7-af46-a65e41d5225f", "comment": "Malware payload", "value": "a586e97038df9bd157699b3a9f35f8416fcb065e82436c15123ee4db1378765e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809385, "uuid": "8cc062a9-a52c-481c-bdc8-fa04b35ac5da", "comment": "Malware payload", "value": "234445d43f8e4add3c1c243644ebe302263e6c46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809385, "uuid": "c70da3f3-8f80-48d1-ad78-21d46675ad48", "comment": "Malware payload", "value": "ea27a2d0a9937223d049519fe4d6ba513d1524b3a7c20075ef37d8156ce32203969c40d2fbe43c52ed0e514b78b98f77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809385, "uuid": "a175a539-c4f6-4f57-9450-90c7ea5f51ff", "value": "T1D845BF027391C062FFAB91734F5AF6115BBC79260123A62F13981D7ABE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809385, "uuid": "ca8662a7-35b6-4183-845e-698109c4cd78", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809385, "uuid": "47659a6c-5646-4f2a-9e09-ec7ccf4ef501", "value": "24576:N5EmXFtKaL4/oFe5T9yyXYfP1ijXdaqE2R7TDnVjSrJ:NPVt/LZeJbInQRaqEYTDnVG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809385, "uuid": "b8572544-e60a-4c1e-a4c3-c870ce236c04", "value": 1235968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809385, "uuid": "b8952478-8924-413d-a3e2-4c064c53f92b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809385, "uuid": "f41fb759-cb64-42b1-b594-4fdfa3f2b46c", "value": "a586e97038df9bd157699b3a9f35f8416fcb065e82436c15123ee4db1378765e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c5bc5db-1969-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772807681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807681, "uuid": "9412a5e6-cc91-4982-b16d-25ef14550c9c", "comment": "Malware payload (GCleaner)", "value": "17e3a006b4bc7fdba4e94d82af800789", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807681, "uuid": "e8b46336-c562-4c9b-b539-fa89e44678be", "comment": "Malware payload (GCleaner)", "value": "a634f747423254c124c3695e09e53fc64230882a530588dddc03abb3be87d435", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807681, "uuid": "c8840ea6-5a03-495a-abf8-bd7ec8a39918", "comment": "Malware payload (GCleaner)", "value": "49c6134da03c986a6143ae6c06eeadd501d111ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807681, "uuid": "3a37f497-49ce-4485-ab49-9544fd0a7cdc", "comment": "Malware payload (GCleaner)", "value": "3be1a9b62102f18b86f059cc5b2f82b248fa2cbae48a291f197cea3cf87526abe15f2efbc31cbbba719d45ffd442df83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807681, "uuid": "90827974-b28f-40ff-a686-2c0e021a3737", "value": "T1AD36E0B3BB709C73CA56273848ABE3095C19EE80D919846135D91BDCCB6E1F1FCAD216", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807681, "uuid": "5291b379-8873-4c5b-9c30-903a8bd76f54", "value": "e5f32a93ddcf3aa9009cd70911b0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807681, "uuid": "b6e3deea-191b-4617-bd46-e5c912af6f54", "value": "49152:Z9CiLxU3u/cp4GzloOZv3DuzM6QK2nri3AEgj2SA40zya2Bi68WfRZa7l:Z9CexU+Ep9DvazOKvAdC+Ovh68WLa7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807681, "uuid": "9de62ded-89ab-49e9-b9b1-89c6a4ca9649", "value": 5123072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807681, "uuid": "5f32dc50-f25f-491f-8f5f-e1edf00926b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807681, "uuid": "d9b3f377-2cae-4d63-a0fc-eeb8bc79a64c", "value": "a634f747423254c124c3695e09e53fc64230882a530588dddc03abb3be87d435", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbd765b9-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772809935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809935, "uuid": "6560bc8f-143e-40c7-b885-e01c23c3a335", "comment": "Malware payload (AgentTesla)", "value": "8536c9607490baff37bfd5088b8ed564", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809935, "uuid": "b29c988c-8a11-4fcc-aff1-abb786194b98", "comment": "Malware payload (AgentTesla)", "value": "a65146cce6104125f73b03f4f1a088fbc36dbcc2112af4121e3bb0304a5812ad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809935, "uuid": "8cdce9b4-2aac-4da2-a218-c61283ac1700", "comment": "Malware payload (AgentTesla)", "value": "2d1d231331c6e3a1fa0726c3adaa1b16da80eb93", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809935, "uuid": "880def2b-2661-469d-a435-7dfa1d5b5872", "comment": "Malware payload (AgentTesla)", "value": "d6cfcd74cbac06e8caa8307ed3c233c3dab2fe1a10abfbd80f27ba154adfaaa9ef8e3a1203c51a02163ae20e74b47cd6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809935, "uuid": "7e003589-2590-4298-a6ee-a558158edfc5", "value": "T19284D042F3C0ECEAF4625073A83AC7601A13DF6E8466871B315676166DE32D32667EC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809935, "uuid": "66f327f4-8d84-4897-9142-958e79e29830", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809935, "uuid": "4ad6f543-0d13-406b-b4c1-74c063f69452", "value": "6144:/gORaJ1dhZ3qeDJ41tc/qSR1+G8F+4LhA88Bv2/4S/nWEzRq:/gd6kG7cP1+GwueFW00", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809935, "uuid": "567bf849-9d1b-4dca-91d1-93eb51099d85", "value": 374560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809935, "uuid": "f048be14-d865-4625-9b23-8417954abe0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809935, "uuid": "d9f6eccb-597b-4e3c-8a13-d996d96720b4", "value": "a65146cce6104125f73b03f4f1a088fbc36dbcc2112af4121e3bb0304a5812ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72e55401-1985-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772819637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819637, "uuid": "44ab9556-177f-44dc-8de6-08baf85d292f", "comment": "Malware payload", "value": "aa49d88d6deac1764084d86652eb0198", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819637, "uuid": "8efcdf65-c141-4d9b-8bd5-f2a40da2b12d", "comment": "Malware payload", "value": "a6ebce366a78e7c015ffbf5d9c5e2b4cbc74657d216669cfcba38c9e2960f601", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819637, "uuid": "400e4b52-d44d-466e-894c-920a3e987f94", "comment": "Malware payload", "value": "ceb68c0b31fec44158a2075efae5e76e17ee38bd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819637, "uuid": "37421289-b67e-4de6-a96d-ef489a12ed61", "comment": "Malware payload", "value": "643100e134fc43a6138b8558a3fc86d7ca3feb2dfe47d9fde8eb605059f23716513e318a157cf21fbd44269ffac79e50", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819637, "uuid": "48d974c0-149f-47b5-9153-ab6ac006e561", "value": "T178E012C87001E282965FDA8B61F7EA44E04396E7A2C97F43DE54BD31C456418B9AEA82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819637, "uuid": "5fff1f3a-5df3-4608-9378-89373b51e0d6", "value": "6:LMFwCriSAS5xKDMFw0Li0D1ASNKDMFwOiiOgAe3t:orvpGg1L7D1p8geGl9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819637, "uuid": "cb254c3a-7dc3-4fcd-9fc9-3a17d1130c2a", "value": 360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819637, "uuid": "ad900da1-6c4e-4a7c-b5b0-360087a364c2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819637, "uuid": "a4befc50-f704-451e-b5bf-9911571bb177", "value": "payload.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e8856ec-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772810261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810261, "uuid": "2a9d9b36-4aab-4cf8-b604-061d5f974b3d", "comment": "Malware payload (RemcosRAT)", "value": "d6243622aa7e6322a6c97861cea7b6ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810261, "uuid": "6efe76c7-65bd-4dae-a332-dc6a61131536", "comment": "Malware payload (RemcosRAT)", "value": "a73a48f955eb19e52426c773cbecb4e47ca4ce5db76018e0bc3f51b10ebeae5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810261, "uuid": "d05c4bae-c370-4d26-919e-547d4fe1144b", "comment": "Malware payload (RemcosRAT)", "value": "5a6e36001e4d21fea00717d353ec922b3d831c6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810261, "uuid": "15a1c044-631c-4a2d-9ae2-2a405c95bd73", "comment": "Malware payload (RemcosRAT)", "value": "f75ec638186756b841011dc2bc931c18389937922c413ed0a851923499f05060606d5ff1c396fddcc4d5dfddd0a9c288", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810261, "uuid": "deeb9b98-56aa-483d-8bbf-31f1d14c9f4c", "value": "T169051258275DD903C0A70FB41A71F274A7B5ADC9F822C3465ED9BCDB783A39029A0397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810261, "uuid": "0c42026b-2614-4bec-9878-08293e961527", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810261, "uuid": "dd165c3a-9e9f-41eb-8a3c-f671d83a0020", "value": "12288:4XspJ5NZ+MmAyrTmraUW08she8XviKvy0mbo1YqbBnovZD5F1t8o6uCPy+tbbRPf:P/oK8sj/igyjQSRD5/GoqPZtbbO4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810261, "uuid": "538ef7cf-c30a-454c-9591-9614063a3347", "value": 846856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810261, "uuid": "2a317efd-b4f6-4636-b00b-b8e8e73ecbe2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810261, "uuid": "728947a8-b81c-4b70-8e68-a48b77081bb3", "value": "a73a48f955eb19e52426c773cbecb4e47ca4ce5db76018e0bc3f51b10ebeae5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6752692f-1971-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772811028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811028, "uuid": "379006f8-fd32-4952-8302-1db06ae86046", "comment": "Malware payload (GCleaner)", "value": "0023e69035a1b807a1ae75d155a18e9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811028, "uuid": "b4274c28-f6d9-489a-b0e6-7dac3bf98653", "comment": "Malware payload (GCleaner)", "value": "a7550ed697d581b56172cbdcd47700befe7f7a54601b5f8c92f1f7dd961cee53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811028, "uuid": "32a07c47-78e4-4a26-b122-5ee59cf56d26", "comment": "Malware payload (GCleaner)", "value": "a1da678dcef2b6cfc2f851c8ebc9acf6991bf7b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811028, "uuid": "27e7550b-18d9-41fc-8b41-598e92c41bdb", "comment": "Malware payload (GCleaner)", "value": "008c85ea981aa766388229714d5d085cde1127b750f32ec0b8a9ac2c1240263953d60daedf83e8856eeb43a17d05ad12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811028, "uuid": "2f71833f-88b1-4ec4-b415-fca6161a87a5", "value": "T1FCF49E25B1908536E162E97DCF5BD2A95C21BFD0293868762EEC1DCC5F3A3837436293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811028, "uuid": "a84e4987-fb5a-4c6d-8603-0a1c5ce53b10", "value": "ce7a1d07b14b49824555865592c3af45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811028, "uuid": "23bc6973-0c16-42ad-b759-e4d1dd5a1bfd", "value": "12288:6kAJdZJGY+5K/Lo9r7WTB+rPbpaZxPrOckdd:oXZJeK0Z0IsPm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811028, "uuid": "a7bc423a-b6e5-4925-953a-451ad6049826", "value": 785408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811028, "uuid": "83b22b43-da87-4fa2-83f5-f4a24ff11d4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811028, "uuid": "f4adb886-f7d7-46c0-9230-02b8eb0a77b0", "value": "a7550ed697d581b56172cbdcd47700befe7f7a54601b5f8c92f1f7dd961cee53", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48a693ae-194c-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1772795085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795085, "uuid": "940a5c21-9651-4ec4-8231-bc1b1feedbd9", "comment": "Malware payload (CountLoader)", "value": "a3e4ca13c322101e1a80369cc97b7149", "object_relation": "md5", "Tag": [ { "name": "37-221-66-127", "colour": "#F2F866", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "explorer-vg", "colour": "#86C1A0", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795085, "uuid": "c0828e33-2198-4a84-bcf4-9bf8be19b22f", "comment": "Malware payload (CountLoader)", "value": "a7733878c28243059c112f76bcacde975e1874817c665bbde0f07174e395c055", "object_relation": "sha256", "Tag": [ { "name": "37-221-66-127", "colour": "#F2F866", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "explorer-vg", "colour": "#86C1A0", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795085, "uuid": "00250084-f56d-42ee-8724-467f4d72a022", "comment": "Malware payload (CountLoader)", "value": "141db5d7681131ded7def6e40f0ff2637fbb614a", "object_relation": "sha1", "Tag": [ { "name": "37-221-66-127", "colour": "#F2F866", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "explorer-vg", "colour": "#86C1A0", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795085, "uuid": "a16dae45-d5ee-4c56-862b-03f4bf3badd3", "comment": "Malware payload (CountLoader)", "value": "a40a8de9f2634dfa9292cc3466fcaacb6bb9ff5b1b1d4b5feb4bae2a41213e027a9fd7de732b493c6c5fc6ff3c19793a", "object_relation": "sha3-384", "Tag": [ { "name": "37-221-66-127", "colour": "#F2F866", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "explorer-vg", "colour": "#86C1A0", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795085, "uuid": "34930a07-6354-4418-a4e8-087ee5426447", "value": "T124B523ACB97A58F8EBCC48F82F590B075383573ACE1E52291A7D19AA7F1150E184DD0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795085, "uuid": "9577ee80-1398-4220-96bf-4b9241990a1f", "value": "49152:qiyFDtycYyirYKD1x4+hes7BJNKcRn6tshsWkn:eFBDiPbwwBvKi0smb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772795085, "uuid": "0690a696-4f63-466f-babc-0f75548f6265", "value": 2470835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772795085, "uuid": "709f0ee0-ef29-4c47-b9b9-a7ff1e94d6f4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795085, "uuid": "64a27af5-a7a2-4692-9357-7ea59e15e804", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "277f0ff0-1966-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772806196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806196, "uuid": "a9a854cd-fa25-4af9-b35e-9c637c87c275", "comment": "Malware payload", "value": "b5d276c14f44256b6923845d0e075b37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806196, "uuid": "0ace16db-c545-40ae-8cfe-46c54b92e0f8", "comment": "Malware payload", "value": "a77caffaab85e0369ad5b26e348ef2dc981f381d692b891e767e6bf717b38ceb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806196, "uuid": "02e5db77-6c99-4d56-a69b-aa60b142f3a4", "comment": "Malware payload", "value": "2e0680941e17bc4633e8e81378ad1863d3a1dd7d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806196, "uuid": "fdfa7dfa-0b77-4778-83d6-4789681b07f2", "comment": "Malware payload", "value": "b3f9c3308169db3ad97cb752cbcaccca377ba7bf0bc8d17bddaf9148719a9cb500cea64e98469fb289b05a616e220149", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806196, "uuid": "2e29ff69-b938-40b4-8c0d-3ec1553d42a4", "value": "T199040B82A9117F73C1C3ABB6F7DFC2553B736A1497D73301A959AEB02F4A68D0E29101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806196, "uuid": "6a78ad99-6450-4ef7-b8eb-c17c23a30f7a", "value": "3072:2zomh356LKH4y8/LTAXtbx7XrqZVM7ZlDvq0Gk+PZdJ7VHOPJLD+:2dhpsw4//LcXtl7XrGmzvq0Gk+PZdJ77", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772806196, "uuid": "1ce11e34-0e8e-47f3-ada9-dd57bbd2a0ac", "value": 182404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772806196, "uuid": "9a5af627-31ee-4c72-9ac2-b7c2ffa1d144", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806196, "uuid": "f89063be-fbad-4d74-bb84-d14b149cfc96", "value": "a-r.m-5.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4170b74-192d-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1772782031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782031, "uuid": "003e06ee-411a-4419-9bc6-6f6e24360304", "comment": "Malware payload (ConnectWise)", "value": "10517fc7b2126763d306e26f9dab6b52", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782031, "uuid": "f84a5a3f-82cd-4fbf-8f0d-9863d595ba5b", "comment": "Malware payload (ConnectWise)", "value": "a789979fa5c689123fdb2b08088dc696ecc6b562ac372b273c2595a08f8624cd", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782031, "uuid": "5cffc667-cb36-4808-a0e6-0b36e29fea02", "comment": "Malware payload (ConnectWise)", "value": "74dfbe0acfc193cc6578d5b14213fc9cd65bafe6", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782031, "uuid": "20972e48-e919-4c0b-8a0b-cbc6860f7719", "comment": "Malware payload (ConnectWise)", "value": "0606546cbc4982cd9c441a0cd0613368d3862d5fbf1281164a59bb1b0053fc2f8c3d520e8f9423b3fdcf3e8c740343e7", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782031, "uuid": "4c1b16ca-db12-4e12-aa21-b7810e6f91d1", "value": "T1E7D61201B3E69574D0BB0A38D87A9266AA31BD005716C7BF5794B92D2D33BC08E32777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782031, "uuid": "1d631588-9c48-47f4-a1fa-ad8567ebd56d", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782031, "uuid": "42801c05-bbc9-47e1-b212-f0f03809b625", "value": "196608:7fefPqBn2hg5kEWmXhcfKjSVah7vGerBn2hg5kEWmXhcfKjSVJBn2hg5kEWmXhc7:RgdEEijLDGEgdEEijsgdEEijugdEEijv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772782031, "uuid": "92109a01-f10a-4769-a09b-aa6e3808aa6f", "value": 12637240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772782031, "uuid": "1478dcbd-dde5-420d-ae56-34e12fc0c560", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782031, "uuid": "2aa5f50f-2936-4c0e-a15f-e1c73d20c415", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd51bdff-1983-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819010, "uuid": "cb9a2245-af41-4140-b652-306aee373267", "comment": "Malware payload (Mirai)", "value": "4cdf01b6b45e0789312a068b08725eeb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819010, "uuid": "300eab85-46be-4ae5-8da9-6726e55576bb", "comment": "Malware payload (Mirai)", "value": "a7938c2d6ea8db8f3334437920e4254083a04785705822aabdbb7c379a740e1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819010, "uuid": "fd55ca4c-a1f3-454e-8ae6-f0b157a9e678", "comment": "Malware payload (Mirai)", "value": "6971a5a1bc163e84755c5d3d059832ce82ff1169", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819010, "uuid": "9cf1a9ed-6ab4-495b-a3d0-13e7a5798125", "comment": "Malware payload (Mirai)", "value": "57c9706656af9e453d4daed89f8c83512e7130351926b3e81239979c2190f9717580ff690d6787f352a021c79d7e0ae6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819010, "uuid": "5e916436-9e7d-4bd4-ab04-56095392361a", "value": "T101A329C9EA7BE0F6FC060C706077F66FC730A9318064DE02DFA96E55E923A51910FA95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819010, "uuid": "2a5d714d-141d-4bc2-8325-64e0c7a99ad7", "value": "1536:xhFI+6o88paBP7OUwWo4joDG3y5bK+AWSWLMegAGcstgGf0X5uxBs:xhFIboxpa5vVoQfjW4egAGXtY5uxBs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819010, "uuid": "62518931-625d-404a-bc47-61c6466b526a", "value": 100048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819010, "uuid": "d2260772-0d86-4994-8646-cce4985d8821", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819010, "uuid": "ac0ef312-b720-47a7-a72f-b145a1bb51ff", "value": "debug.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7168d8a-193d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772788935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788935, "uuid": "3fbbe810-5120-4f16-95b2-0211aad96a56", "comment": "Malware payload (Mirai)", "value": "d82f55cc4002f9e3356300f823dbe03a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788935, "uuid": "a685ab08-40d8-4b07-9c55-63ad749fa784", "comment": "Malware payload (Mirai)", "value": "a7dd0c0a0e32d16e4ee92939f5d46cd6bc9cd502c47e07ed6f5e2ac91ac7d01f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788935, "uuid": "5280d3c7-261d-46fc-b5f0-7b8f86d9cab8", "comment": "Malware payload (Mirai)", "value": "f8304483e28bd433cd3944ac0b5487db5668ef16", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788935, "uuid": "23fe5e90-58e3-4b91-9604-109a81cceecc", "comment": "Malware payload (Mirai)", "value": "5297e02c372950f5e9b72ff20ef44ead7a44cffdf5e115572cf3d62732287434de842328f147b9f9ecfdd88fc9356b66", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788935, "uuid": "c713b67d-5f5a-45ae-ac3c-ca0d0197b8c5", "value": "T19513F1A876213A75D93A4035152B0FD02DEE22D2F813CD933A44E956AF564FE3DE38D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788935, "uuid": "7a964245-168c-446c-a088-1b5239f162de", "value": "768:KET7XP4xzJMIAvhvzhxn6fkDOCChBK2ggiKd1KvxEv+z6Ip4PHJgGlzDpbuR1JK:XTsxdJgvzPn6MDObHK2bd1mOv+zHp4PB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772788935, "uuid": "d83b3af6-e64c-416b-a1df-8df21bbd2162", "value": 42692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772788935, "uuid": "9b03735c-27d3-49dc-bfed-78054340a0de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788935, "uuid": "7636f5bc-7c48-478b-b980-75528ce3b4f1", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3753f901-196a-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772807941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807941, "uuid": "f80b8e65-41ba-40ad-977d-d863f66ade14", "comment": "Malware payload (Formbook)", "value": "bb1c8d0dca329094e5853af14865a0a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807941, "uuid": "df1bfe3d-ef4f-46ae-bb0e-8883ff22d4c6", "comment": "Malware payload (Formbook)", "value": "a7f451f1173d91a895604d3d0498cd2b764ab5c21711cb0ff2291576ec2161c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807941, "uuid": "2278e72c-f126-4494-9a9d-b7ba609103f3", "comment": "Malware payload (Formbook)", "value": "2e5109113e574d0f8b2d6c4d50a483be2bd00af7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807941, "uuid": "c686af69-27a2-4a6c-a3d2-6f90909c4fb9", "comment": "Malware payload (Formbook)", "value": "faee141699c549036b7aa6e6145a4cb622cdacc3a8f9ff2e969959e42110e97018e5f122a50e7367a031af345907d114", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807941, "uuid": "c8d0c8bd-73df-4735-8c1a-d1038781c687", "value": "T1F1351260229DCE1AC4AC1BFB1471E33503FA9E59A123D31B8FE97CE73D56792094426B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807941, "uuid": "36a1046d-e0e4-42b7-9c2e-e92e075e0eee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807941, "uuid": "9053c829-0623-40df-89bd-278ac3452ba0", "value": "24576:KzHdguQUjJsTHZeUMMC8OvLmk2F9zthug1LIfOVict4w:KzHKuTVsTH8UxC1j25huKtQcB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807941, "uuid": "686b3167-7885-44e5-bce1-e77220cf83bf", "value": 1116672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807941, "uuid": "0370e65d-cdb4-4d65-88c3-65be6d27d554", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807941, "uuid": "10b84593-c2a7-488b-906e-faa5499650f2", "value": "a7f451f1173d91a895604d3d0498cd2b764ab5c21711cb0ff2291576ec2161c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "533ab611-1967-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772806699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806699, "uuid": "98c9e51b-dbb4-4b55-8633-f7ed3242607f", "comment": "Malware payload (Mirai)", "value": "9725a8511566e88d84d4a799f85993a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806699, "uuid": "2e0c52e6-68dd-41c3-8158-6d68a09d0875", "comment": "Malware payload (Mirai)", "value": "a869eabcde6768eb40b9c0a68eb665d0d825328f7ef49ddebf78efb5bfdffe2c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806699, "uuid": "4d0c7c1c-d9d6-43e9-8bc1-9b8ddd6e1102", "comment": "Malware payload (Mirai)", "value": "b3fda0e3043812402d8f3217f3e0664e8bab247a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806699, "uuid": "85d6ff0a-99a8-4b61-8721-653a53adab85", "comment": "Malware payload (Mirai)", "value": "5546ee22fc1989cd14ad764605f975e82ec079d86ea0d1d5c0901b149be545e3a44ad20ce954ac6a49709c07ee37a4af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806699, "uuid": "e4e28ece-8535-4007-a8ee-6d4f976e297c", "value": "T11934E7036B517EF7C8DBDE3306F6C20124CEF4132765672672B4DA6CB91A94F49938A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806699, "uuid": "78191522-5d6a-405f-a286-4d976198816f", "value": "6144:3Hv4807GssPTuVnEXsQdnWczvW5XZGUR1dQhp+1J71:Xw809dE8wzvW5XZGUR1dQhp+1J71", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772806699, "uuid": "b79dab4f-6e6c-463e-b876-4c17ef9a64b4", "value": 231379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772806699, "uuid": "702261e7-8838-4785-98b2-6d08e8eba87e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806699, "uuid": "b22bf858-607f-49dc-8bf3-16a1eaecd391", "value": "m-p.s-l.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61baf468-1969-11f1-a769-42010a9c0008", "comment": "Malware payload (zgRAT)", "timestamp": 1772807582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807582, "uuid": "60fdc3b9-50aa-4f9b-9a8f-450222575ecb", "comment": "Malware payload (zgRAT)", "value": "ad57e0aa5f9d05c4a0b7b00e3c78d156", "object_relation": "md5", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807582, "uuid": "e6c2d9e3-6262-4769-9901-2498e21adc84", "comment": "Malware payload (zgRAT)", "value": "a8d214b32d8d0074b8dd8682852a66e9b4dd8566ea2e5255085858bc64034f44", "object_relation": "sha256", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807582, "uuid": "edbb9759-7346-44d9-bf0c-a4f3a7ad7904", "comment": "Malware payload (zgRAT)", "value": "655a8ed12b3008b428ac38e98edc5e93db74c67d", "object_relation": "sha1", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807582, "uuid": "760b322a-a526-4936-adae-a22367f79224", "comment": "Malware payload (zgRAT)", "value": "8d563429d828bf1f999c04211ccd31e5221cee5f10a4960041955475ffdb8269080dbfc5c5d71f25b4dc70c2a4c882c1", "object_relation": "sha3-384", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807582, "uuid": "590c0ac0-2a91-4a48-ace9-6142c487700b", "value": "T1A7F42390918A8FB0CDE7FA76DC5FBED01375419F08B5ABD92D0D058B7C18740E6D6A18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807582, "uuid": "eb1e80f1-95b3-4f91-a804-d652190aa492", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807582, "uuid": "1c1498a1-7335-4626-a7de-23f54d471628", "value": "12288:gS8uaRixN2sCAra1bahqb2cN3zC8gykfvoGAKrcQV5nCNisBS6/mu+CCG/YblTGB:gSPK5RSrhFcU8xkfvWKvVM9NvQGO5Xom", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807582, "uuid": "7d1da5fe-9ba9-4261-bd02-6b42647dcba5", "value": 748544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807582, "uuid": "a677bd62-479b-4026-b6d9-6e0f98ea1590", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807582, "uuid": "29157989-f2f1-4a83-a1e5-f8096990935c", "value": "a8d214b32d8d0074b8dd8682852a66e9b4dd8566ea2e5255085858bc64034f44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01b0b8aa-196c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808710, "uuid": "e85aff89-b7bf-4a4f-b154-042c0ed8c7cc", "comment": "Malware payload", "value": "e50608b581fe517976cdb6726c03ee1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808710, "uuid": "d38db3e7-2466-42ab-bcc7-2aac0280f6a2", "comment": "Malware payload", "value": "a8e2f2b1c34d1e7a6b602ba9f0f4eafd050c859d96f6d2ab2c2fd006c569aedc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808710, "uuid": "62146b5c-a8ab-45cc-9fe6-9de781e09a70", "comment": "Malware payload", "value": "8142b82a012571620cc4dd6986d56b9f41719f94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808710, "uuid": "87a3604d-232a-4cd6-ad44-2c08d30dabc1", "comment": "Malware payload", "value": "a318812cb4cde142625ee9268dba055939c5a2d58780009e8b4aa3e9d0c672e6e4ca8def90c0417166b3a3dc12a4c2da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808710, "uuid": "234e192d-a49d-4f59-af76-522f16b3240e", "value": "T16F45E00423ECDAA4F5BEDB39917805204BF0F927DB22EB6E3D4951F91872B419A52733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808710, "uuid": "3aadc4d8-4d5f-48f3-83f3-0cc60f473e06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808710, "uuid": "8d7417d0-7701-4f4a-baae-1bbefd63282c", "value": "24576:nYgSFJynPgKzfjEXfmRyl/OZblXng07eh8I4lU:YhOPgufjEXf89gGehP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808710, "uuid": "2eeb2dae-8145-4424-9bbd-bcf35d9ebc82", "value": 1193984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808710, "uuid": "347eb0e1-469d-4d60-aae1-91321a51369a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808710, "uuid": "136a121b-021b-4038-837a-c9625219d5bf", "value": "a8e2f2b1c34d1e7a6b602ba9f0f4eafd050c859d96f6d2ab2c2fd006c569aedc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b30ebeab-1985-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819745, "uuid": "9914b601-d5f3-4e95-acbf-ffa14d99f57c", "comment": "Malware payload (Mirai)", "value": "dbb519556acf28ca97e3974949b45aa4", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819745, "uuid": "7829fe1f-62c2-4e21-a0b3-fcb8232a1d2c", "comment": "Malware payload (Mirai)", "value": "a96bf10e6e3c7dc224385f03fdec91973aef4b0b44bffc60a57d7e86be978217", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819745, "uuid": "e8da2162-a240-4f5b-bfa3-528e697d31c0", "comment": "Malware payload (Mirai)", "value": "099f46f4da13cb67d4fea1bb1feae94aae6322b9", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819745, "uuid": "673646b4-052d-46c0-b9b8-fc269a6b005b", "comment": "Malware payload (Mirai)", "value": "e290e2b7e0a18a9b717e11727ba0cc8ff78b7c9589c1f38ea6f2755e855a31caae89661ff6a4f396c1888ad727038f44", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819745, "uuid": "6f20c71e-77fd-40d0-99f4-5790aa422316", "value": "T136A66B137B58EB1EC71822304CB2CA9427295C8541EBA56BB785F318F9F31AC596EDF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819745, "uuid": "7f2dadbb-57b8-4b87-a645-2813f40e7838", "value": "98304:zoElepk8WIuRrjEUPgUV3gCwdansofZs1JfTcp/:zoE4aIuRkWgE3gCw5ofeFcF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819745, "uuid": "570e4ba6-4bd4-44ab-9a87-51dcebcb4ba6", "value": 10232673, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819745, "uuid": "b8c0d40c-2e0b-43e4-acf0-adae269b1fa0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819745, "uuid": "a8a83e3f-0b70-4887-b283-b30f670bd27f", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "951c8ecc-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811104, "uuid": "8ab9ff38-cbec-42eb-a6ad-4f0371b9fde2", "comment": "Malware payload", "value": "ddafc07e82e173802e8d13d7c130ec9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811104, "uuid": "2f27f66e-f4b7-40cf-90e3-e4350c1a466f", "comment": "Malware payload", "value": "a96dba4c0e3b840016aec0a6456b43cb864ae6a4398e9e0473155a39e4b42cb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811104, "uuid": "ce6412f5-2330-4281-87eb-a2ea6496d3a1", "comment": "Malware payload", "value": "38ed6bea7da05941d2146de449bb17637c10d7cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811104, "uuid": "7cbf2c71-cdb2-4125-8505-29e0c7b3a169", "comment": "Malware payload", "value": "b5cb5ad98b92d68f7d78759a0641abb25c171706f1a4db415cecdf62170652b17f04dc4b541308af07142c5fec0ef35a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811104, "uuid": "623ad639-cd3a-4894-982c-bc24a57078f2", "value": "T16326337D009BC119E757E07297B9B6EEDE5F1014E4822338029DC1849AF877817AFE9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811104, "uuid": "e46770f7-89bb-43a2-b28c-77b2401e6fa6", "value": "459038dd913bd7fa2746dd2acf101131", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811104, "uuid": "8f6325cd-81f1-4e46-b68f-0a1608207437", "value": "98304:Ho9kg1hstN1CgCnJtCEcDUjG06WMzEwPZL4607SHy0rqy2:Ho9kUstGgC0D706WMzEwpGaqy2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811104, "uuid": "c1ba89aa-2d6d-4d5c-8513-a1677d3a3442", "value": 4614144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811104, "uuid": "346a28e4-f675-469a-878e-6ee71a1dd0fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811104, "uuid": "a1e339dc-8f68-4008-a4ef-9f046290c517", "value": "SecuriteInfo.com.Trojan.PWS.Stealer.44341.13531.7826", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11cfaf25-1964-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772805301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805301, "uuid": "2a4e3606-188a-4d61-8763-f1a30bffbbe3", "comment": "Malware payload (AgentTesla)", "value": "81ed5086fe18b6a51f3621f6112f39f1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805301, "uuid": "2deac285-6662-423c-855c-a7fef587d3c2", "comment": "Malware payload (AgentTesla)", "value": "a98e7500e1738805441c9c5b188276cd889b0a8bae8caccd94b3c39aa53d9bc6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805301, "uuid": "7e485586-2c61-4317-8d17-6d6d4f366046", "comment": "Malware payload (AgentTesla)", "value": "e439f8a9804b991e0e396e6d8379ef0557f25cdd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805301, "uuid": "b8b3c453-3545-4f0f-907f-9e3914d36096", "comment": "Malware payload (AgentTesla)", "value": "50ee800c4b4c2d836edf022ea5f91c4f7d9285d41f0166522357ffe20c3a7db769989e080081da661462d9e2ed29feae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805301, "uuid": "92ebd5ce-a0ad-43a2-9de2-3fd34849488a", "value": "T1346462027F44EB11E5A83E3792EF2C2413F2B4C71633D60F6F489BA51952652AC6E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805301, "uuid": "9ec78680-b481-4e4a-8342-8bc6885f7c75", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805301, "uuid": "094d36d9-bd9f-4062-967f-94cf9ab860ac", "value": "6144:qnASaKiSgSNm8xSEerYYtHLVlRfhMPRmxp:qnASaKiSgSN+tHp2Je", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772805301, "uuid": "d78da33a-355c-40e5-b808-b1ee29c75069", "value": 324096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772805301, "uuid": "ba6287f7-be69-45cc-8987-bdab8fc21e52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805301, "uuid": "5680acd8-ae0c-4f3d-b9d8-c73855c76656", "value": "a98e7500e1738805441c9c5b188276cd889b0a8bae8caccd94b3c39aa53d9bc6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba96f461-1971-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkCloud)", "timestamp": 1772811167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811167, "uuid": "db77ad4c-86f5-4796-9626-92d60f00ee7e", "comment": "Malware payload (DarkCloud)", "value": "4c14d7b5ac4c07799e5db765a3965ad4", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811167, "uuid": "aa47cd50-da88-4032-b45c-450c176beae5", "comment": "Malware payload (DarkCloud)", "value": "aaca8fd06245a7038f0f222f2bd77ffb89b7c41fb7dababa2a7058abd641552f", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811167, "uuid": "2fe1f7a6-447e-4742-b7b4-aa01c91def96", "comment": "Malware payload (DarkCloud)", "value": "98813c1d2e0548d808a4d46359e854ea0d533bc0", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811167, "uuid": "52bedf50-859a-48b2-96e7-343a29459e4d", "comment": "Malware payload (DarkCloud)", "value": "3047b7d46b63fdc1279cf92c01b20557a503a2550d518d4da572875b7ae577ba2eed1208ffd8112d439367aec4783a6d", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811167, "uuid": "289d43bf-3a97-466a-82e8-068007ecd3a2", "value": "T12E55CF0273C1C062FFABA5734B56F6115BBC79260123A62F13981DBABD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811167, "uuid": "ab0ccd7d-1e77-49d0-b564-9093f4ebcaed", "value": "c1ce208b1192bfcf652c179f34f034d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811167, "uuid": "e22191a2-bb2a-4183-9620-025c3d081b88", "value": "24576:z5EmXFtKaL4/oFe5T9yyXYfP1MAXDzk6Ez/knbkdLv3zi4Bte:zPVt/LZeJbInGizkZ/gW37B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811167, "uuid": "5e957db6-17db-478a-9194-56eda2112f97", "value": 1309184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811167, "uuid": "1245cd11-de55-4025-b3df-13cda7e5a339", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811167, "uuid": "fbcb672f-1118-4443-8b99-ef54dbee3e84", "value": "1b820d25eb575ddb78cf2c0dba54ea33b000d106f1d10760047e2ff760cf0b07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ebeb71a-1968-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772807013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807013, "uuid": "8ae752ff-8df4-45a0-a5ef-b6617a59293a", "comment": "Malware payload (Mirai)", "value": "827a8e3b83d144032c770ff5e761aa31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807013, "uuid": "1a485862-4be1-41b0-b574-2d0bd029a5fd", "comment": "Malware payload (Mirai)", "value": "aacf774455b1b371747775e6bb083f748c006d7939f786b31ddb5e8bfc16106c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807013, "uuid": "25824327-e6d9-49b5-b707-2e08f50433d0", "comment": "Malware payload (Mirai)", "value": "a43a6dcfcfdb691d7933003771be450f9923cb8e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807013, "uuid": "bf708ce4-7f5a-4daf-a64f-3357d05ee749", "comment": "Malware payload (Mirai)", "value": "17fc0e49405631c3020d112d64f3458b9f17959eb2ab8676de6200c704ef09da326446917ad75b36b6d5a63e97eef85a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807013, "uuid": "68944851-6d3b-4314-adc3-98e12bb6ed3c", "value": "T1DF160295F3830D4BD9C5817F758209884900EC2EB6E5C27B7753B5BF78BDA309B66A20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807013, "uuid": "6512a249-28cc-40b3-9646-bf41f397fe04", "value": "98304:ocrlUgk4LlOi0ywSkyv0vY7Z6w4AHzXkVwYQb:fk4x30/Sn/BHzUB6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807013, "uuid": "91a6455a-5f32-48f8-98b5-e97ae6fbe2f9", "value": 4291176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807013, "uuid": "9f87f61f-109a-4974-9aaf-9290d655c1b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807013, "uuid": "c10591f0-b3ed-4822-82a3-e826b270c625", "value": "a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe321693-197a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772815146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815146, "uuid": "57a61d35-36e3-4b01-be11-75066f1c2a8a", "comment": "Malware payload (Mirai)", "value": "828d9abf27c1a91cab5ba7e35b23fb75", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815146, "uuid": "b5391706-f179-4d1f-b342-a343efb9ef27", "comment": "Malware payload (Mirai)", "value": "aadff1cd1e8f5414201101ebdd063fcb4d2957cf9330ad5469b066d6cc264066", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815146, "uuid": "922cb9f6-3ce5-42de-87e3-23978a189d13", "comment": "Malware payload (Mirai)", "value": "9a28b0073ecd01114f5901b16c74721525861d9f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815146, "uuid": "07f039a5-aa22-449d-bf7a-cd22e2b605b4", "comment": "Malware payload (Mirai)", "value": "d63bc35f68071747792b5bf70c81883c8838a4a0cfbd6e06be3221c0e596deaea7234b86ec19bf8814fd7f32b8a42202", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815146, "uuid": "142f163e-da6c-455c-9c54-b829f6e63ff5", "value": "T11F838B23C93A1DA8D84805B0B0B48F755B63E515C4672EFB599AC63AD483EDCF2863F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815146, "uuid": "6b09c527-8a68-430d-a9f2-0cebab38033e", "value": "1536:qxD+xE86+GValyEKhboKZvqbd+/RCaWZNS8Hyu:ql+xsV8Y1PZ6+/Rw4S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772815146, "uuid": "2576876a-261f-414b-bae5-e664a379d221", "value": 83812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772815146, "uuid": "e3edbd03-08a7-411e-b5f1-608d3e7550ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815146, "uuid": "6e125605-a0e3-401d-aa97-629e6df3b7e2", "value": "titanjr.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d035a24d-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (Expiro)", "timestamp": 1772811633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811633, "uuid": "49687f53-4d15-4a28-aef1-a00b383d1704", "comment": "Malware payload (Expiro)", "value": "b31f2172be97160db440bfaf139b36b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811633, "uuid": "4062aa8b-4f97-4014-92bc-33e537cc34a0", "comment": "Malware payload (Expiro)", "value": "ab037125af51cff011b4604f3d417b2a34ce3ed5120d97ddd68817052e2e1790", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811633, "uuid": "6fd95f92-9dc4-41ec-8c7c-2f4b7e5a2c48", "comment": "Malware payload (Expiro)", "value": "7c7f19ca25c058e0ea81df05fec3861b854cb59f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811633, "uuid": "3f0ef380-4c81-42ea-8cb5-22a7253004b0", "comment": "Malware payload (Expiro)", "value": "f643eaa692b792b20ed5ddbca375ed95354f7b385190cd0ba81d782e04a1dbd804456d60b5f211e1da63ea9088e2b9b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811633, "uuid": "7eb73f46-4db7-4ecb-b878-a1c0a6a23396", "value": "T1E39512640755DC06C77A06322552F178DB75CEDBB512D24ABEDD3EAB3B2BB110AC2283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811633, "uuid": "bc9663fb-b2b4-49b6-8e81-3e918fee8588", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811633, "uuid": "2ed8551a-7ada-4def-9ac1-c06c1bae4f60", "value": "49152:yQ8hq3rnqNhCXFBTIPGLD2QP2c6UJDbB1kPMrerEeU:yQ8hq7qTCPkPo2QPphd1AEeU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811633, "uuid": "c4c12adf-6e0b-4954-90b4-0adc7f22363f", "value": 1985536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811633, "uuid": "07a7bf33-3f2b-417b-931f-cc04449b09f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811633, "uuid": "b0a3da42-edb6-4966-a444-a06848325be3", "value": "ab037125af51cff011b4604f3d417b2a34ce3ed5120d97ddd68817052e2e1790", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcafa662-196a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808272, "uuid": "6e78fd09-2830-454c-9dd3-2d3579b24acd", "comment": "Malware payload", "value": "7bbe86720927db1b4034097c44e66490", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808272, "uuid": "0e0ee482-6030-4981-af75-9796718f6f2d", "comment": "Malware payload", "value": "ab1cbdbb23bd7a1add328be6a262d7c5165fc2300abf5afb5a99a0b74e5ac58f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808272, "uuid": "999193ff-c5fd-41dd-bdcb-1a3a26c23c0d", "comment": "Malware payload", "value": "86f620a889814b5e0f0ad07e7d88f0d6c5120659", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808272, "uuid": "a34b0754-1bd3-4689-8301-8209339479aa", "comment": "Malware payload", "value": "16a5059fed305174cf500ae2111706f6a835bc108b191ee4b4aaceda99d2c7373fd9786f6ce973fce5868fed95e14c90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808272, "uuid": "aaa2db43-d69b-4fd3-b503-7a7768c33bef", "value": "T1A755BF027391C066FFAB92334F56F6115ABC79260123AA1F13981D7AFE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808272, "uuid": "52fdd1f4-7802-45f5-9443-00faeb6e30b5", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808272, "uuid": "696c2bfe-60ab-4c84-8d29-cfae23789249", "value": "24576:J5EmXFtKaL4/oFe5T9yyXYfP1ijXda3KHt/4y1QVQxx7LwpwbW7:JPVt/LZeJbInQRa3y/4hQvLK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808272, "uuid": "a8dccffa-3914-49c4-a1e6-b9ac695f24eb", "value": 1285120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808272, "uuid": "d3b0d8a5-c953-44d9-81a4-dd3f2fd7e125", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808272, "uuid": "ea603ec0-0095-4ec9-8e01-c52222cd1212", "value": "ab1cbdbb23bd7a1add328be6a262d7c5165fc2300abf5afb5a99a0b74e5ac58f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c330d2e-1951-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1772797184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797184, "uuid": "051ef880-21a9-4834-b61b-fccf62ddc2cd", "comment": "Malware payload (Amadey)", "value": "4a297bce61aaa3b15d5bcfc532fa6db4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797184, "uuid": "768c628f-790b-4f4e-ab51-6dc3f82b695a", "comment": "Malware payload (Amadey)", "value": "ab4a92b1b4fd0320e7a13519c8c2b8fa8a828ec56db52864dd70dc48061604b3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797184, "uuid": "7ed8d81c-f055-4007-8bd7-755e0ca11099", "comment": "Malware payload (Amadey)", "value": "4e5ce728423600e86a37af7ae48c1b3710906981", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797184, "uuid": "c0edc3f5-48c6-41fd-8e3d-3813567d3332", "comment": "Malware payload (Amadey)", "value": "22d0616638684fe67d495d77dade4f6e852bd8e71b038260a7c7574eb2feccc1c7c044fe925389b5efad27c5d3f65d4c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797184, "uuid": "8ced85c7-c317-4a7c-ad6c-c1c6fef4a422", "value": "T11A24226301922667E52298741CD5470875E3DE7FE2A02005D2F776172E1F3EBEFAB289", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797184, "uuid": "47c59c8a-82e2-49e4-90fe-72cea5c0dd8e", "value": "ee53c10aff1d01eafea53328179e33a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797184, "uuid": "f6dc0016-d8f8-497a-99c7-773057b8b19e", "value": "6144:DzpZjyqgdX/w7drhQZXveORMOqHa02FDz4+7cj:Dzf7gdPw7drSF3tq63G+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772797184, "uuid": "289d6b52-e70a-4ca7-af38-9916a8fd4dcb", "value": 219648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772797184, "uuid": "fb42ca2c-200e-4905-b636-ea1ace587200", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797184, "uuid": "9187ab5c-7b16-485a-8d21-cb3c0e6add4a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1168e288-1968-11f1-a769-42010a9c0008", "comment": "Malware payload (Kaiji)", "timestamp": 1772807018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807018, "uuid": "2d2d5ef2-9e13-4ad1-b385-225786d29382", "comment": "Malware payload (Kaiji)", "value": "60a264328556eaccf625dac0692bd29d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807018, "uuid": "fafd00ce-224e-4def-84ff-02e987eaa01f", "comment": "Malware payload (Kaiji)", "value": "ab802880692ce7b1d574eb00e9bc69849cf4cd9524b203ddf5adb4d0eceb4f5d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807018, "uuid": "5ef86505-cc19-47fc-90b0-c08f82414dae", "comment": "Malware payload (Kaiji)", "value": "79b04cf422e905c69d97e78a32af50a813d1fb9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807018, "uuid": "ec392c98-5a52-4430-90cf-dc3ea6eaf188", "comment": "Malware payload (Kaiji)", "value": "ca84c44847a03521606d7c6097c57edd46b550360edecb9f58668673080aed90efaf0a2b87c3fea259a6c0c64fee8b61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807018, "uuid": "2a8578f5-36b0-49a6-9298-c87e724e483a", "value": "T12FA533954274B409A9289326FDF27D73F683E429F024BC663E96DFA904370F94EF0916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807018, "uuid": "3429b239-641c-4d18-bef3-d297f0be0877", "value": "49152:lQbWX58knyV2k7Gi9L4ZlTle7F79Lz2fpLxA:KbGvyV2NeLeT2FpLeI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807018, "uuid": "1353d330-4680-4f8f-b72c-8ecfad8b2c6a", "value": 2262176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807018, "uuid": "6b3dda85-4c04-4045-bdd7-f0f02624be4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807018, "uuid": "391c810b-a763-42a9-8efb-d731c67b9e37", "value": "linux_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcad48e1-1985-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819761, "uuid": "5bf5d9d6-dba9-44f1-b778-522e3b1f7ecd", "comment": "Malware payload (Mirai)", "value": "830f50e73f0cfcdd2bbeb05b178ce1f3", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819761, "uuid": "b1dd8671-34f1-479c-a966-53962c51c3b4", "comment": "Malware payload (Mirai)", "value": "ac3808558b7dd7dd51b800d98499145e5031895e04732b487787f8fdc6d40562", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819761, "uuid": "79697c0c-a957-4229-99c9-0d7c2df6dc53", "comment": "Malware payload (Mirai)", "value": "463d4614364bbdc855fe5b755e5d8bd99ddc960f", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819761, "uuid": "0e820ab1-dade-4d92-a9b8-b4bf4f39c893", "comment": "Malware payload (Mirai)", "value": "54b42c10f6212c40fa6d7a69fff6c3ee3df374a44d14caccc6c8ede05ca2b1410cb26793c5889ff8e197672c42b10961", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819761, "uuid": "d1a86681-0ea8-4ffc-ae5f-7f8843b5a508", "value": "T196A68C03FCA119E9C1E9D63189639222BB71BC485B3267D72F60F3346E72BD06A79750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819761, "uuid": "e729f10f-f070-4aa1-9386-cfc2d7c9f5a9", "value": "98304:M5zRUtKxFTsfyRMufYsYeDHFYE6bqv+LmVKslpRVriaCJ6IF:MlxFsfy6kauFRAq+XQhims", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819761, "uuid": "f7e73eff-ddd5-4667-b099-4ab484aa0d11", "value": 9663046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819761, "uuid": "2049b114-d36c-428a-b79b-c43e17c4e1af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819761, "uuid": "cbe5bd13-2eb4-43c1-8f42-480110d47b5a", "value": "bot_x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ecef652-199a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772828623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772828623, "uuid": "a8f0f08f-5c72-4ae7-90dd-b144788ef8a3", "comment": "Malware payload (Mirai)", "value": "c754ba8add0296908e66c0d045c38bcf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772828623, "uuid": "3c98b834-d55a-483e-936a-aef274494c38", "comment": "Malware payload (Mirai)", "value": "ac4f283f65513160e27feb1d2b02135a1ac2e3eab5725f9fac5b08a2c7c19a69", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772828623, "uuid": "1e64453b-db22-467a-aacc-e74c5032e57a", "comment": "Malware payload (Mirai)", "value": "3cef0d9d3cdf21ea760ac5118f85ee3fabd45170", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772828623, "uuid": "0aeb9062-b54f-4c90-9cbf-e77705c66166", "comment": "Malware payload (Mirai)", "value": "7de4f1f4f91bd6dc8cad11c4317b7e98fe7888e04212e55a9c75c4b77f8599f31c85fdeee00c480a05c496fe2b768282", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772828623, "uuid": "5e0da38b-d479-4ece-a9d6-07a970f23830", "value": "T1C534298AFC81AF65D5D422BBFE2F428A331317B8D2EA71129D145F2476CA94F0F3A541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772828623, "uuid": "f80728fa-8300-42d1-a2f6-9206f52d4bfb", "value": "6144:T2s/gAWuboqsJ9xcJxspJBqQgTuaJZRhVabE5wKSDP99zBa77oNsKqqfPqO0:T2s/bW+UmJqBxAuaPRhVabEDSDP99zBa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772828623, "uuid": "04daa274-8f27-40b5-af7a-cfd48212876f", "value": 241816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772828623, "uuid": "cc039ac0-edd0-4eb8-a890-6e23e34ee923", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772828623, "uuid": "ec38110d-f51f-42e1-bb66-153d529167d8", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "243b99d9-1974-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772812203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812203, "uuid": "9bee8f72-8488-4193-9428-e7888918c768", "comment": "Malware payload (Mirai)", "value": "a228330dae6c2f3b03b3ae5d623a208e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812203, "uuid": "02bc4ac1-99ad-402b-a50c-d924001d9b19", "comment": "Malware payload (Mirai)", "value": "ac898d1b1b55077172b12a9e2edd2527561f79407fe30fe6601151426ef9874e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812203, "uuid": "7e005fad-b345-476e-b12c-8de903497d6d", "comment": "Malware payload (Mirai)", "value": "3b409ea4c412416654f41b12a8258dc654704276", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812203, "uuid": "b049d7df-95ec-458c-8179-d13191cdc73a", "comment": "Malware payload (Mirai)", "value": "20844ec7c3382da419f68d0ae761f10ab42a86cbc7113dbd70b6be0eccc1a961a2a24f0cd5f69fbe6eb708c5cb852b9f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812203, "uuid": "21e2d8d7-c2d0-475c-92e4-b28737589418", "value": "T139936CC4F243D5F6E88701B16077EB339B32F5B5212AEA53D3689932ECA1541D70AADC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812203, "uuid": "867dc046-e0b7-4d88-a830-36287eba23a0", "value": "1536:3Jw2wjJr2TqZzBfgfJfGUVEf5U31At0o6dIC7WkSKLSIvAa+:3JwLjJr4a9fIJfGUVEf22tR6dbKx1Iv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772812203, "uuid": "0b094a28-e6cb-4cf9-bc1a-04b882c48c6c", "value": 91816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772812203, "uuid": "e332f9f3-ba02-4716-9b4b-66152e8e77e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812203, "uuid": "b64babdd-9676-4316-a38a-b75d4cb9ab97", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e16eabb-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772809348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809348, "uuid": "61b762e4-d0c1-40c6-909c-f36705f80833", "comment": "Malware payload (Mirai)", "value": "bd3ec63331fabbb45884af24085f4249", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809348, "uuid": "fdfb03fc-a123-42d7-9e30-e57e36c4e371", "comment": "Malware payload (Mirai)", "value": "ad74818a56d1aa0f06ccf4da420797bd80efffae638d0f5183250b7887fe32d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809348, "uuid": "98ad48bc-92e8-476b-a68d-c966ec84a057", "comment": "Malware payload (Mirai)", "value": "399b6581ef2e06dd76952c4833d5517909f2ce38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809348, "uuid": "9bf13db5-2389-47dc-8ad5-1586f65d8997", "comment": "Malware payload (Mirai)", "value": "ea60bd281e3a15aa6e54a2a6ab951206b2ec89295fc2e11d38e190d7475969c1c6f699fc25b90d76e541995fc01b1a87", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809348, "uuid": "9bdea155-e7dd-41d4-80b6-539efcad701a", "value": "T1CDC30956F8819B11D5C151BAFF0E124E77131B3CE2DE7312AD24AB307B8A8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809348, "uuid": "d0453a5f-94aa-41da-b4e6-b9f8ee620318", "value": "3072:f2D7YhjFMX+maR8TcDeRqQV3tNQYciYTG1P:f2D76aX9aKTcRQVnoiYq1P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809348, "uuid": "376d606e-8e40-4899-8ca3-dce3a489d33c", "value": 129244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809348, "uuid": "81a8fdc4-ec6e-47ce-9424-6037202d035d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809348, "uuid": "c18d8cb2-2e6b-41c2-bf58-2955bd17a2b3", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c09dbb1d-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772809459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809459, "uuid": "2962fa6d-92b9-4b1f-b308-6156fb06acca", "comment": "Malware payload (GCleaner)", "value": "7402aa93192fcac0b41cbe6c9517fa5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809459, "uuid": "8d48c85a-4153-468d-9d57-02db309b0f64", "comment": "Malware payload (GCleaner)", "value": "ad83e91d4feb45840f97118dfdd1ceeca987a2a9c4f2cdf41cebd4bd277c3d8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809459, "uuid": "2aa2b837-be9a-43ee-a2eb-6468aa8da1fa", "comment": "Malware payload (GCleaner)", "value": "cc10d990de7254283d1dc9ac2c2ad294ad3867a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809459, "uuid": "a0646f38-46ee-4227-be22-429f5b31b2c8", "comment": "Malware payload (GCleaner)", "value": "5fed98e124f44fd71d6b99635b67e590a4e55c5a448875366f317e68aa2ee15beecfb43e35b1160ce56891dca378659f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809459, "uuid": "71524c26-f2d5-4605-8b38-ce08ef87ab50", "value": "T18F06F1D2E5A7823EC5B9BC72DD016CB508B9BB406DCCBBDB06EEB44C9B6D35161025C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809459, "uuid": "cc4c4854-0306-4cb3-9304-3567637b7bef", "value": "345624d13ffc2b7f296b9d2972b1c0a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809459, "uuid": "86b01a13-60a4-42ba-ba63-aa7a99e1853e", "value": "98304:2iZBoko5IXNdax0GPUVeCCAS2Ti5a8f0IbRjzNi:2y9o5SC7oeCCAVeuIb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809459, "uuid": "00a72bf4-84b5-4c47-b8fc-ac420b8a9868", "value": 3814912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809459, "uuid": "9cf0358b-58c1-4eb5-8d94-d823cca4a87c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809459, "uuid": "0240cfc8-fc3a-482b-a927-1fc8ce34839f", "value": "ad83e91d4feb45840f97118dfdd1ceeca987a2a9c4f2cdf41cebd4bd277c3d8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "290ed649-1971-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1772810923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810923, "uuid": "2277b8ab-00de-4bef-9ac5-54b70f213e00", "comment": "Malware payload (SnakeKeylogger)", "value": "262f6bad80f10a820cc0aab347c2d305", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810923, "uuid": "798e9270-dafc-47c0-8dd4-6542a9c7be98", "comment": "Malware payload (SnakeKeylogger)", "value": "ae02c8aeee18c63258cae949190d03de7860648d6a36a4087c53c1e244c20ff0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810923, "uuid": "b3410b0d-1f85-478e-887f-c26ef3e2f4a1", "comment": "Malware payload (SnakeKeylogger)", "value": "0a9fec4e65070862d54d466478d8f6061e041d8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810923, "uuid": "f3196e8e-bd78-47dc-9f8e-a5b5e8c51ff6", "comment": "Malware payload (SnakeKeylogger)", "value": "a9a5fa549a25054b06a23ea8ac5dbb9d2d6c37d58e05cea05a76f74a1e948a559aeabfbec1514166a80664c2956ab298", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810923, "uuid": "52a4c190-3b8f-41a5-b65f-bcc51376464e", "value": "T10C35AE0273C1D062FFAB91734B56F6115BBC7A260123A62F13981DBABD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810923, "uuid": "5a13eddc-aa20-4b07-bf67-2ea73f605d37", "value": "c1ce208b1192bfcf652c179f34f034d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810923, "uuid": "d31a5553-95bc-4289-afe0-aa272ec46aa8", "value": "24576:G5EmXFtKaL4/oFe5T9yyXYfP1MAXDzDrlKSe:GPVt/LZeJbInGizD4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810923, "uuid": "966e84f5-6fdd-4e53-81e5-e5f1197e135d", "value": 1118720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810923, "uuid": "c0ef1ac4-e360-4dfe-89d5-537a9b2af474", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810923, "uuid": "d415bd2f-0516-468b-bcc6-1570b03652c3", "value": "907ef6a8894cb48e4c809ac5616237b59593bbdd104e7fec32e4599c0db45505", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f34d1146-197a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772815128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815128, "uuid": "50302cf4-db02-4a52-9b08-2e9b32ccde9d", "comment": "Malware payload (Mirai)", "value": "bcfbb0f6ff09af5b43cba8c983fad487", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815128, "uuid": "14a5cddc-a104-4ac9-bfd0-47c0444090f2", "comment": "Malware payload (Mirai)", "value": "ae1e0823bebe98bce39630913cdd8927df8c126e6981df11311a186d28c3e186", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815128, "uuid": "b211e304-3f69-480f-8606-823eced098d8", "comment": "Malware payload (Mirai)", "value": "fffded55b86d6d74f70651a9cfb9eb565bdd8333", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815128, "uuid": "af6200f2-ab24-4d0a-891f-1b7d92ec6cc1", "comment": "Malware payload (Mirai)", "value": "e849d99271b7c552d63910250d8b502609824a02a35e92523a4ca3f7136b51b457bbabbe894e0f6bbb4009a2ae5c5cfc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815128, "uuid": "988e1974-c2cd-4a3d-b1c1-62ff480fe248", "value": "T132D31945F8404F23C6D612BBFB5E428D3B2A17E9D2EF720399216F64378685B0E37946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815128, "uuid": "57d2428a-adab-426e-980b-7089c4f67c87", "value": "1536:cRqZNhJ0WgEpYopKNtEQB7F8FAhEu4VUtYmTpQUaB6Ll5skor8VBgiAvlerwyw3i:cRiFKoQEMh8Fo4EdWUaByl6o0ih7oeJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772815128, "uuid": "30d0a18f-9afc-4b28-a26a-110f774cfda3", "value": 138016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772815128, "uuid": "288afc0c-69a3-45a4-b0c5-d87a49beb4b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815128, "uuid": "6bf28fd2-2310-4817-b492-797aa2f6e92e", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b147bd32-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772809004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809004, "uuid": "5ae3906e-be4d-47e4-b2e6-04779eb9de6c", "comment": "Malware payload (Formbook)", "value": "50313eaf24d74f719ca5d99fb84f9f5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809004, "uuid": "f49660b2-cf19-46c9-9489-d8ba613befbe", "comment": "Malware payload (Formbook)", "value": "ae39ccba9894200313b2255b0eb4915da8b8acc058212f538af701d3800eb7ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809004, "uuid": "231ee2cc-a83f-40bd-b58a-71bc04c312e4", "comment": "Malware payload (Formbook)", "value": "244e3a6b79a875657640b2d92a3e62cbabccc49a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809004, "uuid": "13a2a1ae-c619-4ce7-b009-f2240cfcf937", "comment": "Malware payload (Formbook)", "value": "ee7491729d0d668bb6f673b08d4173b380d76ab218a41bd546d4d74ec20fb1f8247b4495f91d7d7e3b4d29a0ac5f063b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809004, "uuid": "3b9c0a6a-aa0f-4279-b2a2-8d78c7abe943", "value": "T18F5512042B26DD03D4BA0FF45A71C3710BF41E8AD921D3539FFAADEBB83A7905945292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809004, "uuid": "40cb1881-4d85-48f3-97fd-8c00556dd0c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809004, "uuid": "34077aad-14c1-44d0-ac84-419abd822898", "value": "24576:Zqu2VHea+Jcri6N6qfnr4x5SE3Y9JJE3vPrnyQTU7mAED11ktAIzz:ZeVHe/qri7Et5s3vLM7mAU1bIH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809004, "uuid": "aefe7075-4ac8-4037-b28b-766053266d1c", "value": 1319944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809004, "uuid": "2e4c3971-e2c3-4ebb-bed9-d6412389045a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809004, "uuid": "2f4177ff-bf86-48d9-9fe6-bab10143c816", "value": "ae39ccba9894200313b2255b0eb4915da8b8acc058212f538af701d3800eb7ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19ab2346-196a-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772807891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807891, "uuid": "f363f881-2db4-485f-9605-c681f2e5a770", "comment": "Malware payload (GCleaner)", "value": "82628eb23240bdae28b18ffb945cd7c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807891, "uuid": "4cfb2743-7270-48ef-b365-d50e0d625ac8", "comment": "Malware payload (GCleaner)", "value": "ae4900605d9fe8619d35c0384540fc831b9bf1cde8b35d97c963a185348f9dcf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807891, "uuid": "faaccf13-eb76-4f62-983f-d5b8728da9f0", "comment": "Malware payload (GCleaner)", "value": "ce5c0c19fb58b8dfc57edacd002f6533dda145f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807891, "uuid": "b3d10002-d8e6-4268-a6ee-6b7d18f1a366", "comment": "Malware payload (GCleaner)", "value": "d41c3a823a75d45f1f65b53f88fee82d8553a85fab01a6e4eb9aa324a23c4480c94f754fbe6a561e10ea6c76a4b3255f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807891, "uuid": "6fa99fc2-f83d-44b9-aac0-7dd1e21cf108", "value": "T17346C02251BBCFECD12EC238DC295A04885178FE253CF7ACFAA560D5262F5567D292F0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807891, "uuid": "8ba854cf-3900-4d26-a8a8-e0ac5d65267e", "value": "e5f32a93ddcf3aa9009cd70911b0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807891, "uuid": "f28c44e9-4083-487f-9359-741d3d3678d4", "value": "98304:x9CexzIdvYfWIlj1JvXW4v8T/x1y1JEZRZx:xuxeWI5vtvE5cEZRZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807891, "uuid": "7078bb0c-be2e-48db-b185-ca000125761a", "value": 5709824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807891, "uuid": "3309408d-7c81-4283-b26e-75344d01a00b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807891, "uuid": "d31c70c9-ba81-4124-9c43-f871b0c7acc0", "value": "ae4900605d9fe8619d35c0384540fc831b9bf1cde8b35d97c963a185348f9dcf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65032f09-1969-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807588, "uuid": "7fe26675-960b-46d6-9d06-14e40c2db8b3", "comment": "Malware payload", "value": "9a334e471d311bd7885626de026125d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807588, "uuid": "dec45603-e8a7-4f19-b8e4-0391044a15af", "comment": "Malware payload", "value": "ae7c683dfd09c59ab259f3bc68f762516fd1113dce424d74c0701ab221d2b442", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807588, "uuid": "f996db85-537d-4537-b03d-175b9c5bd6a0", "comment": "Malware payload", "value": "83e464738e61d1f38d6ed5e7a8a5088452948b33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807588, "uuid": "1c7576b8-a8bc-4e3a-9de8-8c9fe4ba2c3b", "comment": "Malware payload", "value": "4c7f740ae557d758d11203c693617a4ede1b8eb0ef5bc5b3cdc9d383d348cdbd7017b180669aa95bbd14abe0c146af2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807588, "uuid": "01cda996-2d4d-4dab-926b-2d099f4dcf37", "value": "T15694F622E720B069F9A349702D789256792D3D7A2640DC0BBB8DDF1A3771A8764F431F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807588, "uuid": "ea260861-a368-4638-98a3-9e21768cbb8a", "value": "7c1af338cceefa303e49fe9200309632", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807588, "uuid": "33be9821-741c-425b-a8c4-871b234ff36c", "value": "12288:ciZ6+TPnqtLfYKXn6cb06yN0015cH7iI:c4tg6lfan", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807588, "uuid": "f020ab1c-ef96-43c9-a148-c391e082dcba", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807588, "uuid": "96b55618-0dc4-490c-acca-e546a017c8f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807588, "uuid": "5dbcd9e3-0175-4c44-88f5-961a3d6aa94d", "value": "ae7c683dfd09c59ab259f3bc68f762516fd1113dce424d74c0701ab221d2b442", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae11d319-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772809858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809858, "uuid": "0157a805-456e-4fa9-9464-b0740b8b1ffb", "comment": "Malware payload (GCleaner)", "value": "7ce1d245ad32771351ace4ba60b139c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809858, "uuid": "537b7814-feb9-48ac-a189-d694f65d52d4", "comment": "Malware payload (GCleaner)", "value": "aeb5058555d4f961cca7e15598fbe3d1c9f466b0a9b36d391ebc4f7303896607", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809858, "uuid": "74dd6cf7-3b29-413a-b9ef-ab31a138938c", "comment": "Malware payload (GCleaner)", "value": "88aaec4f4a4849f313e1f72f1c669a06424b0656", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809858, "uuid": "3cdd42ba-b812-406e-a783-18bd6d5d6bd9", "comment": "Malware payload (GCleaner)", "value": "36d4180d4988e38402797e2a631c4fb9c85679f84720f964d9f5c795d43561288cf00327a7c8cc3eae12786f39b1f586", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809858, "uuid": "6a91838c-e746-4ac5-a629-e5f82b37eff2", "value": "T1C0D48F25FED08433D1636E38DD1B62A598B57E803A29D44A3BEC1DCD9F35382F865293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809858, "uuid": "85427dc2-ccd3-49f8-abf6-27bc30668db2", "value": "c475b6e242f56325f64c2b76233f720b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809858, "uuid": "a44e9c1c-e790-4b1e-8548-dd14599a3205", "value": "12288:rQ8mJu5T0Ns+MD77lUjVMNokBOWnt0cjJ1bT19D:cJFNhu7lK2okUWtvjD19", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809858, "uuid": "5e8b793d-00f5-4e04-9ad0-46ae4446b180", "value": 643584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809858, "uuid": "e08ffb64-6a3f-41bb-943b-f49952dec45c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809858, "uuid": "b15604ce-a8af-4615-839f-09ff7531f1e1", "value": "aeb5058555d4f961cca7e15598fbe3d1c9f466b0a9b36d391ebc4f7303896607", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f575e18d-1983-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772818997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818997, "uuid": "e9a01e84-8bdb-48f9-8885-71ef30a29176", "comment": "Malware payload (Mirai)", "value": "09cbcd7475de8c8fc0da63f448910b9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818997, "uuid": "083a0a2a-d5d2-4bfb-9fd8-e6852baa2f72", "comment": "Malware payload (Mirai)", "value": "aefebbfd0e0d483092858b0338a45bb3428884c5551763e0863d380a8381aaa9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818997, "uuid": "204d5a44-6a56-49be-b507-4efe344d3dd0", "comment": "Malware payload (Mirai)", "value": "f1cbc02e38c4c6909ac5456771357cf4b094d019", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818997, "uuid": "43d3c912-b247-4fd2-b36d-33c4abcc37e0", "comment": "Malware payload (Mirai)", "value": "5dc69f44660a32e2c6659700bde94b92fb074a25f9c986c02afdfff9bef7081a06dadcf699a38edb8b7f0b90c55ed28e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818997, "uuid": "5a6cde48-08ff-4e62-a8de-03c03bc59a87", "value": "T164C3E686F8502B36D7D2B6BAF70C039D7A2E0358F3D7B2118D345E6173C9AA56D3A121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818997, "uuid": "c70c9da4-bb13-43ab-b345-5d843fa98088", "value": "3072:cTEIs9teU99j/5sWw/lwWujWszCxzSYBuVBuZ:cwbu/lQjWszMXBuVBu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772818997, "uuid": "cb9adfde-19d4-4157-aed9-de93071947b4", "value": 124728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772818997, "uuid": "722d9452-20a4-400d-bc93-707ee740ce04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818997, "uuid": "df379d37-c3f7-4437-8a35-84892b8dad4f", "value": "debug.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cf38bd1-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772809292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809292, "uuid": "4df6a64c-eb0f-4261-bb7a-13861917f1c6", "comment": "Malware payload (RemcosRAT)", "value": "854d086532cbda7c03f94c99f1232986", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809292, "uuid": "3fe8b6a4-5d1a-496f-bd6e-fe2e69f009ff", "comment": "Malware payload (RemcosRAT)", "value": "affcb46f74c5f52af012229335c2e1cfb0c6cc3fa859dc5be3a21e00b2464763", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809292, "uuid": "af00f84e-2c7d-4950-904e-4b7c6a63ef29", "comment": "Malware payload (RemcosRAT)", "value": "2b2ceb932a0e42dad11fd2a27d106982c2dae034", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809292, "uuid": "536c0b56-f27e-49ae-ad95-512ceb54fba4", "comment": "Malware payload (RemcosRAT)", "value": "d91dac9e86e11d3e63db2958b039dc0b48ecaa72557c91fc335d256cab770c1dc153b9c398a5865cfbbfcd31ee22f917", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809292, "uuid": "869d5174-368d-4a75-8934-cc4487cdd872", "value": "T16E151225B765DC13CAE219F19DB696EEA6F8ED31016C8F0372117A2FBD75283E80D142", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809292, "uuid": "fd90c29b-ca02-4e51-a92f-73a17ffa06e4", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809292, "uuid": "eda52218-7d51-452a-ab95-5250a68ff9a7", "value": "24576:qPdnxJDfaUv86ipVwBKQaSTj94PjNzHEW:WHuj6iXwBK7STj9WIW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809292, "uuid": "c838a7e5-e684-4ea6-bd3e-8d95a290f5f2", "value": 957270, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809292, "uuid": "8ca735e0-00fe-42f6-870e-91697707c550", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809292, "uuid": "78c92912-5a90-41a6-a5b3-5348762d452c", "value": "affcb46f74c5f52af012229335c2e1cfb0c6cc3fa859dc5be3a21e00b2464763", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72e30c8e-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772811476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811476, "uuid": "eb64188e-f89b-4510-8b2a-7e49cb5a8470", "comment": "Malware payload (Formbook)", "value": "9948f84b281772b987ad5394a9106313", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811476, "uuid": "5e54fa1d-0d83-4bec-8aa9-a8eaaa8cfb79", "comment": "Malware payload (Formbook)", "value": "b01dae728c574bfbbef47d284e0138a89a7f41528206ff97b919f3ec092bc86f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811476, "uuid": "a521e06d-8f10-44ac-8114-0f3c8883ba62", "comment": "Malware payload (Formbook)", "value": "c04a5c368571359a49a214c7171cc70f1060568c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811476, "uuid": "d284716a-fd1e-4f49-81f5-a212ecd4070b", "comment": "Malware payload (Formbook)", "value": "6b5d5206da82b94088b7616a06f3b80ee832c749fdf067d656ec0078d690e4e934e4b1b254bebb0373dd7c7f6d6d626f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811476, "uuid": "fb6a13c5-74f8-40aa-b416-902efe9edaf1", "value": "T18FB4E00A775A64FDD15BC178C6430912AA727CC64B31AEEF0B944AB66E239F45F3E300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811476, "uuid": "c6d86d0f-e28a-4cfc-85e3-6cf671ce3366", "value": "c71d9111a77fb9217f1e372fa1b6214e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811476, "uuid": "966f0622-53ea-45e9-a4fe-16723cadb779", "value": "6144:LzDb9Qi3uO5hjk3F1Xly5XJJ8Io5s0jznDRj1H9EZjQzl+8HcAM6xvJlwHC:twO/jk3v6o5scnDjRJF9vnlwi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811476, "uuid": "be224f9a-d27c-4fbb-aaa3-0b99d40a5b77", "value": 495466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811476, "uuid": "fa9f5833-4d5e-4b6a-93a4-75ddf13528cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811476, "uuid": "b74b780b-2431-4c1f-ab39-796690a26264", "value": "b01dae728c574bfbbef47d284e0138a89a7f41528206ff97b919f3ec092bc86f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca1bfaf3-1979-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772814629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772814629, "uuid": "27d7b524-2cce-4cf3-81f5-b9de5e03f395", "comment": "Malware payload", "value": "d3a1356e684ef9c0f1b2176b2c347e7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772814629, "uuid": "569889c4-416a-42e1-8a27-4bc0768bf49d", "comment": "Malware payload", "value": "b0bb59ffeb08e8aad98ffa76c8c1f409ab6b7a7245099ec41784b15dfcb6630f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772814629, "uuid": "ed8bd41f-5c71-4162-a9ff-12fcc199a394", "comment": "Malware payload", "value": "32c569da7bdde44603e70de4584a97ccb3b7a26c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772814629, "uuid": "1767d12e-3718-4399-8b88-3413e28beaad", "comment": "Malware payload", "value": "2d885d85613f137c8215fb116d36c24f7e5e9c594f4fb5f696ae65e32b4586dac85653ec9cb7e23c1fa3fe1544a4fa85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772814629, "uuid": "f73dc84c-3692-4983-8073-57feb10ad203", "value": "T1D3E733807135C1EBD8C189F6B72696D6DB09BE8901D6B03D71EE3937B124A55E038B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772814629, "uuid": "aff4dfe4-acb9-4b2c-9747-ed88e14c5567", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772814629, "uuid": "413d0757-d32e-49ec-b9bf-2b7e2c008c9c", "value": "1572864:OejOYfEN/5rC3qEzaT8rLXpHhxwLixMArSp:O4O5rC6EzaCLXpHhxwLix/rSp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772814629, "uuid": "73502d37-db52-4441-aa68-034e54fa2bf0", "value": 69325144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772814629, "uuid": "21cb8740-f958-48fc-b3e8-2759a57961cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772814629, "uuid": "56298c2b-51e9-4e56-84f0-87207ca3557e", "value": "Webex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e5dc8b6-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819254, "uuid": "1e021817-8bda-43ec-91df-addd5363c579", "comment": "Malware payload (Mirai)", "value": "7691ec1ca0ce85fc67e94866ab339883", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819254, "uuid": "b3b0ea5f-f8c2-409f-915c-b1038b9f11d8", "comment": "Malware payload (Mirai)", "value": "b0cb45af42d30aa8582a1d1d51529c8134cdd463593d889b9d82376b89319504", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819254, "uuid": "e121155d-357a-4a84-a6d1-93093c6d854c", "comment": "Malware payload (Mirai)", "value": "633b8906423e6a413b9dfa5740be212c0fedaa57", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819254, "uuid": "6a755b4f-1364-4194-8a03-5aff694f295a", "comment": "Malware payload (Mirai)", "value": "68d580c4f81350d01b2b6efcb1f68915b3503fde92ab93c8ebc091d3cf867a7a0f201f061187ba89a82fd0d38ff5e173", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819254, "uuid": "5bfa41e8-b696-48fc-90ce-df5692f973ae", "value": "T135B2D680B946C917C4C55172BB8E61ECBB16532CE3FB3303DA264FC9279FAA64779940", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819254, "uuid": "f5359df7-bbc5-4077-92b0-ec40f88c765b", "value": "384:0fRofuCgAOl4X8ThV1bVPODBxSw1mvtfyEa4oY6Bk+M6uJ1Fx4e4u:0f6fuCgPl4XEV1bVP2RLmoN/M6XE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819254, "uuid": "08473a54-53e4-4a81-81a9-aa667c4a916a", "value": 23520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819254, "uuid": "cdca2381-2865-4a28-9155-5661beaaf723", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819254, "uuid": "45fa5990-5b45-44dc-bb34-71a0193c28d3", "value": "violetarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d0af94f-1934-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772784865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772784865, "uuid": "e1b09feb-3383-4cf8-89e9-6b6ef5ff2608", "comment": "Malware payload", "value": "8646799d65c1522aae8252a0521bad0a", "object_relation": "md5", "Tag": [ { "name": "app-64-7zp-dll", "colour": "#80A805", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772784865, "uuid": "744b866e-a229-44bb-8b0d-7c18c1351fab", "comment": "Malware payload", "value": "b0e20d6cac274d7d3d0eb47f39acb6302878a2881952c91593c2db3f036341e9", "object_relation": "sha256", "Tag": [ { "name": "app-64-7zp-dll", "colour": "#80A805", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772784865, "uuid": "2db07b8e-341d-4046-adfe-deee54c71be1", "comment": "Malware payload", "value": "a49943944130c8f94bc775c1bb90af735fd8311c", "object_relation": "sha1", "Tag": [ { "name": "app-64-7zp-dll", "colour": "#80A805", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772784865, "uuid": "6cc46643-1d84-4995-a813-03138126aba3", "comment": "Malware payload", "value": "3da41abb5473653f049a04798ff6a6abef140dc779dabb82bd1469ab431b7b172357f5f2d933e4303a9bd2406c097531", "object_relation": "sha3-384", "Tag": [ { "name": "app-64-7zp-dll", "colour": "#80A805", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772784865, "uuid": "60b337ea-3e4d-4e74-a6d7-8c65b404071b", "value": "T112183312B7E4C07AF1BB1B31A4F167110A7A7ED91B75A20F3349928E0D35B80E939767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772784865, "uuid": "e5b10d62-207e-4e1e-a266-6b5719e2974d", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772784865, "uuid": "f8915bea-d437-44d7-9889-a96240de25e2", "value": "1572864:M+e4h7TL9BHopUaxQvL77ILwCXkucQaBcSrufGanp7GgtcQ3AsEROqQ:de4NYeLf8wCTcQaBcSruZkUEBQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772784865, "uuid": "58f9723f-6ce6-4562-98a5-cda5c0c4b54e", "value": 88744733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772784865, "uuid": "6187b1d2-67d0-4b7c-a983-72d3b32eb039", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772784865, "uuid": "9e54e910-f821-4f33-bd30-f196859fdc06", "value": "b0e20d6cac274d7d3d0eb47f39acb6302878a2881952c91593c2db3f036341e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "874c2574-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819242, "uuid": "e561eb76-d55b-488b-8418-e1589e8c0ff9", "comment": "Malware payload (Mirai)", "value": "b596495934eb79c69046dcee96ec00db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819242, "uuid": "e3433f6b-e84a-4815-8f7c-1b4bd40ee6fa", "comment": "Malware payload (Mirai)", "value": "b102629b50cee10898e6c6e0f40e79764a051eea93bbaf15f3ddff99b41edff1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819242, "uuid": "67175063-8e12-43b0-87dc-00f9a2f17f7b", "comment": "Malware payload (Mirai)", "value": "a3aa0f276b661fa3ce0e8dc5138f03e3496fbffd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819242, "uuid": "71a66dea-f5ba-4f20-bcfc-c282ca058303", "comment": "Malware payload (Mirai)", "value": "b270ddf26e43d1e507237ddca6be38e056a2aa499920cf3bb289828c76a1e61b6cb24a5d2e29e30067e1cf25666d0f51", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819242, "uuid": "9d1546d7-7fa8-4653-a341-a7c469be33d8", "value": "T1CE04D50E6E158F7CF7A983354BB79E21975C338326E1C946E1ACD7105E6028E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819242, "uuid": "3ca1df7b-a486-4668-a113-c82f3cca77b7", "value": "3072:3qon33JOgCbdfDG1RZWHD/RQ4Cob8N9tsv/mcBETAjZ56/PMoCfJD99DqKKIfKs+:3qon33JOgCbdfDG1RZWHD/RQ4Cob8N9B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819242, "uuid": "798476b7-50a3-4f06-8534-1532c3391b58", "value": 176004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819242, "uuid": "fbfe9f05-4a65-4918-b9c9-e72e1dea2fea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819242, "uuid": "f45a7a20-bbf2-4033-a437-473dd965d39a", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe70f5fe-195b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772801832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801832, "uuid": "be6726ee-0016-4fec-90de-a4b74ff6c0c2", "comment": "Malware payload", "value": "696d2ecab2b3a70809ff3e2fad192200", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801832, "uuid": "c8d787ce-847c-41d3-9233-33d9aac57457", "comment": "Malware payload", "value": "b12b1bd3046f0e1b4838f187c334633b63df4cc76934ddf6140d9f3c008f5339", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801832, "uuid": "033d5f7f-e580-4f2f-97b6-a6eef02f17dd", "comment": "Malware payload", "value": "4c928b107011a24ad57904bd238459cb23c6177c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801832, "uuid": "f65bb21f-e29e-43c2-9824-1a2294bbfb52", "comment": "Malware payload", "value": "85b5df0db8e4a5535485840fceccd734d5b59e82ea093f63d2e6bf4d7a8264fa15a1fc30c615abc7ce24e80a06acaecf", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801832, "uuid": "7787b71d-5ba9-459e-8193-efc852f1c7ad", "value": "T176267C46E19223ECC466C1FCC3D7A232BA75BC054534BDBB4570F6312E72E9C6A69E24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801832, "uuid": "2cf77e2d-0574-46da-b19a-d52e55e1ad09", "value": "1cfed04bf9e198474f898827600813f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801832, "uuid": "7b8daee4-d6a7-48f9-a3cf-21b7e4e5a1ff", "value": "49152:fd6vr7qayHmNw0l9qOosQT+wbYXhROpF2jm0dtSnSxtnpO011VZvc1VOljKuTzYP:fDGNjqH+wbdk3pOG7ZE78a4Oevgm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772801832, "uuid": "4ce68e3c-a7d2-4832-bd00-147a606faa73", "value": 4574720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772801832, "uuid": "1a55a14f-9d27-4bc7-9c96-846b4c554a36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801832, "uuid": "e2d54391-8b70-4c69-9e22-ce8edc6b113f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a096f6c8-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772811553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811553, "uuid": "11f33952-8d11-4d06-8f93-f30c19b04f19", "comment": "Malware payload (PhantomStealer)", "value": "015867be700100e3a8e487b829e8495b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811553, "uuid": "38122645-4685-43b2-bc5b-91bca619de59", "comment": "Malware payload (PhantomStealer)", "value": "b162f3294b0c36fa3a52128e3db74e3ba7da2b1e8abcef7309a5b79033510ae3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811553, "uuid": "518a988e-65d8-423f-beea-e19e5335d96c", "comment": "Malware payload (PhantomStealer)", "value": "4216fcbdca67ac3f78d3d2779f821225b1388a51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811553, "uuid": "f8c039e7-0e6b-4493-b8fc-c37b436a551c", "comment": "Malware payload (PhantomStealer)", "value": "4f983f4dc6aafedd32b19ab27b6a9c98933e24f8b2f1d70e2f04024caca2641239f1b5648c5e81481f46c8b0b2135395", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811553, "uuid": "98f09e2b-5243-49ff-896f-f7fde7a97c62", "value": "T12765124C155ED507CAA607BA19B1F6BD133D6DAA7411C61B4FECBDEBBE62B041808383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811553, "uuid": "a34ca620-2a33-479f-9360-8e4a3ba92830", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811553, "uuid": "10e91033-db3a-4684-ac03-c5f68b702fdf", "value": "24576:63I5aOx5wKumSA/GHYv+JSUxkF3zPr3gZDUvoSutqpP:dUQ5wcSZ4mJDxkFPr3gZuoxtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811553, "uuid": "b93712d8-748f-4839-bc8e-7c84ab0ce7dc", "value": 1534464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811553, "uuid": "bfca285e-4480-4e83-acdb-65d29541915e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811553, "uuid": "b3fbbe1f-aab0-40d3-b7b6-1b1540dd822c", "value": "b162f3294b0c36fa3a52128e3db74e3ba7da2b1e8abcef7309a5b79033510ae3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d9d0a6b-1971-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810958, "uuid": "de9ec652-360b-4750-979f-74b7dc127b97", "comment": "Malware payload (GCleaner)", "value": "066026e04a209435aee037a299ef9b40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810958, "uuid": "53787075-ccff-41fe-8484-102a134f45db", "comment": "Malware payload (GCleaner)", "value": "b16dd50ca45b2c023f2ffa8a58945c0d09dfef1b68df23bebe27c569c75c5ffa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810958, "uuid": "138108a9-dd80-4d61-b971-14effca15f8e", "comment": "Malware payload (GCleaner)", "value": "884acb5cb3ebdca5bbae07feb72af184a8a1cb09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810958, "uuid": "9e5aaa89-b87d-484f-afba-5673161b353f", "comment": "Malware payload (GCleaner)", "value": "4f61091e7a5f6ea84af6afcb2bed30ee831c0775cd54e63e914a71a4ff9b05e19a3f98a6ea617a2726143bfce8dd6855", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810958, "uuid": "6bee3706-37cf-49ec-ad75-6ed01d9bd91e", "value": "T171F48E23F6B0C432D1226AF99C1BA6A5D825FE803D28554A3BF51DCD5F39392342639F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810958, "uuid": "6090e470-42c1-4ed8-923f-d4666bd131e4", "value": "ce7a1d07b14b49824555865592c3af45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810958, "uuid": "4103b686-5a79-4905-a3ad-b6e0b8b482df", "value": "12288:7kAJdZJGY+5K/Lo9r7WTB+rPDEF/qedzXWGHtkd8vHHPLhR:ZXZJeK0Z0sEF/XzGGCdqL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810958, "uuid": "d8afd938-f5ba-4539-aee0-b48d94bc7508", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810958, "uuid": "a2c1c101-2ff5-47a5-bcf0-4a145387bcdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810958, "uuid": "93796fde-477c-40e1-bf28-8cfc06539029", "value": "b16dd50ca45b2c023f2ffa8a58945c0d09dfef1b68df23bebe27c569c75c5ffa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8da1d27c-1984-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772819252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819252, "uuid": "c3f0ff55-0c7d-41b5-81d7-368b11b70747", "comment": "Malware payload", "value": "37175639049fa8a62bf3b61051bc96d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819252, "uuid": "f3302934-7487-473c-91d9-e28be6121fab", "comment": "Malware payload", "value": "b199922b585a0d0042f3295f57fd7a97af1dbb773508e5eab86378ae997eff38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819252, "uuid": "b09881f2-ae1a-4e1c-bdf4-f34142904b82", "comment": "Malware payload", "value": "828d2d357424120d10f91dd7da4c62c816f8c90b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819252, "uuid": "ceed6001-210b-47a0-a096-a0edfcd07395", "comment": "Malware payload", "value": "09a0fc0049a5593cb0b00de3270ea3bec2a4b887d28a43ee2f53ae5a3f121513210b982b64e1009605f57f95399d7337", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819252, "uuid": "9b030714-638a-4c5a-8d08-36515a83f979", "value": "T172B65C06BCC42BBAC46C4A7484FACA5522B05E140AF1466A6165FFEDBC772797F078CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819252, "uuid": "0ece6b48-3b9e-4b00-8eee-59bed93ce75c", "value": "98304:lTCDV/MOEs8ru7vMoKQWmDeat2jkmhk7cIGCX4Zcxs:JCxMrsiwvMo7DeJjDhazJX4Zd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819252, "uuid": "c2bde110-9a06-46e8-855a-4dfcd84696ad", "value": 10897533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819252, "uuid": "188c857c-de63-49e2-8631-8c0a3eb1be79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819252, "uuid": "9a5f669d-9d42-4ce6-aeab-f2fa21b328b5", "value": "mipsle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82918c89-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819234, "uuid": "8c54c2fc-ee82-4c30-9fc1-52fc919b0f91", "comment": "Malware payload (Mirai)", "value": "c7f9014e8c2201aff052645939d921a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819234, "uuid": "5f02bd84-ebda-451e-a9ca-1057afbc2b0e", "comment": "Malware payload (Mirai)", "value": "b1a021aa45f7043937aeb3af7c917e32c74941447d59e341958b0ed4d32d1aa2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819234, "uuid": "288933d6-6571-49ef-acd7-401024c0c980", "comment": "Malware payload (Mirai)", "value": "0f004e34e58bee0feb53d0aedafcc1defaba0365", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819234, "uuid": "993f4069-2da3-4f2d-8993-84c29a97e917", "comment": "Malware payload (Mirai)", "value": "e0cfd14d232ba64ec8c56f21cea35668c3b4ad01914b0ece8c6651413c446b323e0e847d8ed011a536f9b883c7090e41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819234, "uuid": "a4c7ab71-bb9a-4d13-9ca6-5a76e0131fc7", "value": "T1AB341901D5508B57C1D22BBABA9A425D37336F68D3DB33129E24AFB02F85B9D1E3E111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819234, "uuid": "eeca33f6-ab20-48b7-9860-a7751babbb5a", "value": "6144:zemCWerlgXVaqhMY9E8YRSEvWm/xvcmytL+7CZmXkJHN4/:GNrl2VaqLS8YRSFqcmytL+7CsXkJHN4/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819234, "uuid": "c4b9edea-c370-45b2-ab1d-ca12679ffa40", "value": 244122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819234, "uuid": "7c4f8cf9-2650-4db2-b102-9ed2cfcb0a35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819234, "uuid": "a03fc1ae-4b2a-463e-9c95-1a5e487d6baa", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e08d963e-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811231, "uuid": "664ecddf-b7c7-4ed7-865e-64f14bc7512c", "comment": "Malware payload", "value": "870cb549615edd94c80d337efe346ceb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811231, "uuid": "8c23977e-6218-48dd-a961-744951ea1866", "comment": "Malware payload", "value": "b1d41fbf6c36416fe4c1399761cbb0a84512827769a1f1a88b81f4e2a7d5ce6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811231, "uuid": "917a4f32-4faf-4252-bc6e-330f267f5663", "comment": "Malware payload", "value": "8e8a4bb65a18b6988737c0c17d5b1003580e9023", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811231, "uuid": "5210e3fb-32fc-42ea-955b-43d85f3ab2be", "comment": "Malware payload", "value": "def5a548ea89b16693c72bc622179dd20c983315f3c1ca9782e6c2d6e31c555404752a3294d65d379269526719393318", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811231, "uuid": "cd3363f6-75b6-4f8e-85cf-70222a5d0be0", "value": "T1643523F061E4C563C8F1093078F62479AFE2F2F738B497AB37510B18D623F859926A65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811231, "uuid": "85d5fe61-d4b8-442e-bc90-f9915c30655d", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811231, "uuid": "439a5687-cfed-418a-a0d6-6ca2be757f4b", "value": "24576:L+MUrq7lykcNjejzZA+PC1zobRmxmbZW1W3a9:4ryMSqIMzsR9mWK9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811231, "uuid": "e8cc4463-46d2-459c-ac6b-ce7beda5d01b", "value": 1088632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811231, "uuid": "0e1b0f59-eb28-4acf-b5f6-1ac2a53140de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811231, "uuid": "cf044da4-b0e0-46fe-aad2-82a21d99176f", "value": "b1d41fbf6c36416fe4c1399761cbb0a84512827769a1f1a88b81f4e2a7d5ce6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d41a8bc-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772809722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809722, "uuid": "3afad6fc-6ecd-4730-b76d-7163b9a8b0cf", "comment": "Malware payload (RemcosRAT)", "value": "d62845e626015ca60a3742e13d108a7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809722, "uuid": "009a4324-7862-4089-a8c8-4ec705de7344", "comment": "Malware payload (RemcosRAT)", "value": "b1f9e219e31d134c54f69d55cbc04ea6d8351a795cba900c225b6ee5b427fac6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809722, "uuid": "59d402ef-1541-4ec3-8ff5-edfe11509bdf", "comment": "Malware payload (RemcosRAT)", "value": "b70f1539c738a877b20bf2c782b5c69c6fc3c019", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809722, "uuid": "4b21b963-9627-4f93-b402-d4a9f4183ab0", "comment": "Malware payload (RemcosRAT)", "value": "86ac545d6d4ec5af49085b228a8a098741f07b5fba6762f2b2c426859f87cbd38e2228d0b4453a047cd919b06c913b53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809722, "uuid": "9a4ce8bc-89ef-4df2-bcfa-15e3bd00fa96", "value": "T1A294029BEB1BE921C2454937C9F585F6D7B09D22E055043E3351BF2A4C3AA8ECE1913E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809722, "uuid": "245af67f-29e6-48d8-a108-a733af389082", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809722, "uuid": "6ce6a632-dca7-4246-99ab-f148a23d5301", "value": "12288:ik8TgEN+ZRpBzjGsBmnJAqwSY6j+E88R9QMmxApF:o+ZRpZd4nJA/Fk+EV9nm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809722, "uuid": "7a3031be-9e69-44a0-aac0-78f1eaf72eaf", "value": 426328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809722, "uuid": "8e014666-4165-4a73-b067-0072d78ff378", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809722, "uuid": "ccea2d8e-b73c-47fa-a655-b77a2fab8564", "value": "b1f9e219e31d134c54f69d55cbc04ea6d8351a795cba900c225b6ee5b427fac6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5b5ff58-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1772808555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808555, "uuid": "1cc6095d-8621-4c89-affc-ddb20b13c71c", "comment": "Malware payload (GuLoader)", "value": "5cb96f0c017f854237211bda81de0709", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808555, "uuid": "357e3449-52b0-4b23-b72d-e6f16e543c7e", "comment": "Malware payload (GuLoader)", "value": "b20a621d134dc2725fc2390d02310b63b0fdbdca1000a1f45233257ff3f0709c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808555, "uuid": "fea361e7-784a-40c5-b7e6-4e1bd2e40373", "comment": "Malware payload (GuLoader)", "value": "eb7ca1b54ae544033bbd909bfcc4d886a7678adc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808555, "uuid": "96a0961a-7462-4bdc-96d9-6ba96296cb9c", "comment": "Malware payload (GuLoader)", "value": "570eda5960db348f629885ac66e145fd5bbf7d627b65175e39e7a1247bdcfbbf092d885f2902094afeb5052b9196971c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808555, "uuid": "9c57ed00-ace6-438a-ade3-fb11e9429179", "value": "T1A944CF613BD4D806DAB6C572D2B3FD39E673DD290A324A02A7F57F6C3836650581B30A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808555, "uuid": "0944df10-d76c-49cd-9dff-78078d63e057", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808555, "uuid": "d881eae0-d017-4403-8d52-5c4fa102a9ad", "value": "6144:KQ606x/yo7PJkPt8JfZeP53E1e4t4wG3QN2bmxwPC5fLsewO:wrJkPt8JfZsSe4RkD2wPyfx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808555, "uuid": "64036aa0-b6ca-481b-b435-54996336a61d", "value": 263152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808555, "uuid": "38d69eb8-aa41-40da-a4b2-bdb999f6ea0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808555, "uuid": "a687bb01-0319-44da-9210-e0a91b354e2e", "value": "b20a621d134dc2725fc2390d02310b63b0fdbdca1000a1f45233257ff3f0709c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8593ea79-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819239, "uuid": "f683daf4-3613-482b-a888-9743ebf8340d", "comment": "Malware payload (Mirai)", "value": "fb42517c1da9a2c57ab86ff2fd5cc998", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819239, "uuid": "2e0f34d7-23e2-46c0-aea9-fe7314ad8163", "comment": "Malware payload (Mirai)", "value": "b232ed17beeeb269b4b1cc1e224a248a12acd2bb5a95165775c775512d26e8f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819239, "uuid": "850e8ebe-2b87-4ad3-b29b-83e328a4a996", "comment": "Malware payload (Mirai)", "value": "b3b087764002d0b14d1b15e5e66ee78be0946b37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819239, "uuid": "8bd81acf-e7d7-4250-99dc-4695dc7b2874", "comment": "Malware payload (Mirai)", "value": "3f6d53681e019abb28de285c125635673588ae433050b703364c6ce7c98d3a32419e1426677085a50b1c0729f443d4a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819239, "uuid": "2ed65e03-120c-4102-bb34-61c97a4706c1", "value": "T12654C6067BA19EF7C89FCD3301EA861114CDE45612A92B2BB274D61CFB4B94F49D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819239, "uuid": "047dec32-577f-425c-b851-bfb7c065da60", "value": "6144:pNRuvydJcM3NtnHWbHpWPgxvZsFekuJ+gAfVlruXb:Qmc8wrppxvZsFekuJ+gAfVlruXb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819239, "uuid": "bd26d4a0-5abc-4ab3-a867-01851d65f9fa", "value": 287768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819239, "uuid": "11cb2792-ece8-4472-a350-08ff903e7240", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819239, "uuid": "4b82e510-c4c4-4480-9e5f-aacdc997b524", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "805c0bb5-1984-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772819230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819230, "uuid": "b9bbf374-f2fa-4d16-83e4-67d391d79283", "comment": "Malware payload", "value": "9d29df3bc3eb5213271366bfb0d5f3e9", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819230, "uuid": "39cc1a7e-7aee-45a4-8230-346834e4d34e", "comment": "Malware payload", "value": "b291f17e5402645975b43f5c77bccfe4086521a8692a03416155b67d6c681c2d", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819230, "uuid": "31c3cc5b-8d38-4782-8033-5aba4fbeee2c", "comment": "Malware payload", "value": "2436ecd17f8d2af11547587efe849762e82e6d17", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819230, "uuid": "13178965-78ed-4cdb-970b-8eb90b854e38", "comment": "Malware payload", "value": "2b7ce0e0f69d40c570c70035a3d8df82dba8cd024bc850b4e8dd3a4bea24b63a682c583e40a7bd77e5cd920cdd8ecf77", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819230, "uuid": "f81c06e4-cc8e-4cb2-abb8-73d98d1b5a2d", "value": "T1B4B4122BC272BDEFEC152337552704A5A9721003B22D631B0FDA3A61587FAE5F19A17C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819230, "uuid": "b8d55f7c-ab00-4d84-9c54-81b337c010f6", "value": "12288:cAGtl1z3azYLeGg3GhPmTzZzYK+NrJHigZG+CC4u0:sX3iYq0SzdYKsJHigYXu0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819230, "uuid": "4e84dabb-5da1-4aa3-8d97-ec085776ebef", "value": 506290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819230, "uuid": "8020f72e-db8f-49c2-a8ec-db8699606c55", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819230, "uuid": "b1059eaf-21ee-4295-ad93-94a99bf7e9ef", "value": "SecuriteInfo.com.Trojan.GenericKD.79631975.450.25353", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02443a8e-197b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772815153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815153, "uuid": "897f4c04-ad36-4c7a-ba74-6f6eaa146158", "comment": "Malware payload (Mirai)", "value": "fabae4c565f3ad1c3335df9a17b42b56", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815153, "uuid": "ff64436b-a0e9-4e5d-9be2-40ab13a02dd4", "comment": "Malware payload (Mirai)", "value": "b33bb5abe865f0d0ef3667186db0b6f93bb84f449e2edd32bfb4c77b601dfd3b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815153, "uuid": "52d07e9e-d8ba-4d77-8115-daa96836016c", "comment": "Malware payload (Mirai)", "value": "2ff3baa60d70d1dc7120ec64fe3239ff2f9b4fbc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815153, "uuid": "5e05b8f8-e1e1-4815-a624-50734e2cfeef", "comment": "Malware payload (Mirai)", "value": "e5b5667d5456f0475b9960210859c9184b0995a128ed9a0c0214adbf72e5a01536b00bad8b0d422e8d75a16062bf97b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815153, "uuid": "c3a7f29b-5722-409a-ae15-1bdb16e10fc9", "value": "T1C9937C85FB83E1F4D94609B011ABF7798A31DD322024DD6BEB98FE72BC21612911A75C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815153, "uuid": "b5a946e5-f761-4bf8-ac3a-f001c42ffbc3", "value": "1536:hqj89KwF8ROXbDdcj04/xHj82iRqo6ppUQ31QUHLKVyMyFwr:64F8ROLxcj04/xHY1suiE5yu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772815153, "uuid": "4625fa12-d305-4710-bdd2-fc874e8b1711", "value": 95476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772815153, "uuid": "478d04cc-6c76-4d5a-bf13-dffcf7e4b97e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815153, "uuid": "d64487ac-2f50-406f-acf5-7da9d0881db5", "value": "titanjr.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f095767-1902-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772763205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772763205, "uuid": "5718f028-f1ff-4449-bbda-f5c3bbf8bc66", "comment": "Malware payload", "value": "3808ec4d16c6fb7a5e77483e3e5f5070", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772763205, "uuid": "dafcc31a-eac3-4277-827a-0fd45a8ffcd4", "comment": "Malware payload", "value": "b36242b890223e207b7d28e421fc59db917436fdf63706dea7721182efbf29ef", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772763205, "uuid": "3f9342f5-bb8e-4386-9328-da45b7182d67", "comment": "Malware payload", "value": "582c6365e8127aa5626676171122327169d43fef", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772763205, "uuid": "f7c6837e-17cf-4ca7-8484-2000f20519ba", "comment": "Malware payload", "value": "1168be526162ec7650bd367229434eddb660fd0b5752a8e61a9c53e4ae2c30a6610e13f2b45bb299adf4b4924bb25bf2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772763205, "uuid": "97715cc8-694a-4052-9d77-76e145c09ce5", "value": "T1B3925CB412896C79FBD1CE399F3C6F4CADE8C2C42124E3ADBA0F39215A1166DC70535A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772763205, "uuid": "5df6dda0-b5fd-4ce7-8a0e-551d9a035650", "value": "384:NFcuQpWx+BL0SWL0gRzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:NF8i+BL0SI0izsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772763205, "uuid": "5f6cf88f-3dd5-4c59-872f-abb2425dac55", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772763205, "uuid": "8c501b5f-b77e-4bea-97d0-dc8913e8afed", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772763205, "uuid": "2d0d732e-c80d-40da-a6bf-1815d4e2cef7", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9b97930-194c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772795274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795274, "uuid": "54a80e9d-25d9-4727-96b2-f6503af7c3fe", "comment": "Malware payload", "value": "116e7dcd100a9f35a6af113e54e55e8e", "object_relation": "md5", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795274, "uuid": "c9f0bac1-3078-47a9-9e53-28322170902c", "comment": "Malware payload", "value": "b3ae22f8a008ffac65d771c4a2526a9dbd5bd3211c40ff6edc1e5c84cfa6afff", "object_relation": "sha256", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795274, "uuid": "a247b3b1-5d22-40c6-a104-ec828a1b261d", "comment": "Malware payload", "value": "24fa027209dfc7639c2e1650c061a8463e75c8e6", "object_relation": "sha1", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795274, "uuid": "da7aedc9-f950-448c-8062-b17e7e669a4a", "comment": "Malware payload", "value": "15adbac8c287ce8e59d876275cf8b4baea0cc3471e13e7eb7cd188f640287ed0b7725c8d75179c3d1d4ab0e52dc9e2c8", "object_relation": "sha3-384", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795274, "uuid": "bc73551f-5f16-4716-ba33-0276cb2dbd6f", "value": "T11A6733B86060DD47FC95C2BE931DCE5681981C59C923E23DFBF840A91ECB2C94B5D4AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795274, "uuid": "f6adcfd1-6c48-4b02-851f-6ccd14c0bf7f", "value": "786432:Zs1sWsMqmbnReyfZEZReQ0zGnS7gk5eNndQHh+srh:Zs1sWsMqmlfARjc7gkcldmr1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772795274, "uuid": "e856371f-fd82-4972-9cb6-b329b38f2969", "value": 32162256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772795274, "uuid": "47025e19-f6f6-4d6f-9c35-bc8616f267b6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795274, "uuid": "de568a29-f412-47c0-aecc-a54bac71b3a1", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef28644c-1970-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810826, "uuid": "186d8165-46cc-485c-a525-c4f1ad36c90d", "comment": "Malware payload", "value": "691606e5fb1cc64d311002995810b4b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810826, "uuid": "2d3b7ec3-aa5f-423c-9025-6b203b845a0f", "comment": "Malware payload", "value": "b460c0b72ff0dbd0ebe4edc27dd55b68771f32fd4632a7e05d8e2d4913dc7a53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810826, "uuid": "055a78b3-f5a6-480b-875a-47695cc573bf", "comment": "Malware payload", "value": "dbe8e22c68e69f6a49671847468a3a71187fb4bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810826, "uuid": "1a26e050-6bf0-409d-806e-a0470a2e9177", "comment": "Malware payload", "value": "81b6b4b0703685acc171231ec78ea5ec48e628929314fc8068366eb0f439dec8206d60b34d6645b8dfe9396d332de291", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810826, "uuid": "1097f0dd-0c35-44d1-9d97-f0e50e5a4e8f", "value": "T110151240ABC4D8DBE72412749E7BDAF54F462C39A5A0A52E13F47F0F7C767836126A20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810826, "uuid": "a3c1d926-2ac0-4160-b2f1-05a9e7d6d1ba", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810826, "uuid": "7119c4bd-098f-416a-8a21-1a320270b9b1", "value": "24576:dadWcJwiDq+TfauwZ/qsOxb/+nHNXw9KhDlyVKPY39iGQ9R:AWcJwiTiRvGL+ntXp1ly0PYEGQT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810826, "uuid": "1843284c-14b3-450d-9eff-c9078a2b80ca", "value": 946646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810826, "uuid": "96c62c0f-5590-4aae-b133-933ce65e32fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810826, "uuid": "6e07a61e-207d-4595-b8b3-232d4395709a", "value": "b460c0b72ff0dbd0ebe4edc27dd55b68771f32fd4632a7e05d8e2d4913dc7a53", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7178c10-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772809497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809497, "uuid": "48f72a6d-0f2d-4ae3-b69f-9c1ea21f09bd", "comment": "Malware payload (RemcosRAT)", "value": "ade83601f88480f0f020ee1f9d44e002", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809497, "uuid": "5044a8c5-9c83-4992-ab75-6d80e2d81ee0", "comment": "Malware payload (RemcosRAT)", "value": "b460eb7a68ff9aeb7835e5abbb46985757183568fdbe2b2d0987298f76666699", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809497, "uuid": "e6ee17a2-6d68-4fa3-a4b2-1db89a1b8746", "comment": "Malware payload (RemcosRAT)", "value": "2a3d0718a033559f0a79e2d2096b8913ec413f37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809497, "uuid": "2719fe06-bca8-4915-afd2-868b32a05ff5", "comment": "Malware payload (RemcosRAT)", "value": "543ca0f77c91b4e0068a7580565b0e14c7fb5244a505bd8c5c3dc76a6ad5a46536d7592acf8fe8101f249d600e8d639f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809497, "uuid": "b79e8725-739a-4bbe-8f26-941d69b24073", "value": "T10A3502182759DD03C4BA0FF55971E3B45BB16D8AA921C3438FEAECEBB83A7105D45382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809497, "uuid": "944c4781-5071-41ef-b14b-544a82520a67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809497, "uuid": "81aef0a1-242c-405f-b691-7c7b9e4580aa", "value": "24576:Lqu2VYhfwY+2KWDCzqmeTpgxnHSibGZeurBPIQVxekR6r7zSR5Ry9:LeVYhfwx6OApgxnyibGZ7JI+xekRR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809497, "uuid": "2e690fd9-47a8-4f51-a4f7-93c90c154d64", "value": 1071104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809497, "uuid": "2cb46ef5-7784-4cfd-b813-56a0c38c635f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809497, "uuid": "4bc535f2-1e74-4cd3-8c36-3cd5e9012f84", "value": "b460eb7a68ff9aeb7835e5abbb46985757183568fdbe2b2d0987298f76666699", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b6a4651-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819034, "uuid": "bd14a1e0-1eaf-4719-abfd-4e30d0de1b28", "comment": "Malware payload (Mirai)", "value": "8db4095708eca1961b187dc370a1b489", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819034, "uuid": "132f382a-c545-4029-b5e5-92be2248d1fe", "comment": "Malware payload (Mirai)", "value": "b48beb1e9b25426470d9a9de67c71bfe3724f7ffc1d75092983704ff97eab2f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819034, "uuid": "fe431c55-1d97-4f09-bdc7-09759d04ccd4", "comment": "Malware payload (Mirai)", "value": "bebcd30b6bfda11a5190bfb0c05d5c4866c7d602", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819034, "uuid": "d9926e9b-1cb9-4cf2-be88-af8cbec9faa5", "comment": "Malware payload (Mirai)", "value": "231fa5299497cb38793534ebabb79072d2e1be736b842098c85bc8e5e8ee55d51b36bc54817ec06762c64c1ebddfb447", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819034, "uuid": "a439aaa3-defa-4d5f-a5e2-152fe7794044", "value": "T135A34AD7F401CDBDF84AD77B4453090AB530E3620A831F76626BB967EC361A81927E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819034, "uuid": "87c6b463-2bd3-497f-94df-420493dbfac7", "value": "1536:kYXcoUyW4YMXDD/BOurrP4Vt4yCb8v3eHvWLNJ31hiZ6KzL4t2uDGnAA56:RXuMzDpRD4Vt4yCBA31YZZaDGnAY6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819034, "uuid": "6e915518-9271-4312-8978-676a8e3218e6", "value": 99888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819034, "uuid": "16fa9b42-0564-4b6f-be19-c301cb5f0f3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819034, "uuid": "08c8643b-ebe3-4990-a764-7a7ed0f91090", "value": "jawirbot.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45910bcf-197c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772815695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815695, "uuid": "b5e3527e-ccb1-41b7-99d2-eb5c8ab47ad6", "comment": "Malware payload", "value": "70920f342814ca5c662cbbed00d60eef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "filecoder", "colour": "#9867AA", "exportable": true, "hide_tag": false }, { "name": "Ransom:Win32/Filecoder!MSR", "colour": "#C4D6A3", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815695, "uuid": "0c3c67bb-70c8-41c5-bb3f-56709fd53727", "comment": "Malware payload", "value": "b547dc7a77af8022abbf19a7006213342444caea1cede20ea2409ce9bc9790bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "filecoder", "colour": "#9867AA", "exportable": true, "hide_tag": false }, { "name": "Ransom:Win32/Filecoder!MSR", "colour": "#C4D6A3", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815695, "uuid": "5ebb5d02-39b6-49d8-ad0b-5f8457d41bf6", "comment": "Malware payload", "value": "3e96e1f6a2d7cc6b72473d141e1962260325a0e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "filecoder", "colour": "#9867AA", "exportable": true, "hide_tag": false }, { "name": "Ransom:Win32/Filecoder!MSR", "colour": "#C4D6A3", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815695, "uuid": "7752f65f-8832-4f55-8449-469d20e6fc8e", "comment": "Malware payload", "value": "836162c5b770e8ccbcd8c5424b9fc018cd5226263790e133421beaa4be511a36ffd5cb07642a8e69677c3ce805dea880", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "filecoder", "colour": "#9867AA", "exportable": true, "hide_tag": false }, { "name": "Ransom:Win32/Filecoder!MSR", "colour": "#C4D6A3", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815695, "uuid": "5d3688e6-c782-475d-9e7f-ea706be9cc9d", "value": "T1EDA52A07E23E25F9D1BFA0BE84C22942F9617C7907355BD76750826ADE22EF4A83D710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815695, "uuid": "118ff058-ab65-474c-aff5-dd3969f2d119", "value": "c94c85d90b694c7e238e0b67dee148bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815695, "uuid": "7d3e6c9e-c900-4db7-be8d-41c6aaff0fd9", "value": "6144:6j57PRbwHB1eHZGMBESZxBTr9QLhrbhYFveEbBENpKqmqED2Umpg7ajG:65Jbme5GMXNxC1oeEbupXmdvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772815695, "uuid": "f4a69322-40d7-4002-9590-09c0ff18d8ba", "value": 2197504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772815695, "uuid": "e1706175-4b69-4a51-ba60-ba9466a8bfba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815695, "uuid": "e381b715-f122-4b12-9db0-321d6e1f5e22", "value": "main_Cry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2401249-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1772810402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810402, "uuid": "6a6d6896-191b-444f-9bfc-2f81fba23582", "comment": "Malware payload (MassLogger)", "value": "4ac5adeb7c7c5f63960c5f3561dbab28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810402, "uuid": "846e7da3-78f8-4b5a-92d6-7b6a441a228a", "comment": "Malware payload (MassLogger)", "value": "b590c146e143027205b94d5e5136f5a623f32b28ff3156c6ee14c899cd4cb8c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810402, "uuid": "a6073c04-12a5-47a1-9ee6-90dfe4e25be2", "comment": "Malware payload (MassLogger)", "value": "e231086a180694d147e8023002cd4e1d4a40e365", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810402, "uuid": "d42f9dea-1f16-4550-bfff-67f54ac3520e", "comment": "Malware payload (MassLogger)", "value": "a9269440c6e4ed0a9d62aef1a08896ff0726849a64e26df20d1135bddca90a74ee1f9a72a1b71ec1087ae9fd67bcba5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810402, "uuid": "c13519df-c2a6-45be-86ec-2224f63a64ac", "value": "T13E050194662ADA13D95197B80A72F6B8077C1EEEB501D317DFE9BCDBB926F164C00083", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810402, "uuid": "50eb9020-d17c-4765-88eb-4c08cb1837d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810402, "uuid": "c02e51b7-2ca6-4d90-bbf4-cc1a6571d1f7", "value": "24576:pJxU6+erzP3DgClGOyKBqpMyvq0ymf4fs0NBAXj:TFx3E4GOyKwpMkqqmNiXj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810402, "uuid": "08a785bb-5200-44e8-8f3b-1ac8b47705ba", "value": 821248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810402, "uuid": "3c116e12-9e1a-4a01-a2a4-8c89a92632cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810402, "uuid": "27051b8a-dbb0-4147-9b7c-a413e88d30d3", "value": "b590c146e143027205b94d5e5136f5a623f32b28ff3156c6ee14c899cd4cb8c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a332f79-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819247, "uuid": "5bb2f39d-ab36-43c9-ad4d-042e3e89dff3", "comment": "Malware payload (Mirai)", "value": "d5ba96d648edeb8fafa6db421c50d00c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819247, "uuid": "56984069-af54-4e05-80f9-24743046e312", "comment": "Malware payload (Mirai)", "value": "b5b328bc058554f1d6e926b7a0d250802f325228c4d54edbe36663e540fd58b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819247, "uuid": "2b02cf98-66d0-4eb7-9595-ec33db652798", "comment": "Malware payload (Mirai)", "value": "375951c947fdd837ca76d6527713c4ad7d69bd01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819247, "uuid": "80173e23-e74b-4a61-8c79-d4c0235a499b", "comment": "Malware payload (Mirai)", "value": "e604af5d7a9dd86de24ac8e1a2863ffdd133b4d4825791e79734260e0d7a654d0748cba3b0977fd3b6f9c4997da26152", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819247, "uuid": "13c76476-84c3-4031-8e72-9c2b6fd2304d", "value": "T191A3E551BC82562BC6E123BAE66E668D336177E4D2CF722BC8204B157BC591F0C63F84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819247, "uuid": "b1fb5014-0e23-4c44-af4f-16bd621433f9", "value": "1536:Ved/NPJCEXq0irFcpF49hTYegR9jI0U5Jua4UP7cxOhoASL+40JLPTq0+:VY/NPJHPeFc4L0g7QL+46Xq0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819247, "uuid": "f90eeec1-dba2-46ee-bec1-fd4aeb5e8c26", "value": 98336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819247, "uuid": "98c74bf1-b7d6-46d9-86f9-2d58e1baf1b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819247, "uuid": "462d2ad7-6104-44a7-abb3-b57dc1aff0d3", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c8a11dd-19a0-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1772831223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772831223, "uuid": "10907012-2b06-4052-abfd-8e2801b19e3f", "comment": "Malware payload (Gafgyt)", "value": "3a3e10ed339fac1250cd80076485b592", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772831223, "uuid": "d83d5f63-6d87-4647-a2ee-c00068cff942", "comment": "Malware payload (Gafgyt)", "value": "b5ed6f13acd8271d9ec55eea3386b1e63163a425ee221011644fc289dab7f944", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772831223, "uuid": "f3275c1e-3238-4cc3-b0fd-51a9d415d70e", "comment": "Malware payload (Gafgyt)", "value": "25d6542b8029c39bb1d7c5ce850dd4e7e80892ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772831223, "uuid": "6b5cedf3-8a02-4aba-a12c-098f36e51dad", "comment": "Malware payload (Gafgyt)", "value": "92425d97780d9a958b0d0af8bd24c936c9e9ff3f947515ab70d5a2691bb8561807439294233e2c81f616d8b0f362b151", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772831223, "uuid": "92291e4a-a6f8-4848-aee9-42bdfc05a8d9", "value": "T1DFA3F832E643C6B3C44306F101A7EA6B0D21BE67093A9A89E32D7CB4AF334C67555F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772831223, "uuid": "d07ba468-5fff-4a46-ab0b-51cff7a84d6f", "value": "3072:gxh3bYcTa9RPls9xwut8zIU9mmFVcqIRGnDFT:gfUcOqXt8zIU9mmFVcqIRGnDFT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772831223, "uuid": "cc6dd439-fd69-43d9-8ef0-182c5211f21f", "value": 104252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772831223, "uuid": "7185df71-0c01-475d-9268-e25c04a977a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772831223, "uuid": "9752053f-7eab-46a8-9661-129eac59dc03", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "474db48d-196c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808826, "uuid": "249b62b5-367d-4a91-8cdb-54be52d9c477", "comment": "Malware payload", "value": "34caa859b5f7c05bb0cf21fb3acda59a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808826, "uuid": "4129c45b-3460-4eb0-9386-0c19fbd427a0", "comment": "Malware payload", "value": "b64ff32025fa0643cad047a6084584196a6b8fc6ca823e9de581452be6044649", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808826, "uuid": "21239a89-a2d1-4266-9a06-5f017eb152d1", "comment": "Malware payload", "value": "905c400697256f1b633a21c1152ef8c3266f0512", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808826, "uuid": "5b9ab03e-e1ef-4a14-830b-cf73036ce4c6", "comment": "Malware payload", "value": "5ad37122ea0182b5f49d49be2b81f0665efd74afdf1a35a8aeca78472672dc9b0b7ec23a6ffff05cabd55f4f963652e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808826, "uuid": "e524b742-f60d-4e24-9a61-83b21cea7a80", "value": "T1C54523008591A867D6E31BB10EB916FFFFA7AC202590D75B27947E1B3DB24B0AC06357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808826, "uuid": "2b019f5c-d00b-4ec5-af13-453f98ad49d9", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808826, "uuid": "0962c187-78af-412d-a686-e048b92bc615", "value": "24576:2Pd0EKAagSj/5QC2XXGaOxug88Huxt1y1uVUAjlHRTSzbDWp2BDj77dfFsDn:aOAJSjRQC2XXGaOxugfOxSgmb3DWgF7Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808826, "uuid": "78188ac7-b8b5-4e08-ab0a-7fe768e5fdb4", "value": 1205888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808826, "uuid": "8e7b3135-a1a8-4bcf-91f2-4ea6251cb76d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808826, "uuid": "db11ba38-1c11-4c96-9963-c2eb61b99662", "value": "b64ff32025fa0643cad047a6084584196a6b8fc6ca823e9de581452be6044649", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0e67637-192e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772782375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782375, "uuid": "10c4a5d3-b549-4097-83e5-d3c7f7f87c94", "comment": "Malware payload", "value": "d370dd4bd61fcb884405dc48d900f2ab", "object_relation": "md5", "Tag": [ { "name": "api-devx-help", "colour": "#8AD189", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782375, "uuid": "8a815035-c551-493e-ad9a-2dca8d1cc557", "comment": "Malware payload", "value": "b68a680ba87e80cb05c482dba25dd1e350dbd3997f3dd037387570865e6dae5f", "object_relation": "sha256", "Tag": [ { "name": "api-devx-help", "colour": "#8AD189", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782375, "uuid": "20907e0d-8209-4bd8-8bff-5ea7c164b646", "comment": "Malware payload", "value": "636781364bbf0f2e2d8abb88f3a3806ab4d3d68d", "object_relation": "sha1", "Tag": [ { "name": "api-devx-help", "colour": "#8AD189", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782375, "uuid": "9584ac42-6794-43e0-a469-108352c56d11", "comment": "Malware payload", "value": "3e1ea91b00a0d0afb5fb002fa4a539c30df3b639036a2fc4dd39498aefb49fab39413376791a8fa30679268ce8921fda", "object_relation": "sha3-384", "Tag": [ { "name": "api-devx-help", "colour": "#8AD189", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782375, "uuid": "7cd768ed-7be3-423e-b7c6-ef0a5b2aca40", "value": "T1F5F733AEA2C46F231DCA831E4976BF9C6121C325E1E4A4796DB82F4356E0B075F3D16C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782375, "uuid": "b5e329bd-bfb5-49ba-9d96-8251570a2472", "value": "1572864:YBh+bST8j1cEiWoYFzZholtSEmxnkG2Su8nR9ZwLlAMu/Ya82:YMr1cfFYFtholtSNb5nlMu/1t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772782375, "uuid": "00bb6d2c-fed3-47bf-a075-3427dbbaa15c", "value": 73297628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772782375, "uuid": "d46f4d17-383e-45b3-8300-131673b454b2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782375, "uuid": "f308f905-ef7e-48cb-874c-0b71251d394b", "value": "4a2b12e5035f89f0c928a0c427fad80b972591bf146e3b88a68597452a6daa5a.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80bd7d4c-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772809782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809782, "uuid": "0a6d4f0e-5c62-467c-93da-82444409e75c", "comment": "Malware payload (GCleaner)", "value": "813620cbae97cb0a071d28a58499d118", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809782, "uuid": "e79654f0-2578-4425-ae9c-f3b4769db1cd", "comment": "Malware payload (GCleaner)", "value": "b6ade0d7968f621e47f5018b371f6f12817869cc9719a985d37a0105fa7fdc4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809782, "uuid": "25937162-ca10-4ed1-8f10-fb064309325f", "comment": "Malware payload (GCleaner)", "value": "330fe683bdf089fdc8c7739de55703aafa89f3e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809782, "uuid": "a7d9c416-86d5-4924-8ac1-b6aa7e911500", "comment": "Malware payload (GCleaner)", "value": "e84da59c483b5e0d0723fe521f725066d954b3676981153e8ba41664d56a22c14909643f7bf70ab27a97c60e8e3721d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809782, "uuid": "a68b2694-ab46-4f10-9e66-0e0aba3ad095", "value": "T168159F62A2BD84F2DC337E7CCD3A625C4A197F11A9F864466AE41CF89FF57803425293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809782, "uuid": "f18e3607-b258-4e45-8479-0d78e2c612ec", "value": "855c002a8df581e0836bc0be1ec15465", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809782, "uuid": "293d9b65-6403-4eaa-9b83-e16459c905a3", "value": "12288:XAmht7cInjR4Nhf2lGh+F/ZVXwT41W8wcS3A+qgl9:QczjR4n2lGgFPwJcS3Bqgl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809782, "uuid": "b62e89f6-c364-45b3-bc99-efbb53e91d31", "value": 875520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809782, "uuid": "04d9660b-5f77-472d-8d55-dc3b185f7689", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809782, "uuid": "e98ac50f-2223-48bb-a37d-7fa367477188", "value": "b6ade0d7968f621e47f5018b371f6f12817869cc9719a985d37a0105fa7fdc4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95a06204-1995-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772826567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826567, "uuid": "5e75d344-f5f4-4320-a06c-56899663531e", "comment": "Malware payload", "value": "3a78bf8c70bc1665040a7af7a47007bb", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826567, "uuid": "4de19a17-68b3-4ae3-8203-5ed2065d39d0", "comment": "Malware payload", "value": "b6c4bf5db2d8fbca7920c4ec026b211e0346210cb187b5fe12e914b3d64ea4cd", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826567, "uuid": "00fbbc31-1649-4a75-ade9-6c58ace4f75e", "comment": "Malware payload", "value": "1d37a65a51c6c1aa48e123a0421a5445e0e4f55e", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826567, "uuid": "5887b876-c6bc-4e7b-9909-cc4b390cc998", "comment": "Malware payload", "value": "f7b5d0d67bbe5fc252bc9b8186b15b99947a81cadbc835e5746a736652ee00f9604c9ab107085827511d11d0edb8680e", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772826567, "uuid": "d3c2f390-012f-49fe-b2d4-2135308310cd", "value": "T118D42203CAB1FDAFE5039F77B8542411600A902D435C91A7A9CAB5686CF317BA3FB59C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772826567, "uuid": "348c5c33-9c8d-40b4-9ec8-67267b5ff998", "value": "12288:QWAOaYozIthC3GhmxFFvvR8lmoL6K6ZmidSy7o7gZGmF88:aOaY0BJR8lffiwyega8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772826567, "uuid": "f0dc2b92-47a5-4840-a41f-20f19fae473e", "value": 639170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772826567, "uuid": "72d1d1e0-9c11-4d85-b5de-342e5075334a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772826567, "uuid": "7098b5e7-97e0-4b75-be4a-6dd8219059ad", "value": "SecuriteInfo.com.Trojan.GenericKD.79632786.7649.19762", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "816a42b9-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772811501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811501, "uuid": "4c6fcca9-d391-4148-baf4-d68245054d9e", "comment": "Malware payload (PhantomStealer)", "value": "c06701acc13e0ef86286d00821e1bf28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811501, "uuid": "0c4e0559-5f1f-4a42-ad8b-2356b8493620", "comment": "Malware payload (PhantomStealer)", "value": "b6da3c835e772665e4223368cc4a7a940a114930c68604c789ac2f272fc1a232", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811501, "uuid": "65ebaf50-9cd8-467c-8ca1-e90deaf93804", "comment": "Malware payload (PhantomStealer)", "value": "7e69d47e7f92919c27d12577555cc0a051a76b71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811501, "uuid": "a23d26f7-a7ab-4f70-b072-66c85c227f1c", "comment": "Malware payload (PhantomStealer)", "value": "e659bfc33e8d3d93341907ceca90ddfb9bca1384707cf4e6bb54e8ea6a41b29217c0cdffae9b6b6e8fe13f7177dbd21b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811501, "uuid": "9608fd5f-c467-4fff-aec3-f694c615e8eb", "value": "T1CD75026027A6DC16C36D033258A1F5789775DE86B015D25ABEDE3EDB7B2AF020E81343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811501, "uuid": "c974832d-2ecc-4bf6-a5a9-37d9a95fb75a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811501, "uuid": "0d358990-842a-452a-a580-3bc19a1158e7", "value": "49152:TjB3WDvyDqMek7mlkmO/SaL9ZkNYD3I9mU:TN3WDvsek47O/F9uKDQmU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811501, "uuid": "46cdff71-47c0-47fd-8377-1f89222c9fc0", "value": 1637888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811501, "uuid": "210ee698-4a98-4b38-b1ce-201fb80d1f9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811501, "uuid": "c419b21f-6547-4f75-a9f5-b2fed32bee93", "value": "b6da3c835e772665e4223368cc4a7a940a114930c68604c789ac2f272fc1a232", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc6cc81c-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810365, "uuid": "0d845d77-38dd-40c3-bc2a-02b370aeeee5", "comment": "Malware payload (GCleaner)", "value": "db33f1c75c231c841377dfde5ae4d394", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810365, "uuid": "2710a3ae-b02f-4359-a7cf-7a9f67d9298a", "comment": "Malware payload (GCleaner)", "value": "b6ee0729957312560cc80a55e5a7eb2e8353419a31269cace6ab5ae57c533041", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810365, "uuid": "06749c64-1f13-4e05-9588-5baafe484e03", "comment": "Malware payload (GCleaner)", "value": "9b64e419ed9d94662f1f8bf32a1e17691df3cfd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810365, "uuid": "17e50bac-d814-4466-9f70-4b13a8a784ca", "comment": "Malware payload (GCleaner)", "value": "f487e93a679f96ed526184a11158b947759db26673cd56a3452b56808763b6aa0922ec320b3b049026cb16c530e8bada", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810365, "uuid": "3264c11d-83f1-48ec-b695-7d1806da28f5", "value": "T17F059EA3A1E34CB7C16B2E3BAC5B569C5D35BF182E285846DBD41DC84FF82417413AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810365, "uuid": "1a1e8545-dd1b-4088-b10a-2d9a02284c98", "value": "fe4280c06246cc873fe89746dadec91e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810365, "uuid": "88476cd0-c2e0-475e-b240-d4b786235d30", "value": "24576:LlluEBpPj6o4CPbE9taCbdIWLYWzw3KqlukavOWYu+:Llwa1VHOFqaj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810365, "uuid": "39f29406-1997-45dd-87fb-b98895efde94", "value": 847872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810365, "uuid": "d92d022a-2dca-4a52-b5a5-68015a6f4b35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810365, "uuid": "48cf493a-e76f-4cbc-aee9-4e0f68a5ba11", "value": "b6ee0729957312560cc80a55e5a7eb2e8353419a31269cace6ab5ae57c533041", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aafc40c9-1972-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811571, "uuid": "da8b0240-d746-40fc-a79c-80d01305c3a4", "comment": "Malware payload", "value": "ccc46ad99d2bb5a241e1a512c3433905", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811571, "uuid": "b3231faa-e8e7-4e97-a082-f100344f480a", "comment": "Malware payload", "value": "b74ab01d4cec9234b0f84a3313d5cf4f8a874c577b972fb5aff1713ad79281fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811571, "uuid": "ada77b99-254d-452f-b9b1-830d893a7712", "comment": "Malware payload", "value": "f9ab537f32f26059537961812d4b0b8150c593bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811571, "uuid": "409ac475-2de1-4940-af08-8e607c0c6c2c", "comment": "Malware payload", "value": "7328afd877bc7e92ac509cbeefc39343a648e8a647c5841020a679eecb7f56ad57bf4b3534003da684edc2bb89136977", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811571, "uuid": "2cc7d3e9-c719-4c79-9508-93686ccc2aa7", "value": "T1DDC35C6773A530F8E0B78539C8514A05EBB2B47607619FEF03A4829A1F376D18E3DB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811571, "uuid": "9dd2d8b5-cc3b-4064-b135-cec64c88a86d", "value": "94981ce5d0fcd07b1d9a024f7e602f82", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811571, "uuid": "aa0d1e4b-c397-477e-84c2-54b6faa98e78", "value": "1536:ZB4i39bFTwLn/crsToY4AGvSK9PTH3qSA8rfvbZxLCCo9tMe0F3ysWKdF9dloHOY:8i3gPBAvSKFarMfDZFPo9GF710O859", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811571, "uuid": "0eda8275-9498-48a2-8663-7346ad67c985", "value": 122368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811571, "uuid": "bf0e2594-be2d-45d2-a27e-5f01ab34ae23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811571, "uuid": "b07ea3d7-a93e-4a97-aed2-b8be0e91d606", "value": "b74ab01d4cec9234b0f84a3313d5cf4f8a874c577b972fb5aff1713ad79281fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "715b3325-1985-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772819634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819634, "uuid": "99e77a8f-18c8-4f9e-ba4c-dffd4bfa044d", "comment": "Malware payload", "value": "f09ea6ca03ea3bf2aed3591cefacad80", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819634, "uuid": "31dc3d84-1438-4ceb-86a1-1c893cace8c8", "comment": "Malware payload", "value": "b764666518d9fb50e3ae5e69e36eb5403a8ca270a29073181bd8a3e164dffcae", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819634, "uuid": "a3aa891f-7744-438e-b433-8b221b19f2dd", "comment": "Malware payload", "value": "c9aab3ef0c831f094e4e6c18732f89b98c63851a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819634, "uuid": "858dc20a-401c-4b67-b0dc-3ddceaea4e03", "comment": "Malware payload", "value": "e98abcbd73c28afbca86f59f8ef54abdb7663be9a840b398b0ca4c50b29c82c559ae73145b1d8d9690a657a5e94fa074", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819634, "uuid": "a6af672d-7545-42c0-8e8f-088e9f331d9c", "value": "T130D05ECB7162173119BC472730A4489565ADA5C054E38F7EE59E2A7791CCA64F018F43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819634, "uuid": "1ff682f7-1df3-4d02-892f-349102100cfd", "value": "6:h96YKPqv4MmkXP+D7AIqevafdLRdFV1LfdLRdFVN8LfdLRdFV+AFlJHv:5KiUN7ANQ+dHFV17dHFVN87dHFV+AbRv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819634, "uuid": "45ce316e-bc2b-44ed-918a-a89a6a0fdfcf", "value": 268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819634, "uuid": "139d0ca4-5c0c-4964-9d74-66d3e60bc3fb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819634, "uuid": "9128ab3e-43b2-444d-9029-d949b5b00b46", "value": "kla.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "648046fa-193d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772788689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788689, "uuid": "d3695a03-7ca8-4772-9b44-c0f315161608", "comment": "Malware payload", "value": "ed284d6d30d673c4da3d7d5ef7dd29d3", "object_relation": "md5", "Tag": [ { "name": "162-0-230-185", "colour": "#77577B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788689, "uuid": "61760464-30b8-4d04-8b90-4a6250027626", "comment": "Malware payload", "value": "b78d3527d88e55225f4978fc3f06ba627e4aa95fd89d7cb929f42ba9662aa66f", "object_relation": "sha256", "Tag": [ { "name": "162-0-230-185", "colour": "#77577B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788689, "uuid": "2e69eb07-f2b6-416f-b1f0-823df4a1ccd6", "comment": "Malware payload", "value": "bbd7f09e8cf9dbb2f99fc7ad2e1518a0a4c332c0", "object_relation": "sha1", "Tag": [ { "name": "162-0-230-185", "colour": "#77577B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788689, "uuid": "da95ee07-0ff3-4838-b6dc-8573118830c8", "comment": "Malware payload", "value": "36dee0091d9d5acc33681bb28bd349d463847bf56fbd0a7c4ea164d8c8e86d390230410e7182070283a918447aafd9fd", "object_relation": "sha3-384", "Tag": [ { "name": "162-0-230-185", "colour": "#77577B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788689, "uuid": "3552b149-bc3d-4d22-8ad1-1b11ef6c9abf", "value": "T10F365B17EC9155E6C0EAE23089629652BA31BC497B3123D72F90F7382F73BD05AB9714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788689, "uuid": "12822cd8-bf9e-4f2f-bd29-79a271d1ade6", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788689, "uuid": "12c80390-0086-4aca-bd58-06e049333c88", "value": "49152:UyYaoPhVkzMM/FH2jhD4Ck0F4AnO/NF9HAU8ruOTB7fpYwKeK9KEaerf5E:UgSQFCO/9EuQYD5E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772788689, "uuid": "606e1f3a-dd1d-493f-ad71-ba1b523f7226", "value": 5246464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772788689, "uuid": "3a81eb7b-9860-427d-8b1d-050c146555b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788689, "uuid": "f182756e-2b6e-4925-ad36-a6965acfd952", "value": "b78d3527d88e55225f4978fc3f06ba627e4aa95fd89d7cb929f42ba9662aa66f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcceaa91-196d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809453, "uuid": "9f63d262-39a7-4cd2-a0d7-18643d5c6b16", "comment": "Malware payload", "value": "a02469ba8abedcf15bf61ba570222871", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809453, "uuid": "c3c23048-7f1b-4128-b0b9-f67597211a99", "comment": "Malware payload", "value": "b7b4f83fd70601927c86f2457a8fcc6897109037ec0dc9158d92e7d5f63ae4b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809453, "uuid": "f138b785-5570-4b11-8406-f36f45be780a", "comment": "Malware payload", "value": "d16a42286dadc57d507a82d856452626ba0470f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809453, "uuid": "0cd106c4-52fe-4c5c-abf8-6e709a625c76", "comment": "Malware payload", "value": "9c16b91a6d6340eb82a965d0331f9357add90d561b12e3e3dc0cebade394ab0b3791db1d168ec7f7bd4bb1a1d3f0b0ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809453, "uuid": "0b7fcf50-a5b8-4104-a4d1-d3ef98ad7371", "value": "T1BBC4BF91F711DAABD5A60ABA5CBBC4313567AC2E86D2411E316DB22826F331111DFF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809453, "uuid": "a3b5f20e-cc80-4adf-a9fc-41bb63ef9387", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809453, "uuid": "9e0674e5-5a63-46fa-a72c-75a41b88eecf", "value": "6144:pwq3NpQ3wDIywUF5ykHERIe6M1tPhDLjQ/jUYIuUXI5p7omlOXIfsYXPXfCwdCQn:pzcae6uti/jbIRXIH7rOXIHHh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809453, "uuid": "d51fad3d-c6fe-4db7-87c8-0fb2380cbc5b", "value": 590024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809453, "uuid": "4ffab053-36c3-40e4-88a1-c209ba3fa8c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809453, "uuid": "8b78cd4a-6b0b-4466-a9d4-694829f6eb2f", "value": "b7b4f83fd70601927c86f2457a8fcc6897109037ec0dc9158d92e7d5f63ae4b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f68b675a-1900-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772762735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772762735, "uuid": "3addde8b-f57e-4df9-8ccf-e7b879138bea", "comment": "Malware payload (Mirai)", "value": "67bfc8f21a1fcd140e1f9294dd5fd280", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772762735, "uuid": "a14eb3c9-c391-4def-9034-793a8a1063ec", "comment": "Malware payload (Mirai)", "value": "b7b86adb378b1c9dd37e9b34327be1c54b1ee44e122b12d6c73ea1eb49fb9913", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772762735, "uuid": "2e64ceef-7176-4464-a51c-3f645eb65bcc", "comment": "Malware payload (Mirai)", "value": "5880c7cab22b6cf249a1aa3c99fa713aae3aebdc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772762735, "uuid": "5295d9cd-bb09-4ee6-aa94-a81a6aa73a2a", "comment": "Malware payload (Mirai)", "value": "097fd17a428661719db4d0de7cc8897fd112901b326d44989eef1787dfb02c13b7c44693aaf3053996dfe8e592233a19", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772762735, "uuid": "f5e8ce56-3ae3-4351-b745-d340750d31a0", "value": "T1E2D34A2275391E2BC4D0A87E22F74361F1F167DA25A8C90E7EB20D4FFF252206547AB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772762735, "uuid": "cba41c96-a6b2-41b9-b675-98f00359f0a2", "value": "3072:lCldeCsOs9kzj2vV4XcZgqniE230IO1BlsT3j0A:APeCK9kzivVYQitymTT0A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772762735, "uuid": "4a6ff370-55b3-4a17-8297-b65f6188166a", "value": 140776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772762735, "uuid": "51c98fd1-ca61-428b-a436-574f519cb49d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772762735, "uuid": "8d4e61d6-f5bb-4376-8db8-b35e70304cc4", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3592ea48-19a4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772832848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772832848, "uuid": "76e4aa79-4df7-44ee-813b-828ed9fb6293", "comment": "Malware payload", "value": "0e987ae99311e98a8e1b88bfb7fb01ca", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772832848, "uuid": "a178d23a-db30-4a06-b376-8adb2f3b2948", "comment": "Malware payload", "value": "b7baebce1e80a690c32b9da7891c455f27deae7ccf33a4353226b2ccf97ee77a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772832848, "uuid": "052988cd-50eb-4a83-bba1-50baa1be3e67", "comment": "Malware payload", "value": "df32ad3229c068da0662900b9e5731f580801736", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772832848, "uuid": "d88bca93-af75-46ef-ab7c-42ca1ed33151", "comment": "Malware payload", "value": "927e5c228a52f1b4df85a6222d5bccd03a2ec7562a38ca250f94da2b2b189e50659e5a1aeba09ef3a70fe48e33385a54", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772832848, "uuid": "00280e5d-1d59-49f3-8cd6-f9dec8cba3b4", "value": "T13095D00573F442DDFEABE1768A13C507C7B2B84506378A5F06A06A766F33B715A2E321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772832848, "uuid": "2d1b8419-c9ae-40fd-bd7e-bf680049bfb3", "value": "638af1c562ad8f76992023c9692ec222", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772832848, "uuid": "bc76b988-54e1-4ebe-a2e3-7d5d76981bc4", "value": "24576:7CZGvW0tK4jReYSTQ+zYAGRw5bUkGDjkNrXxLHFcefAas1cNUtwLID0Lpu8XcWJI:c1H4jR2TYrQbDTrMetO4FcmZMlp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772832848, "uuid": "a282524b-7646-4c38-b114-0a7905b618e6", "value": 1900544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772832848, "uuid": "61c1420a-856b-485a-95cb-3c0277f78986", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772832848, "uuid": "195df881-0f9c-4a50-9baf-01958819abc8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e7eb9bd-1985-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819630, "uuid": "5e8c2bb7-8c98-45e6-81f5-bff4ae661bf9", "comment": "Malware payload (Mirai)", "value": "bf7165c604bc7164a97bbbb7a34ae7f5", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819630, "uuid": "d82019b8-a417-4b56-b4b2-2930159d28b5", "comment": "Malware payload (Mirai)", "value": "b7db4a9d8eefbc5cd91d9e3a79ece553321978cc26f3260385e513fdeda85473", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819630, "uuid": "7e1a9ff7-9a26-40ae-b6e7-c107303bc37c", "comment": "Malware payload (Mirai)", "value": "533d45471ed41ed742a6a5c64de5bce86a78653b", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819630, "uuid": "fc5e5894-7858-4f98-b2fd-92c85fde3530", "comment": "Malware payload (Mirai)", "value": "3a8dc34a47825ada9f7f952cb7d163bcb30d4535ded28a6d478b92ac0638b3cf3abd8fe8f267d7ad85cfd5337b609922", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819630, "uuid": "04a29784-5685-4f37-af3e-82ca9fd25912", "value": "T13226337F999C8B1323A03A73FC5B5C0D47B9253318653F64612A8ED310E8A691F5DAE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819630, "uuid": "2187a3bd-b8bf-4c1d-b4b8-da005efc021b", "value": "98304:VDQck0PDbFv5mH8of6U6i4k4fqov8VDlfuTso3mQwz/w:RpFv8coSMsCov8TuAo3mQwz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819630, "uuid": "c03ca29b-847b-474e-85db-aa74a7b1cec5", "value": 4505308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819630, "uuid": "443b31c1-aac1-4455-ba3b-75ca9b6bc951", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819630, "uuid": "3be9dd87-9e93-42a9-a12d-510fe615e4cc", "value": "bot_x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0799506e-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819027, "uuid": "ca61c009-1a83-4b21-9498-51166bd26820", "comment": "Malware payload (Mirai)", "value": "119026c653319e1b616aa92d8e6d8d1b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819027, "uuid": "ff76b89a-57c8-486f-9913-ebbcb8fba281", "comment": "Malware payload (Mirai)", "value": "b7eb50e81eed3519ac29ec4faf5d4a0a55785d9ffdf0c6c33bd489dffcb50724", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819027, "uuid": "e0d7d05c-117b-455e-89dc-28568e549bf1", "comment": "Malware payload (Mirai)", "value": "88a826ef20c603f16691fea9739bea9aac7fa83b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819027, "uuid": "48af9c8e-c522-4f33-8e36-8498d38f3e55", "comment": "Malware payload (Mirai)", "value": "970d3e144d4c02ed20ba218b11b972a380f366494104d5d409305634da0dfc452eb40999c66d2d7f0526e72dfc62e0f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819027, "uuid": "e10e4bc1-9932-4ac2-a883-c90683e7bea0", "value": "T18293543F1B231EB3D0D92031016762B2BCAED74834BC8BDB8CE1646D6E1A95D34596DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819027, "uuid": "07a79828-cd44-415b-8e3f-8982bca6647e", "value": "1536:50PvxMozxIeak7lm5FrBDapM2/XsalMylgkJ02uPzNf1uhR7:50RMozx/U5l/ylgH9PHuhR7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819027, "uuid": "83371489-a3b8-4d62-83ae-92214b051149", "value": 89844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819027, "uuid": "4c4c7511-873e-48c6-ba9f-3b9a619e45b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819027, "uuid": "56c00f9d-cfcf-4cde-98bb-9362fc08dc05", "value": "debug.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e2fba15-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819226, "uuid": "bc7d5560-1ed4-44f2-8b3f-4dc42cceb50b", "comment": "Malware payload (Mirai)", "value": "ad6d415f4bd413a201f3b33d6b754587", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819226, "uuid": "364a6e0b-7b78-4dcc-ad6d-e3ae57a2a4b3", "comment": "Malware payload (Mirai)", "value": "b8408776cf7f457bab3d8239bfe18cd5ce035884f6fd2b91b797e4a6ff93672e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819226, "uuid": "021bb398-0298-40f0-9824-4eca1902c5b8", "comment": "Malware payload (Mirai)", "value": "bf3e8b23b2b2d53ec2b98632427b25ad44891385", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819226, "uuid": "8132fbf0-56a1-44bf-acfe-d1bdf58f0792", "comment": "Malware payload (Mirai)", "value": "ad54d4e693362438fef74be0769452262e147764d2e37dcba9c92a8ab47e87a9d6753d9a059e3c8d0a37915e5607769f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819226, "uuid": "4e79c74e-e45f-43aa-81e7-11fd6f34c128", "value": "T1AD832997B801DE7EF80BE7BA44A309167630FB660D930B757257FDA3A9321D51812F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819226, "uuid": "56b3af62-18e5-4049-9b24-007daa614e7a", "value": "1536:Fhaen0ttvl32ZmVNePg81y+TFRNp15asGszX6NrL89D0aFQ7ckbXyQ:zae0t6sVNePTy+TFB2s7zXKmvFQ7fGQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819226, "uuid": "96682baa-0531-4bab-99f1-7d5329083d9c", "value": 84664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819226, "uuid": "bc700dc4-def1-4bd7-8399-c42c15f89dd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819226, "uuid": "a4e16923-9f32-41ba-8093-05c2d42436e9", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "210f0a8f-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1772810480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810480, "uuid": "1b73396f-0b67-4e35-8b3b-1a180d14baa6", "comment": "Malware payload (MassLogger)", "value": "7759abbf57abc407475296aeea127c6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810480, "uuid": "8c393239-525b-4fd8-8abd-071bd38f9c59", "comment": "Malware payload (MassLogger)", "value": "b8e84695c8a14f7223d17d6957f4eb1ef4cadba8918911a5988b51a925042cfc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810480, "uuid": "be5adb29-bd31-44e2-b4dc-91a1c571d883", "comment": "Malware payload (MassLogger)", "value": "477c2de6aa189eaac9d9aaf24d57f7c92392f7c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810480, "uuid": "3c966ff2-1992-4c31-9e1a-96630ab93580", "comment": "Malware payload (MassLogger)", "value": "701507c149b6411c00cf69cd9a508ff251083c464bc4fa9816552b2d637c755a452223e031155592da732128b51e2af7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810480, "uuid": "10ce9764-28d8-4557-80ef-77006be0af66", "value": "T19F55E1506E406252E4390B39C093AB342375EF9A6706DB1B89E87EB33DB3BD6DD17805", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810480, "uuid": "37e95a66-9a85-48dc-9caf-8bc1ad20e320", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810480, "uuid": "b2a663e8-e590-4a66-b079-a28cc6ef69f5", "value": "24576:pCp/dZ+8EsdfRA8D5sjF3leiy9GM4ss2NGmpBnd:pwlBDAu5CcRf4qNG4Bnd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810480, "uuid": "b3545c63-4c00-4db8-bb1d-ee9222b9e99a", "value": 1374208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810480, "uuid": "b240b1a6-c582-46ff-bd98-79790829a6f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810480, "uuid": "39b4a231-bc65-40d6-ba3d-0aea16592768", "value": "b8e84695c8a14f7223d17d6957f4eb1ef4cadba8918911a5988b51a925042cfc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea7dfbef-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772811677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811677, "uuid": "cb50ee23-c614-4e4d-b1cf-3a1bef8e6391", "comment": "Malware payload (RemcosRAT)", "value": "43c5cde9f51671778f5ec1dad9e9ea23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811677, "uuid": "01080a7e-151d-43cd-8948-19bc4245eac2", "comment": "Malware payload (RemcosRAT)", "value": "b91ee6b195867a96f22bbcd98cff92fd2347b720e42281ef06c5d7e27c70250b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811677, "uuid": "bd2cca50-67f0-417a-af9a-956d2d7a0ab9", "comment": "Malware payload (RemcosRAT)", "value": "94cb6668e88d1326be58b31e001c81b245396401", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811677, "uuid": "7f31ed6f-34e0-451e-8754-2a0cca8b14c4", "comment": "Malware payload (RemcosRAT)", "value": "511b016bc1f6c75d3ba943a668e85aecf4af6fbbba7c4a3d38432265b35e2d62d37665c4076f6a59c8014a3e879c7e78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811677, "uuid": "af785a7e-3ae5-49bb-9680-d7995d69da69", "value": "T1F10501580749C502CAA52B7A29B1F2B85B7D6EDBB401D3175FECFDEB7D22B150804386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811677, "uuid": "418f5c49-d34c-40f4-8dc5-a1dd5f0653bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811677, "uuid": "472dc4d4-cf8c-4540-a6b0-02eb76a06805", "value": "24576:0RxMLSBA4Xc/srYkKFHa5P5MNrFXLOcxsrkI5aO1:2xMLoYSY5QyNrFXaOsBUO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811677, "uuid": "2947a87f-b7ac-4210-a2d0-387fa1433963", "value": 855560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811677, "uuid": "e71ac2b7-3a7c-40ab-af93-509bc136b07e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811677, "uuid": "8ddbdcd3-5f53-4f1e-9a38-91edb21c2efc", "value": "b91ee6b195867a96f22bbcd98cff92fd2347b720e42281ef06c5d7e27c70250b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fd527e7-1937-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1772785997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772785997, "uuid": "89cd4574-0442-40fc-b97a-75062f03beb9", "comment": "Malware payload (Gafgyt)", "value": "66798bd48daf517243b13d841ef06b0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772785997, "uuid": "3e74801c-8aa0-4fe9-ac3e-30ae45c9fad1", "comment": "Malware payload (Gafgyt)", "value": "b95bbb3739a3cc10ade36a6ee9e86d38aef7e6562cb531b9ca312430ec34f68c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772785997, "uuid": "a29ec447-0f7e-4d8e-add7-d93b2d5833e4", "comment": "Malware payload (Gafgyt)", "value": "8a1e03efb834834d7799241525d0d4659db751c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772785997, "uuid": "84f8474b-8e81-4814-b9bc-561454ce7f3d", "comment": "Malware payload (Gafgyt)", "value": "beb48ef1c4511771c09ef2dc7714eacf38e9a8f3bfdaf1157a4ea5f0e8e5c017b9903a26613d9a5c62b702d7010d70de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772785997, "uuid": "6dde7a4d-2849-4921-a966-312c41f20ea4", "value": "T12914A81E6E228F7EF66CC73447B78A30976923D623E1D644D1ACC2145F2039E645FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772785997, "uuid": "284cc9a2-ee5e-4ca1-b035-df86214a494a", "value": "3072:s5KGLhIDngYPmfYx8aPDDx6t54SlboRZA:s5KWhILgu+aAt7lbO6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772785997, "uuid": "b46c235a-a9d3-4287-941f-0ea0f72f1415", "value": 199364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772785997, "uuid": "647b48dc-5585-46c5-b2d7-bd1ec65fc70b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772785997, "uuid": "b6daf4f6-4997-47be-b2d4-487b10b4e88c", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bc410cd-1974-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772812189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812189, "uuid": "9d0be3cb-76bf-4d8b-978a-7c897225f044", "comment": "Malware payload (Mirai)", "value": "3fe106119d31d4dc8ea417a6bc5a38bc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812189, "uuid": "e9002182-9a5f-4b6e-aa6d-12b6560060ff", "comment": "Malware payload (Mirai)", "value": "b991b6e300560636ded835eb1d5c878278d393591ab511943404ac33b1481991", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812189, "uuid": "268e561e-781b-413b-ae60-3454809b3903", "comment": "Malware payload (Mirai)", "value": "0c522b45c228498dfde7078cf29e55d2579616ab", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812189, "uuid": "fb76f144-1a4d-4fce-a0de-1f6cde6f035b", "comment": "Malware payload (Mirai)", "value": "7b7825451aa45d0006a02badcd27bffad12670d5119f13bee59d29fd86f66afdda05ea91c64492d558d2fb3599879861", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812189, "uuid": "f627e313-bcd5-4588-8287-543030556063", "value": "T19EF06DE92224C322B4A1462934E02BCD93CA5FF7A440CAC9B1314B1AC1885983EA1BA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812189, "uuid": "6aaaaee3-9bac-44ea-923c-180e38a25b85", "value": "6:HTB0cEwC7JB0cEw4xXcEC1hNpB0cEdiJB0cEd2XcERBhNpB0cEDIJB0cEDIXcEDS:+HwigHw45e0HYgHGRB0H8gHaXm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772812189, "uuid": "0c341286-f7c8-44b7-821e-db0e34c86754", "value": 522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772812189, "uuid": "3fe99858-3db5-46bc-936d-523fd2cf36b8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812189, "uuid": "45d5381c-ad04-46d4-8670-3a25dedd7a39", "value": "a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f64f552-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1772809296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809296, "uuid": "2ef3f75a-a472-4d18-bda7-76f205e85cc1", "comment": "Malware payload (MassLogger)", "value": "cdf8dee3153d294ba453de9c2ecb553d", "object_relation": "md5", "Tag": [ { "name": "bot8257734127", "colour": "#A03FE8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809296, "uuid": "00e11b0c-b671-4a4b-a12b-90343d7b763b", "comment": "Malware payload (MassLogger)", "value": "b9cc5c028d00a8ecc7a1c0fcb34d4a2ec87959f479a2a306e9babba12f2704c3", "object_relation": "sha256", "Tag": [ { "name": "bot8257734127", "colour": "#A03FE8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809296, "uuid": "838e8365-125f-4002-9850-4a4dfa0a8e7d", "comment": "Malware payload (MassLogger)", "value": "cd6c5af47a259562a3ccaf28f53a3171dbc7019a", "object_relation": "sha1", "Tag": [ { "name": "bot8257734127", "colour": "#A03FE8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809296, "uuid": "ac6bb7d7-cd5c-4760-8b5b-40395f922762", "comment": "Malware payload (MassLogger)", "value": "445def99b7abb75d03c12ab507f88ce753e16c93e2fe023bedfdc903be89f2e9c1468e4352c13cc391bead63846cc6d9", "object_relation": "sha3-384", "Tag": [ { "name": "bot8257734127", "colour": "#A03FE8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809296, "uuid": "7104f895-4a89-4149-9a59-aa06c0553baf", "value": "T1804419443BF95619F3BF5F79A8B050504AB6F92BAD1AD30D1C8620EC2E31B51EE50B63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809296, "uuid": "5fe06480-9adf-4aa0-b911-1f30717102a3", "value": "3072:ARYyGJwDsUAoyV0CdWvH8UdoTSBEegmIWZu1V1XnWO8j9XQIvn5bfIQ7SairKDye:ARYfaDsh7WkUq2n9AoxgrKDm/Xyv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809296, "uuid": "6d59ddd2-58eb-45e1-b1ea-5e940384c1dc", "value": 261632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809296, "uuid": "2ebc53f0-753e-41c5-bf6f-5a9e2324bc96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809296, "uuid": "ede01857-655c-4d9e-b688-0b22edd7fb0f", "value": "b9cc5c028d00a8ecc7a1c0fcb34d4a2ec87959f479a2a306e9babba12f2704c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72fc6243-196d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809329, "uuid": "99e8f626-107c-4278-a148-2064223e5d7c", "comment": "Malware payload", "value": "840c7b9e1d4b6186c0fa3e88e16e8702", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809329, "uuid": "ebf40c0c-09b1-4a04-9c72-c172999e4e18", "comment": "Malware payload", "value": "ba0f602a1bf172dfd4e194dae01c6f9600cf10b83e8569168a11d4773d720d64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809329, "uuid": "e74b0538-d357-4129-9140-e00559054f7f", "comment": "Malware payload", "value": "5977d35ffbde6f65eb00ffb340d63fbc092abb7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809329, "uuid": "23fe3707-8436-4d77-af24-0028d6caa390", "comment": "Malware payload", "value": "aacd063340511051555f3425ebe5352966e82ed9da0c287ff68f56365d6fef44a9cfbd39b5a3cb47281eea4f487863f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809329, "uuid": "bc1b7dca-a8c5-47b6-9b14-4e0f32e80ec2", "value": "T19405232575D1D13BE297833230831B772BF6EE5693A17247879039ACBA76B419B27303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809329, "uuid": "03374b90-68e8-4536-8c17-b571fab792e5", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809329, "uuid": "6c8aa69a-1db2-4f63-be96-0080880af6b6", "value": "24576:u3djNO3wtX4uelQbQQKr7AylCTsPJlsOSpMYWzAb76VAtuuWSgH/:u3ig6Q0b7F5PJNzAc0WSgf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809329, "uuid": "d1e05287-c8d7-429c-86ca-d6b839488ef5", "value": 857280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809329, "uuid": "913e760e-5cfd-4e76-9bed-56cbf840cbbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809329, "uuid": "891d5d1c-9b62-4eee-b28e-8efe9fc6e20a", "value": "ba0f602a1bf172dfd4e194dae01c6f9600cf10b83e8569168a11d4773d720d64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f815fd1e-1969-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1772807834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807834, "uuid": "3f64b454-7014-4134-9bd9-355644e58944", "comment": "Malware payload (SnakeKeylogger)", "value": "6e343e891c7e84d1f576482a051d3b19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807834, "uuid": "184f3b8c-b48a-44cc-9019-e7a4bffbe7d2", "comment": "Malware payload (SnakeKeylogger)", "value": "ba9d251e11a47377b03707def4f6bab7889b1c6099cb8abbde877068ca6b0ee0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807834, "uuid": "527cac03-8712-4141-8673-a98a47438c62", "comment": "Malware payload (SnakeKeylogger)", "value": "cefb76976a10ceae90358a204767e4bf3469b686", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807834, "uuid": "bd456c2e-9557-4803-ade1-e8329fb31c2d", "comment": "Malware payload (SnakeKeylogger)", "value": "ac68d38275ee2e7af1aadeb0b0458aab9515e368fe6e638151264711420c98b74141e4121d1fed7c4c9f6174b3930872", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807834, "uuid": "1a91a48d-2677-486e-8e19-ff7c7906c240", "value": "T127F3125DDDD9B923EE7ED2F41B4BC33E93C17293A51C509C5689A045A270D0032A6F2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807834, "uuid": "85447fe8-dedc-403d-858d-c8c2fe72d4dd", "value": "60559adcf3698c3eb3c69577ebf28413", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807834, "uuid": "8f5c446a-1007-4d8a-b1d5-573a9e4f1d5e", "value": "3072:KUROplVIRFYccZx95VCLO18NwcFEYTDRGSqqVkhqe9E4EZQNgUtEmKu1yg4NCB83:KFEF+ZvmwyvASPGPrgUtEpg4cB8+CF7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807834, "uuid": "97e5331a-3b30-44bc-a3ea-a166e64842b3", "value": 170496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807834, "uuid": "a84a7af2-c56a-4f1c-b5c9-935ca0445495", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807834, "uuid": "fb9a08d0-6107-4281-9854-081162275afd", "value": "ba9d251e11a47377b03707def4f6bab7889b1c6099cb8abbde877068ca6b0ee0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7e4a8a6-190a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772766925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772766925, "uuid": "0a53f47c-8f0e-4ee1-9fbe-df81ace8060a", "comment": "Malware payload (Mirai)", "value": "0d743ab91910850360107221526d2d25", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772766925, "uuid": "dfa01cfb-fe6d-4578-9399-8adf18abe7f8", "comment": "Malware payload (Mirai)", "value": "bac8eaae693e2d7b18b917d8c52e00eeefdc9bf1014b324a0b1ab16b7f3e13ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772766925, "uuid": "59c1c0e4-020f-4056-97c7-ff1a6f683231", "comment": "Malware payload (Mirai)", "value": "6e8e0857707d7e9947e2a8b1ad0784ff869de010", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772766925, "uuid": "f0db6ac8-60c1-4c52-bd25-c8fd593ad8c4", "comment": "Malware payload (Mirai)", "value": "ff5274f5b2d5af349c0ca4fc73da6f390303204c4a4dc635016d246b73dc0ace5d347f4d0734d0e18794e717457b51d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772766925, "uuid": "a9fe71e4-a9be-42df-947c-de427c9677bc", "value": "T1A8D33851B9829A27C5E123BFFA6E018D332563E4D2DE72178C215F217BC691F0DB7A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772766925, "uuid": "412b4eba-7baf-4e0c-88cb-ef85fbdeed5e", "value": "3072:snFif7apx6XS+kUgpjWXQQKMs0u29wzulziQSc:sn8ZS+dQWXQQK5s9TeQSc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772766925, "uuid": "e6c0a288-5303-461e-83aa-3069906a62d7", "value": 140756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772766925, "uuid": "1e111398-507d-4980-b770-fe98974fcccb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772766925, "uuid": "e10c494e-568c-4a24-b434-ca6f059b58b2", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f780f8e1-197a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772815135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815135, "uuid": "9a331b3d-8455-4891-bbee-937d0b33394c", "comment": "Malware payload (Mirai)", "value": "6c41031ef5b1beb8fbaddcb358867cdb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815135, "uuid": "59608cc1-65d5-43d0-808b-d5f6c9bf774b", "comment": "Malware payload (Mirai)", "value": "bb681a4e9261dd57a0b6239202d0f2d9312ce98ad4b68032fe642c4f22d27e98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815135, "uuid": "2e03c7d0-5ab9-43c2-99c5-eee91d373762", "comment": "Malware payload (Mirai)", "value": "d5cda79cd13fba4de0c37fc68e72f49b4ccd0f47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815135, "uuid": "63d69a54-085d-4432-98c5-d00876ca98bf", "comment": "Malware payload (Mirai)", "value": "42d14bf10c260264a0ed3cb46ca88e16c2e8f4ebf6743ea27eeb7cf4efc6d0feb6ac06450964e7c869609432a12896a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815135, "uuid": "18f3664a-a3af-4199-b1b7-6be6c324a5b3", "value": "T1A1934A52FD818666C6C126B7FB5E028D372613A9E2EE3203ED256F2133C795B0E7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815135, "uuid": "42616a93-ace4-4a91-92af-42f31b6e7930", "value": "1536:Kd86Y6RpPoaJstYVlWtk6ItV2SCq79gwFJwS5sJzGeJCQsnUXjQ:Kd86YGpPoaheS2loeYwSLCCQs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772815135, "uuid": "251c1dd8-2c95-4b41-b7c9-9662f294ae4b", "value": 89832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772815135, "uuid": "ba13b7c6-91fd-4535-8aee-013074403801", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815135, "uuid": "4b4d36f3-2b35-4cc4-ad57-b93fd6ef21d8", "value": "titanjr.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9397e9b0-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810243, "uuid": "2a166314-a6a3-418c-9669-13bb0ae70dbe", "comment": "Malware payload (GCleaner)", "value": "3f9e373c70b7f640a48d79f9ad9d0c72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810243, "uuid": "25580b9b-b2e7-4a15-b12e-6063a08350f5", "comment": "Malware payload (GCleaner)", "value": "bbf25110cf72488aea555735bdf55abfc784c12775d15178a605eefce4dcd801", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810243, "uuid": "2d46382b-4a95-4a35-ac31-9bc27dc5a9fa", "comment": "Malware payload (GCleaner)", "value": "f8c795f9cd7b0d9ca470261774aa47b0b9fb4d33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810243, "uuid": "4d7112a1-adf5-4f94-b7a0-e27ca6a42583", "comment": "Malware payload (GCleaner)", "value": "110d43b8515a7fbcac41c96c0ae9ed7cb94c84656da2e7c053211f8cde44c1ffe84e16278addc3dc0f89c8deb6a7d255", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810243, "uuid": "75ed04d6-5087-4a5b-a7bc-2687f561af34", "value": "T16045AF22F2928433C97217399C6F67995C3ABE113E3CA84A3BE51DCC5F3514179352AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810243, "uuid": "8d35aab7-80b0-4ca1-933b-4cc34ad43d0f", "value": "0eefadf8e9087d6d95cc4aedf30a5018", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810243, "uuid": "88e779b0-c7df-43db-a959-771f99654f06", "value": "24576:bVwXV4HSmYq7MPPfEd+epgAKt+AP6YGEp:+cOfmBg5t+g6YGEp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810243, "uuid": "c78e3fc1-762f-4152-bad1-3e35ca07be29", "value": 1249280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810243, "uuid": "033ff752-56b7-47f4-b874-4db39b1df851", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810243, "uuid": "2f23ba5f-7150-435e-8df7-284b32106a8f", "value": "bbf25110cf72488aea555735bdf55abfc784c12775d15178a605eefce4dcd801", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b3693b3-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772810578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810578, "uuid": "aa62dea4-83b6-4258-a42c-3a12fb76c897", "comment": "Malware payload (PhantomStealer)", "value": "201ba00a05dedcbbc1e4a37538fe1e5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810578, "uuid": "272b5f96-94ba-47d6-977c-ecc512c38c52", "comment": "Malware payload (PhantomStealer)", "value": "bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810578, "uuid": "8934378b-1f3b-4f42-92ad-e95d83f2141f", "comment": "Malware payload (PhantomStealer)", "value": "321b1d216c750ddbfc2d54c7dbdb87b51fc9d92f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810578, "uuid": "51719dc2-6b8c-41d8-8a70-64881c664933", "comment": "Malware payload (PhantomStealer)", "value": "50357146be7485b0acfeeab72439b69534525e59e6afdcbc038a61aac4660a06f8c9ccbd8259d0e4a284a674d8b9d929", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810578, "uuid": "59feb243-1fa0-400c-814b-af4eb540a22b", "value": "T1EB6523496786D813E4A523741972F2B0177D2EDEB811D3078FFCEDEBB9A2A559C04283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810578, "uuid": "41ef7176-c668-4f6a-a7a4-3a3121712c2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810578, "uuid": "55dcf79c-4060-4479-8dd5-e9ed004f7777", "value": "24576:9ajYc6edu/L9qZKi5bpFjcGPXv/Rfa3xdlV0fAGKXiQVGjTWXJdmw:9aj7I5i5VFjcUX+HVE8XAjOTmw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810578, "uuid": "95e3ec41-98eb-4b9d-b340-3c69bab35f71", "value": 1534464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810578, "uuid": "bc5dda1d-dfed-475e-9574-b7215cbb5731", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810578, "uuid": "b99fbc92-0153-4d74-8640-d00b2421fd13", "value": "bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbc32fa9-196a-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808216, "uuid": "c584082e-43d4-4406-a402-0b1803852b57", "comment": "Malware payload (GCleaner)", "value": "f3b0e5b7a7de2b0bec06b675f344f344", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808216, "uuid": "1b87bf51-017c-444c-85ab-32ba90c8ae26", "comment": "Malware payload (GCleaner)", "value": "bc32d3a3d8d4f809464fac47cc6e6c7d47f983b55c5190c646e9c8e6beebe69f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808216, "uuid": "b081b93e-a6ae-42e9-a49c-59dd4f71f296", "comment": "Malware payload (GCleaner)", "value": "9cd53068061eb4c3f9f447c054aaa7fc67c36a0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808216, "uuid": "b4b409be-7fa3-460a-a04b-71f674ac00d3", "comment": "Malware payload (GCleaner)", "value": "d7dccd7ec521ea02b2755acf5dc33c5fb6e80ed0d3995fe4b66325006245128b545452557666f54b003a0aac6fbb97b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808216, "uuid": "eb4a37dd-7de0-42a6-8772-786851797ee6", "value": "T15126CFF6E7B4CCA6F0A79D344C3F03AD6A6464D3FBAC10F61E98E8C8151D13760A9199", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808216, "uuid": "0487ed24-a0a1-4f21-bc1d-52ccaa44a32f", "value": "e5f32a93ddcf3aa9009cd70911b0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808216, "uuid": "8ff9f4a8-98f1-470b-bac9-75b24b71bc25", "value": "49152:S9CiLxmBvzqYGJCddY44soU6PvAb/a66D4ZbGiqLnleMUW:S9CexmBFGJCvMsoU6Ab/a6xqjleH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808216, "uuid": "8d021fc6-2adc-4a8e-afc2-9ce809041381", "value": 4690944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808216, "uuid": "6cae9ca9-eb9d-4b38-b9f1-6fc89d02ffbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808216, "uuid": "f6d8dcbf-7de4-4f17-b88f-7811f96f5b57", "value": "bc32d3a3d8d4f809464fac47cc6e6c7d47f983b55c5190c646e9c8e6beebe69f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0041207-1969-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772807687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807687, "uuid": "b0f1a7fa-bb58-4430-99bf-1b1e6de2447e", "comment": "Malware payload (Formbook)", "value": "3a7bc83c0ebe2b38b9d2553df0218204", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807687, "uuid": "ca1d36ed-c55d-447d-929c-d9ebab50f2f7", "comment": "Malware payload (Formbook)", "value": "bc62b6e9167977e3269270c50f278a5fb21de9fb5390247208ab0cdffb6e873d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807687, "uuid": "f2ec2935-f0de-4f56-abe3-ba0908382b41", "comment": "Malware payload (Formbook)", "value": "907ec0edd859f01f40b2ff6a76d2bb233f3ff988", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807687, "uuid": "6a7b9f28-e61b-4d0f-bf65-904b3cf28460", "comment": "Malware payload (Formbook)", "value": "733312d7c79344bc3ab1c926c6bcb30116486be2edb2d12b32149323cdef15856917b1fbc4fba2c8b8a81914e76bcbb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807687, "uuid": "957d02dd-318d-42a9-9931-ee379ade5ffb", "value": "T14C45BF0273D1C062FFAB92334B5AF6115BBC79260123A62F13981D79BE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807687, "uuid": "a1695077-9e55-438b-8877-bbef65edce34", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807687, "uuid": "28f5c573-2b09-425e-85b5-53b090181def", "value": "24576:95EmXFtKaL4/oFe5T9yyXYfP1ijXdaOj2CwLLwaDc94hKJjGp:9PVt/LZeJbInQRaOaCuwaQmUJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807687, "uuid": "b61e7388-ea4a-4219-829e-9aae4ef3bb5e", "value": 1245696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807687, "uuid": "90a71251-3054-4fcc-8ee3-25bb8c785405", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807687, "uuid": "8f29b051-162e-494d-af7c-0ebca7aef8f8", "value": "bc62b6e9167977e3269270c50f278a5fb21de9fb5390247208ab0cdffb6e873d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12844837-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1772810456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810456, "uuid": "5fe19fb7-9d70-43c3-a0e8-83b3859d9284", "comment": "Malware payload (GuLoader)", "value": "562f7ae252dc03fe56dd458330771748", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810456, "uuid": "3212a363-7b1d-42fe-aae0-3579c67dfa9d", "comment": "Malware payload (GuLoader)", "value": "bcbbc761561cfebebf30e13c8894e48ea6b2f9e5286c291118c75ae6918c9d68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810456, "uuid": "45a68044-0f55-410d-9a3c-02db702f8ff4", "comment": "Malware payload (GuLoader)", "value": "dda31f3c2cb5eac6f42745c4b0bffd8a452514da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810456, "uuid": "41658541-22d2-4976-b9eb-79e0a4a14f70", "comment": "Malware payload (GuLoader)", "value": "0c8c91ba98ac1739659884d6931cb4dd704823c8a16babe84644077a51d76d8bd395bfca8ce3b87aa5de562f62a9d1bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810456, "uuid": "d45e910f-dd4c-4f8d-95e3-5a5be05c2da9", "value": "T1B31522402AD9C4DAE7180676D83BCAF20F16DD685A90905633F97F5B3EB6783702B709", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810456, "uuid": "71829340-5d0a-4863-aedb-e3127685dee3", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810456, "uuid": "34130840-064d-4ce8-9900-8a90d2ce6c77", "value": "24576:dadWcJwkm2HvzcV6xOWaeM/vCdps00eJlGzvofwHR91:AWcJwkHHLcV60Cw0VDGLoIHR91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810456, "uuid": "ea91d70c-e35a-4c95-b13d-0dd047470f66", "value": 925299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810456, "uuid": "8f7bc7bf-8277-4f1a-b165-7d17808e8a05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810456, "uuid": "288debd6-ec99-4008-b74b-2108d587ca82", "value": "bcbbc761561cfebebf30e13c8894e48ea6b2f9e5286c291118c75ae6918c9d68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7951155a-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819218, "uuid": "0306dd05-e0ef-440c-b175-221576213750", "comment": "Malware payload (Mirai)", "value": "8ce572175b5c0d682d1087d5500b6158", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819218, "uuid": "91b207ed-e332-4f31-b6dc-c5e8b23a7a44", "comment": "Malware payload (Mirai)", "value": "bcdf187e31b84706449b463894f9808fa7cedb6f8811234335c2797dcac150cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819218, "uuid": "ca14d631-ace4-4401-9adc-e635789d98f5", "comment": "Malware payload (Mirai)", "value": "72c2bc93126aaa3bac8391eaaa7aa67f40f7542c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819218, "uuid": "31a60d20-3935-4053-960b-b6c54f1744aa", "comment": "Malware payload (Mirai)", "value": "4e762242d041bfb5cbc174e39cbd0e44f9285aa02026a3ad9374884ec5a4eae156ff5eb9a1938f005f7df60462f8b1be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819218, "uuid": "460609d6-57e2-4906-ada6-0a4fdd957fd5", "value": "T164243B03771D0A87D09B2EF03AF723F183ABE91116A66240F61EFD845373AB1A559F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819218, "uuid": "fe536627-fc5c-4e14-af8d-f40f0d9370a4", "value": "6144:uyoeyo2Mp0xwlBlqprjIna9wv6Oooc+Scoha9byTKC:CejMrYa9wv6Oooc+Scoha9byTKC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819218, "uuid": "5ac1f97d-2c0e-4a52-a9b3-88414ebce373", "value": 213216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819218, "uuid": "600e78d8-3abb-4069-b8f5-b1deac509be0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819218, "uuid": "2707e809-5d9a-48d7-8563-325f5983cd36", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1ad70b3-1966-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772806482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806482, "uuid": "d78c2dd4-6b7d-439b-8496-247f7f829781", "comment": "Malware payload", "value": "7a015da457c341d6b9e36c84a9f314e1", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806482, "uuid": "485dacac-a55d-4c4b-a416-e989287f44fd", "comment": "Malware payload", "value": "bd4c96efb1ffcd39501d6fd1a32922efca5030161df6107f5fac39598397ec5a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806482, "uuid": "c532dcdc-6407-4b47-8785-77189eee71fb", "comment": "Malware payload", "value": "599cdd605c215251c447c216156e9810ae6de31d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806482, "uuid": "a412df96-a7f4-4e7a-ba8e-3fc45159bed5", "comment": "Malware payload", "value": "9bb978c608e023e9a050e4f23b2781f5243525c17b1270d7f6a95c59314dd8990b1c3765f50c556c6ba22f831c9c406c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806482, "uuid": "94665bc7-ccbb-477f-bfc0-b77cb71abdd1", "value": "T18FE36B7FBF424C55C95D0DB3E4A359448BA6CDA6582BFBAB20D81CF57EA381C4C4B850", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806482, "uuid": "45a6fac1-df9b-4141-8684-a349552981ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806482, "uuid": "f84de68d-502a-452d-89da-f573562911cb", "value": "3072:UQ+clBSdGrIyKH/C4MwGNJbFSBJEJtmQIbBG5qwgEA6IIr:brlMdg8avVu44bKqqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772806482, "uuid": "77409a0c-7f6e-425a-88ca-3bfac73f1567", "value": 148480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772806482, "uuid": "750bdbba-c5b1-4eda-8600-6fe0d72eeb47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806482, "uuid": "0bfd5856-0b16-4f2f-b77f-a9a40cfa2fde", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f6a2e86-1933-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772784466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772784466, "uuid": "49233ba9-ccc7-46aa-a64c-cfab18ef9dbb", "comment": "Malware payload", "value": "f17298e10b0b662f1c4206c3bdcad7ee", "object_relation": "md5", "Tag": [ { "name": "app-64-7zp-dll", "colour": "#80A805", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772784466, "uuid": "b066f78b-cff4-4d07-b5b6-ac7b9d9ff5d9", "comment": "Malware payload", "value": "bdb1bb7b7824a994d9370675109b2e4f0c2f1abd7472032c7268dcfd6932249d", "object_relation": "sha256", "Tag": [ { "name": "app-64-7zp-dll", "colour": "#80A805", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772784466, "uuid": "a1d8bd17-102c-4ec9-b7f2-9283fb348159", "comment": "Malware payload", "value": "dc955098399deb69a62b8141af288d0540cfde68", "object_relation": "sha1", "Tag": [ { "name": "app-64-7zp-dll", "colour": "#80A805", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772784466, "uuid": "d6341117-3d63-4eaf-b22e-03cfcd5f67da", "comment": "Malware payload", "value": "1e7bfec9d33c5650e916ebd89852b04810d9e1c66df9c7a3eb4a8d52a7a4e74be75dd49422a207e9c8854f8e158b0d94", "object_relation": "sha3-384", "Tag": [ { "name": "app-64-7zp-dll", "colour": "#80A805", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772784466, "uuid": "e78f04f0-43aa-4ab2-8623-9535a2086265", "value": "T17F183312B7E0C47AF1FB0B3191F167550ABA7FA55A71E20B3348928E0D35B84E938767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772784466, "uuid": "1ccbdd27-31d9-453a-afe9-efa8fc297aba", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772784466, "uuid": "9081bbbd-9db5-45c0-b532-8ec3db0b6a18", "value": "1572864:N+e4h7TL9BHUpVLwCXkdaBcSrufGanp7GgtcQ3AsERSqf:ke4NWxwC+aBcSruZkUEFf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772784466, "uuid": "3bf3cf55-3898-4267-a5ce-f16ae4571b71", "value": 87382422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772784466, "uuid": "b30e2bd4-61ef-40da-ab09-fcf6796d7337", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772784466, "uuid": "c8fee2a3-c1a8-4df9-9b10-85fce582715c", "value": "bdb1bb7b7824a994d9370675109b2e4f0c2f1abd7472032c7268dcfd6932249d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5ba9182-196a-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772808179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808179, "uuid": "3eeda912-02eb-4ba3-b6a8-1b914b44e09d", "comment": "Malware payload (RemcosRAT)", "value": "17411307a6176899397201958e3dbc64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808179, "uuid": "d9de4446-d36d-4be4-92f0-71a9a03c5a5d", "comment": "Malware payload (RemcosRAT)", "value": "bde50852020ef1304a8d5bd9813b542ac2849b74d6e1c5c6d36c1a14b1e381de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808179, "uuid": "9d48d88e-2a55-40e6-8a86-0234af479e40", "comment": "Malware payload (RemcosRAT)", "value": "3ea5ccfd8d48c24ddb67896eee2dcbb92993de0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808179, "uuid": "8de771e4-1ab8-485d-bd4b-a74f85fd55ae", "comment": "Malware payload (RemcosRAT)", "value": "0ed7bc3749318805764a4fc7e688b9d481f895ea931ab7e6697b35265e973132ea2c319d47f502e7808cd854276acf8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808179, "uuid": "07123127-8e55-4d03-8df3-584e64f01410", "value": "T1E8540214BBE4C81AC0641270ADF7D7F657F2BA329A56130B3358BF5E3E72281DC19299", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808179, "uuid": "8c784c71-6b25-44e5-9e71-c79d705245d0", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808179, "uuid": "d157900c-58c6-4e1d-9c0c-ed303a846e72", "value": "6144:3+MvoJXYsbLSTWgQPigLl3qZnmWtum1hvblpgg6bkxLCuE0s+DKNh:3+FHbLSS/4Qo1htkk7/WNh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808179, "uuid": "fd9b51c2-bc07-4640-ac4f-e18a204c5bcd", "value": 279168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808179, "uuid": "d860c9ac-c4fe-4649-8052-d9853c6d233d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808179, "uuid": "5f1c17cc-a445-4411-874a-314704e3d6a4", "value": "bde50852020ef1304a8d5bd9813b542ac2849b74d6e1c5c6d36c1a14b1e381de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a478390e-1966-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772806406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806406, "uuid": "45f49f5f-a0c3-448a-b6ac-23abbd8b959b", "comment": "Malware payload", "value": "e01eb452a58959d6739f08ca82d6e994", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806406, "uuid": "7164ef37-35b5-4987-b8b3-2ff0db322b82", "comment": "Malware payload", "value": "bdec218e90eba0b0963dcc8bc7886536c269f443c7b5cf4c75a94ba68ab620d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806406, "uuid": "04e4e625-db81-4cf3-bcdf-0cc39c640b83", "comment": "Malware payload", "value": "97acf5317093366f356b5ffd0f85923cab0eb11f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806406, "uuid": "f3dc5f80-9cd8-47c3-9efe-3918118e963e", "comment": "Malware payload", "value": "ab29cd2d13ae1b116e224d85c3a0b6e138f3d23bb89fdfbe7f44cc9103663c600d81b70145e1ae525b4837c38f554801", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806406, "uuid": "93945572-656e-454a-aa6f-b8a343b717c5", "value": "T13EC39DABB24F1051C82647F41BCB579C2E3325019E2B9AE77C6E373E1A369DE58063D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806406, "uuid": "902e7101-5363-4e41-b471-a7c9d51a94c1", "value": "3072:wf0GQgHfg5nBR4YYSOxTKB6Aq7mgbgiCrheiiU4bqe:wf0tJBR4NSALD7rnCrheioqe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772806406, "uuid": "3732060c-209e-4d7c-a344-8020c3efbb90", "value": 124344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772806406, "uuid": "324bd73e-9a6e-4454-9758-4b8cf18a5e40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806406, "uuid": "38cc485a-b503-4aca-98da-8f1a408d113f", "value": "iran.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "339d4d11-196d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809223, "uuid": "711340e2-62c9-4b3e-a131-6d75eab1f88c", "comment": "Malware payload", "value": "a32b06b147d409edd3b41eb23bdf2f99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809223, "uuid": "b71800bc-13f6-438f-85b1-080674edfa8b", "comment": "Malware payload", "value": "be17ca398ebedb1855aea679a1dd047baff05fc142408b8e6dfa8fe24be89b94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809223, "uuid": "cf15465b-5262-4fbb-899b-f65369e4d427", "comment": "Malware payload", "value": "b58f01d9c3a87133f1d48ee74ac364735114278b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809223, "uuid": "989e78e2-6764-4a4f-9f72-3dcc9a1c6c7a", "comment": "Malware payload", "value": "734d9827584ba4a7b3eb6e3408230e79d4fd1ceb273f38dcdcc78e17e891153efc1683cd6a4c136f02b125e3c2c1842e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809223, "uuid": "645a9328-9298-4aca-a1ad-716a596dd6c6", "value": "T1685512642719DD02D4B94FF01A72D3B44BF56E96A821D313CFEBEEEBB52B3412941242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809223, "uuid": "5765867f-cf58-41ab-965a-8fb44e6e4253", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809223, "uuid": "7fa0542e-eec7-4a05-8f7c-c8b2c16f0c31", "value": "24576:cqu2VRHGbuBpreVUwypbn8vJY2/funaJCtlIxSUoirAxULpuRhj147LtXu9q:ceVRHGbuB9/Vz+uACtl8SUoizOhe7Lta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809223, "uuid": "bc8c4bc7-d23a-4e81-a1b0-b71d975a6431", "value": 1304576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809223, "uuid": "0d36dfd9-8212-4280-808b-92d1df9ba2db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809223, "uuid": "cdd5c539-30c4-4b3d-8e03-4fa62f39023b", "value": "be17ca398ebedb1855aea679a1dd047baff05fc142408b8e6dfa8fe24be89b94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3127f8d-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772808605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808605, "uuid": "1eed1e28-1cc5-46a3-b2a5-8420f1722f99", "comment": "Malware payload (RemcosRAT)", "value": "4c747a9ee24f8d87428e540ba58d0da7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808605, "uuid": "7caf6633-6a7a-4e8b-8aa4-0c5de5884b99", "comment": "Malware payload (RemcosRAT)", "value": "be797b3dd66a1b437f7bc827fb05a8086c41f7f2604d4af5c59943cb84b2c98b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808605, "uuid": "06df89ca-2f18-4d13-9b78-aeb9b147f6a5", "comment": "Malware payload (RemcosRAT)", "value": "4a729e1c0efaf388b01dfd266a85706771628278", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808605, "uuid": "cfd74f29-af5e-40b0-840b-fb911cda32a4", "comment": "Malware payload (RemcosRAT)", "value": "3040d51def2d94cb3158e77ad2f340fe4bd36c1ce043751a3df2ffa2ae7fec60c5b9457c88d018a2706b20b138b952a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808605, "uuid": "43bd9309-d5c8-4436-ae29-5561875bbef1", "value": "T139051231328CCD06E9981BF99175E23907B56C5AB123D227DFDA6CEBBDA9781160C313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808605, "uuid": "570058f8-d7e8-4d78-9040-ed269af746f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808605, "uuid": "5d5e97f8-bbc2-44ee-a6ab-0c8aa7e5e55c", "value": "24576:4wKIguQq7dh9fU5y2ZxY/XqjH5oNUMYPP6WDfVicti:4zu17db8IajHWNUXnpDfQc0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808605, "uuid": "78442e48-d082-4aad-ac5a-9aedf6bdf982", "value": 856072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808605, "uuid": "18ad9a37-013d-47f6-9557-b5cdeafbe5dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808605, "uuid": "e1040978-d35b-4019-8cec-a4ab6b6a4ab9", "value": "be797b3dd66a1b437f7bc827fb05a8086c41f7f2604d4af5c59943cb84b2c98b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5992a2be-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772809716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809716, "uuid": "c2123741-366e-4cea-9f98-10b17ea5a4be", "comment": "Malware payload (PhantomStealer)", "value": "0d2d6c3cc8c999b694942c71bb263436", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809716, "uuid": "0751bb6b-1031-49b2-ae11-0b3052747fcb", "comment": "Malware payload (PhantomStealer)", "value": "beb3e7842f4b116d2c50970f7829a5ce8244e36f5cda5fed9c6f920376070136", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809716, "uuid": "8913fa07-b00a-426c-b442-2510f03ab4d2", "comment": "Malware payload (PhantomStealer)", "value": "028e7ecdbb5aa9b7ef1be0f5213c711c16773eab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809716, "uuid": "c72ab326-31aa-4d60-b9e8-c4dd199e744b", "comment": "Malware payload (PhantomStealer)", "value": "5ca39f64131f3919a2c63a56fd70b77abb1998bb870a31ea6209364867cf3d8b53f2d73649bba2cd5b353f18a344d433", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809716, "uuid": "66fb4ee9-4c01-4dcc-8da0-69aafe4af4fb", "value": "T119C5335316A71ED2F5CB27FD1E66D689B720B43AEB08A23239E91684CF0B4BC4F74145", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809716, "uuid": "e01eb883-2aff-4eb3-9bf7-30b190c365c2", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809716, "uuid": "3165db52-3456-40a3-948d-d87839454780", "value": "49152:NX7Px5bYOQRcpqPUH63sojodiF7oqI7fWnTGitwhXbK8PeYw8:NX7vYRuE86cojoUF7od7Wpwhm8Pj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809716, "uuid": "6793ce38-2205-4d05-a7cb-99213f907f5e", "value": 2670080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809716, "uuid": "8d41ec71-93b6-4c2d-92fe-8cb722cb902b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809716, "uuid": "cd55f700-6db0-4842-a113-e27f4610f54e", "value": "beb3e7842f4b116d2c50970f7829a5ce8244e36f5cda5fed9c6f920376070136", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbe81ec4-194c-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772795332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795332, "uuid": "04dcd743-ac75-4f24-b22c-e52f6ca4548b", "comment": "Malware payload (NetSupport)", "value": "419870e92a24ec8019ae16e83d7e8bb5", "object_relation": "md5", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "jakkakaskakasj-com", "colour": "#CD2821", "exportable": true, "hide_tag": false }, { "name": "jasjdpoekkqwda-com", "colour": "#F78A49", "exportable": true, "hide_tag": false }, { "name": "modeactivate-dev", "colour": "#EB9FC8", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795332, "uuid": "80dcb350-8a06-4081-b043-2b5db656b32b", "comment": "Malware payload (NetSupport)", "value": "beca6a851553f042c74ac60243849a978e553173e23acb28dd98b3cb1b0af2d6", "object_relation": "sha256", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "jakkakaskakasj-com", "colour": "#CD2821", "exportable": true, "hide_tag": false }, { "name": "jasjdpoekkqwda-com", "colour": "#F78A49", "exportable": true, "hide_tag": false }, { "name": "modeactivate-dev", "colour": "#EB9FC8", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795332, "uuid": "7da2e210-3fbe-4dec-8cd6-b0574e64b8dd", "comment": "Malware payload (NetSupport)", "value": "f785c99db3edd5f9aade53f032b2edeaa7bffb5d", "object_relation": "sha1", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "jakkakaskakasj-com", "colour": "#CD2821", "exportable": true, "hide_tag": false }, { "name": "jasjdpoekkqwda-com", "colour": "#F78A49", "exportable": true, "hide_tag": false }, { "name": "modeactivate-dev", "colour": "#EB9FC8", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795332, "uuid": "2b379722-3e63-4438-991a-4f6342e183a6", "comment": "Malware payload (NetSupport)", "value": "57bc094dcf0f29627cc9fd1f310a93c6eace7c6aad49afa68633a51e6331ee587897d675658156be49c836309304e40a", "object_relation": "sha3-384", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "jakkakaskakasj-com", "colour": "#CD2821", "exportable": true, "hide_tag": false }, { "name": "jasjdpoekkqwda-com", "colour": "#F78A49", "exportable": true, "hide_tag": false }, { "name": "modeactivate-dev", "colour": "#EB9FC8", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795332, "uuid": "70bc6145-84c5-45ce-9826-8a1cc4317ff1", "value": "T10826339A990989DFC94B4F74C10B5E1AD33E3A41F25E7081F6728252CC89B9F4BB871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795332, "uuid": "80a56f74-18cf-4c2f-9507-633290c6d665", "value": "98304:5WquIS1xqutSAs/VYj3b2+30/wBQV86/VYj3b2+30/wBeVo:5YIS1ntSrQy/2eQy/2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772795332, "uuid": "1676b372-44e6-4606-8bea-72b0dd037a47", "value": 4429381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772795332, "uuid": "0d428c79-cedc-4327-a6db-113396b11eec", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795332, "uuid": "3675ed7f-85bc-41db-babd-4fb5ceb58a30", "value": "at3.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c4a78f2-193e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772789024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789024, "uuid": "9b7e0a66-7b31-4252-b02e-8768427b053d", "comment": "Malware payload (Mirai)", "value": "d0480c01dff63a6ea85e431f794497ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789024, "uuid": "01132596-2dee-4b31-97d5-7fd8e325d157", "comment": "Malware payload (Mirai)", "value": "befee8ef3e4e2e3bc4f0a8c19938d46a1c76c6f36093d65b56c0ba1346120901", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789024, "uuid": "f2775c3e-72b3-4363-a13f-b98221030c01", "comment": "Malware payload (Mirai)", "value": "de0bd8d079d1c993d55521387fc63045d0b103ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789024, "uuid": "d2f15364-1d77-4862-b2ce-45f86c2629d7", "comment": "Malware payload (Mirai)", "value": "dc996778774b1f47f0c12d467b5126022f9a039f415c291311930a4f87d7633bbed7913a3253937e036cb05c5913e593", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789024, "uuid": "536cd3b6-5bfb-40d4-b21f-5864a6688b6a", "value": "T15D636BC2AB43C0F4E8261171607BF7726A72E53A0069DF87D729D831ED53A02D66A3DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789024, "uuid": "8e7e0d01-886c-4f2d-85d1-ed1037a97728", "value": "1536:OtlZD4krzJx/JE8x8PLjQs633/xgAMInc7WM0TabX:OnmkrXpxeLX633Jg3QI+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772789024, "uuid": "101d5121-4663-44bf-87bd-79bd9a8f1f41", "value": 71824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772789024, "uuid": "87615470-b247-4a22-b85e-5d8564d6d055", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789024, "uuid": "c946cbd6-64c7-4892-82f9-3af736684918", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "567c3c71-1904-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772764184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764184, "uuid": "eeba0fd0-6173-48b2-a429-4761ab29ae63", "comment": "Malware payload (Mirai)", "value": "4458a8e933bf613b765376bb60da1ed1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764184, "uuid": "8c3ef129-7baa-46e4-8593-a76207ee4451", "comment": "Malware payload (Mirai)", "value": "bf113dd0b032f4abd156a6fc9af4928463b3882e554eb1fea5b4df5885b58213", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764184, "uuid": "2c70a8c8-297e-4a9d-b357-08daf4fc8c11", "comment": "Malware payload (Mirai)", "value": "a5464b306ef414c23e2b2ebabae87112d26c33be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764184, "uuid": "682be3da-d67d-4b01-88ef-16734d719b97", "comment": "Malware payload (Mirai)", "value": "f6eef98c65e4582292a02120536c2620c0e202d65eb97f551a5a54be615a171f0354c71f092924455785ec46a923f28a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772764184, "uuid": "d260b621-b8e3-43ba-8609-c2d507718b31", "value": "T13593E551BC82562BC6E423BAF6BE668D336577E5C2CF722BC8214B117B8551F0D63B80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772764184, "uuid": "c5ebf29f-9547-472c-8c94-58804bcf84d6", "value": "1536:PWrd+dC++zBz/dPXQL0u4WaJuLaVlW04brj9uYpMNGY2LYghb:PO+d8zBWLac0yMNGFlh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772764184, "uuid": "1834beae-3b73-42fc-b621-57e2fce38450", "value": 93804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772764184, "uuid": "8a9196bf-5f8a-43c6-af51-e18bc470aa0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772764184, "uuid": "619f5ba4-5a97-44ba-aba4-fe066aa10e88", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "027d2ede-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1772819019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819019, "uuid": "51da4b7f-04a9-49ce-a9f4-08cf4c6e1e46", "comment": "Malware payload (Gafgyt)", "value": "e18785269062ee21a5f9c386a977ee51", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819019, "uuid": "1ddaee76-ec29-4929-88d0-6d4f139cab3c", "comment": "Malware payload (Gafgyt)", "value": "bf1f9d9f1e07d33303690acfa885a0b772414c2a7c65dae4710aab4f9eaa1a8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819019, "uuid": "1fd2cc27-22b6-4d14-a297-386b31c10867", "comment": "Malware payload (Gafgyt)", "value": "84fea8a1a352c41cabff1bac6663bbdcf0327b08", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819019, "uuid": "ec3afe33-8a70-4465-abda-d36b91936116", "comment": "Malware payload (Gafgyt)", "value": "5888f248e76713f1c30c1a845455c2faca0464f4eac020fff7be6c54c131a07ee4ce8316990e92858302fbe4bed5edd6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819019, "uuid": "a59c0196-4caf-4f72-aca2-6ff768d51ac2", "value": "T11FB36C7AC1303EB2C6A7F071A832657A07D565180B0E0AD24A6EE351528FDCFB15F76E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819019, "uuid": "e33f448e-7447-4cf6-bd46-ee59a2d66336", "value": "3072:DksC3uxCQiijl/uAD5tBWI0Zv4p5huvBCn:QsC3/QTVDDBWFCduvBC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819019, "uuid": "525b3330-b139-4671-a48d-2d6650a6c987", "value": 112588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819019, "uuid": "317c1d21-2778-421d-b7a4-27809f59e816", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819019, "uuid": "e9d9b5e0-270e-4046-8b14-4723a8471eec", "value": "debug.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf3324ed-1984-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772819335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819335, "uuid": "0f0d5369-8e5a-4309-b4cd-d0aed64455d9", "comment": "Malware payload", "value": "4221403ce3b6f394ba72208c44fe2ec9", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819335, "uuid": "31452956-6251-48c7-a9a6-dcccc63297bf", "comment": "Malware payload", "value": "bfe610790d41091c37ae627472f5f8886357e713945ca8a5e2b56cd6c791f989", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819335, "uuid": "5f62e514-af89-4462-ae31-ac2da999b332", "comment": "Malware payload", "value": "ef94e27d91a3bdb07460cfadf294db1d236e3db7", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819335, "uuid": "889e8e4f-0e8f-4c62-a433-5336187ed55c", "comment": "Malware payload", "value": "978771db7ee286e8bb4c57c5e8eff165562f090487711d840248a30d6d7d926d60667b3556d459390a7f2d84860b704d", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819335, "uuid": "a9be1253-81ba-42e2-bf74-604568be3cbe", "value": "T1AA54CF2289A6054CEDEE447877CE0B988EF1BD913B6064333B5B66F4C978512B44F73A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819335, "uuid": "089ee2aa-fd65-48d1-a9f8-7de87cadc86d", "value": "642f4619fb2d93cb205c65c2546516ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819335, "uuid": "8ad81d06-8a55-431b-9181-c002f5e8c0ba", "value": "6144:afUyccXQec1NmsVrLH+6fGVIuAoI7p8/Ugpio1LCBfpc:NcXk11+0q/x6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819335, "uuid": "e810af20-b198-4bda-ab58-bea7fc691992", "value": 290816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819335, "uuid": "94e0c0b8-1b72-4038-be5e-3b31c84af623", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819335, "uuid": "840eced2-d862-4c8c-a4cc-ead114192132", "value": "module1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffd2e23f-1971-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772811283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811283, "uuid": "46c79628-af5e-4297-89e4-3378b03f213b", "comment": "Malware payload (GCleaner)", "value": "8421c712ddb10e8df13624a76ed54a2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811283, "uuid": "cb113109-6fa3-4ce1-9cbe-493c04d634e5", "comment": "Malware payload (GCleaner)", "value": "c01cc0a3fe9e26e5734cc7c8fd9bc668164cefce3ec796ec9b516be37666819c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811283, "uuid": "263ad620-2d4e-42cc-baf6-81e36c078551", "comment": "Malware payload (GCleaner)", "value": "6963feebda916c9e68351784d344d24603ea5dd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811283, "uuid": "467ce65e-c502-427e-a641-702601b91a42", "comment": "Malware payload (GCleaner)", "value": "7eed3bc3174a33649e229b4fdd9dc2cdd17047e06dfbd31d1278a712d06f1166d8224aa4fb5e14b29a075d7fa25cdc7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811283, "uuid": "0a8be5a0-1a76-4b34-9a77-df0560d1a8dd", "value": "T198059E25F6D08733E1336E38DD1B6665583B7E812928584B2AE43DCD8F2938235E63D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811283, "uuid": "40fa8ff1-76f4-42bf-9dd6-16a6f0f6b096", "value": "ce7a1d07b14b49824555865592c3af45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811283, "uuid": "5b2a999e-5991-4da1-820e-e846262cbbe1", "value": "12288:RkAJdZJGY+5K/Lo9r7WTB+rPpQL7ivrIl7i8NZTBtq6mH:zXZJeK0Z0qQXqcNZTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811283, "uuid": "1b901888-40a6-4737-8edb-d5462939799c", "value": 796672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811283, "uuid": "db9ebe0e-22bf-4cd5-9231-5b5e8ff0ef2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811283, "uuid": "534521fb-6dd1-4faf-99b9-43b1d6f7f81e", "value": "c01cc0a3fe9e26e5734cc7c8fd9bc668164cefce3ec796ec9b516be37666819c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79f231f6-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808482, "uuid": "a91b5b03-5ba5-40c4-a8af-bfbfae9b1ae3", "comment": "Malware payload (GCleaner)", "value": "bc8ebf945482854a1099bdbc4f08cdbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808482, "uuid": "24430d1b-b730-45ed-b399-9f39b317f6ad", "comment": "Malware payload (GCleaner)", "value": "c0affa0dfb8c4580023efe118e90f4849eb0b307dc4b152926e0f3f0e14743cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808482, "uuid": "5cf9ebcd-6a30-470a-8a09-640aff22a0fb", "comment": "Malware payload (GCleaner)", "value": "bcfe15e211c01eb540d534f73d3243518d0c1ec0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808482, "uuid": "8a189a45-23ac-45bd-a60b-57c12d472811", "comment": "Malware payload (GCleaner)", "value": "32cf7dd34445c9ec442b595f808b0859b46151247099f72ded1dfb10a9bdfccec1398d00282d8c1bdb97e71f9766701e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808482, "uuid": "bc1d1d8e-9e5e-4a72-a0e2-e517a500c17b", "value": "T13936E0F271694525C2992AB89BE29CBEF731ED03042E537C278EDDC88C542D3A4E56D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808482, "uuid": "9a1c7b77-60f6-405b-9c00-20d71827d87b", "value": "099b2b7fa2a0044e2ca25418be2f8a70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808482, "uuid": "86137edd-648a-4dcd-87c1-f1906a2938c8", "value": "49152:bto5hTkrsdAKZAh40VwvLrhZsNEfQiFSOmJZHUYmC4noUpZblRigxEoswq:btevDu6fQiFYmlbEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808482, "uuid": "20d299c7-d794-46f5-b2f0-ae40d9ee55a0", "value": 5246464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808482, "uuid": "809bbc4e-4d9e-499d-993b-3698f1a0a38b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808482, "uuid": "144a148d-2571-4c76-b670-c5450657a08c", "value": "c0affa0dfb8c4580023efe118e90f4849eb0b307dc4b152926e0f3f0e14743cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45409fac-1969-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772807534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807534, "uuid": "9781c1df-25d7-4977-8b20-80a07906bcc7", "comment": "Malware payload (GCleaner)", "value": "1ef9d614eba5ffa010dd9b423dd33e96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807534, "uuid": "45e7a0a4-eba4-4b6a-ad60-5c17f55ee7b3", "comment": "Malware payload (GCleaner)", "value": "c0b274dc6de6c9f1d0ada3d2ac009e672a821c8d7e5a03100349bcc7f73f6c5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807534, "uuid": "b415069a-7ce6-4486-a157-3fa294078f9c", "comment": "Malware payload (GCleaner)", "value": "6c3732b6c8c1ef480b727f8a9696461ef12547a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807534, "uuid": "7b5ac685-dafe-4475-ae2b-7967d9c59c81", "comment": "Malware payload (GCleaner)", "value": "aa6bdcebc62b1dee95c50062a037f860b7105429d78118ee1c1cc1d91f67fa7bc8bae5130ba6e5c7a136f0ee810a76fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807534, "uuid": "08f4a394-c811-4738-b9dc-ca0a2c6259ab", "value": "T1F006E06FEE718FABCCA345316926231DC5E079C6ADE259479B8C2DDD08E70806CF1792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807534, "uuid": "ed7caced-37c1-44de-94fd-9445c4899644", "value": "66d4174db3b382b1ff6e32a72864c0fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807534, "uuid": "bcb23ad7-3ab9-470e-a5bb-71f59b58e069", "value": "98304:35ruw+klLlPNpU4JshSzyuwOf09Ax9J0AD:3DlLlPNNJshREuA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807534, "uuid": "fd08cb07-70d1-42fb-837d-d8f338bdb4c7", "value": 3975680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807534, "uuid": "b5f3696c-214f-4309-af5c-25e4e122c5f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807534, "uuid": "edadbcb0-6167-49bb-bd57-5b076b6d8636", "value": "c0b274dc6de6c9f1d0ada3d2ac009e672a821c8d7e5a03100349bcc7f73f6c5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7da25d3c-1905-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772764679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764679, "uuid": "866228f6-87d5-4bba-ae12-41b4898a5480", "comment": "Malware payload (Mirai)", "value": "db6ff3b76df4fa32888c46de985d6fb4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764679, "uuid": "047b48a0-f8fc-49c9-9480-4318ff0fde4e", "comment": "Malware payload (Mirai)", "value": "c0e572bb278fb7f035665a52ef03ddee2d482b6b29573fad1697c8b66355b7c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764679, "uuid": "f7a0abb3-dddc-4b98-ac95-277c4f2a5c57", "comment": "Malware payload (Mirai)", "value": "dd5b8f7e4c71a8b93c034bf107c2a6aba3b0cbd8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764679, "uuid": "5af7731a-5177-4c3a-a77c-e86074a683cc", "comment": "Malware payload (Mirai)", "value": "4263ae2d79c295f7463f49c102f0c33fbb2d186863cfc8545a67a5c6e1f91978a33ae7e9dc85c99375bf2871b39c19cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772764679, "uuid": "ae3e7065-ebed-4c16-b3ea-d2dfef9e899d", "value": "T17804D719AB550FFBDCABDE3706E9070539CC641B22A43B363674D528F54E50B4AE3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772764679, "uuid": "8e28cdfc-2851-46aa-b906-fd04c6be97cf", "value": "1536:c/jMt1mhsHcfnDq1etVfR0TKVzZ1paTEjuqvUNIx6Z8GhMna4lxVs8dpThT1Wtsq:wjMtTHW+0tVV6qvd6rUxVVpAKdw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772764679, "uuid": "643db496-f026-498e-8c2f-b0eda978b93a", "value": 181852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772764679, "uuid": "da40777b-e731-40c1-8e47-1247c2503beb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772764679, "uuid": "3ffd3e97-662f-464d-9927-ca473997a931", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4c74102-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811131, "uuid": "f74c9000-5f26-49da-a822-0d423127f088", "comment": "Malware payload", "value": "2b5ab30a1fd9b1c5957bfb3f3b3a850b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811131, "uuid": "a0a0c556-1c22-4190-8b16-627b6211b766", "comment": "Malware payload", "value": "c108cdb426e95056c6af3e0a4035013f901ff13fafde07bd931acba0a990d185", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811131, "uuid": "2bdf739e-0d33-47b4-98fd-a987bc32cd50", "comment": "Malware payload", "value": "9ca1014298a8267059eed118961e165570fdb5ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811131, "uuid": "7218158d-5aa8-49cc-a879-bbd858714509", "comment": "Malware payload", "value": "33463815c5798fcb50e720c8a7d47ca4bc6a54de6800fb7f53ce0d412b4f5feb83992a089e625ebd7468817415d8f4f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811131, "uuid": "41d8062b-c6dd-429f-bab5-962b866e4891", "value": "T1E3D4E867AE958F45F3E02E3543DF691C039694B25BB26B0B2F20237B9C411E7ED99384", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811131, "uuid": "756ba6e5-a148-45ff-84d3-0dfe7bc9fcb8", "value": "12288:P2aGYDPziyZ5QpxfxbulDXh8wNVtxwQRcDxnx9:PXGYDPzLiNxbuT8wNVtaQCDp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811131, "uuid": "6e0aa878-702b-4b45-9985-82a50a428816", "value": 625152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811131, "uuid": "f91c43c2-1f1e-47a8-95ab-140211688f8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811131, "uuid": "832eb7aa-4861-4f3c-8ba9-f3908b04068c", "value": "c108cdb426e95056c6af3e0a4035013f901ff13fafde07bd931acba0a990d185", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3a96b25-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772809035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809035, "uuid": "6132f5e0-b65c-4d59-8401-608ab4d600fb", "comment": "Malware payload (Formbook)", "value": "fe723c44a9170bb519f6ea604cf8d0d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809035, "uuid": "d0e39149-6e5e-4986-8aa4-c62ffd0bde13", "comment": "Malware payload (Formbook)", "value": "c19d93b3f0b05d5e2931214903b3bf350e860ad5d7e750c3d7671ac726633534", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809035, "uuid": "02607a79-e759-4931-bd4d-ecc3367b79b2", "comment": "Malware payload (Formbook)", "value": "11d408476b4d7293ef1a901fa2023900900a69fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809035, "uuid": "67df26f2-f46e-4862-b148-78a1f7f4dc03", "comment": "Malware payload (Formbook)", "value": "45a5c8905920e47a08a9e8ce0848ae84ff3e25822c2cc97ea0af6fe55a8f3e6a4790174bf9edcc46e015485506afe35b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809035, "uuid": "7d301a5a-f7c8-450e-a30e-c2d65d3f1a12", "value": "T14345BF027381C066FFAB92334F5AF6115ABC79260123A62F13981DB9FD705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809035, "uuid": "1537d350-2ac9-4777-bcc5-c461a34725ea", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809035, "uuid": "7db51681-6745-4de4-8343-dad4ae4020ec", "value": "24576:D5EmXFtKaL4/oFe5T9yyXYfP1ijXdaf6/wyMTH5p21qs:DPVt/LZeJbInQRafzTG1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809035, "uuid": "041db8ef-8c3d-4165-ac51-7810b4a97933", "value": 1246208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809035, "uuid": "61f3b1af-f42f-4b85-bbb7-55d5f59f7a12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809035, "uuid": "5182b083-553b-40bf-97d0-203bade0f913", "value": "c19d93b3f0b05d5e2931214903b3bf350e860ad5d7e750c3d7671ac726633534", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64600172-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1772811452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811452, "uuid": "b64c3cdd-a33a-423b-be61-c595f99b2bb4", "comment": "Malware payload (SnakeKeylogger)", "value": "e5622701551cebb67d26dfa3bf57708b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811452, "uuid": "beb9ed9f-5dc2-4e96-953c-fdd0cd69c76c", "comment": "Malware payload (SnakeKeylogger)", "value": "c212afcf4ae31723c9e917c8a1f88d9d39aabd4c7e7c5fefc97a82ccc71e63c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811452, "uuid": "97429cb3-f725-4123-95e7-b3f993111a7f", "comment": "Malware payload (SnakeKeylogger)", "value": "14e1707b38cc877e45883a053da874baca240e24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811452, "uuid": "30041117-e597-4dff-8f6f-cd4b23907f15", "comment": "Malware payload (SnakeKeylogger)", "value": "43c82f80cfb02bb1a077b07d019f6c5545f627e64c661ff474c2081e36b36a1f7ac4a50139aa879ce48bc9c13940f8ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811452, "uuid": "bd535788-e8d7-4c03-9bd8-827eea68cb13", "value": "T14025016C6245D503C6AA137A2D31F2BC17BE5DDAB411E3278FE86EE7BD627161804383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811452, "uuid": "83cc8752-65c1-4b4e-b632-934113a44146", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811452, "uuid": "e12ba804-3898-4583-9b30-fad92f81765f", "value": "24576:UQOTKVNhst0/aArp5XGvV5ZlhNF4G7Y4VLeI5aO:UZ4NhjnTAOG7YyLvU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811452, "uuid": "dbe7fe96-732d-43e2-a92d-11678b663572", "value": 1034752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811452, "uuid": "0b91673d-54b0-42b8-9b88-ae6846d50c9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811452, "uuid": "249bdb59-5fa8-4d90-8c1e-b6629314feb8", "value": "c212afcf4ae31723c9e917c8a1f88d9d39aabd4c7e7c5fefc97a82ccc71e63c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f9ef965-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1772808438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808438, "uuid": "9702dd28-b1a9-4815-9f9d-597f9d1065cc", "comment": "Malware payload (a310Logger)", "value": "472a915ec9e48efc34e795d48fb4ec9f", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808438, "uuid": "374da7a8-bbf4-4289-b53d-3fc07de13707", "comment": "Malware payload (a310Logger)", "value": "c22f089d9dbd076f959cce2510a44126ab72ea4279d50297fb7784163cb7d2b4", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808438, "uuid": "e8ced3b6-41e7-4fb1-8dc9-dd7c0b6ec9df", "comment": "Malware payload (a310Logger)", "value": "cac1e3cada9c7d5743ee4fcf075b049d374040d4", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808438, "uuid": "fd01810a-9f32-42b1-a686-8427cd649a1c", "comment": "Malware payload (a310Logger)", "value": "27bd48160fac82fd2406a305fe9c3d1f5b7782200ca5ddff6ca7aa74daf79663dffd01574fe57925387a8104326357f5", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808438, "uuid": "4ce50c84-8971-47a3-be00-2a9ae6980144", "value": "T1D0845A23EA60A12EF1A3C9F1B9A5A25728263D395688EC57F3415F5834711E3ACF131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808438, "uuid": "ffce61f3-3e41-4728-b35c-48ef95fab554", "value": "252c027bda7298291893ceb108f11214", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808438, "uuid": "1426cf02-025a-4920-9cc8-24e9437ea1a4", "value": "6144:Y8d1/w5KA81IJ8GpF6nuTmOOUWTy85NE4EnvFEsvyF6GCyHxxBT7k:bjYKkJj6GmZUWJCv0nCyHxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808438, "uuid": "fb9ec8a0-82d5-4388-9d5c-d25b192a9eeb", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808438, "uuid": "d6578178-275a-4b45-a71a-8dcfd67b816c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808438, "uuid": "2900b4ae-94ba-4b05-adff-aec1cf46d9a0", "value": "c22f089d9dbd076f959cce2510a44126ab72ea4279d50297fb7784163cb7d2b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa5ec05d-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808697, "uuid": "57d0c279-99ff-44c6-8abf-35b36bd2e1ea", "comment": "Malware payload (GCleaner)", "value": "e50508a545872898c41a4293fbadd0db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808697, "uuid": "4ffa872a-4e5f-423b-b44a-4eef3b6899eb", "comment": "Malware payload (GCleaner)", "value": "c267a4759effe8a53e7c96ec9e5bd54df62fc29e6f0094e81b32e971d3b03088", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808697, "uuid": "6a33fc1d-2f36-4b03-9ecd-57300b92115a", "comment": "Malware payload (GCleaner)", "value": "0fe9d0948d80986c3f70db33787e0dcd3773601a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808697, "uuid": "f6637102-db0a-441f-9c8f-a60615f14fb1", "comment": "Malware payload (GCleaner)", "value": "e68bf78f6e367ef3a85e2cf6344668716012627b915b9a41147c555fbc0fac5366e287574394a631e6593b5d97e19057", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808697, "uuid": "985b1c8c-b693-48b8-85be-e89382dda585", "value": "T18206CE81555F80E3D4233738BB3AD627D91ABED728A16BEC0BDD09184B287029857F77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808697, "uuid": "02276c30-26db-4021-89cd-341dea12a543", "value": "099b2b7fa2a0044e2ca25418be2f8a70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808697, "uuid": "fda18a8c-8330-46f1-bad4-4683582666a2", "value": "98304:Ute9CsbR7tiJK3uT9LxkJvIdKii4SKXAIjF:UY0JK3upN2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808697, "uuid": "8ef9b2a8-cee4-44a2-a580-85a7b8d4680e", "value": 3950592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808697, "uuid": "d020d880-3a9e-44d9-a223-4cbd1e80a7aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808697, "uuid": "dbf990de-0757-430e-9d43-c667d7c33e04", "value": "c267a4759effe8a53e7c96ec9e5bd54df62fc29e6f0094e81b32e971d3b03088", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6814365b-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819189, "uuid": "435944b6-a9f9-40e2-9617-523313757912", "comment": "Malware payload (Mirai)", "value": "fe4f41b2535f167a3498882a1b474697", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819189, "uuid": "59d9d863-f19d-4380-8313-bd6dfed05bd1", "comment": "Malware payload (Mirai)", "value": "c27f2570516a37e683cd7d3485b70ba6ce12edab6719f8a3678ac261056691ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819189, "uuid": "a1043bb2-b4e5-4484-9417-8168aa69505c", "comment": "Malware payload (Mirai)", "value": "c5af54a157a2bd48050a2edb9b26b0cc2168b80f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819189, "uuid": "5906a114-cad8-4dee-b4bd-e95fd43c5587", "comment": "Malware payload (Mirai)", "value": "1fb3b1c346ca93745771455d5a53037a4dd26e3306d59b8b76f796c102b6f40d4393238fd9a6bf79cabeece965bbe37c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819189, "uuid": "727087fe-ba0b-40ad-9453-175c8a1db280", "value": "T1ADE32781B9829A27C6D523BAFA6E018D332623E4D2DF7217DC215F2177C681F0D77A85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819189, "uuid": "d1724e35-c1d4-48a3-9869-4c3865c2f827", "value": "3072:kTg0fK0GYILZ95+eYzHOs95ms6jQQvHe:kTg0fIYI75YaUD6sqHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819189, "uuid": "ec055001-94ad-4618-bbd2-5dd156f349dc", "value": 144896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819189, "uuid": "603d5142-1ba2-450b-b295-4e5f9ff32623", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819189, "uuid": "66771b16-401f-4eac-b289-f8a5d67b90d4", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9de3070-1985-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819756, "uuid": "29d36470-3dc1-4742-acaa-6eb3544ebaf7", "comment": "Malware payload (Mirai)", "value": "495f856c62b2e02c6744c64af07c48c4", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819756, "uuid": "df635b36-3cea-4a6a-bb3e-e832b48968b3", "comment": "Malware payload (Mirai)", "value": "c2964cad2a88c3a03277756d0c3905b3689b6980850975e2ecfd6862cb3bef3e", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819756, "uuid": "c592d44a-edd5-407f-9613-a4fb6a2aa1d3", "comment": "Malware payload (Mirai)", "value": "3a3746032017f602aa602fd2edd2aac903f8b57f", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819756, "uuid": "167236d1-4f4b-4ba8-be64-79b720c7885c", "comment": "Malware payload (Mirai)", "value": "46ebc5f373c08feba10ee32a42629b22dc61fcc580cec522944895f4bc36dd71202289a6276eb1de934f4279c9a8a4b2", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819756, "uuid": "c62443bd-c5be-4773-81ac-c0aa8cab33ed", "value": "T1F3A64C05EC852BFAC46C4E7444EAC95552709D104BF29A3A66A4FBEDBC772387F0788C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819756, "uuid": "24467b5d-1ea8-49f2-ae64-c3595d6cdbbb", "value": "98304:+OKOuo2QnYPc6juE2CNXaR7MpG/Xa+zSrFvY:xKCh6jL2CUf7z2JY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819756, "uuid": "75ce39cd-8984-4720-8063-c2b9f2c89fa1", "value": 10183193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819756, "uuid": "121bbf6e-5333-4d93-b3d4-6672bcfe8f42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819756, "uuid": "1852132a-c285-44dc-97ad-09d730d86af9", "value": "bot_mipsle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2502f4d0-196a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807910, "uuid": "a925b5c5-9898-43cf-9517-722b9790daed", "comment": "Malware payload", "value": "7219ecb0f2314fd0a645a0db8e4cd671", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807910, "uuid": "33cec853-aba7-4731-9b2e-55505f399d0f", "comment": "Malware payload", "value": "c2ad94bcec514687c25dfd08030502812814407ea841a297715cf9bf0b2b5825", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807910, "uuid": "035a0443-54c4-4509-b9d6-65cb5efe1d77", "comment": "Malware payload", "value": "8ec42c17dda20eda67d92fce2fa0475c0518b225", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807910, "uuid": "1856f1e4-a555-4971-be95-77880fce57f8", "comment": "Malware payload", "value": "98861ab650c4735aeb0bf0bbe81c657c853f3921eb044f105aa6b054c1f27b41c3f747e98ea15a806854aab55191b168", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807910, "uuid": "1b1ec4b2-141b-46bf-865c-f898db99db82", "value": "T15245BF0273C1D062FFAB92734B56F6115BBC79260123A62F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807910, "uuid": "84e09fe5-ec9f-4f04-9f3e-115360d029c6", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807910, "uuid": "01d96d75-1335-4126-94da-3f79270a0b5f", "value": "24576:A5EmXFtKaL4/oFe5T9yyXYfP1ijXdaA9JWo6lJgatGd/K:APVt/LZeJbInQRaA9c3+d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807910, "uuid": "0de5cc8f-22e4-45fa-8748-5d98eff9ee41", "value": 1183744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807910, "uuid": "83cc3401-142c-407c-9b69-4c89aac40440", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807910, "uuid": "3691c1aa-253e-4ecd-b2db-efffab159379", "value": "c2ad94bcec514687c25dfd08030502812814407ea841a297715cf9bf0b2b5825", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0e7dbb6-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772811688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811688, "uuid": "bada90a0-e038-494a-bd3e-b151092daa57", "comment": "Malware payload (AgentTesla)", "value": "de444e8fdccdeb2301c14f58dbd64afc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811688, "uuid": "63ad12ee-f34e-4686-ae77-4e8e1db903ae", "comment": "Malware payload (AgentTesla)", "value": "c2aedc4f08d6f58bee4d4b9ae0f24221ec0493978896175045f22029e71a5b1d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811688, "uuid": "91f92f94-7f51-42f9-a1e0-bd23f23d4a85", "comment": "Malware payload (AgentTesla)", "value": "25f47746cfa8e42e3e4368fd52649967ed56e0c9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811688, "uuid": "11fc8354-bcbd-4108-816b-f82fd9c3e475", "comment": "Malware payload (AgentTesla)", "value": "7452c91735d3caa98f97f1a58a51a714c82ac0ba6b3854ea2b222842380c1357cf1949c5c724effdc36f43ccb4017a89", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811688, "uuid": "ebde1d98-4dac-464e-851e-29a0ddaf8794", "value": "T1D545BF0273C1C062FFAB91734B5AF6115BBC79660123E62F13981DBAB9701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811688, "uuid": "967832cb-72ad-4483-b760-86522a4b70ac", "value": "c1ce208b1192bfcf652c179f34f034d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811688, "uuid": "117ae6d0-9036-407e-ac8b-fc63fb3a070f", "value": "24576:I5EmXFtKaL4/oFe5T9yyXYfP1MAXDzOh3n0a+KDp9uO:IPVt/LZeJbInGizOhnpHD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811688, "uuid": "f2e322a6-172e-4169-baeb-77806932eb06", "value": 1223680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811688, "uuid": "f8984d61-246a-423a-9330-c12ede58a335", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811688, "uuid": "ae2e237f-4966-4d77-bafe-fc870518ae06", "value": "c44e5dfb7303a832d42e4824696a91ebe9f46aa2dcc0b515fcec75001ce00eef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b4b3672-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772809182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809182, "uuid": "a3a29282-d4aa-45ed-ac9a-5850900e8777", "comment": "Malware payload (GCleaner)", "value": "9fd8ffd1dcbb9b6a9f4c9ad160a8f013", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809182, "uuid": "179dcc9f-27ce-49b1-8ea2-146ae0b4b0a9", "comment": "Malware payload (GCleaner)", "value": "c2c78cc74dc06a094819feb6d92927c48bcd91addb8f4f37a42cbd7120ebde0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809182, "uuid": "da04db88-6767-49cc-aab1-65138577625b", "comment": "Malware payload (GCleaner)", "value": "8f2e8664353320090f76d69849ab1d458274ec16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809182, "uuid": "53b9bb9a-3265-4397-a2ae-aff3ffb5470a", "comment": "Malware payload (GCleaner)", "value": "34f5c070286f13820dc3e790a770a9c3e62e19a1005fc034e9f52a23877362f1e92bf0591be5c2bdc423151a8a833819", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809182, "uuid": "416aeca2-f1af-41f7-b9a1-28cb87319126", "value": "T14C06E043D1725E3AE5532871862292DB4371FBC9382FA8DE1ADD6EC04A562C0DF1B3D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809182, "uuid": "9ad49ade-f5f4-42fd-b27d-682524753804", "value": "234372fce9eaa047bc4c39047910954c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809182, "uuid": "2387d019-895a-4b9e-bb70-b97be581ea57", "value": "98304:cBJMp8JVgXZnWv7K4aZYByTnKT7+WoxjJ3clsEjn5:cBJqJWvPa8yTnAK5J3csEj5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809182, "uuid": "d3e71dae-7e5d-4430-b44c-74326128c5d0", "value": 3911680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809182, "uuid": "9188d5e0-07ec-4529-8d14-e76e82031bd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809182, "uuid": "c448f267-ac15-420b-b981-02a3af2c2d47", "value": "c2c78cc74dc06a094819feb6d92927c48bcd91addb8f4f37a42cbd7120ebde0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d156f60-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1772809776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809776, "uuid": "ddddb1ff-f92e-4698-92d1-62e87b9b0150", "comment": "Malware payload (DarkTortilla)", "value": "bf3319a1ec6a8952453d2eebd828c37d", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809776, "uuid": "df388d29-54e1-4ac7-9c4e-4aaca0317fb6", "comment": "Malware payload (DarkTortilla)", "value": "c2f557d0ec74807286105a5a4a0303d68638aaab4642aba9f035231742a0f38e", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809776, "uuid": "45c67885-faad-40cf-96ee-91b80bfd41d7", "comment": "Malware payload (DarkTortilla)", "value": "5981ba8104e55378807a0887f848d1b8ec7ca027", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809776, "uuid": "0bd3fd6d-0b41-4be5-9c46-16285d4370ea", "comment": "Malware payload (DarkTortilla)", "value": "99658ab0f1803feec0b05ee5518dac00b0a0b3cf8f062832ca0d1f48e6fe57eb4d124e3941b8dd287f7b6543360d9a80", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809776, "uuid": "2385342c-2823-4ac5-936f-6ea9f0b3239c", "value": "T18645D02A2DD31B40C1A2DB79C3760D9463F0C6A75613D71BBFDD02F4EE1A3BA9522252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809776, "uuid": "332bc19c-5e76-44db-8e50-ea0273ce9abe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809776, "uuid": "2e6c6a13-5263-44c6-aa12-170695453cfa", "value": "24576:GRXIzQP4lTp3YHdCvVGEtpojZ6tm48YB1KObv:GRyQPYp3MdCvM0Oj94pP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809776, "uuid": "26e4e9f4-49f8-4976-8369-55cf455cf8e0", "value": 1270272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809776, "uuid": "d0aca0ed-74d1-4acf-8515-237e0c4675bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809776, "uuid": "5adbc986-64a8-42e0-889f-17231ba2acb3", "value": "c2f557d0ec74807286105a5a4a0303d68638aaab4642aba9f035231742a0f38e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e6099b3-192c-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1772781404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781404, "uuid": "fd8e5f38-e678-403e-9f63-4bec1f8dbcd7", "comment": "Malware payload (XWorm)", "value": "caf1198f8ef5cbf0b01d56f82421e33b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781404, "uuid": "1bd90e87-0023-480d-9802-73ba00cb6842", "comment": "Malware payload (XWorm)", "value": "c317ccd99409d270cd2a1a95846823f8f75814b1afdf340d7504d586065131dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781404, "uuid": "9ad79a90-e7ab-43cb-b0e3-cc121f1733a8", "comment": "Malware payload (XWorm)", "value": "56cf8f9380bd9a477f344ff901caa6d08132a090", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781404, "uuid": "67d6f1f5-0667-4d62-95ef-e8baba7f1ead", "comment": "Malware payload (XWorm)", "value": "ec6692f3dd945d13ffa2405088db9a5fb17dc8a608e7306fdb82cf57a8382f75844a0f85ba1e35252b78dcb2aea47d86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772781404, "uuid": "142c2102-eba4-4a13-832d-7ada23f5b23c", "value": "T17585CF0573F442EDFEABE1768A13C507C7B178450637865F06A0AA766F33B716A2E321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772781404, "uuid": "15259ee0-581d-454c-98d8-a6ee5c366c9f", "value": "638af1c562ad8f76992023c9692ec222", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772781404, "uuid": "2cf2cc86-d689-47e3-ad19-7d8669c43aa5", "value": "24576:QCZGvW0tK4jReYSTQ+zYAGRw5bUkGDjkNrziAas1cNUtwLID0Lpu8XcWJ8Y9ivdX:L1H4jR2TYrQbDTrzKO4FcmZMlp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772781404, "uuid": "22791666-440f-4bba-a667-7b8f00fa401a", "value": 1872896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772781404, "uuid": "55fad75e-7d6e-4c48-a7bf-42934f8473eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772781404, "uuid": "fb7d8f99-6693-4e45-91bc-c4cc6710a688", "value": "IT92501227 DOCOPY - \u63d0\u55ae\u6838\u5c0d TPESE6030054 \u66f4\u6539\u7d50\u95dc\u65e5 =\u88dd\u8239\u901a\u77e5 SO3934.PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bb08ec0-196d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809290, "uuid": "fcd2a860-25ba-41e3-9e5e-dd4482668e27", "comment": "Malware payload", "value": "2a23362def44e0b0a29adf310351bde1", "object_relation": "md5", "Tag": [ { "name": "bot8257734127", "colour": "#A03FE8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809290, "uuid": "36427fd5-051e-48a8-832d-1d09cb8cf6ed", "comment": "Malware payload", "value": "c34631c58915e547e7cc7c0cb2675d04d42864648e211892b054e76d136ba473", "object_relation": "sha256", "Tag": [ { "name": "bot8257734127", "colour": "#A03FE8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809290, "uuid": "ad68d3c1-9d39-4e48-bfd3-b46b6797e2a7", "comment": "Malware payload", "value": "fde6513bdc1216c71420d144ffa83b1169e72c2d", "object_relation": "sha1", "Tag": [ { "name": "bot8257734127", "colour": "#A03FE8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809290, "uuid": "5719fa9e-3cc6-410e-8006-12857b976056", "comment": "Malware payload", "value": "ea7c97598e02e3588b51d14ebd7c2c9837e03ae5d7450d42b544f7e908f4f0297284da0d40ad5eeeea45723e50449d99", "object_relation": "sha3-384", "Tag": [ { "name": "bot8257734127", "colour": "#A03FE8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809290, "uuid": "094dfa42-1ef1-4332-9d07-44e2c3be3638", "value": "T1C1C4AE19E7E404FDE0B7E578CD824912E776BC495771E6CF03A4A9A61F232908E3DB12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809290, "uuid": "6c9e4ec9-2ede-432c-8d30-1d3c42787f8b", "value": "2057790ae7855765d51bdc4142e62f9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809290, "uuid": "8ae615ae-1640-41a2-b94c-158c704df66b", "value": "12288:LRZeGAfqNGA3Uq29XIDixjpyq0BErpjqQARvvH:LRSfrAEH9XIYpj0BErpjAvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809290, "uuid": "2ff43337-f16f-4541-854d-e437a350cbc1", "value": 584133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809290, "uuid": "6ad825c1-7c3c-4e74-9c12-03061c855635", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809290, "uuid": "b2b1abce-d681-48ee-ba7b-34757bde19ae", "value": "c34631c58915e547e7cc7c0cb2675d04d42864648e211892b054e76d136ba473", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c0072fa-1971-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772811062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811062, "uuid": "4862ab20-613a-44fa-87a4-f5aa3b8548f6", "comment": "Malware payload (Smoke Loader)", "value": "3310425a84722a8f9e2259feee92fd9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811062, "uuid": "78b4494a-0351-4dce-b9f6-1e9468e8cf96", "comment": "Malware payload (Smoke Loader)", "value": "c3ac4db0e6124466d04014505114b7b16813b0750c619f23b484ad65b1350484", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811062, "uuid": "963ef82a-5ca3-44ef-8dc8-2c7f5bae330e", "comment": "Malware payload (Smoke Loader)", "value": "413d861445b98c0f6ebcef3098c87d9e94aa4039", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811062, "uuid": "311dcf3f-199b-4830-a9a4-ab0d5526ef28", "comment": "Malware payload (Smoke Loader)", "value": "f40e76f674e77eb264bbea295ba4b85ee0278966a46f712f93952435ea9a338dec1b2bd901940dd543dd2e9333ea51c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811062, "uuid": "b711daef-3ecd-4690-ba80-d0d8a5731de6", "value": "T1DDA5390A6D8748E1D06A9239B9B251BE7F30BC3D0B3263C71B8076782E726D75D75728", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811062, "uuid": "d15e9c0d-36e3-4851-af9b-a1ea731036ea", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811062, "uuid": "81645b4e-6778-4302-b99d-0fbdfd4e69d7", "value": "24576:lr0ATXqsNYaF4PpHCdkeo65m9fOoAXtwx9AvRWMQYyiauPgSqvOWtP4XKe/Imskd:lr0ALqsNYaF48dkep5m9fzvOgeQ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811062, "uuid": "44693d1d-38d5-4a3e-a331-fa7163da3cdf", "value": 2138624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811062, "uuid": "79e4b7a6-e940-4c39-8d54-b912df2a1d91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811062, "uuid": "a293bd5d-5e11-43f0-a4b6-d152598d01e2", "value": "c3ac4db0e6124466d04014505114b7b16813b0750c619f23b484ad65b1350484", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a22efeca-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810267, "uuid": "9faf727d-9b43-4bff-b8f0-003d32085be4", "comment": "Malware payload (GCleaner)", "value": "a2e27ff7a2a485cede0c7b61b2b7d88d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810267, "uuid": "2a17abd1-749c-477d-8d91-2e42cd92b613", "comment": "Malware payload (GCleaner)", "value": "c3be80af28d7a99f20c18f2e1e9877b445df6f653b5c94c23965735d33198d0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810267, "uuid": "0f3e1834-da13-40ee-9eea-2984cc9f39a2", "comment": "Malware payload (GCleaner)", "value": "584d34b541dda5b17ca7de24215ccf993bb69a46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810267, "uuid": "2c8585d7-71a5-4c9e-a96c-8590513c5fa8", "comment": "Malware payload (GCleaner)", "value": "feb193d9d5435268f2b098e26c16eddb2a63dc52f68ee01c1b17d0431898486571b84b9e57db81bc8b284c5c44e1ce2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810267, "uuid": "08437828-ed9f-4472-bcea-74392ade46e3", "value": "T13245AF22F1D2C433C17296399CB767AC5C29BE112E38984A6BED1DCC5E39E4174352AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810267, "uuid": "ec501baf-d828-4050-9da5-db84eb3944cd", "value": "0eefadf8e9087d6d95cc4aedf30a5018", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810267, "uuid": "1e8c8770-2acd-423c-8860-4d62099ff5a5", "value": "12288:mVLMD7V2wGymFSmu4eDCQi0628ZhcPaGfEdERlSdpgdICREi9L/322f8GeAcMQNy:mVwXV4HSmYq7MPPfEd+epgZHww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810267, "uuid": "c6519da8-4a39-4d2b-a90e-7938cf672d8f", "value": 1238016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810267, "uuid": "71380029-b5d6-4d56-8f1a-e2c9419a0dd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810267, "uuid": "4a230bd7-4c84-4beb-9e1d-ab100fcd44c9", "value": "c3be80af28d7a99f20c18f2e1e9877b445df6f653b5c94c23965735d33198d0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd1447a7-192d-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772781993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781993, "uuid": "0d980dd1-b36d-4f61-a9f3-1c30123d9f2f", "comment": "Malware payload (AsyncRAT)", "value": "6fe9b18c7eb943dfe044ccf7189720ce", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781993, "uuid": "44d8f8c4-7e5c-4eb6-973d-a7e8d3631873", "comment": "Malware payload (AsyncRAT)", "value": "c415c892b1974f6b2307ed640521d5a693590f6a83cb7ddea823ffde77eda076", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781993, "uuid": "c5e53877-abed-438b-9e6b-d06c148dff1d", "comment": "Malware payload (AsyncRAT)", "value": "eac07b9e883d16f76f160dd1061499b32a805076", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781993, "uuid": "2659c6f2-2090-4172-8318-6b7c9873cff7", "comment": "Malware payload (AsyncRAT)", "value": "50c97dea63aa060e589a9d28ddb093059de075a874c32753d196717d72c059f8ff0d3aefc02b6dc6c7a385d20291ecc4", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772781993, "uuid": "67e0a73c-e282-4892-83d3-bcdd6ab4002f", "value": "T16AF24A0573E59665E1FD0BBD5C3686044372FA474D22D7AE2EC450AE2A237C8CF24BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772781993, "uuid": "88868045-1320-405a-a34f-32f6ac9f9454", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772781993, "uuid": "b388fe47-12c6-47dc-9091-dcc8fc769bfc", "value": "384:eMTZPkBc13ohM9oehElE1bdcWOebX093bayseHQxnC7O+WmlIuufGfrfC/5WWbEN:eiZPGc5ohM9BhT1hV4RbJwB+WWoQQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772781993, "uuid": "e73b5bea-50c8-41e5-9e68-ee6c228b6796", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772781993, "uuid": "a9c5488f-4b67-4bda-82d5-f2ab9fbec4b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772781993, "uuid": "a62eec66-e778-4abd-86e4-8c96715979bf", "value": "MalwareRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4c44a48-194d-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1772795722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795722, "uuid": "59066f61-b578-4404-b09b-0c1a4c3c295a", "comment": "Malware payload (CoinMiner)", "value": "fb2bfda2f18ffbc4c9cf4ed284ccc7e5", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-smokeloader", "colour": "#3EC35B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795722, "uuid": "db29f540-2d72-4b9a-b534-ba2d1aaa15dc", "comment": "Malware payload (CoinMiner)", "value": "c43c7367aab0e39d7b0ff160002af85ac1b214508ea6f3390e2a4a2933ac03b2", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-smokeloader", "colour": "#3EC35B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795722, "uuid": "c471abca-4b91-4d01-bf9a-1473ac671a61", "comment": "Malware payload (CoinMiner)", "value": "fddff0e6cda7e6debe859a9a78e9402603466650", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-smokeloader", "colour": "#3EC35B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795722, "uuid": "a336041d-4625-4fca-90cb-0ac3166f7f12", "comment": "Malware payload (CoinMiner)", "value": "6a1ba67ed45c1ccec1b348fdce21639370f5b61ebac8b7b5c17cbdede97153fa918ce338802f7ee0b8a9be284b07b9c5", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-smokeloader", "colour": "#3EC35B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795722, "uuid": "4e3935a4-d5e8-4234-ac4c-f9c67d41f8e5", "value": "T1B33633507FE5D0B4E1C11975ACA26FB404A2EF201360DAD38F157666AD333E4A372AED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795722, "uuid": "a57aa4ae-8ec4-4757-8006-df2bc39e6c4e", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795722, "uuid": "070285de-569d-45d6-abaa-5a251ba04f1e", "value": "98304:Cl558QZyNUAqxTLz0aipaI7MxGtPYtHW5Qktow5KXDTkkgnBN13aFliUw:ClP8QOUAmT0a87MjHW5JocKzTHwBNxH5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772795722, "uuid": "24dbf37e-2e2a-43f1-9c09-da6e767aec8e", "value": 4902232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772795722, "uuid": "b818d81d-50ab-4fce-9558-8ca8826dc245", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795722, "uuid": "f189542a-99df-486c-94fc-3889ddd12013", "value": "Intel_Display_driver_v1.2.14.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58fdfd02-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772811433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811433, "uuid": "0f1568fa-d3e6-4515-833f-76c407f7aeb2", "comment": "Malware payload (AgentTesla)", "value": "bc53e52d5b6bbe91d0baa1a1f2be7592", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811433, "uuid": "af2c800a-e839-4b95-953d-bff07a2a73e0", "comment": "Malware payload (AgentTesla)", "value": "c44e5dfb7303a832d42e4824696a91ebe9f46aa2dcc0b515fcec75001ce00eef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811433, "uuid": "fbf54dd2-b515-41cb-a90b-75e79cc00be1", "comment": "Malware payload (AgentTesla)", "value": "b0905e33b3803350e1f6e30fb50efdb589d0885f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811433, "uuid": "6bebf49c-6623-4ec3-9b70-fba396d3d8fc", "comment": "Malware payload (AgentTesla)", "value": "c8059bf13ad40368674404d5120db026fbab1f1f8992e55d8a7e7c4cb0d2147aca3aabefd13e12cd7470e86dc7edbed6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811433, "uuid": "ca6ec22b-ae74-448f-a4cd-865981ae9a17", "value": "T1C1E4228296C19920C25473708835CCB0867D78B19F5AB76FCB2DE69F38B43D6986730E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811433, "uuid": "dfd8c7f9-285f-487c-9db7-dd40244c744c", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811433, "uuid": "b7fd4c6e-a5d2-41a2-bd7d-b70eb3652222", "value": "12288:Mz7hU5I5yuNHIgzSFKxWltRohBfSTso93Uq2Fe21BwOYp1aRer4bqgp+UXf1:Mf+iN57Gtene3tkH3n0a+KDp91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811433, "uuid": "87f5e4c9-5c85-4b77-9066-49206a55b2c6", "value": 717312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811433, "uuid": "e7bef19a-3d55-4b82-b054-435bbb489b4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811433, "uuid": "3b2bf341-25b0-4775-bd6e-97ea523570ed", "value": "c44e5dfb7303a832d42e4824696a91ebe9f46aa2dcc0b515fcec75001ce00eef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "810953d7-1984-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772819231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819231, "uuid": "dfc78435-c2e9-48ed-a343-bafe6dad5afb", "comment": "Malware payload", "value": "4d910c1151554338f4fa4f10c8932315", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819231, "uuid": "e10991fc-94ab-411c-8ec1-b9abd7b7c594", "comment": "Malware payload", "value": "c481c4451af1acfe983dd69fcd4f6aa2f10fe7b707b976110f9f71598edb9785", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819231, "uuid": "03ec31ec-0c00-4943-baab-f3d2628c1b19", "comment": "Malware payload", "value": "fd0a1c306131de4c12edf52869418eb86bbdf8b2", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819231, "uuid": "ba471b6c-ed1b-4c80-b868-ac03c36a3681", "comment": "Malware payload", "value": "7333f988907bbea1860264dd318759c014c0bdfe2ebb070b12e9c409c5af4d6c82ac7a9af96ef097f16683e7a0a1206c", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819231, "uuid": "448dea79-2361-4aac-8dc1-087aeef0d2e2", "value": "T1FA051227E691FE9FD816633314A38495A476AC03B71DA30B2F913729187E7E4F09A17C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819231, "uuid": "2f80e97d-3c21-4b4c-9589-c6364b92d6f1", "value": "24576:9X3iYq0SzdYKsJHigYXu4ZVmn0LzmkwE:xycWwJHiBzC0vqE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819231, "uuid": "939883f0-6df4-4c21-b8e2-db1297f95ed8", "value": 844800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819231, "uuid": "a3650e72-1b7b-44de-a6a7-07778d51ebc9", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819231, "uuid": "eaa848e2-f07f-410b-8361-c65a9fa94930", "value": "SecuriteInfo.com.X97M.DownLoader.2354.3359.32611", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6923dd8-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810328, "uuid": "6a98cb26-f15b-4937-ab8e-2adf846df66e", "comment": "Malware payload (GCleaner)", "value": "bcd1ab195169f4027b91af4ec75774f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810328, "uuid": "085f014a-ba2c-4022-8642-9ce80d96aab8", "comment": "Malware payload (GCleaner)", "value": "c4c888de7d2e4390d4836a7799d0cc340d60708993acfda560da8bfdfe39cd26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810328, "uuid": "625cbd37-f242-48a0-9e2c-4ddedd6fd377", "comment": "Malware payload (GCleaner)", "value": "cdd7f0bcb395760dddce05952494f4a68497efdc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810328, "uuid": "ce00fd10-f352-418f-bd56-469348848678", "comment": "Malware payload (GCleaner)", "value": "dd8fc649b0c1eda257dfe0e3c09fd6f886c3c01478b7271e2f209142a972146b2066037b28dc12396d72fc4556900df2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810328, "uuid": "e57333ac-a810-4c50-8be2-c8e7f9c41825", "value": "T1F7158E22A2F17637C1672A7DEC5B5E5C992BBE1029EC98462BE40DC94F39341F8251F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810328, "uuid": "0c48e098-c2cd-43a2-afa4-961b621266f6", "value": "fe4280c06246cc873fe89746dadec91e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810328, "uuid": "0874d8b8-0eff-47ee-876a-bf92e2df6f22", "value": "24576:mlluEBpPj6o4CPbE9taCbIIWLIbmlnqcgP2Ny:mlwa1VYnI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810328, "uuid": "56d37f5a-08db-43f6-b67f-61244ac6ded3", "value": 877568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810328, "uuid": "d317004d-ce01-4b4b-8caf-09c2df8a1125", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810328, "uuid": "8e893d2e-ca1b-4228-b099-74a58a306bb1", "value": "c4c888de7d2e4390d4836a7799d0cc340d60708993acfda560da8bfdfe39cd26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff2ab0f1-1961-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772804410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772804410, "uuid": "68d73e47-3764-4cf6-aa6b-f21079fd3327", "comment": "Malware payload", "value": "155a62ed88389bc4ac3e39439595769b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772804410, "uuid": "fb3a7a4b-5628-4d69-a5d0-3b453f1cf7c8", "comment": "Malware payload", "value": "c53d186875cb6139ac89ea653b251230b1f45023b1ad825033e17de59fcf098e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772804410, "uuid": "7df218a3-70e9-407b-b87f-8860fac70be6", "comment": "Malware payload", "value": "2d22a353e0ae0e01ce1f4dc00f1bffac21114a80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772804410, "uuid": "05f35dfb-2448-4353-8d8b-4bb8194c1830", "comment": "Malware payload", "value": "625a764acd52b01f066b6646928d332ab91f48ceeec9a9b431a26381331177fc81c130d8e7c9b642dee2530393bc4f94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772804410, "uuid": "402eec1b-028f-4cda-b42b-de8d5af7a67f", "value": "T19E55010A97D1CEF3D1654334C8D7472033B5ED946E561B2B149CB928BDA33805EBBEA8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772804410, "uuid": "706e5f52-29f0-410a-9053-b7e5d04f4289", "value": "9e0133a9f3caeb588bafcce9a599b9de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772804410, "uuid": "72408412-ec96-40ea-b817-933918776f7d", "value": "24576:SrH953GbHD0CclGqHTsJJNrXLSodwQrnAe9:8953GXnqHTsJLSoaMAE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772804410, "uuid": "ed7920e6-3b3f-45f1-9196-9bedf9a7cb19", "value": 1351680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772804410, "uuid": "f528beb0-b966-420c-8cfc-e07adbd19dd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772804410, "uuid": "25c5db8b-1c65-432e-8907-c275e795dd29", "value": "2026\u7b2c\u4e00\u5b63\u5ea6\u8fdd\u7eaa\u4eba\u5458\u5185\u90e8\u8c03\u67e5\u4fe1\u606f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ba91d15-1972-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811464, "uuid": "e894c745-31c1-4103-bbdf-570badb511e3", "comment": "Malware payload", "value": "1a0360e644838721110b383497ad6483", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811464, "uuid": "e19b765e-c916-4c8f-a20d-92fb8ac70363", "comment": "Malware payload", "value": "c583950dbe528fae402b8632a6bfff199c2a92eaf8f8347d0d3a04a68eec0e67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811464, "uuid": "03315702-db43-4f66-a6af-5aa5ac39fea7", "comment": "Malware payload", "value": "a68a54a0f6d8278b89ee3c44c37d24fee5997b09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811464, "uuid": "619a45c1-0303-457f-83ae-1933e1f48b15", "comment": "Malware payload", "value": "49ddc5c2ab56336c9e439078428f1a6601209b12ebb44b51538f609deede0475a43700043d49684f236a5de98b6100b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811464, "uuid": "7d0758dc-c39f-4e21-9502-7b4b27744d8d", "value": "T12D45BF027391C062FFAB92334F5AF6115BBD79260123A61F13981D7ABD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811464, "uuid": "db499b6b-9890-4ef4-b1ad-fd2c565c4392", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811464, "uuid": "5f12c9cb-e538-4d82-8052-777c7383f93b", "value": "24576:F5EmXFtKaL4/oFe5T9yyXYfP1ijXdaj55+4z5gOPX0+Igvftv:FPVt/LZeJbInQRaj55Be60S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811464, "uuid": "45883b87-e200-4e17-9185-9619acca0e40", "value": 1267712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811464, "uuid": "72737d65-5c56-4755-a569-b190324470e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811464, "uuid": "866c9acb-cd82-4e44-9117-257705c79669", "value": "c583950dbe528fae402b8632a6bfff199c2a92eaf8f8347d0d3a04a68eec0e67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4eb54af-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772809010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809010, "uuid": "86e4cd3b-5881-4e2e-a00b-d13715295630", "comment": "Malware payload (AsyncRAT)", "value": "64e35aa0ac4a03a542890cead08046fa", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809010, "uuid": "da8fda0a-41d2-4838-8670-d4a5f5ef4353", "comment": "Malware payload (AsyncRAT)", "value": "c5abb8f607614ec7063c3a2d84d26f444ae82fc60c9d9ba4d3e13ff137594cf7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809010, "uuid": "9bfa1698-5906-4a8c-8bdd-21f14e6a7816", "comment": "Malware payload (AsyncRAT)", "value": "90ddc1d086f9f0afb71967f034bb2b7b328fca21", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809010, "uuid": "47f15180-cae0-4052-b186-a926f005af44", "comment": "Malware payload (AsyncRAT)", "value": "b6afa92e4a1c1f90de8d80c528e2ea8de807a7fb7b1465849ea551010964af04044e9f83c6de635e9da242f05d18a5ea", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809010, "uuid": "44d44e48-d25a-4c49-8942-f6cb18c72a11", "value": "T123F4F1326E862A24DA790FBDC066149537F0C847625AEB3B6FFC00F46DB3B49C927561", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809010, "uuid": "561ad257-2dc5-4fda-b613-7ed17e923ae9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809010, "uuid": "49229a22-a62d-48f1-942e-1dc6b9e827ee", "value": "12288:DIyHAXRNGszIMjy1j89CFnLT/N0HPNI0iAxxrKXBxoo1C7MYzcH6JblNB1:D8khpLT/4PPH7caoc7MwcaJblNB1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809010, "uuid": "af37e261-f1cd-4472-b055-e2559e4985c8", "value": 777216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809010, "uuid": "cc5d1f5c-1e68-45a9-a4f8-fb829e2c4bb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809010, "uuid": "b6e5b8c0-825f-4817-9740-2e53181055d7", "value": "c5abb8f607614ec7063c3a2d84d26f444ae82fc60c9d9ba4d3e13ff137594cf7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d8e8242-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772808488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808488, "uuid": "652879cd-ec77-4e0e-809c-1d3d99459896", "comment": "Malware payload (PhantomStealer)", "value": "32242f4f03fe8394a9f128ae33fd8d62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808488, "uuid": "289a7df6-1a19-4c01-9c74-e8723ce22833", "comment": "Malware payload (PhantomStealer)", "value": "c5ca924a6c158fb9d273e2450c3cdb5a92f02433ad87dfdf2977e1aa9fb16348", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808488, "uuid": "38771da8-f1f9-4ff5-9bf3-6a5b573a1b7c", "comment": "Malware payload (PhantomStealer)", "value": "4890b902c12eaa4a8abb11048f63bb37313fe01f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808488, "uuid": "ad68f899-c741-4a81-adbd-d6d2e4172852", "comment": "Malware payload (PhantomStealer)", "value": "738d101d11d7c7f3d428b3d2a2b778a8bf95092affe16365bb4be49d777c461b7e2a5aa08811798e7b8859dea38bf877", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808488, "uuid": "10f18f20-f9b8-4b9d-9971-ad14f25bac48", "value": "T110F4DF68B3F84A01F1FF5B7194B19951AB34B513A961E71E15C080CC1EB2B919F8AF3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808488, "uuid": "a4c3657a-ac4e-45aa-994f-a8a6e0709fb6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808488, "uuid": "b7ce25bb-a462-4167-9030-ec31910adb65", "value": "12288:w9v7l/7kqjVnl36ud0zR/6CtQ9PUHIG8DXjAGq2amJYeQabdLdlLUwi:w9NkqjVnlqud+/2P+ATAS/JYellLUx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808488, "uuid": "7bef09fc-6978-4c8c-acfa-38bb273cef92", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808488, "uuid": "71d6fc74-f41c-4aec-8cee-5a576e139b87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808488, "uuid": "d209d552-f24d-42f3-a234-726d5be12ac9", "value": "c5ca924a6c158fb9d273e2450c3cdb5a92f02433ad87dfdf2977e1aa9fb16348", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bd57065-19a0-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1772831221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772831221, "uuid": "10e485a3-ceb5-40ec-9248-1bb27ed0c6ed", "comment": "Malware payload (Gafgyt)", "value": "30536bc26d56494b63f3ce35c632f907", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772831221, "uuid": "e40da413-593a-4d85-a7c7-ceb206838eb9", "comment": "Malware payload (Gafgyt)", "value": "c61d2ad5c13b82dd5a2b9a3f3465a18c1912f76c353141f62f86572bff22a543", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772831221, "uuid": "8ab3380e-644d-4a5b-a3b2-165ee4d7c5b9", "comment": "Malware payload (Gafgyt)", "value": "86388b01ee2f76b93735da958c2c1f2db02e72e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772831221, "uuid": "ccbe1b1f-e820-4b1f-8f67-0e44acacccbe", "comment": "Malware payload (Gafgyt)", "value": "996b73abce24b670a2e118d08a7337e8a5ac61bb7c803eb9ddfec5fb4dd6acf7cd1e8cb7da9df88a6581cd14c940ccfd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772831221, "uuid": "ef835946-85b0-4be7-a844-de8fa240758c", "value": "T14AA31A32A640DA73D14305F211ABDF260D32FDBB1A6A9A56E36C3CB0CE364C5B561E5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772831221, "uuid": "18c0fe03-0f4f-44a1-8434-0ff26c56e6e0", "value": "3072:jeN347UiKLr4tr+KM8BIxIsKfmmFVcqIRGnDFT:jeu7oMgyIGsKfmmFVcqIRGnDFT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772831221, "uuid": "d464f47a-8a8b-4a62-9304-d7d08fc5f562", "value": 101116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772831221, "uuid": "de58f050-bb0b-4a96-8862-2682d1738ff0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772831221, "uuid": "57795640-71b9-430f-8385-cb4f81b97de3", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5a9114a-193c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772788423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788423, "uuid": "2af2e600-94b1-49df-9ba8-253544fd5428", "comment": "Malware payload", "value": "35f9dc1364f026e03153691c471174a8", "object_relation": "md5", "Tag": [ { "name": "157-20-182-49", "colour": "#B32581", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788423, "uuid": "8a071d28-59a0-491e-9263-eec285c4f956", "comment": "Malware payload", "value": "c62a0fd0a648ed3853a6c339aa006b1d994e8f16c4170e4be6c8aef5f96d4a0a", "object_relation": "sha256", "Tag": [ { "name": "157-20-182-49", "colour": "#B32581", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788423, "uuid": "0bb9381b-3511-4441-89d7-56ebe8d0ce13", "comment": "Malware payload", "value": "9bed3573e534fd28bce8afef7e445ac1b39a920c", "object_relation": "sha1", "Tag": [ { "name": "157-20-182-49", "colour": "#B32581", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788423, "uuid": "ca3804d8-cdb9-4426-9cad-60210a09d1f1", "comment": "Malware payload", "value": "e6e34cadce8d797071c43695ef4b68933f3060d65041a7640c7f5f9ad6aaed033b1e3c69e952cfd140f11c40cc9a5b62", "object_relation": "sha3-384", "Tag": [ { "name": "157-20-182-49", "colour": "#B32581", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788423, "uuid": "a5843f9f-9664-4eee-be42-e2a0dfecd669", "value": "T183953387F3F106A7D767C3BD01774A055620B4021785FDEF83918AAA1E5B7C29C2AB87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788423, "uuid": "9781fc26-d03c-4f54-bea6-2f10be945695", "value": "5e2e89e71bedde0dfac8800dd978d77f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788423, "uuid": "1e374a0a-450d-4d7c-9795-aafb407c6051", "value": "49152:6YJWPXqwvWt0oTTUjyVCa/J/htOGLtz1t5:jWP6wvWtBTU2VCasGZz1t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772788423, "uuid": "c159cfa4-dfb9-4614-9177-f500fb2dc6da", "value": 1905152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772788423, "uuid": "bca2b058-f9d5-4bb4-8cd4-e0eb3f79ddcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788423, "uuid": "7e281f2e-4ec4-49e0-9a22-d14c0e8584ce", "value": "c62a0fd0a648ed3853a6c339aa006b1d994e8f16c4170e4be6c8aef5f96d4a0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "004d96b2-196b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808278, "uuid": "9e3b6c26-81c0-426d-970f-ccf4f850a8dc", "comment": "Malware payload", "value": "c1b0ec6f041a056f59fb8a65681dfbba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808278, "uuid": "4c18291c-bf67-4e3d-baf5-447db24f062f", "comment": "Malware payload", "value": "c6b821a7a1f92b532427a9a75664f14178f68e7b40309375f02c3fee06401d38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808278, "uuid": "12d682ea-4364-42f1-addc-91ab99ff6a25", "comment": "Malware payload", "value": "366e4ef65931b7a83dcc64083f4137085f448cf3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808278, "uuid": "18cbee99-e35a-47d4-ba3b-87092b0fe604", "comment": "Malware payload", "value": "dced18547689519b7345cb5e0487ba15453e1395b34267298688670b41baa2f3bf94c2a59a7baef2ac466acb8eb65dc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808278, "uuid": "859c2098-15a1-4278-89b4-ecb5a55d9e02", "value": "T1417412027BE0C53EC4722A74DDFB82B656F0BCB45A55560B23E47E3A7DA23C1DD0A246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808278, "uuid": "e207c5a9-d796-478e-8a44-bd8246a8dc11", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808278, "uuid": "176321f8-65f9-4978-9fc4-100db1c5740e", "value": "6144:F+MvoJXYsbLSn1lcSq2yAsR337SYdqj4PJQNk/omyOy55eJTWY2Y5ZEh2DKO:F+FHbLSrcSqtAjGqkPJQ6Ryh55ZHYLEq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808278, "uuid": "a3293740-362d-4ee5-8060-414ce0143bbb", "value": 358368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808278, "uuid": "ac819b82-e903-4898-b8ae-e631f5c7986b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808278, "uuid": "49455dc8-e9e8-455c-8859-f81c59023de2", "value": "c6b821a7a1f92b532427a9a75664f14178f68e7b40309375f02c3fee06401d38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f532051c-193d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772788932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788932, "uuid": "f5409239-114f-4260-aa1c-892fe0e0feb9", "comment": "Malware payload (Mirai)", "value": "d6ca54464876f052c06a87e723340eab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788932, "uuid": "e15db2a9-718a-4d67-a178-504957c2eb4c", "comment": "Malware payload (Mirai)", "value": "c6eacc954db61745a632a7184c716f138e39201b3d572606949e3264d9e15493", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788932, "uuid": "ea341e8d-3e55-4037-a238-c97beabe01aa", "comment": "Malware payload (Mirai)", "value": "18225b13b7fdcfd57092253048d61206692d22fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788932, "uuid": "9f908bb7-f82c-469f-896d-87be5d239ebc", "comment": "Malware payload (Mirai)", "value": "f4d0b0927f06934c556bcbf35b9be3977f425a8207355b132bba69dbedfe59ef2fa30ce55f2ac8b53c4e355020c1a738", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788932, "uuid": "68598405-4374-41b7-94c3-4592b0f9b706", "value": "T1A9835B22FD75193BC8C4A47761F74376F2F6438A24E88A1E7D710E8CAF646402297BB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788932, "uuid": "362d016c-c8ee-4ac0-97ed-39d3d9913de3", "value": "1536:XhRLk5+YRoVvgOrVp5gi/Aow7bKtF01XNT5+GIQQihtTFmb:XhD3pbvwqnYXNNMJb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772788932, "uuid": "80093522-b6d8-40d0-a170-f1933b0de165", "value": 87496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772788932, "uuid": "17df9084-b2b6-4276-8e32-f4ff3ebc994e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788932, "uuid": "c16f9584-fc27-4a3c-b096-ac18a819226a", "value": "morte.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84d409ca-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819238, "uuid": "80d31567-74f6-4f0b-ab4e-67d346956850", "comment": "Malware payload (Mirai)", "value": "79144d170f6c58d53e3091bab9e0fbf7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819238, "uuid": "43bb1ab6-7d78-46e6-ab50-d49ce0a040d6", "comment": "Malware payload (Mirai)", "value": "c7b3a25eaaf819a7e1614a5a57eb89561c957eaeebac878e02a263d211ad5e7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819238, "uuid": "79e0b759-9a26-42c9-8e86-c7b9daae091e", "comment": "Malware payload (Mirai)", "value": "5d1d52d5c3c6a875e712fa360d45cd63ff5dc91e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819238, "uuid": "3ea5b5df-5628-4de3-970b-76d727b5871d", "comment": "Malware payload (Mirai)", "value": "e6af030194e196c3441d8ac9c7e69a55fb016b1a84436ab9332633cda084a8fa82e1759d16d12a5d4a3487232e4ef520", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819238, "uuid": "6ab3b92f-6034-4d37-9cc4-12fd270ed1d7", "value": "T1E373080277080F03D06369F0267B2BE087AAFDA528F5A685751EFEC55271DF22186FD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819238, "uuid": "7d062a6c-ae38-43ce-84d0-ff6cdb0d047a", "value": "1536:GpW9GEpIy7HWPwVXOALIn99HwfO4INvS+wl7eai/ses/BpJ:7lXXISg+O4I0+pvqpJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819238, "uuid": "e5134201-9299-4cbd-ad0f-d541124c4b57", "value": 74960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819238, "uuid": "f693fb4f-bb2f-473a-bdc6-5112a1f7117d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819238, "uuid": "2299dbd3-ee89-472a-84b4-62aeff76cdc8", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eea80f75-197a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772815120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815120, "uuid": "6362cdb9-c6d4-4982-92a1-4eecdcef2623", "comment": "Malware payload (Mirai)", "value": "384f0e026aa078dea81ac46d0d65101d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815120, "uuid": "87e00b50-aeb5-4579-aa59-4296f4c5d984", "comment": "Malware payload (Mirai)", "value": "c7db460d143b5f0af28e84506455d30753fcd0c28f59d54c49c68a2f9e54b4dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815120, "uuid": "375c3095-2622-45a7-8e80-89a56507a1df", "comment": "Malware payload (Mirai)", "value": "70cbbb1d3f2a09fc106397d34d83b1b7e27a3e01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815120, "uuid": "f0d43d96-5531-4e71-87c6-42a1031085b6", "comment": "Malware payload (Mirai)", "value": "df9ff1951fbfe93ad3b9770ebc5abd2f611bdce6a12731c45750d16ab366eccd00a6c01a3671add0e44dca044011e789", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815120, "uuid": "f4c78fb3-1169-4735-948c-8b23aef9a4cf", "value": "T13EC3F909AB614FFBE86FCD3746E90B0525CC551722A83F7A3574D828F64B54B4AE3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815120, "uuid": "9cd66144-e292-40a8-818b-cfa5f6ab64dd", "value": "1536:htJ6cGVoxBFf+g6z3jLH514RX07P+Y0+YdW0OKh+6gposmZ5uBrKnrAEFjYVi0h/:TJ6cGVoJ6Tn4Y6g7mCpZEiV+0d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772815120, "uuid": "1b8177a5-6391-4323-b8df-7de7637cc295", "value": 122496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772815120, "uuid": "d67df9f7-bbea-47a2-a8af-8204f32f003a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815120, "uuid": "264acd75-2fe1-498d-9f80-0429ccf2fa3a", "value": "titanjr.mipsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a5f7d1e-196d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809342, "uuid": "62e2571e-3088-464c-85b4-4578792026e0", "comment": "Malware payload", "value": "dc4a75287b8c44b919d71a1acba950c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809342, "uuid": "cdd2b324-c3f5-4d00-b18d-d61462098e27", "comment": "Malware payload", "value": "c8191ba3179a701a7de242f38baa7c2bbd538fc8a2d137d5ee3773044ae953a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809342, "uuid": "a0b118ee-37de-4859-83f7-dfd6b59234f2", "comment": "Malware payload", "value": "947cffb3406a1e1ceae1b9156db8dd728e6507f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809342, "uuid": "c2b878c6-c5d5-4ee3-96b4-6277a067edb4", "comment": "Malware payload", "value": "bb5f92c12ee142d8a04a6654daa6fd864c1af7cdab8f2390f6d949d2889fcd99b90b64e7a8e896f323e6e2e553c41e31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809342, "uuid": "a2823aa2-6e81-418d-a0d7-86b89a21d706", "value": "T14B652358320DCD13C4BB5FBA1E60E67017B55FCCE452C2129BF6BDE7743A6A1286138A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809342, "uuid": "fa261edc-3dec-4deb-9fe8-a782a7b6ba20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809342, "uuid": "1e45eb1c-ab9d-4413-a485-04b9c3c9aa12", "value": "24576:9/6m3G+H9x37pLNrPZPEPdpzD4/FsTGYnG8wyAasiBK/43R+FrWU:9/6m3b997xNrNODDYdFDyiiBK/4hK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809342, "uuid": "55052d4f-e0cf-4e9b-963f-f9d323b999d2", "value": 1519616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809342, "uuid": "56cc9072-e4f1-4399-ab66-76ce55891cfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809342, "uuid": "6fb7b671-b75c-417d-aefd-4366a3325346", "value": "c8191ba3179a701a7de242f38baa7c2bbd538fc8a2d137d5ee3773044ae953a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa2d6623-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772809851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809851, "uuid": "861e2ef2-8839-43bf-bd8b-593115b67c99", "comment": "Malware payload (Formbook)", "value": "eefc3b9207a1c640f8a6e560eed3725f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809851, "uuid": "deaf1bae-9d6a-4047-b806-aff9dfa7927d", "comment": "Malware payload (Formbook)", "value": "c85402d456a3c2495a0f94fdf43dfc0ba276f1b69f7d48ce5f2b608b1f10f845", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809851, "uuid": "146e7678-cb77-4b08-af9e-963aedbc1e7a", "comment": "Malware payload (Formbook)", "value": "bed04f48a13579da82c7101e5862e683898bc15c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809851, "uuid": "9e900a87-108a-43bb-925f-5b36ad7a4a57", "comment": "Malware payload (Formbook)", "value": "d98e66c67fcae338e700f15029efd38f08d573ec6631f62fa49571a900f9c4520b94a41c168ae186d3d5fc1afc47cc0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809851, "uuid": "359366d6-f07e-46e7-840e-2c26f4120677", "value": "T15C45BF027381C062FFAB96334F5AF6115BBC79260123AA1F13981D7ABD705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809851, "uuid": "8ff523d2-c475-4157-8b29-8234f7afc7d7", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809851, "uuid": "5f066cda-969d-450e-b5ca-cf99e9cc3352", "value": "24576:75EmXFtKaL4/oFe5T9yyXYfP1ijXdaoN8Djher1sEVz:7PVt/LZeJbInQRaoN8Ho1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809851, "uuid": "65fdc568-c3e4-4a30-812f-1f3779983cf8", "value": 1259520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809851, "uuid": "cab5c72c-fb5a-4b02-899d-668125ae2749", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809851, "uuid": "39d77a89-de46-4250-902d-2728fde4dbf5", "value": "c85402d456a3c2495a0f94fdf43dfc0ba276f1b69f7d48ce5f2b608b1f10f845", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c48ae64-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772808808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808808, "uuid": "1d5212a4-6788-432b-afd7-6945acc61a76", "comment": "Malware payload (PhantomStealer)", "value": "f131055a0b1c9a9137b405bb1edab061", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808808, "uuid": "d4321a98-ec75-4c1a-a240-48dbc6967f6d", "comment": "Malware payload (PhantomStealer)", "value": "c86c29b2de734ee139b06fcb1ef305618db1752f066df82473291cc5175ac45a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808808, "uuid": "82e40531-e44e-4cb6-960f-c1c2da64c3f3", "comment": "Malware payload (PhantomStealer)", "value": "533872cc59c23dcea68e7b87982841c9741e5186", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808808, "uuid": "c0697684-6d25-4056-9ff2-30cade5b74bc", "comment": "Malware payload (PhantomStealer)", "value": "ef03b985f313e5c497ffe736f024284e6efc0db7cffc192e0553436fea15119956d7b51a33f2707e64b836638b89300f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808808, "uuid": "3a0ab5d8-190f-489b-9a68-58133a5c26ab", "value": "T1547522943216EC03E8A28EF119B1E7F117746E9D5841E353CEE6BD9BF079B4A1D043A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808808, "uuid": "fc94d528-63b8-4b0d-9b46-9c97852a8f13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808808, "uuid": "d00059b6-ba97-4806-99b0-e90054e4cff3", "value": "49152:neVbO1WqNz4tsw83cTyUUmOXcLxmRWdPU:XcqaOwzJUmObWRU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808808, "uuid": "929b1682-4876-492e-ad5a-59fae285a513", "value": 1581568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808808, "uuid": "54bd8d4e-30fd-437c-854c-1bdd341f4bf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808808, "uuid": "3d10cb93-95fb-4381-807d-8eb104b08906", "value": "c86c29b2de734ee139b06fcb1ef305618db1752f066df82473291cc5175ac45a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "986a0224-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772810680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810680, "uuid": "164036c0-074c-437d-8f07-a12a05c43718", "comment": "Malware payload (Formbook)", "value": "d3e47549fee8d3aa70c0cbc608b2ac5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810680, "uuid": "a216e23c-78aa-4254-93dc-4c666dd84c38", "comment": "Malware payload (Formbook)", "value": "c88854358f4a82cdfd1ba118fa7e45bba1893af416a364cddd5873f04aa71a4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810680, "uuid": "2bd57ddd-3bdc-44c2-9873-abc9ef715cb3", "comment": "Malware payload (Formbook)", "value": "811c7730f24976e9e7c984b3bd4fc19cc79cc65e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810680, "uuid": "5fd992eb-eb7b-4e87-b890-27aefb954191", "comment": "Malware payload (Formbook)", "value": "e98d8425f7a9abf3a40af84eed0d5cbe499b5330a0a284d8589a073568e31cdaebe941b05d126fc652e26b11af53d061", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810680, "uuid": "7953680a-b10a-4788-8f68-d548d9d1ad47", "value": "T1CD2512DC2A45CA07D4A65B745B31F2B417B95EEEF800E207CFE8EEEBB5A1E145C44182", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810680, "uuid": "6f947229-474c-429c-b80e-59430b61f835", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810680, "uuid": "c98f22b3-8b93-49e2-b9d4-b3e976771d9e", "value": "24576:kTjnRhvgV1Nbws5muQSZz1ed++EziQMHU0Sotpr:kTjRhvgV1E6ZIREznM00SAr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810680, "uuid": "7e938772-1845-4ee9-b7f8-d32a8a8d6813", "value": 1043456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810680, "uuid": "d433c9a8-ee6d-4bbd-8b44-c229d64181e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810680, "uuid": "89ea7082-39f4-4b0f-97e5-d73183753e96", "value": "c88854358f4a82cdfd1ba118fa7e45bba1893af416a364cddd5873f04aa71a4e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa8bf6e6-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772809127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809127, "uuid": "ef5ea849-aa22-45b7-9de6-547a51240412", "comment": "Malware payload (GCleaner)", "value": "23a6b2bb1dadb441ad6881bbb6b759a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809127, "uuid": "04f7cb0d-9198-4162-808e-9c1428b4a1c4", "comment": "Malware payload (GCleaner)", "value": "c891cbab9247525629100f8504f978ed072d5b6d5db28fe6f413eb731f771ad3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809127, "uuid": "e7c0f7eb-26c8-4150-a104-60580300ca28", "comment": "Malware payload (GCleaner)", "value": "e3955a4ec1a2a58199b9974b9ebc44749ac3042f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809127, "uuid": "fee69d0a-a7bf-4ac9-93fb-685caca1a14e", "comment": "Malware payload (GCleaner)", "value": "c34afe209408bc6fd0bdbb79b8056fd5481c8a22fcfeebe8dae97eb82377b566ab494b49a112ab211f7d469b4ac5236f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809127, "uuid": "0e8bb245-2850-481c-b530-8e38efdac371", "value": "T18F06F0CA56C8E436F623B1FB99028176410BA55CB97F400A2DDC6BA533770BF7AE2153", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809127, "uuid": "c31f0cae-0c6b-4eb2-bea2-969262497b33", "value": "234372fce9eaa047bc4c39047910954c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809127, "uuid": "86063747-b951-44e6-ae03-bd6b44003bf5", "value": "49152:+GQJMwLieJ4mG+S44LAlq3znTmvi8gMcwTzg0KbMxHoEvXkzN/A8nkV9d:+BJMeh56BAlQWvi8lgcdlv0BErd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809127, "uuid": "acca66b0-6bc5-4121-ae15-5d22b04acefb", "value": 3660800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809127, "uuid": "9046414f-8ae4-44b9-8dee-d25e5353203e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809127, "uuid": "19facf47-5205-43f0-a63a-d076f3681271", "value": "c891cbab9247525629100f8504f978ed072d5b6d5db28fe6f413eb731f771ad3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3de715f1-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808381, "uuid": "f6bd65e6-8873-4f24-9d0f-05b88021782e", "comment": "Malware payload (GCleaner)", "value": "a215289aabcbaf85ab704de1656902e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808381, "uuid": "8e93aaff-1083-4d6a-937e-f2484ed67ecf", "comment": "Malware payload (GCleaner)", "value": "c89d6db80f4f2d60d80f47e55c0c15ecaf75efe569dfb33759f88e2b4cd94b35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808381, "uuid": "29e8fe11-051c-400b-bf5f-96f69b0602d1", "comment": "Malware payload (GCleaner)", "value": "ff1d907ff37e899f0fe6cee22dcef3286e051f0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808381, "uuid": "fafb1d82-409a-4661-815f-0376f4f7f7b7", "comment": "Malware payload (GCleaner)", "value": "2435c0c20b89a8d598c22594bdca39650daff758d755afb9acef6ded9c9356f538afbfb34d457d685077f1b9ebb44ea4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808381, "uuid": "a06261f8-bb76-439a-a787-69203fdbb145", "value": "T1C756D051F360FB56F81AA2344C1D7AB8C5E8ABC02D65258C97F414C4BADCE72E723276", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808381, "uuid": "0f79ec0f-4ed4-439d-831f-8c9d2bc7f882", "value": "c243d5a6283f8eb7bff20dd0797e21c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808381, "uuid": "19126ae9-b997-4a38-a28d-29fb8729a9ef", "value": "98304:SH57aGK4k1fVoBBszDIsr1ttJLk1MgMzfboG:SgpIMtte1a0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808381, "uuid": "0aae6688-8631-4acb-978a-4e195f56c290", "value": 6200320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808381, "uuid": "b08ea2b4-5f45-4ce5-bb79-7c4ea0ba8fef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808381, "uuid": "72607253-68a4-4d1e-8f9a-89de071a7c19", "value": "c89d6db80f4f2d60d80f47e55c0c15ecaf75efe569dfb33759f88e2b4cd94b35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7716b5c-1969-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1772807699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807699, "uuid": "f6f069ae-ad56-4e0f-b87e-ddd27ab025b1", "comment": "Malware payload (GuLoader)", "value": "5334c648166d1514acb15a411d8439e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807699, "uuid": "593d7959-8708-402b-99a2-196451c670b2", "comment": "Malware payload (GuLoader)", "value": "c8e7a02f038692b718562729a122e39e64cad6f27d0396bbf157cfbcc90ba7d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807699, "uuid": "04b78d20-74c4-4f0e-9b3d-a7cb186ac916", "comment": "Malware payload (GuLoader)", "value": "80ad97dfb8364243d33e964f54bcd77ce867f4a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807699, "uuid": "a61c37d2-5abc-41c3-b7cb-d669e05d14cb", "comment": "Malware payload (GuLoader)", "value": "534a5d4ab7a893fa41804946cad593e134ff0455b9fabf4d0c6a4a2d50d800c871dabe2765d2e2e8006fe225b90ac99b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807699, "uuid": "306e6ef1-08ed-4e2e-a86b-0380a524c4ce", "value": "T17EE4230F9A30C54FCD209A3EA8BB5F723BDE5E479575231B37027A9DB166102F918361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807699, "uuid": "a4b7abd4-1fa6-43ca-9077-9a45051025d0", "value": "24f4223e271413c25abad52fd456a9bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807699, "uuid": "f9d1bb33-35bf-4d46-80ff-116c9636aa7a", "value": "12288:HDd6lbK2Hmxe+WQ4nWjvGRto/6Td9ObzQqdT75+6upqgwSkIHrbSZ9Kv03:HDmmsm3WQGQsto/ed9Obkuf5VuMRIHP2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807699, "uuid": "d1d203e6-03a0-406a-b728-794d2734534d", "value": 716648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807699, "uuid": "eb8d244d-8ba6-4211-96b4-d500eea6f091", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807699, "uuid": "270955b7-3945-4c0e-8c66-bb8064e4f7b4", "value": "c8e7a02f038692b718562729a122e39e64cad6f27d0396bbf157cfbcc90ba7d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9643fe42-1904-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772764291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764291, "uuid": "177d959a-5ca6-4c44-9bea-2a6aeefe5f20", "comment": "Malware payload (Mirai)", "value": "83392024be5503e1199de47b3861fee1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764291, "uuid": "79bb5096-646a-43c2-b9ad-f95dec1ee345", "comment": "Malware payload (Mirai)", "value": "c91035ab5f3df08bb8e83b3db25edd5ff7f874d9c591677e2ecc48531a10df90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764291, "uuid": "a2c19b3c-927d-410c-a546-c13b7fe6b994", "comment": "Malware payload (Mirai)", "value": "100e95d4861e36150d341caae0b70d6203bc487e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764291, "uuid": "85e93ca7-d545-4fe4-8556-1dbb4b0eb63c", "comment": "Malware payload (Mirai)", "value": "c1c4b6c0e2fb295de4169ad17d310e117300e061680b39de4b825384689ead54a998834e13c336366b67024b12436701", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772764291, "uuid": "1afc1af3-adf0-473b-abd9-a381ed9defa2", "value": "T1E4935CC0F783E5F1EC5701B5A137E3339732E039502EDA56C369AA27ECA2550DA1A76C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772764291, "uuid": "13d61adb-04c9-4102-a938-58e78409b26e", "value": "1536:tr6dfMqjhWebH868H0zAeVq/Lv/EL6c4eW+JIptgv49SQflbsg:trifMqtWebH98UzAeVq/bC6YW9tD0Qll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772764291, "uuid": "0de89e91-fb26-4553-8149-c5199efeaced", "value": 92812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772764291, "uuid": "9160e61a-0323-49fd-85bb-a86ff11a4829", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772764291, "uuid": "35464b2b-d62a-4032-8ef7-89340dbd604f", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20251d18-1953-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772798023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798023, "uuid": "572816ca-ff64-4b31-95b5-b2f7d24f8633", "comment": "Malware payload", "value": "ebb2ef8c4746b85c05d2efe6b21a606e", "object_relation": "md5", "Tag": [ { "name": "Akbank", "colour": "#36752F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798023, "uuid": "a7f04e1f-5534-47c1-9b82-60b37f1c348a", "comment": "Malware payload", "value": "c95db7526f321648daf2f40d98429e46dad56cbfcabc12ceb3d3c66189460b01", "object_relation": "sha256", "Tag": [ { "name": "Akbank", "colour": "#36752F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798023, "uuid": "f523eb6e-95b5-41fa-83b7-349cdee5b1d4", "comment": "Malware payload", "value": "d447b49d2c9ab2174d2b7a3a30086554dabf21dd", "object_relation": "sha1", "Tag": [ { "name": "Akbank", "colour": "#36752F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798023, "uuid": "01cdb3f8-8cea-468c-ab16-f9ec0fe1e970", "comment": "Malware payload", "value": "c8816767139dbde766e626f498f12fccc32b09629f7658b4d6e1371e83e4220aff870e34fc0e4f440d713d11b815ec97", "object_relation": "sha3-384", "Tag": [ { "name": "Akbank", "colour": "#36752F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798023, "uuid": "d41222a3-9e88-4999-9117-edd28c937383", "value": "T1D2F27693F1539F4A39C7272C4986779FAC8BA918487F8C2F13883489EF56F97850B506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798023, "uuid": "99d4f807-dbd7-418c-bafb-5895ca380144", "value": "192:/ExAHXXAxXSIoYnTuRiekIFzE9fc7ALNWwAwiovvTOU1T316xCRW+JfopbNUDc6s:/8AHAsiev5z2SNOv/1ygrA6BZ1qGsL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772798023, "uuid": "96d8d5ba-ffd0-4bce-827c-da84e21af2d9", "value": 36031, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772798023, "uuid": "2ed2723b-0806-43ba-b9b2-e299d1cf25ee", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798023, "uuid": "b859196b-cac7-4c60-80a1-c4fee0c19c0f", "value": "ebb2ef8c4746b85c05d2efe6b21a606e.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a23b2d7-196f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810012, "uuid": "a6a588d5-0ac9-48b0-8711-1c2382b41705", "comment": "Malware payload", "value": "0480b70012dd01f708e8835b42d82c0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810012, "uuid": "1e6abae1-3d22-4f71-aa3a-1c38019ea24d", "comment": "Malware payload", "value": "c9a43ba99cd760d1faeffacd882141e28a76f8d1bf8c97a6e46dea4665a45e37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810012, "uuid": "f5ce4276-59f5-483b-900f-895461e55679", "comment": "Malware payload", "value": "47065bd5abe802cf2388866832c95e7a7bcf76fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810012, "uuid": "543647da-b830-4e68-9ce3-42240911521a", "comment": "Malware payload", "value": "1d685f3c86c6e206beb396caf1ed87ae464c4e28726916e8c04c15a139e9e45e2d21ea88cfc8288ad6fff4f60cc107b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810012, "uuid": "4f165abb-1cac-4c82-a4fb-83411a3b5e3f", "value": "T11B84F2C27180B2B5E46248736EBF4E899BE76C25568125133360F73D34B38A1DB6BB07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810012, "uuid": "5b7764ea-87d6-4b80-8cf7-fdaaabf9f9f8", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810012, "uuid": "5dbb82d7-1084-49bf-8834-98eb4278a146", "value": "6144:+NDlOiP+7wHtoS8CP/8kfbH3wkTvjNgVymmtoPF5na6i:+l3f8I8uA2NgwmmKPFY1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810012, "uuid": "aad10bc9-9774-4e78-8bd3-cdd26799c6b6", "value": 393184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810012, "uuid": "b8c24968-d9f3-4d0f-a9f2-574cd6f5692a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810012, "uuid": "f8e6c842-18c2-4803-867c-93a3da93c152", "value": "c9a43ba99cd760d1faeffacd882141e28a76f8d1bf8c97a6e46dea4665a45e37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ea0b776-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808463, "uuid": "43824715-5674-4dc4-be0d-f37d8833f4f0", "comment": "Malware payload (GCleaner)", "value": "50b49486bc5c4e9c42a102cff5003d83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808463, "uuid": "a82937b6-bba5-46eb-8687-e0870df5a072", "comment": "Malware payload (GCleaner)", "value": "c9ddcdd884cbab133c62472c58e042b7e950f9b41241c58009aa0e677de43527", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808463, "uuid": "3e30d2ff-8578-49ed-a5a8-906dc7a8da37", "comment": "Malware payload (GCleaner)", "value": "61c1f5c37e83280fb4c76e42fcbf674c33dcd077", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808463, "uuid": "fa1a9053-e991-4531-9145-f4e601f8a81a", "comment": "Malware payload (GCleaner)", "value": "d5b7591a2a3755904e06adf2399c05f8b4c579f2aadf3476c46733b509e52c5e4aa67f273d4b79502a84d72898534c51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808463, "uuid": "a6a90b25-5ac8-4287-ac88-4a15c2492fc6", "value": "T12F06E0286BA00237D125553A8E3AF6D7A7D3EFE96D5E88CDDFC18F080C3635475291A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808463, "uuid": "b9bf5ec5-e6ce-4a75-8954-9ba13368781c", "value": "c243d5a6283f8eb7bff20dd0797e21c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808463, "uuid": "a809b57c-4b22-440c-9771-b3b7d972d161", "value": "49152:dH5n77Tjj6Kcogsiad+oSBeDMSktybtfByGIGN9ReVd7BQcAdPUESi3lx5u:dH5z6Kcou6+oPDMS4y1BFReP+dD1x5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808463, "uuid": "08b2af30-d27a-4635-a830-fdb08f2c9824", "value": 3884544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808463, "uuid": "a0dd98cd-301e-4db0-be73-08ec6a752c48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808463, "uuid": "17224d7a-dbcf-4e46-b7b9-02b5b0b2ed49", "value": "c9ddcdd884cbab133c62472c58e042b7e950f9b41241c58009aa0e677de43527", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d804fd67-196a-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808210, "uuid": "4771e8c2-3e6e-4e4f-9149-c89aaf5ba26d", "comment": "Malware payload (GCleaner)", "value": "194495d03ed9159b3c12093a635aaf8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808210, "uuid": "4e5689bf-4c25-4a7a-bfca-297954304bb2", "comment": "Malware payload (GCleaner)", "value": "ca1d7094aa4555f5daaa0e70bdddb2b857f173d9edc84689e6ddf2c120c4638a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808210, "uuid": "bae7b517-854d-4462-88d7-bd3ac57a0189", "comment": "Malware payload (GCleaner)", "value": "4dced1a1497a3a46427567748c837789cc79fe39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808210, "uuid": "294ba845-5ffd-43f2-a432-f6e737b979c4", "comment": "Malware payload (GCleaner)", "value": "6a7ca11ff20916cf151039177dc4de86f03d83b12f54df9809d324d1ade5954f9e7e13ee370dbbdeb941915f175e26de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808210, "uuid": "532549d1-3dd7-4678-a1c1-849e43bd0a2f", "value": "T13D36E06653A64927D838CAFDB81EED81A8187EFB7CDE9717E85054E6163F000D4213BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808210, "uuid": "a98529a1-c2a3-487e-9f4b-e6bd4e2ad235", "value": "336c69b6e8562d1c5231f219b62d7473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808210, "uuid": "5ddfc813-6428-4ec9-8a01-c46d6c9b2eef", "value": "49152:V9t9ua8rrFtmwd9wRmZfTtS48VLcSPXtBhYTC/2lp2VUdtiirlaxQndMmS63ePuT:V9zua4bWR2ZuYwxWp+UdtiewxQnnx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808210, "uuid": "291e556f-1f82-4c2b-92c3-90d180ec20de", "value": 4903424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808210, "uuid": "59c6ee61-e1d4-415e-ae1b-251e8fa2c239", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808210, "uuid": "ce726601-b44e-4a4f-be5f-25846c396a74", "value": "ca1d7094aa4555f5daaa0e70bdddb2b857f173d9edc84689e6ddf2c120c4638a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0de49ec-1971-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772811258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811258, "uuid": "f84715a5-3621-4eb2-a219-96b869a4a3a3", "comment": "Malware payload (AsyncRAT)", "value": "c4075cc4bc0bfb318eb086f9eef71986", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811258, "uuid": "33c217ab-f09a-49da-b733-3af3c40958e5", "comment": "Malware payload (AsyncRAT)", "value": "ca243e16148289b90bcb2aee876d54f7eeed997ed08578f99d3b0fd5245c2a55", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811258, "uuid": "c855f182-8d79-430c-9b53-e7916cb305ce", "comment": "Malware payload (AsyncRAT)", "value": "8862801d27cef0a719c68f407eec5c4895ef9f35", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811258, "uuid": "4ac9be12-8412-4403-8c52-c28cb3eead2d", "comment": "Malware payload (AsyncRAT)", "value": "23effda4a6ff358e5b82e6c445502171f23df5c6f96c179bb54cfd426e3a5db8a427455bf910f861ad11b76df4feac91", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811258, "uuid": "a7276933-c6f5-4d51-8726-ee2fcbb40b5e", "value": "T1481502586618C812C4665B381AB2F37917789EEEE902F3179FCCBEF7B956B154C04283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811258, "uuid": "f4e2fc5c-7201-486f-b168-35cadb492182", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811258, "uuid": "e5d0fdca-8149-4ed1-9057-05bb74752df4", "value": "12288:/jNiMwPeUP3jDdRMyCsuyBCWCPDFEGNMBvsaMPnjQd1EenBlLRNsn873eHl3nB5H:MFjZW5yjC+EaM/jGEEj1B73eD47", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811258, "uuid": "7c383d35-cd92-49b9-bc28-86cb34eee9ea", "value": 877056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811258, "uuid": "796e80f5-663d-4a52-9a12-b31fe21a9f1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811258, "uuid": "06cb1093-131b-430a-94d4-0980ca1645d1", "value": "ca243e16148289b90bcb2aee876d54f7eeed997ed08578f99d3b0fd5245c2a55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e87a9b4-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808758, "uuid": "3d2d9860-af4e-45c2-8311-0fc0e6418b22", "comment": "Malware payload (GCleaner)", "value": "7191cf63e30c72a976f31ba3f25ed23d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808758, "uuid": "13100279-f434-45e5-bc44-bdf69b96e05a", "comment": "Malware payload (GCleaner)", "value": "ca886a6976f572e898247cb88df45e757f5ab24f47164d38ee59853f88235b5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808758, "uuid": "48c5107e-d238-45a5-9274-8c411def0cce", "comment": "Malware payload (GCleaner)", "value": "387d29da8d949a7b4617563d986b93fae8a73a1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808758, "uuid": "e0a42bfb-0781-440b-b935-da237e90fb5a", "comment": "Malware payload (GCleaner)", "value": "d7197d83a62633560d9bc244c1ed5ca07996b404818a628f2fdf8d0f7e391ec9bee6926ddac9c12ff66897e2b9fadc5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808758, "uuid": "0e2632e0-12af-4363-a779-fad6b5ecd089", "value": "T10B46E05177F0A078FB77CA36E4F68796543AA5412B23BF8B24650CCBBA90191FF25132", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808758, "uuid": "158533fe-cd97-4bc6-9822-8476d4c2a06c", "value": "234372fce9eaa047bc4c39047910954c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808758, "uuid": "793ca89b-07ef-4683-b736-f5d1b0aba4e4", "value": "98304:NBJM4GMfQw3fRPuToxWJJFozjx9yJgD45QjcK+9/:N8Fw3ZPuToxWjOzFUmD4S+J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808758, "uuid": "f95f3e21-4901-4956-8569-d47e32f11ef0", "value": 5672960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808758, "uuid": "50f100b9-e267-4422-a612-e9700a09493f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808758, "uuid": "4bc95740-43ff-45c3-87f7-7a117bea270b", "value": "ca886a6976f572e898247cb88df45e757f5ab24f47164d38ee59853f88235b5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b1a975a-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1772810443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810443, "uuid": "7460d177-5e14-469b-870a-b9077a6dfc71", "comment": "Malware payload (a310Logger)", "value": "3ef004db69e83338bbc677cbfef1fd82", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810443, "uuid": "15f7c0af-d866-4659-9ded-b8121e67c2ca", "comment": "Malware payload (a310Logger)", "value": "caf1a2035a70c0706188075c8096067059e8fd0d68247f6b0901c3f6299c1c57", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810443, "uuid": "bccbe764-8f30-4345-b4a9-47cc7f4b7d1f", "comment": "Malware payload (a310Logger)", "value": "9f7d6fc17dbd9243bc9f8252314e8c0ac5985d67", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810443, "uuid": "21185393-987c-48b2-a0bd-79316c4da8e0", "comment": "Malware payload (a310Logger)", "value": "1bfd4512398cb1e8aea728af8327626f71f59ec6825fe15ced02abf58352d92cf1b940a1322d33cd96184d1fa3d62c1e", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810443, "uuid": "20f177a9-5248-48dd-881c-951917cc78fb", "value": "T1AF05230696805D58D2221334C035CD704AB678F49E95B32E872FF1AB6C75397DEA3B8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810443, "uuid": "e2a069fa-3be1-40f4-a4a2-3c45536f9086", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810443, "uuid": "0554f4f0-7718-4492-8ee4-0518bc486380", "value": "24576:3f+iN57Gtene3A3Hk0DmztpXFnfpT21opMq:PLXKtene38HFmzXFnfIO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810443, "uuid": "c9ffef21-1e54-471d-a858-a59adca7f06b", "value": 854528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810443, "uuid": "69814b59-9c6b-4f64-9dd0-f63b14ccad3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810443, "uuid": "d1eb9e81-47cd-475e-906f-9e277e7202b4", "value": "caf1a2035a70c0706188075c8096067059e8fd0d68247f6b0901c3f6299c1c57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f99d4648-197a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772815138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815138, "uuid": "beeb5267-acae-45aa-b96b-ff9f858c7a05", "comment": "Malware payload (Mirai)", "value": "6101d57c130210f0e31947a4e502a515", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815138, "uuid": "be16f1ef-b1b4-4602-a988-cb8220246fa1", "comment": "Malware payload (Mirai)", "value": "cafd2e423cd6f049c2ac3e3c4e7c96c14f08f7651c032d7e90a4d7456a635f5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815138, "uuid": "0de7b696-38a8-40e8-ada1-570e8b509b3a", "comment": "Malware payload (Mirai)", "value": "0eb9ae4aa56940b0fe061e78826174334dccc2a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815138, "uuid": "ec80ee5c-efe2-4341-af55-9f98129f3907", "comment": "Malware payload (Mirai)", "value": "f00c15241e6168e22fcdc52e261cbb83e22569eda3c1c5189be408b368ec3cb660a062b0ee4d7b6dfe0c083e7bcf6f97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815138, "uuid": "da8c6215-c178-462f-b09d-23daac1c5b81", "value": "T1BAE33BD7F900DEFAF80AE73B48570806B530BBD105925B372257797BEC3A1991863E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815138, "uuid": "e3d8f2a7-d23e-4d1f-a127-774448844a88", "value": "3072:TdLgwopU2wZAWnQwCCVCjda4Z/dzokG7KVvjbiKLrekFGyQcMNS:T9Mjda4hdLG7YLOyQxNS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772815138, "uuid": "e0df7112-f58e-4498-a94d-9d1cd954692a", "value": 152288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772815138, "uuid": "74b42e85-9a0a-4fc2-ad4c-29695d8c427f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815138, "uuid": "a8ba6e02-4ad4-4a2c-a0bb-289c0aa186a5", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d889427-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772808917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808917, "uuid": "1b972292-357b-4b8e-8ac2-7dce94e44646", "comment": "Malware payload (PhantomStealer)", "value": "6fadeac34b74382f8bfc6d15f9431b64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808917, "uuid": "3fb3f164-346c-483a-8711-41b88e0569f6", "comment": "Malware payload (PhantomStealer)", "value": "cb26297f974f33bff2a5fb526f501b167046f3219aa11d8bb5e926f89163106c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808917, "uuid": "79e4a562-5195-49c7-85bd-35c8eea31229", "comment": "Malware payload (PhantomStealer)", "value": "8a8dbf8ad79c23db4d351fc2028f804b09742963", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808917, "uuid": "efccfe04-47c4-49bc-b65f-9ec413bbdfa1", "comment": "Malware payload (PhantomStealer)", "value": "a1a18376ef2fa01ede4c34fceaee434b5a1c547d87f1413b51120eb4735aec19b1628254ef6b63e2384f23906a9d4492", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808917, "uuid": "8dac5a78-099c-4b0e-a2d9-2ed24b2da0a9", "value": "T10E8512322D461E14C9280FBDC06621D433F0D88A1666DB7F6EFC01F86EB6B5ACD275A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808917, "uuid": "136bec22-05fd-4598-b476-63dd141498df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808917, "uuid": "6808e423-a7c3-4c80-a367-8c93aa1c2a6e", "value": "24576:Q/WujIhpLT/4PPH7caoc7aKIcsjU6UsHMdrE6Jv3oqriYg1Ai4JCHvJblNB1:Q/4LzswaoHvjxUsHcJv3i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808917, "uuid": "fe8ade48-aa41-4f85-a381-c3de81d52fbe", "value": 1814016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808917, "uuid": "c6d20ecd-04d6-48c6-821d-34e90029d38d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808917, "uuid": "ce40a5ab-52ab-4c99-aea7-3c34c21291d8", "value": "cb26297f974f33bff2a5fb526f501b167046f3219aa11d8bb5e926f89163106c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c74ba8ac-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772809041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809041, "uuid": "3f9dd297-5f16-4102-b2cf-d71183fd2ea6", "comment": "Malware payload (AgentTesla)", "value": "11fed8301c0eaf65593e1b3970207707", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809041, "uuid": "fa62719f-414d-4004-9d03-1a061bec886c", "comment": "Malware payload (AgentTesla)", "value": "cb2a33063cc222af874fbd8992a6501158674cf1228bc71a74d7d8b649e2728d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809041, "uuid": "69f20b2e-96e2-4128-8fc6-8303f33f4bfb", "comment": "Malware payload (AgentTesla)", "value": "3a9fbab10d431e5ad38c1e58def5485da3693fce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809041, "uuid": "4f68f53f-3a18-434b-b7b1-348a0c6894ec", "comment": "Malware payload (AgentTesla)", "value": "789c90bfc74898d0cef07dfd7b944316a1bd3ae5bb2021546bdac841100101eaefe3412cc55289c3e3ca46edeef6bc8a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809041, "uuid": "5098201a-44b1-4d3c-b530-9ab504a6b76c", "value": "T1175512241709DD02D4BA0FF80AB1D2745FB92E9AA902E353DFEABCDB743A75159052C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809041, "uuid": "cb370ac3-f01e-4236-893d-740eca645410", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809041, "uuid": "2d65b1ea-c7a0-439a-8c3a-22593ff29596", "value": "24576:zqu2VkFT1JZhGghQAjvKNbZbzh5s47XuMEThd8PuFRuqlvwcJT/:zeVa5hVvjyNb5QcvE78U4qlvh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809041, "uuid": "d5207909-8781-428b-8adf-8ff36e32d9ad", "value": 1291264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809041, "uuid": "5b17beac-0103-49a6-8972-95d2d9c37fa1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809041, "uuid": "849168cf-ad4f-4ae0-92c1-2c4c14c18230", "value": "cb2a33063cc222af874fbd8992a6501158674cf1228bc71a74d7d8b649e2728d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4af3451-1983-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772818996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818996, "uuid": "abd84b08-94cb-4f1f-a864-8e880ffc2999", "comment": "Malware payload (Mirai)", "value": "067df61e97c272079e67df54306fa42d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818996, "uuid": "54cb0222-f20c-4130-8439-073f2d214349", "comment": "Malware payload (Mirai)", "value": "cbdedd6f4deae17d8d5f50ecd3ddff4c5ebd9738e5a507efa54636552943a7e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818996, "uuid": "19569f5b-ffff-4433-8252-08a6b52dab5c", "comment": "Malware payload (Mirai)", "value": "e61bb9530a01280e52d49b9bcb1d5d48ff275375", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818996, "uuid": "9bc577cd-da56-41bc-8d0e-702f0bcd7c1f", "comment": "Malware payload (Mirai)", "value": "ae0a9d60563d7c4cbf12bc0a1d14d8a5b5671104888f9a2350253bdfd7cfd841a9735f7eec352ed731b735471e68e8e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818996, "uuid": "7d9b9adf-b6a4-420d-99ae-5d088a6bc600", "value": "T16B837BC2F743D0F4E8120A712277EB315A77E13D5069EA83D769AA71FD42601E72A39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818996, "uuid": "9bf5b644-76ea-45b9-b2af-2736c6cd03c6", "value": "1536:4MV7EcnKzqUHdgSAAz3Vx4l3RLF0CiwAsrswfer1K:nqzqKdgS3z34l3RB0CinszWA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772818996, "uuid": "fad0e275-6e04-4d13-9de7-710f512f76a5", "value": 83600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772818996, "uuid": "7997ed5f-d234-4387-9909-877eec4682f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818996, "uuid": "bb99abb7-b00a-43c4-8e87-c37e6a61cc3a", "value": "jawirbot.x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b4902af-1972-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811356, "uuid": "dd4bce7a-8dfc-42ca-8c83-8472b5159b6e", "comment": "Malware payload", "value": "8af73f133abd0e310102e4822c459440", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811356, "uuid": "235906ca-1a86-4661-bfef-8bbb902a5bcf", "comment": "Malware payload", "value": "cc0ac918b6ec24e7da59e7d170d3dc69c626a71d28e9ed27908cedeff6459288", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811356, "uuid": "c362548a-417e-4edd-b1e4-e6ec50afa3b5", "comment": "Malware payload", "value": "762b03934830423b39b4004305957423fbf6499d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811356, "uuid": "520dc719-f19a-4aa4-a8c3-5f1e1b745d5b", "comment": "Malware payload", "value": "4e9ad49d58d614cedbb424c2afbbf6242251e1e909769fa150b48a4a1fd501e39e9a9cd82f41c020fef643eeaa0244fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811356, "uuid": "92f4035a-28d4-4689-9855-591d24286962", "value": "T162A402237391E3BBD156C37730AE43179F30A8265716196F3390EB9968F3172AB4621E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811356, "uuid": "1d191737-680a-48db-90f0-239c42c81066", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811356, "uuid": "e9706f05-15be-4918-a94d-12ed25825438", "value": "6144:F6dE91NycbxZemk800jAPxwL58xsNSZpzTSN17tQcfNCtH6opnIQzAtcpWH8Ww:lZZesW85PSWScfY6opnYtcpWcWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811356, "uuid": "17ac9d50-fce1-4d96-bcb5-594a1283005b", "value": 472248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811356, "uuid": "32aa046d-e8e8-400b-9aec-ad9ace13819b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811356, "uuid": "096c3256-14af-46ae-89a8-f304f19d330e", "value": "cc0ac918b6ec24e7da59e7d170d3dc69c626a71d28e9ed27908cedeff6459288", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69c28f84-1985-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772819622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819622, "uuid": "4cecc514-23a3-4b8d-b111-e074f5571c51", "comment": "Malware payload", "value": "59b11a791347868d6b1f607d79e9b79b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819622, "uuid": "2329c56f-3b13-49fb-bb50-afadc9295701", "comment": "Malware payload", "value": "cc2e73eb93ec7a76c007d078f328e0a2c817f231f9d1e35b647c9c371d3cbc98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819622, "uuid": "0304c1df-a482-4d4d-b01e-987bff599a5f", "comment": "Malware payload", "value": "4d4188a443bb1560ccb59a19d5191f81df760675", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819622, "uuid": "faffa2b5-d12d-463e-abc4-0c629e345fc6", "comment": "Malware payload", "value": "636c74e8e82c846d09c1521d499b1d9d49e4f966839ab323d24eae1bbda79c844f7b6c5e79638a2ec9786338ae0ff9e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819622, "uuid": "698cd383-e037-45c7-aa07-16a1e8899631", "value": "T16BE37D17EA8540FED0FAC170478FA237BB22B8896125375E26A42F613D36F60675DBC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819622, "uuid": "e6f9822a-95bf-4cb1-9a43-24c4dfe60d8e", "value": "1536:dZvw2UNkIAmCpjUuSciCFtu/UqZ+84Wsf1N+jYFGnIpIawX4egkdw95CSMdLdzuy:cNkI3LC7u/iVWsfHDknIpIawIl1YddY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819622, "uuid": "e816d7c5-5d1f-41f6-86e7-12fa46cf8ec7", "value": 145608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819622, "uuid": "0612dea1-d803-478e-94a4-1a0cd484fa29", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819622, "uuid": "814d658c-298d-4f77-99ce-ff1dec8fbed4", "value": "x86_64-linux-musl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a35d5b32-1950-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772796955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796955, "uuid": "247d57be-ec6a-4222-ba53-cf189a2defe2", "comment": "Malware payload (Vidar)", "value": "d17f3157f8c7762b853cd24e9b2009f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796955, "uuid": "97f0ea92-60ae-4a80-afa2-17c102961f58", "comment": "Malware payload (Vidar)", "value": "cc5bfb4f33883348d5237c664f0bcf25961fc24c5bc6b022ecfe2446d9a40ed5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796955, "uuid": "a9ce8bdc-049d-48e7-97d5-2235ecbd8684", "comment": "Malware payload (Vidar)", "value": "c98cafcb23f729079e492d0af698d70d46c8c4f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796955, "uuid": "01973cb2-6a4d-47da-b3ef-8999ed39a5e2", "comment": "Malware payload (Vidar)", "value": "ae53ebb3bea4b00be50c5121fa9a410b4a184c0358c37398065155bdca62c1ecd3e93eb03b5b56440b8bad84e7c54cc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796955, "uuid": "c289ac03-4e2f-4026-975e-464219c8b370", "value": "T154959C07BCC065B9D4A9D2328AB212A17B31F85E0B3077C76E55A6B82F773D41E39394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796955, "uuid": "6648bf2b-845e-4ca8-be4e-b0657df4b266", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796955, "uuid": "cbf16b16-40f0-474a-ac6e-76bcd4687037", "value": "24576:qar+x7uoE5NvmT1T05NDjupwMy8M/L3pYcy4eFHkulIXOcsYgtriXCK1+C:q77uo6Nvn3Nmcy5GOyMYgtSCK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772796955, "uuid": "fb1bc1a8-c048-4991-a483-a4b744020951", "value": 1993216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772796955, "uuid": "7ef7857b-93c6-43f2-86ea-ac2676298f92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796955, "uuid": "2feb17cb-8c20-470d-8be7-62711ff47659", "value": "d17f3157f8c7762b853cd24e9b2009f1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d6df8e8-196c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808783, "uuid": "953509b5-f7b0-476b-86e4-b43f46bdfaf8", "comment": "Malware payload", "value": "fb3a2f3f7fa2e63bcc003f7b6409d3a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808783, "uuid": "8eac0806-f323-49a7-8886-e569a0273bbf", "comment": "Malware payload", "value": "cd4dcd82fb8f25fa353fa171c95f07af2cb8222e4922b15c60cb078068396e51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808783, "uuid": "0a1ebc0d-720a-445b-82d8-4d6add91a45b", "comment": "Malware payload", "value": "841c4c8804043f534e3db3db505dfc1942e20f22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808783, "uuid": "dcacf45a-e720-49a4-a4f5-331cbfd1252e", "comment": "Malware payload", "value": "bbf07003dd0b6d3e06349d762aa253ff67be7396fe8a9c5dad44ad555a6393719ba9095c7bfcc7bf08d999c625fad380", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808783, "uuid": "f6862798-1318-4ad0-bd3c-0dc53be434f5", "value": "T1A4341227BAE1C063D235423009BA29B79BE7B51521D45B477F18EE6F7C3E141A42F2A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808783, "uuid": "8f780766-bf89-4c63-afad-b454b5194532", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808783, "uuid": "dd0b4039-81f8-4741-bf24-2f8a8d90e4aa", "value": "6144:RcBvWb05tvaYjZjdfyGpHKHAL47aMIE7SjiW:iO05tCQZjdfyGpHKHAL48GW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808783, "uuid": "2a38ed06-a6f1-4bd2-8f09-1818d619f3db", "value": 244208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808783, "uuid": "51bbfd3d-fd16-456f-ad1a-86f436977eb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808783, "uuid": "a4a1299b-faac-429b-b5c3-c47467f48e58", "value": "cd4dcd82fb8f25fa353fa171c95f07af2cb8222e4922b15c60cb078068396e51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87ebea1c-196e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809794, "uuid": "ce0b64ea-a404-42fb-98af-27747379b417", "comment": "Malware payload", "value": "bb048c06b2c3355a3fc9546b07e31f66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809794, "uuid": "0ade59fd-96ec-478b-af2f-10334fa9bd46", "comment": "Malware payload", "value": "cd66333acfb3c6ee09e7d46b98259edd3e628089f4006f75765f6625939129fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809794, "uuid": "2668de83-0eb0-486f-8b5a-7bb4d3dee545", "comment": "Malware payload", "value": "6a708ee0f5dfa52e855404c37af4f3cb06e4ff18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809794, "uuid": "015adea4-6294-4230-8510-02f29c535ba9", "comment": "Malware payload", "value": "d5de2d9aa777a25f48343e5afa70843dd50f905e7d1e22e7b1950d1b0b167005488de970a530b6b92ffd48ac1bdb76d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809794, "uuid": "95c68884-6f7d-4d3b-b8de-7fedb5e02b5f", "value": "T17245BF027391C062FFAB91334F5AF6115BBD79260123A62F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809794, "uuid": "0e08e44b-bd93-4d0d-baa9-a26217d2c105", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809794, "uuid": "5206be66-fdc4-4a5a-8f2e-cf3a7a570a4d", "value": "24576:b5EmXFtKaL4/oFe5T9yyXYfP1ijXdaMtd5F2P3TBMRM:bPVt/LZeJbInQRaMvM32", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809794, "uuid": "263355bd-abf1-46aa-ad77-fb14481760ac", "value": 1260544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809794, "uuid": "0966b633-d420-4bc3-8a44-f74e754fa8c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809794, "uuid": "763b1869-13d4-4514-b8a6-9502505f2278", "value": "cd66333acfb3c6ee09e7d46b98259edd3e628089f4006f75765f6625939129fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "907ca1bc-18fe-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1772761705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772761705, "uuid": "329c2f2b-515e-4d0e-ba20-eb26144298f5", "comment": "Malware payload (Joker)", "value": "cce267c6ebb015f61c62234073ccb82f", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772761705, "uuid": "2adabfeb-9c3c-4170-8191-0d0fbb6eff0b", "comment": "Malware payload (Joker)", "value": "cd6cb1f97c7ea0c144879b40b2b0a1a1bd56bd0163b982f3e4a9af683efa9978", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772761705, "uuid": "31d991a5-dadb-42cc-a4a6-be3147ae8016", "comment": "Malware payload (Joker)", "value": "8e50994e94eb92bc28d40cde32447ea73c25edf2", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772761705, "uuid": "b10bb8c9-3326-4d22-bb26-bcb1ded176ab", "comment": "Malware payload (Joker)", "value": "c1bb636698c7f28c7584111d730db3cd84192e7e8bc3abb40598cde5fbf27bb685223dd37affea3ee38d3251bac59024", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772761705, "uuid": "eee5b3e0-5050-4437-8797-09f664769e97", "value": "T156B6124EF31CA01FD877643248BAD232025B4D518E92AF6B29487B1D2AB75C46F9DFC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772761705, "uuid": "dfa31e71-d664-40fc-9512-c1d09eea712a", "value": "196608:BPCqDg3n0A4dDzHd3OKTBc1LY5x6W6h/eEM0bLI2jzvIHWL8K5X:BPLgXwBbd30Y5t+HIUu+8K5X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772761705, "uuid": "6d8033e1-6921-4bd1-84f8-3acf5bc148b4", "value": 10444750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772761705, "uuid": "a213aa7f-5e9f-4d40-a641-67488c93a47e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772761705, "uuid": "d5f029a2-9384-4882-b50d-4ddc29e398ee", "value": "com.text.messaging.simplesms.app_1.5.1.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "070c3a5d-196a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807860, "uuid": "967d0d59-3039-4f91-9740-f8bf02b99599", "comment": "Malware payload", "value": "938ae8c79faf89f90cfc3e7106692d29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807860, "uuid": "1750b86f-3e36-4248-9701-1ef13ea4c13e", "comment": "Malware payload", "value": "cda3e360f0c0865942c82ab048cd4b90b83d1552aaba9fab4b4f91e18d69d703", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807860, "uuid": "000184f9-3c07-4199-bbf1-f2ef4e737950", "comment": "Malware payload", "value": "945aa34bb604b7dd6e69f5753a58102b94ba793d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807860, "uuid": "69406f28-e04b-44cf-b6c4-3920aa749d2c", "comment": "Malware payload", "value": "255396cc4abd806ec8cde6f0bda3189a7456140356301616938f7ae76e426dac353537fdf012c414146c19001bc9018e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807860, "uuid": "b15bbdb7-6898-41b1-8bd1-1f13f4295086", "value": "T1DA75236055ADC667E9EA0BBA2971D33123B1AD9AA112C3138FD97DE73C667C30D58303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807860, "uuid": "ac9b37be-0fb2-435a-97ae-b99717ce2be8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807860, "uuid": "54b20b2b-67b3-4585-bdd6-02e8c0b181b8", "value": "49152:gzHxuZ6lHCTKM4/9aDAiN054i0t3su0rs7LjDpQcu:j8jMU9aDAiNz/6rsPjDp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807860, "uuid": "e1caaf91-f70e-4ff1-8ca0-31ec0811e672", "value": 1609216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807860, "uuid": "25a2cf08-19dd-4a6d-a528-0db1d2b3c237", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807860, "uuid": "4bbea14b-4a66-489f-8691-30d90c872fb5", "value": "cda3e360f0c0865942c82ab048cd4b90b83d1552aaba9fab4b4f91e18d69d703", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e9eb67e-196f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810100, "uuid": "7788c0db-a4ac-4faf-9626-54b4a3afae9f", "comment": "Malware payload", "value": "cfa945642689791b203c483cca698949", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810100, "uuid": "884a52f5-c0f6-4c2a-bc17-45300a9b8152", "comment": "Malware payload", "value": "ce261cc27b79c8bd9f57e8053cebb89e0336687565265680d6973f147d8ab1e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810100, "uuid": "f5fcfabe-2c98-490e-bca2-62dbdfc18cc7", "comment": "Malware payload", "value": "52cc314f8a4f92b6bbb854ab293241b24036210d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810100, "uuid": "cc7a0255-d625-45bf-a515-f519984607d4", "comment": "Malware payload", "value": "67d5aae4b55c13d756fda5d1eb949b6673673e9a2a7db03ec087aa11a6f790dc81d4717ea97956c36eb587344f69fd14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810100, "uuid": "b4f9cc5c-595f-47d9-99dc-b72d3bffba34", "value": "T13A96339FAB2292AFE7C13A32612DE51773D0197C33C3E1CA950B5BA61E81D275C1DA1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810100, "uuid": "20278042-5121-4925-8650-7157ea36435e", "value": "35a81d16af9f2ba6d515f11152d0364b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810100, "uuid": "4fda9f2f-f3dc-4a72-8af6-ff3ad4e1dc8e", "value": "196608:K3e8Y9DtK0oW1B6ohlK1e1kplgS3GX4Yjdsgshxx/k:K3e8Y9DtK0R9hc1dplgequ/k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810100, "uuid": "61733f2e-bb23-492d-af81-b02127d2ddda", "value": 8825752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810100, "uuid": "4a97cc37-e6de-4290-8d46-f936056d9219", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810100, "uuid": "57be0b1b-d8b9-4c43-bd56-3e5679403696", "value": "ce261cc27b79c8bd9f57e8053cebb89e0336687565265680d6973f147d8ab1e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6d2a50a-1972-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811671, "uuid": "5881fe2e-d8e0-4fa9-98c5-c5e3ea07ab92", "comment": "Malware payload", "value": "7263c3c4bdf4e2c82126331573715102", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811671, "uuid": "c5da1eed-436e-4cfd-a507-5eef2220fcfb", "comment": "Malware payload", "value": "ce4cb9bad8fd206592fdeb7aec338f5f1d0e9e0f160d41bf7f7ee39a7d8a45fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811671, "uuid": "d7adeb14-39a7-4446-afa0-66c5c7aa0a5a", "comment": "Malware payload", "value": "05ca6c2742aaa8e2bd43956cf4c9c6df339d2a58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811671, "uuid": "00e8ae7a-4e66-4a81-b99b-c8ca0a7b108a", "comment": "Malware payload", "value": "effd039013dad4f93875a5b3cebfe3a4201326f3aa7de783e7052a8dab208ecf8752bccf873aa172adad9cddbe94eb32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811671, "uuid": "9b7bd377-4374-402f-9f97-0cdcfe96eadf", "value": "T132C533BDEB725E6FE0AE43F79D7743B1EF58D30941CAD197623A0E5204213EC2192226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811671, "uuid": "dcd36bd6-2840-4011-af4e-604887fe5083", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811671, "uuid": "0b98c6dd-df22-4029-bba4-6b03df134d2f", "value": "49152:fdgBup2kaur5Vg93ZU4fHx8tPBSGIdZHrxqPVIxhEJJjLmNGbnvpR:lexur5+JQEdZNC46RR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811671, "uuid": "a8422dc2-0bf7-43a2-bcfb-be0bee3e8975", "value": 2725888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811671, "uuid": "d8786b47-0acf-46d8-a9d4-345a1d3b706e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811671, "uuid": "94ddebf5-166b-4343-8eea-5adf7a4a7e1d", "value": "ce4cb9bad8fd206592fdeb7aec338f5f1d0e9e0f160d41bf7f7ee39a7d8a45fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac45bbc5-196a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808137, "uuid": "8a98ef37-19a3-4da6-9f5f-d3674ba1861f", "comment": "Malware payload", "value": "5b68cceb5c3db8f8057ba8634e064970", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808137, "uuid": "af74d39c-ee53-411c-a9e0-dbed6dc4a3e9", "comment": "Malware payload", "value": "ce9c767e5ed0d986e1245fc5523f94cc0b360c5c5fc9e9cdc42b2f3716ef26db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808137, "uuid": "a7223c3d-41f8-48a4-8702-9395e8ede0d8", "comment": "Malware payload", "value": "d5c78ceb734d1029ecb9f10cf245e406e19ac639", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808137, "uuid": "38d1decc-c879-480c-8f60-a448484b71d9", "comment": "Malware payload", "value": "d0f7f5a0b9ce5c90088f56f549777e79443778864dae45b071ddc73d54a4961c357afd3bef8010bba38ed8acc134a1a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808137, "uuid": "353298d5-753b-4db6-948b-c67a1b0651d7", "value": "T1FF55F10727D049A8E5BC8B79D6B900E443FFB7476B22E75D680A11E78D22746EF01B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808137, "uuid": "d88e3437-6eb6-45fe-b878-7ae4362a070d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808137, "uuid": "e6bafa10-405c-4120-8fd9-ca766468e5b3", "value": "24576:JOfZNC8ZHKJCX0fI8mVS7C3ZKbcbgREVRClRaHzi:uZWWgI8mc2Zc6Vuw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808137, "uuid": "ab088575-18d2-4978-ac33-365a7bf3b6b0", "value": 1368576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808137, "uuid": "f0f65c65-3335-42ab-9794-af8fda744dd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808137, "uuid": "09d00715-77b7-4ea7-96d6-5543b65380e3", "value": "ce9c767e5ed0d986e1245fc5523f94cc0b360c5c5fc9e9cdc42b2f3716ef26db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbc36c6d-1969-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807841, "uuid": "f22e2c83-cdbc-4796-90a0-cbd3df15bf55", "comment": "Malware payload", "value": "d2cd4400132f1c88f3a4ce141266bb08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807841, "uuid": "f8d45f5e-848b-49a8-a261-a0afa0cac360", "comment": "Malware payload", "value": "cea0a539a99cd6f08d8df39797a2e567804b67315463943c0b66f8c7201088f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807841, "uuid": "83d80291-23db-44f7-b248-f6f2950bcc02", "comment": "Malware payload", "value": "a60c0522888c363bc87edf812b3c0a77f8b6f57c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807841, "uuid": "3805de62-c002-4075-95f2-bbb8026685b2", "comment": "Malware payload", "value": "d1e4b4e817df3e7bd096923fbca2b275133c4af5d6ce9ec697af5b453c34a5ad406b739cc60488f002bdc872ea5bb77c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807841, "uuid": "065d4250-752c-4da2-929c-153feafb3cd7", "value": "T1C41512611B12648FE0530974ACF177B5FAA49E663BA8C3C27A90F548BD3B3454F253C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807841, "uuid": "58aeb2c8-0425-4490-9c78-f859186c227e", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807841, "uuid": "fdd5be75-4f57-434a-aba8-897c7040ee6d", "value": "24576:hHO/MdQc6o7t4jj/+e1d+WdBz6kqd43jbz1HVkMIwSqLbBYNGT:hHO/u4+I+WdBGzKb0wSqp9T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807841, "uuid": "10b139bc-1e52-48bb-8dfb-e2ccc27325bd", "value": 890032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807841, "uuid": "f3e75012-e9e4-4fb9-bba0-4653a0a0c9c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807841, "uuid": "89cb5a45-22ae-4769-ae43-45978373dba3", "value": "cea0a539a99cd6f08d8df39797a2e567804b67315463943c0b66f8c7201088f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe01d805-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772808703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808703, "uuid": "0052d7ae-124f-4006-8f3f-22754c5b2c7a", "comment": "Malware payload (Formbook)", "value": "1e19a8f371a690809ecce6793334c0d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808703, "uuid": "0069eee1-63e2-459f-9085-39ce3f395ef7", "comment": "Malware payload (Formbook)", "value": "cea1d12aa2845d2a90fad75a30df6985c342e80bd9327c0c4db49f75a4f3bcfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808703, "uuid": "edd972d8-5150-43c5-9e52-7c19a3a8cbae", "comment": "Malware payload (Formbook)", "value": "a7d1ccfbde0ec23d5b036ee0db6fbe813a2336ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808703, "uuid": "e487b54a-a23f-46f0-8778-9de98f5e2bed", "comment": "Malware payload (Formbook)", "value": "b4ad6c8c078be8db1c5e7b10e0a56689e27e3c39bde80e41e8e2d58f87057e82f47bc062046bf65eec31e1b8eb9aff1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808703, "uuid": "8036262f-5422-4ef1-bf0d-e080d89c8166", "value": "T1B43501583B19CC03D8625FF019B0D3B466B82E8DE814D3938EF6BEDBB9797412945382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808703, "uuid": "bd97dab6-ce98-4073-8841-e02551499d40", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808703, "uuid": "571381cb-90fd-4a71-b5c9-bc4b00dbec87", "value": "24576:lequ2V0Ct+Iz6Cd2WdNBcb9dLQ//6/m9++TxmpmRElUE:leeV0XJ86hQK/M6UEOE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808703, "uuid": "d1a3ce3a-74f7-4d4c-85f1-f179b5b1827b", "value": 1093120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808703, "uuid": "85e3b077-66e6-46eb-93f4-5024a09af04e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808703, "uuid": "5af0fb24-384e-482f-a9ff-3f1040169626", "value": "cea1d12aa2845d2a90fad75a30df6985c342e80bd9327c0c4db49f75a4f3bcfb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b08e62f5-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1772808573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808573, "uuid": "d9222041-cc84-44ec-8617-f5841e1017f4", "comment": "Malware payload (GuLoader)", "value": "5d966542f52352043102e66d4ebe9cc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808573, "uuid": "18b12d8e-e73a-4fa2-96d4-55bd0d22f716", "comment": "Malware payload (GuLoader)", "value": "cea43a68ec88fc4246b096fe93be15dcaac13c2ef8267f29e30efb44615a94a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808573, "uuid": "2cf58cbf-3f4a-4780-a165-b91f8d371116", "comment": "Malware payload (GuLoader)", "value": "86317b834dfb99e5cb29e2e7b35bc06537e372fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808573, "uuid": "f367d20d-9f08-478c-9c49-56ec8116b984", "comment": "Malware payload (GuLoader)", "value": "4dc985ae08a59b877cfde06cd257907396e5b41eb856d4f80623644d3864bc768e43df336882799fe0e015299e2e7611", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808573, "uuid": "b04444fa-a823-416d-a349-a76723b03608", "value": "T1711523206DC1D683DD155A31B5368FB267FEEE3206D883261B72BE5C2E631865A0F721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808573, "uuid": "ea2cefb4-145a-4043-940b-6f92510832ce", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808573, "uuid": "4fab1664-3457-4f25-91f6-83dec33d36cc", "value": "24576:gN81QiQUHQvjSxi9YGkFL1bbxJDQVuoqjyFa/nJNGrkz:Av5/99Yh5VonKUahQrkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808573, "uuid": "fd89cca7-7c72-4616-8f31-4178e576cfaf", "value": 893657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808573, "uuid": "8d339f3f-a5a9-41fa-9450-2dc5ec4bc1ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808573, "uuid": "76196187-4792-4658-8854-f60fecac29b2", "value": "cea43a68ec88fc4246b096fe93be15dcaac13c2ef8267f29e30efb44615a94a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db9080e8-1972-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811652, "uuid": "7dbffc4f-8351-4de4-b51a-06175b099d09", "comment": "Malware payload", "value": "a11d6570770c570d4491e89803f326a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811652, "uuid": "e4cab618-0b7b-4840-b59b-e5858f3d5ec8", "comment": "Malware payload", "value": "cede4b642824918bdaeab1d518c34318ccaebc35b3ff942623aaac07ad895305", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811652, "uuid": "72a9d8a1-fe86-45b6-8efc-d08bb00ace8b", "comment": "Malware payload", "value": "c4ef89deff4500a122f225a03782b6ec0985a928", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811652, "uuid": "fb42c94c-3d26-41ba-993f-0ca6f8a60df8", "comment": "Malware payload", "value": "c9f3bf40bba3bb31ec55bc0c08f8c60b4753744b7194922c4028751f9464bb956b0622b179488093180d9566cf751135", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811652, "uuid": "c331d716-c00f-47f3-b500-4c3aeb0693a8", "value": "T17E740812E7607426F95385702EB8A65635283D3A1680ED0BBB8D9F4A3771AC3B4F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811652, "uuid": "eb308819-65e7-4277-9ea2-8a28d7667cea", "value": "21753e9d67f85b5312ee8bc3083cf369", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811652, "uuid": "9e40d3a7-c205-4d81-b9ae-88a37409db3b", "value": "6144:xS6OIACrriVJWRw0eJFXDLslnA5momw7FrEBsReZzClu:xSbaRw0eJFXDLslgYw7FrsmeZG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811652, "uuid": "763e5cc6-c709-45ca-b246-49ec0720f981", "value": 348160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811652, "uuid": "df14f12f-7936-49ae-928e-e80e05ac4c53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811652, "uuid": "8485a776-b89e-4e9b-b82d-068456ea172d", "value": "cede4b642824918bdaeab1d518c34318ccaebc35b3ff942623aaac07ad895305", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04a14442-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819022, "uuid": "2d8d3bb3-3bfc-497c-9390-61dbce4d0393", "comment": "Malware payload (Mirai)", "value": "cf46dd76a0cc16b5331838fdba356326", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819022, "uuid": "0ee3a0b1-dfe3-4938-b14e-6383fe4f9ac2", "comment": "Malware payload (Mirai)", "value": "cf0d8b4ccf8b9f7d2852c68ff2eaf839f33844ba276f268b061599e6e6b9203b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819022, "uuid": "5342321f-51f2-4fe9-a9b2-4806423b0771", "comment": "Malware payload (Mirai)", "value": "933fcd5c3681c02c3252d02c907a3ff76bc9613a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819022, "uuid": "ee43aab9-2e29-45cf-8a48-82ee7c1e76ff", "comment": "Malware payload (Mirai)", "value": "ef66660072218b27134cd4978dab15dcaafebb45fa668301da485029d8934334f2be9613008586a9750a2b0976fdbf8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819022, "uuid": "929b96c5-8a7c-4bc2-a4cc-228a115276f2", "value": "T172C3AE83FA8728A0C86207F003C70FAD6F93A111CE5FD4E7AD1DA67B5A7A0DB1516781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819022, "uuid": "b839fc05-7992-4d83-9062-404cff057e40", "value": "1536:hm33/oJ1EMlGnzyhE9UWlbjZbeG4S81lT8014pxs5tOg1SE8/LW8:he/61EshEeQfleG4vK014zgWq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819022, "uuid": "6b84feda-167f-4c80-b347-d6fc648f7db4", "value": 124676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819022, "uuid": "0a16e5e0-ba70-410e-af62-d9a2c41f3093", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819022, "uuid": "d31e18b1-f663-482a-b682-f3d0ac2c7403", "value": "jawirbot.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2d6f1e8-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772809409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809409, "uuid": "4454adab-9634-4bb7-846a-51dc7de9e963", "comment": "Malware payload (GCleaner)", "value": "5c204ac97d557de40f02e9d0c6a4af05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809409, "uuid": "f744abde-055f-4a4e-aa97-58fce9efd17b", "comment": "Malware payload (GCleaner)", "value": "cf50e23784e95859a894ef868efd6bc61e03c177d4133607f72fa9400d98cd8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809409, "uuid": "a94fb96f-edaf-4a09-992a-7dd83b60a2c9", "comment": "Malware payload (GCleaner)", "value": "fe4cb5f5359e621aa95decce431b849c1a156166", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809409, "uuid": "dc46e33a-bd21-4182-85f6-8cc23684776e", "comment": "Malware payload (GCleaner)", "value": "dc3a8356d61b3d3ef05f6f5af49059c28795cdb606f6bcb481e135272f96982aefd29553134d72e58c9822527f7d29b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809409, "uuid": "a11f5205-7364-40bc-b7ee-fd1c1c4b2014", "value": "T1ACF49E25B6E14437D1636E788CDF62A7D825FE812D28597E2AE41DCC8F3938134E62D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809409, "uuid": "ce96dc79-76e7-4a42-984c-78ded08b691d", "value": "345624d13ffc2b7f296b9d2972b1c0a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809409, "uuid": "921ec014-1eb5-4a4e-92cf-8ea8ff1f8c6d", "value": "12288:O48VY65TrPsgNDHZ8nqRea6okyu1XhBt1e:f+7PfJZ8qB6ok9pft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809409, "uuid": "964ee969-da10-4f90-80f7-455854e46724", "value": 759808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809409, "uuid": "d0b2da1d-84dc-4000-b8da-49d16dc5b468", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809409, "uuid": "e5ebd86a-2a9f-45ef-9462-55d8fc61b3fb", "value": "cf50e23784e95859a894ef868efd6bc61e03c177d4133607f72fa9400d98cd8a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ae9cd6f-1963-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772805021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805021, "uuid": "51304373-6933-443d-a9bb-4b05439e46fe", "comment": "Malware payload", "value": "6c095337077674dd62b196bbd0062b7c", "object_relation": "md5", "Tag": [ { "name": "abcknIe", "colour": "#31F8E7", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805021, "uuid": "eb6f1a3e-1e09-4657-98c2-0b7c0767bb8e", "comment": "Malware payload", "value": "cfc8e1861f0064c16f7e6552ab90be74e5718165f0ecd032255bcceb0f0a504e", "object_relation": "sha256", "Tag": [ { "name": "abcknIe", "colour": "#31F8E7", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805021, "uuid": "7bf30ae9-43b5-45f5-ae35-fe966548a61f", "comment": "Malware payload", "value": "cd318783d538fc766c93c7dcf92f099ca6ac36c0", "object_relation": "sha1", "Tag": [ { "name": "abcknIe", "colour": "#31F8E7", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805021, "uuid": "a590b264-f091-4c82-947b-bfa6383eb9d5", "comment": "Malware payload", "value": "899b7ed31ed4b4a9c2dd84348835a6dc5641588d87f8f9903e86f6cbce0717b2a6dd35b68534c9a969b535e0cbfbd3e2", "object_relation": "sha3-384", "Tag": [ { "name": "abcknIe", "colour": "#31F8E7", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805021, "uuid": "bb9fff3b-dce3-42d5-a114-b64b79fd73e2", "value": "T1C4634AB35493FDD92F2A1C10E4043C502CED6DAB96B89A68F98939D470D5124EFBD8F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805021, "uuid": "699ef8da-ad70-49fa-8581-5468029394c3", "value": "1536:WzKNDPe/hMpTSqM69YQ9Kj/Krn2E0ZY79fCIZSBNXDYDD+nUf91z9L9PEJo2/N0P:WzKNDPevqM69YQ9Kj/Krn2E0ZY79fCIv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772805021, "uuid": "3ea3189b-a367-44de-b20f-d1cc7b54e6b3", "value": 67647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772805021, "uuid": "70a89470-b437-499f-8e3f-4de2b3205e23", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805021, "uuid": "7e8de033-3bc5-42d8-ba0b-ddac1dd60d3e", "value": "raw.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6af38cfc-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819194, "uuid": "79ede9b4-fe21-4bfc-ab7a-04f162af4546", "comment": "Malware payload (Mirai)", "value": "6ccbd83abef838fb4d3789beea7712a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819194, "uuid": "3b51432a-65fb-4db0-85a1-e3512511fb8f", "comment": "Malware payload (Mirai)", "value": "cff577fe1c3b2793b27b7bb061af86db8cff1e839e9303ff5c51ef337470248d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819194, "uuid": "82fff1ed-8fd7-4b3b-9375-d01d47684a78", "comment": "Malware payload (Mirai)", "value": "67b617afd55e550ee5527a34562c92edf38c4ce7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819194, "uuid": "fbf5640c-7239-45d9-8566-4fe335666d48", "comment": "Malware payload (Mirai)", "value": "8603d670d7d0026b77f233a4ee5275b09104fef1362c380ae9f1ba55797254d6443f28e67e0d742dd7bb7db5d1be523f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819194, "uuid": "151a1896-7e59-4630-a0a7-8e8fb43b5a4a", "value": "T119D2A14E2D229FECF62C85328F778E20A7A123D623E1D684E75DC9005F6120E556FBE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819194, "uuid": "7926b333-0039-43c2-8d44-82301ecb8743", "value": "384:iZ3TRKbP7GJbpL4Xud+sviqWcM4r6RTJ8LGHjk9a8Od24KYwUyP2DSxDcx6N2ADk:SsjYbOQtiq1MyGD4VEbjxyDFS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819194, "uuid": "86a8128f-cfba-4521-987d-b7945841d462", "value": 28968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819194, "uuid": "dd05145d-9da1-41b3-bc7c-1c793e6b4afa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819194, "uuid": "110276f1-d938-4556-ab65-1964920162f8", "value": "violetmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6a00060-197a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772815133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815133, "uuid": "5bd92f38-7723-43b7-a374-86da016a98a1", "comment": "Malware payload (Mirai)", "value": "688855d0f65db6456a62a9fa3d2c11e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815133, "uuid": "9b2f7a91-f086-4bf7-b307-c6504c519753", "comment": "Malware payload (Mirai)", "value": "d10173050b1d9e93e455c599af58d97e15cefdda008ce7ce00b10d1288721e8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815133, "uuid": "5cb0c5db-e2b5-4b66-9689-4f5cd24a8075", "comment": "Malware payload (Mirai)", "value": "ed80efe9012024a048b619e20c5db82001317b21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815133, "uuid": "0bc25f06-fa5b-45b1-8b5f-89115687cf35", "comment": "Malware payload (Mirai)", "value": "773fc03abe8d50f5c57ab23699f77785cfd089dc73947b155a7fc19f9585854744359f0f0edca15a0db0aabee0060e7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815133, "uuid": "b92aaef3-1db9-4fca-867d-69bfc8d30d1c", "value": "T1ADA348D7B401CDBDF84ACB7B4453590AB530E3620A831F36636BB967EC361981927F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815133, "uuid": "a756b7c9-98b7-435f-9f51-f8b22a4c519a", "value": "1536:ZuBzQ1QMflgBWwlxnA1W8qHW4nkVds6a8n3+HLKaWJ3gGVl6KzLItGe4FsIfSn:ZuegswDnA11L+kVds62w3gglZK4FsIKn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772815133, "uuid": "2bb1cbcf-2ebb-4c13-b882-b06df37d31f7", "value": 99840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772815133, "uuid": "b02273b0-9788-4a66-8db3-f1d77d7effc9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815133, "uuid": "eecef27c-1ed8-447c-85fe-3772c712c343", "value": "titanjr.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ed18216-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810450, "uuid": "eec7625d-60b2-45dc-af9b-ba78c0180ec9", "comment": "Malware payload (GCleaner)", "value": "5fab8ed6524b8d8331375854a5fda89a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810450, "uuid": "81fc4b07-a459-4089-9ceb-6445f6bc926c", "comment": "Malware payload (GCleaner)", "value": "d12c5876a52a22a41429326723e22f9d9ffed07c4d91f7ee0a3361464fce56b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810450, "uuid": "ab8b68b0-6f3f-435d-96d2-51b3a32d4b9a", "comment": "Malware payload (GCleaner)", "value": "cd18151e896b5198b538302ba4ffd0964a99b6bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810450, "uuid": "85984082-5506-4f1a-b8d3-2476ba14629e", "comment": "Malware payload (GCleaner)", "value": "e77f69a1c8483edd981d3f856067408276125456664bcf746fa01eb89d3f4b21c5ec95f7ba8c4cecec8bca977150ed0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810450, "uuid": "bb544a87-9a27-42bb-b7b1-d06e6364e870", "value": "T1CD059022F2A15733D2631B39BD5B726CD426BD112D39684567D81EC83E3B682B4EE343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810450, "uuid": "329f8f43-6dd0-4d10-a7a9-5c87aa7e78b3", "value": "5343399a39928268750ade4858cbd1d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810450, "uuid": "8e74370a-ee37-461d-b1c0-4f0b3f150efb", "value": "12288:O2d0/V6Chk61Wd0Mv6jE/h/EkyYkB1YNGOrpWXD6a2F0T:76N31WB6YJHIB1YoopKD6pF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810450, "uuid": "ec32bc91-e323-4ff1-9350-48df6a2da78d", "value": 813568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810450, "uuid": "3f940ee5-1305-4bc7-ad9c-f204b1a2ad0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810450, "uuid": "0d9a28ee-3f45-414c-8b59-d4f7079083d1", "value": "d12c5876a52a22a41429326723e22f9d9ffed07c4d91f7ee0a3361464fce56b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6035d3c3-193e-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1772789111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789111, "uuid": "bee56d26-7928-451a-a7aa-e6d989110dc4", "comment": "Malware payload (ValleyRAT)", "value": "5a93ca1560e5e9689620887be0f110b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789111, "uuid": "55a69d5d-eb45-466f-b4ff-1336cbd64871", "comment": "Malware payload (ValleyRAT)", "value": "d16696ece5eb6833f6497b70a5bc894a32479a52f19b1f5dd49be5473f8d2ba5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789111, "uuid": "faf92065-225c-42d2-82cc-720af3d22728", "comment": "Malware payload (ValleyRAT)", "value": "d6f688726227b0ea0bbf4ab6bb6a93b5c28a631a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789111, "uuid": "8c4798ff-37e8-4f5a-a068-8e25384b7ca5", "comment": "Malware payload (ValleyRAT)", "value": "5578cbaa2537a7ca7ea2ecf1a673ebc1d487d41140e0547d04ebeda15dbf49e6a177cdfed82e874fb3b8f41f29560985", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789111, "uuid": "1472e8c8-f2cd-46e9-9d97-ffd682c6c47f", "value": "T15494D01175D2C473E9B215300AF8DBB95A7DBC210B359AEBA7D4077E8F302C1A731A66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789111, "uuid": "62f200cf-2376-44dd-83eb-a05a703c2d82", "value": "a035ee702e8e6269a6c35195019f1c86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789111, "uuid": "ea8030f7-fa9a-4ab8-bec5-cd8efcfefd34", "value": "12288:F6I9oJimDwgjNZxxbmKjwp+2C3/7WNT4c2Ds07HZfmKCEPXAP3:F2JiXUN3gymOTo2sCHFLBXS3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772789111, "uuid": "d8593cf6-082a-437d-b0f8-b803f501cc2e", "value": 440832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772789111, "uuid": "dab66fd1-3a7c-4549-a748-6858cad26f0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789111, "uuid": "930cef4f-3d5b-4de3-88ca-338cf50e8128", "value": "2026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "835c7c38-1971-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772811075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811075, "uuid": "e85f4dcb-8524-4b59-a100-6cc8dbaf2b02", "comment": "Malware payload (GCleaner)", "value": "ef4b61054be37f6c34ec077892fc37cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811075, "uuid": "aa052d65-547e-492a-8202-1e3227f710bf", "comment": "Malware payload (GCleaner)", "value": "d1676e001f2c73b10c4c116bcbd36871b7e02a18830d17f7be522a622ad57416", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811075, "uuid": "efb1b377-b2dc-4a81-8f3d-8db507abf2e3", "comment": "Malware payload (GCleaner)", "value": "69caa3d07ada74eb23ce50eabf2a483e3818383b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811075, "uuid": "5ab3e3a7-2eb1-4317-baad-b8d3233c90bd", "comment": "Malware payload (GCleaner)", "value": "0fbf5a444b8412502a68999a315ccfa3436ce4cce575e46c6c3ddaf722a66b1fa2468db21e487490b9a15c811966d796", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811075, "uuid": "2a2fa6ac-274b-437f-ac08-3beb24061742", "value": "T139F4AF22B2A34533D1673A789D5F96DC5826BE0D7D24684A2BE82DCC7F3C741782E253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811075, "uuid": "f018dcdb-9f69-4cff-98ab-2ddd2504520d", "value": "5343399a39928268750ade4858cbd1d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811075, "uuid": "1fed26d9-885e-4bbe-aea5-c6145c97c86a", "value": "12288:n2d0/V6Chk61Wd0Mv6jE/h/GkPbE/cnHvHLT3famWUpQ7l6:C6N31WB6YJdzXnPHLjDZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811075, "uuid": "2f870864-5e81-467c-9c22-ab7c2ec3dbd1", "value": 770048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811075, "uuid": "4004336e-8d2c-40e7-9ca9-a0897e6b75e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811075, "uuid": "a7ae7c4d-3f9f-4ae0-aedc-90b3a620d69b", "value": "d1676e001f2c73b10c4c116bcbd36871b7e02a18830d17f7be522a622ad57416", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ce33c34-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772811547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811547, "uuid": "2cecd1b1-c94e-4a33-bae1-0472173f0367", "comment": "Malware payload (Formbook)", "value": "a3dc45ddeeac98050a238087a0bd22dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811547, "uuid": "45074d92-713f-4f61-bff6-fb879c11fcd6", "comment": "Malware payload (Formbook)", "value": "d1da5e68419ac6732ceea1962b8eca991d422b73132042259c60f261d2bc2410", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811547, "uuid": "d8817c04-65c2-4bce-977c-79b92201eb33", "comment": "Malware payload (Formbook)", "value": "401bad2575b4edaae656caa98d3de1ed0eb30a47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811547, "uuid": "0626abcb-fc75-4115-b251-f8634e230efc", "comment": "Malware payload (Formbook)", "value": "789e58513747b0f4fc6ceeb066cf052cb1c1115a4bb20c9afe3cd75f2f8fe1430d6502240720c809d6d28e32758914f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811547, "uuid": "1c8aa025-335a-419c-ade7-e8527ca822db", "value": "T13F45BF027391C062FFAB92334F5AF6115BBC79260127A62F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811547, "uuid": "f3309422-6a6e-476e-84d8-035464b5f7ac", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811547, "uuid": "0cf2d428-7628-4ab9-b855-459065a42f02", "value": "24576:F5EmXFtKaL4/oFe5T9yyXYfP1ijXdaNZoWe1JC6P9Ixx1xba:FPVt/LZeJbInQRaNijDC3t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811547, "uuid": "eb7b8ea1-a02f-43f0-b9f3-86557483bb59", "value": 1271808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811547, "uuid": "ecbf995a-b6f7-4065-af29-95a379da2b7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811547, "uuid": "4e303947-fa28-4921-ab1a-4d406600254b", "value": "d1da5e68419ac6732ceea1962b8eca991d422b73132042259c60f261d2bc2410", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28a8e2cc-196a-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772807916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807916, "uuid": "89f99b63-a286-432d-a779-b11f705e135e", "comment": "Malware payload (PhantomStealer)", "value": "dc4c5ccffa81caaa05204fadabed0734", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807916, "uuid": "2dc21685-f990-49c9-bc7a-d249b362a5ed", "comment": "Malware payload (PhantomStealer)", "value": "d1df0c9a1ce7bcdb7869a5813baf1a4d25bb2ec2c841fe0d01204e494d80ca07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807916, "uuid": "ed0a80a5-51db-4c30-9315-2eed666df07f", "comment": "Malware payload (PhantomStealer)", "value": "68fcce4df7bcc792943c41780fc5eb26195b2a3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807916, "uuid": "239d3b69-df79-452c-b37d-869dd4a08ad0", "comment": "Malware payload (PhantomStealer)", "value": "e0c5773084097558ef4b32c8f00cc379ab345ac898a5d7f9e8bb50c03ac82659a88b31e061adfdaf5080e0197a3ac1b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807916, "uuid": "768d765e-37de-4c03-9377-d4e45ea5c532", "value": "T1D475236111ACDC65ECCA27FA1434E33407B44E7A9511C35A9FDE3DEBB996B412D08B83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807916, "uuid": "073f9028-63b4-4b4d-a652-f430e9f884c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807916, "uuid": "23fea3e7-eea0-4383-9b90-d8727e9e1a10", "value": "49152:kzHTub8/FD0YlIwhzhIgN2BcpduJEXafe8FxHOVN8jQIVQc1:Nmesz+guudwqJexH8IV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807916, "uuid": "c0f5df1b-234d-4958-b092-1999a6b08fed", "value": 1606144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807916, "uuid": "67cf2854-e5fa-4b33-9b21-8aee7d72c793", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807916, "uuid": "95e86de5-f1bf-48b8-aea3-6024b534ddb0", "value": "d1df0c9a1ce7bcdb7869a5813baf1a4d25bb2ec2c841fe0d01204e494d80ca07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1403ae7-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772809085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809085, "uuid": "ba242073-4d7c-489c-908d-d4c7d238ecaa", "comment": "Malware payload (RemcosRAT)", "value": "9a1d5a45ae1f8284a929219ee2e110e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809085, "uuid": "3825f10b-3ee9-43c2-a221-c77ac9ad18b2", "comment": "Malware payload (RemcosRAT)", "value": "d1e90b1144b37e6dbb21f46d5777bbe66dbc4152013d9819e4225c46d7da8dfe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809085, "uuid": "b83adf8a-7e81-4dd8-9ccb-9fc7a9ff01f2", "comment": "Malware payload (RemcosRAT)", "value": "2f5a1762933287f6fa6fff9b9043744c57037558", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809085, "uuid": "8a88c8c0-91c4-47eb-a8a9-cd3247cd9e91", "comment": "Malware payload (RemcosRAT)", "value": "2d54397cdd7f8c089b7ead09d5af3d4c479335ca50e0453dcb0fc500362e291e47b208665dcc227ba4298c0356e5c1d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809085, "uuid": "74e5ef46-3f96-4c8e-bcf7-bc326bc90c9b", "value": "T19D94F24BEB1BA860C2898473CDF548FBE7709C22A056183E3391BF1659365DE8D1D63E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809085, "uuid": "5f67ddd7-cc84-4166-bcc8-bbd96f58681f", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809085, "uuid": "8733ceb8-82d0-4c06-9394-aa41731718fb", "value": "6144:wNDlOLZLClTgENzd74/wF9wczdJtx+KS2hSzNm95FBI+DUeW3O:wk8TgENzJ4/knpJtx+wSzK/DLsO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809085, "uuid": "11188697-ee12-4074-9932-25c8c9cf4ef9", "value": 416336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809085, "uuid": "c86d7f5a-da44-4a31-8199-566046b74def", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809085, "uuid": "a50f6777-3a4c-4c5d-be49-005ecdcc1bca", "value": "d1e90b1144b37e6dbb21f46d5777bbe66dbc4152013d9819e4225c46d7da8dfe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83470778-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819235, "uuid": "e69c20b0-c42e-4a3b-9e5f-f3faf13c3caa", "comment": "Malware payload (Mirai)", "value": "870bc254ef586de382728aed00df5d1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819235, "uuid": "9db814a7-751d-4847-bc35-210a4a3e9e2d", "comment": "Malware payload (Mirai)", "value": "d2537370a8e859756cdb2a6bb995245ff3abd63ec66c0588762cc415f0f2b88f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819235, "uuid": "199a72c7-fa0f-4de4-8177-a9d117bf3064", "comment": "Malware payload (Mirai)", "value": "7a1423a302ee0ac166af0c0f01df7becd014334b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819235, "uuid": "73392449-f643-4c9d-a419-f6db5c50fee2", "comment": "Malware payload (Mirai)", "value": "125687266d5ed96511a62ed974a965eaa865110594bc168bd13fe9aae59b4737aaaf86936b4e36ce0fa1c6f2f84abbfa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819235, "uuid": "77de0d80-3c9f-4b75-8315-a6944c411058", "value": "T13D240A41E8548B57C6D22BBFF78E429D37365B1897DB33019E24AEB02F8578C6E3A111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819235, "uuid": "0bed1dc9-e2b8-436e-9c47-3af4cbbef7c7", "value": "6144:t6mPMXTnPt0nygajMeMoln1NveOjBcTZdIWdvRBGLTC:t6NXTVTgwMeMoHNveOjBcTnIWdvRBGLG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819235, "uuid": "9af3c239-186a-4687-bb3b-a3c0a120b946", "value": 220578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819235, "uuid": "63f8a53e-1b28-4b46-abe3-2dc24478f9a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819235, "uuid": "5632be2f-0a8c-48c1-a451-fed6d66f24b8", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d6e9048-1977-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772813507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772813507, "uuid": "32ef2bab-3cde-4e4b-b7aa-37dc7ba46662", "comment": "Malware payload", "value": "1ea42f9fc953ab41f064708b3cd347bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772813507, "uuid": "80ceb5f3-fbda-417a-acd7-9db8ce1d26ae", "comment": "Malware payload", "value": "d3340c20023148c33e3a4ad463f3a5598d385575dbed52bedd077e791fa58811", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772813507, "uuid": "299ef0ac-15e1-431f-8b79-39905f590a3d", "comment": "Malware payload", "value": "174c8bb62cc65ceeb0d7c2842f579adf937fc717", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772813507, "uuid": "e31268ea-b936-48d1-8fae-7c9836561f74", "comment": "Malware payload", "value": "775ef01a3d1b52f9d8052106b687649ce615af0514c60a40e12695d74d13a78e8e31c7ccf39c565fdba3ab959d9e9906", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772813507, "uuid": "a4c7e183-a08f-4462-bc79-e5b2f0a67c36", "value": "T18EC56C03ACA418E9C46E9375ACB652967B71FC89077223D31B6379382FF27E05939718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772813507, "uuid": "c902d62b-f0db-478f-8ea9-036d255e2410", "value": "1ee5ceaa8651bf31ebd235088b7e8b9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772813507, "uuid": "314b90c7-88d9-42a8-895c-efca956f4412", "value": "49152:vGm9IuRDGBKkt45Ki2ZiVpjVyFBKwO24Eze:vGAjRY4JnV1VyFBKG4Eze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772813507, "uuid": "5ac1a3c8-adbc-4ff5-864d-3a6ceffe1600", "value": 2604826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772813507, "uuid": "a20110d7-af0a-4f97-a06d-2d7973f47ec4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772813507, "uuid": "d7af2c07-4b19-4657-899b-3ab934d907e3", "value": "intl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff93baf9-1969-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1772807847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807847, "uuid": "e4f9be38-281b-45b8-aa97-d0e686cc8c3d", "comment": "Malware payload (QuasarRAT)", "value": "d09fdbe01a4fa1294637bbd885de913e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807847, "uuid": "3fbd7f0a-3a7b-4149-bccd-3987efd7e519", "comment": "Malware payload (QuasarRAT)", "value": "d3f89a58a3531e544425fbd7a08c2f00657c235cc5d7c29d5b99b9bcbacae270", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807847, "uuid": "a2bf99fc-c7a6-4644-b908-c70671d48eea", "comment": "Malware payload (QuasarRAT)", "value": "33c7115ea7ce5826bcf9132a853c2ff583c017ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807847, "uuid": "4949858d-ff98-473f-88c1-ccc9cab681eb", "comment": "Malware payload (QuasarRAT)", "value": "37331ab0e26e6ec1f0b5392ca24b7b5525629388999248f011b87aa6f60042b3918cec3110e364708e5085a6d0030ccc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807847, "uuid": "6fcecddd-2fbc-4d40-b512-60afca9edf82", "value": "T11D46221737C18D58D67D87B5847988C2A7FAB74B3B21C71C794A139A5E02382AF01F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807847, "uuid": "7bd8f412-1fb2-4f8c-b356-a57578d6f9e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807847, "uuid": "5c4427e5-d274-47f5-831b-4e274bfe3e41", "value": "98304:vnB8/oQ/2a9Or4cW+PvkNDHmkQq32yeDGWJ:vtagr4cW+P8pQwnW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807847, "uuid": "54534c7e-6ef8-4ddf-8eb1-a3e2414033e1", "value": 5675008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807847, "uuid": "02bce9d0-1ffa-4342-ae18-5e7c43fd52d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807847, "uuid": "33ab5bd1-7962-445e-856a-fd37f9a0034e", "value": "d3f89a58a3531e544425fbd7a08c2f00657c235cc5d7c29d5b99b9bcbacae270", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b35cefef-1934-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772784956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772784956, "uuid": "377a8c9c-c8f1-4927-857e-b7fec5d8313d", "comment": "Malware payload", "value": "4775f0865529f4bc900e2639bdbaa1dc", "object_relation": "md5", "Tag": [ { "name": "app-64-7zp-dll", "colour": "#80A805", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772784956, "uuid": "ffe3b3a6-d68b-4ff5-bec8-f2949a0d4f20", "comment": "Malware payload", "value": "d453950e093f7970a2ad7b6b545b800b7c8e1341775e1726a19460fb0a9a48bd", "object_relation": "sha256", "Tag": [ { "name": "app-64-7zp-dll", "colour": "#80A805", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772784956, "uuid": "1930301a-33f9-48cb-a000-40f62782d827", "comment": "Malware payload", "value": "5789166bc60df239437c7baa5f0476d5584e387a", "object_relation": "sha1", "Tag": [ { "name": "app-64-7zp-dll", "colour": "#80A805", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772784956, "uuid": "2b0fd704-fedf-417a-aa53-0d54daf6112d", "comment": "Malware payload", "value": "2d4f79213c3bf81a9af88425b0260c95a66082d37ab411acf6323d44a6594b223c215077603d6f9bb237e7c2e908d4ee", "object_relation": "sha3-384", "Tag": [ { "name": "app-64-7zp-dll", "colour": "#80A805", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772784956, "uuid": "b026fef2-0200-4658-a3ac-2c8d5792213c", "value": "T10E183312B7E5C07AF0BB073195F197650A7A7ADA1E34E21F3348928E0D35784E938B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772784956, "uuid": "b45cdd40-9e19-4a5b-9627-9c92c85db1dd", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772784956, "uuid": "6542a707-0a83-411d-89b3-d8b7ff600c19", "value": "1572864:Q+e4h7TL9BHeaczUIXmLvB9+OMLwCXiaBcSrufGanp7GgtcQ3AsERmqT3:Be4NOtUkQ3nowCyaBcSruZkUEZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772784956, "uuid": "a4c97996-2c87-4704-bdbc-9f6bb73232e0", "value": 91970970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772784956, "uuid": "3feaef03-884b-4e69-b8f8-dc778c55d4ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772784956, "uuid": "750d93ef-f292-4b0a-9081-82f63a0ab353", "value": "d453950e093f7970a2ad7b6b545b800b7c8e1341775e1726a19460fb0a9a48bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ca13c46-1985-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819626, "uuid": "26bff042-4d49-469f-990c-1994bd455d0c", "comment": "Malware payload (Mirai)", "value": "931d0a44b856ea6a31966e3bc0511c75", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819626, "uuid": "541850a9-a837-4cbc-b8db-bb8e592fc7d4", "comment": "Malware payload (Mirai)", "value": "d457de2b246a9ec46a7e3ab21bb0471ae1de82eab1e21aa10cd972a8e0826405", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819626, "uuid": "d9b91d9a-6095-4c25-90a7-b5f637ec96f6", "comment": "Malware payload (Mirai)", "value": "212f5d838293bec9421703b2824c649bca4b2868", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819626, "uuid": "68c6aa91-e63b-465b-aeb7-04e492c1cc60", "comment": "Malware payload (Mirai)", "value": "39da98a8be1462f9ed523e99bcefa0282990dd3936d506bb67d9d63005f45b313eeb530419918fe6cd8eba4c24cdf91b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819626, "uuid": "4ff62975-c0d3-41bd-ad98-cc649a04e85c", "value": "T1031633E803D53ABFCC86BAB2577129E4751E540BA78E994DA78544E3234E2C87E35C33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819626, "uuid": "00ef1589-b887-4904-beff-96b843dd5e8f", "value": "98304:kWLcgwETf1EJIceYbf7RnzCdvejJpRg0uZCBr4vRg9b0l0:kWwe6X7RuiaGBr4vR3+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819626, "uuid": "80948fd2-8d08-42b9-8cda-df2da4bad31b", "value": 4018908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819626, "uuid": "61aef222-65db-43b8-aa6e-1499e8619de5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819626, "uuid": "cd66f8f2-cfa4-455b-a745-148e9502c8b9", "value": "bot.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a742b49-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772810201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810201, "uuid": "8589c436-c160-442e-94bb-04a511987552", "comment": "Malware payload (Mirai)", "value": "bc162ed909c21c628fd395c2e13480e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810201, "uuid": "26c200a0-1589-4f6a-b79a-f816ec3801be", "comment": "Malware payload (Mirai)", "value": "d49640c8ff3ab2bc8654447d6b7dd0bc8af450e4b36cb1d7fc1ef5eb0fe77c68", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810201, "uuid": "75f8f669-2723-4d0a-a26a-a1e62cf08791", "comment": "Malware payload (Mirai)", "value": "a2514bb7c729e9b3e8d2387b8ffbb7887cac7384", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810201, "uuid": "5f51fef6-eaae-4d77-9e6d-909f4fc0e318", "comment": "Malware payload (Mirai)", "value": "10da0ddf92cb8ed179cbf89b144b62c95364bdf813785de9495de740ec5c0842a64de6275114468f93c339230a3c12b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810201, "uuid": "ecd9be1a-086b-430d-808b-ba852ae0562d", "value": "T16EB30945F8445B17C6C666B7FF8E438D7B2A1758E3EE720399256F30378B85A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810201, "uuid": "b809b2f8-3a16-45b2-a9f0-cfe6ab450c95", "value": "1536:p7jnPq8azP4V8YOTIBRvyNOzIuSIwYeFWd/lk68wywlQ3Ym3Tb/V1oEakCxQ:lzPqF41OUBljSIxecUtCa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810201, "uuid": "dd1f8907-fae1-4c66-a5da-38b6d0910fae", "value": 113184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810201, "uuid": "08955807-c489-4032-bc97-4cc1d3710d09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810201, "uuid": "390e8e36-d2f2-4f8d-b642-1c72ce2b5598", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d48f262-196f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810044, "uuid": "a4b95922-9a4d-41b8-81e4-dadb6103b027", "comment": "Malware payload", "value": "58f7750a1d90245d1099027d086a4464", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810044, "uuid": "6d9e102f-4886-44b0-a0fc-c1e18476ea1b", "comment": "Malware payload", "value": "d4e52baac054cee9ed04194dee97bd4352c1ab686659434faa42d5524733c96b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810044, "uuid": "cbddc848-485b-48b8-9db7-f73f0ffb4742", "comment": "Malware payload", "value": "54c7ccc757627ef8318bd503da4dd84503349943", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810044, "uuid": "9e6b677c-89cc-4a17-8898-825ca4a4e0a7", "comment": "Malware payload", "value": "10820e1fae190b9105c92c6643eb823eb8391138244b2f5ff4b90aed09d5c34413518e778486aed632aa654abe9c3a72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810044, "uuid": "0e317b0b-8562-41d5-9a44-0b29678b3f2c", "value": "T1D2966C12BB9941ECD1BBC034D2564637EA7130DA0B34ABEB85C48A692F66FF45E3C354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810044, "uuid": "f80fbf37-9966-4044-ab91-b79ec0802489", "value": "5f6964f0e426fd8e7f1b681857cd8dd9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810044, "uuid": "fefecc79-77af-4540-8594-e3a71e4ab824", "value": "98304:eY8jCtNJVy/P9geDlT6KxDvPlDTQcA1sIG5+qe/fK:H4CqnlT6KxDvPlDT/fe6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810044, "uuid": "1ad4afde-a240-4682-a747-17f46c96f1a8", "value": 8648192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810044, "uuid": "e55daa73-48bf-47b5-9b92-817269043e6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810044, "uuid": "afae8af0-7360-43c9-9123-51f62b9df3f2", "value": "d4e52baac054cee9ed04194dee97bd4352c1ab686659434faa42d5524733c96b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92809daf-1971-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1772811100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811100, "uuid": "fc2e8935-2717-4511-821b-2fbda9307616", "comment": "Malware payload (a310Logger)", "value": "470acc0facd45a26c2d8d6832adccb25", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811100, "uuid": "7c1862c1-11a9-4637-948f-ec3811cdf147", "comment": "Malware payload (a310Logger)", "value": "d646161900acd640c4afa967fe9178b80028e041a7077d4c3c6eacff2447502e", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811100, "uuid": "20933af6-7cf1-4648-8458-967f009f21a9", "comment": "Malware payload (a310Logger)", "value": "6e6d0d758a0962c76dcc9d1532d22c0af196bcac", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811100, "uuid": "e63216b9-d541-433c-9980-797fdc90c131", "comment": "Malware payload (a310Logger)", "value": "bb3b31a15fc993fabf0a6877fd6ab9e5b0d272e18d5475a035265231b47d992353eff09322b3f8313e032a28d8c25f97", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811100, "uuid": "25f4e46b-0b59-43e8-9f27-6970e5a8b659", "value": "T1A7845A23E660A02EF1A3C9F1B9A5A25728263D3A5698EC47F3415F5834715E3ACF131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811100, "uuid": "4c806cd9-1798-49e8-b976-9b3eef71fba4", "value": "252c027bda7298291893ceb108f11214", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811100, "uuid": "e5d3f54f-146f-498d-8b0c-3ad425a0def2", "value": "6144:q8d1/w5KA81IJ8GpF6nuTmOOUWT6xcBfbbNcknSrnGRyZXPFnUY:ZjYKkJj6GmZUWOCbcSRyZXt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811100, "uuid": "8e18f84d-8e39-4f74-a47a-b12c7b51bcf0", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811100, "uuid": "34493283-101d-48b0-adf7-7bb1edad3b6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811100, "uuid": "558419f7-8bdb-43cb-bd82-eaa9ad90327d", "value": "d646161900acd640c4afa967fe9178b80028e041a7077d4c3c6eacff2447502e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a2971f3-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1772811489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811489, "uuid": "83604b05-d1aa-4954-9422-021bb6372a6e", "comment": "Malware payload (DarkTortilla)", "value": "1993feaf0078980fad8284db3fa15b98", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811489, "uuid": "245745f6-50b9-406e-af9a-6a040feb6b29", "comment": "Malware payload (DarkTortilla)", "value": "d6a085a08c7ba0687b2ebac638f016531370f29a8bc618a6be8cc862eb9839c6", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811489, "uuid": "d0c283d8-d396-4e28-9133-9d3f4d60eb11", "comment": "Malware payload (DarkTortilla)", "value": "b3e38a612b46d7939f3045a58c02342e35b0b75b", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811489, "uuid": "08a488dd-432c-4055-81b5-d4ad8bfd2b53", "comment": "Malware payload (DarkTortilla)", "value": "e7ba6e3ad7bea0555a26efba2a57ce2a04339cd7f64027e3e395c78d0d0b65dd946a8a88c365c08d5e2a160f2a7af28f", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811489, "uuid": "a32d3884-c3d0-492b-acb0-440c50e8cd63", "value": "T1C035E11A4DC36664C1B95F38D3B914A893F0965B6252E3AB6FDC02F4CF56B4FDA03092", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811489, "uuid": "ebf16588-3154-406f-8a53-10d3062b2722", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811489, "uuid": "e7c8b231-2b08-4957-bf61-f7a2db42c41e", "value": "24576:cZ8lLR/3saJ1a7bfypNpjAQaweBBv1KObB7Am:O8l9Psava7yNpjAQTsfP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811489, "uuid": "6cedc615-98c4-426c-91d6-3db460ac3712", "value": 1133056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811489, "uuid": "3ea3762c-7faa-4dc9-b418-d8c15d633b0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811489, "uuid": "3835dbb8-1f94-4c73-a84c-a829f0adf98e", "value": "d6a085a08c7ba0687b2ebac638f016531370f29a8bc618a6be8cc862eb9839c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d20b646-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819198, "uuid": "30c67dc6-2993-4232-8368-3300391e129b", "comment": "Malware payload (Mirai)", "value": "e91810d741dfaddfa5a4f428b51d79ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819198, "uuid": "32b9a0b5-a5ae-4dc4-9160-f436d1db1a25", "comment": "Malware payload (Mirai)", "value": "d749723ff700a54473b2701b29d9b940c64152598885e453c811317dd7181379", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819198, "uuid": "d4517836-309f-497c-9f2d-1520e016ba13", "comment": "Malware payload (Mirai)", "value": "cea68b9f44b24d8ab063819f59eb0f19d494fc37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819198, "uuid": "f6779bda-3a65-4fac-af15-efd9b5d7ecc0", "comment": "Malware payload (Mirai)", "value": "5fab51715fe4f9b83cdacd1a4a415a60d907f3d5aa00329b2e2ae450efbe934acb3d80d281beda1fd425f57b9adc07ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819198, "uuid": "5994c515-7f77-412f-87ce-99a2e14f8e2b", "value": "T1F4737D63DDAA2D14C64485B470B4CEB62BB3A6A4418B2FFA3255C77C8053A8DF5463BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819198, "uuid": "74947512-2244-4c13-a4fb-d74e43f32907", "value": "1536:Y/UEWW9Ai0r1D5O3sOZ++Ak5FY9zEhJKK2baZ7vPLCVeCedIP+hFkxCWe7u:Y/UEWW9Aim1D5Oc2b1DYNEh2G7LCVerg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819198, "uuid": "0b777a22-d291-442f-9a09-381601211241", "value": 80388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819198, "uuid": "e5174153-190f-4ae0-a239-0586bb0834d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819198, "uuid": "c8fc6859-39d3-407b-b76f-b917de277740", "value": "violetsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99aecdc2-196a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808106, "uuid": "a681d8fc-70a2-4426-b885-0e005a969ca7", "comment": "Malware payload", "value": "fd622753916bdf3a91debf2b1f0c6fec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808106, "uuid": "2ecfab6d-766f-4e54-bc0b-3aadfde7b332", "comment": "Malware payload", "value": "d75ed36fa6871750054a4c792233222c98d99ad595d51500465d41ce575a2409", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808106, "uuid": "9d544c87-8898-4fee-ac6f-6d9b2720048b", "comment": "Malware payload", "value": "0425aa2cc20e98353b63eef4f1a3af7fa61b56fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808106, "uuid": "e27e8826-c76e-45ec-ab40-272e0aaaf233", "comment": "Malware payload", "value": "f953a7515f6eb8224e44bea64420579f31bac7e37a47829201539b3f8bc288dac4c94a0a3c3e2e2bcd0a8f3abdfead91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808106, "uuid": "0b1378b9-f8d8-439b-b9c2-e8c2470b945a", "value": "T19C741250BAD5C227CAA206306D6BC7FB17B6BA3569174B077384BF1D3DA23D19E0E241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808106, "uuid": "23b2c628-b3a1-423c-81de-b2721f21a494", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808106, "uuid": "00a3491f-3c3f-49ee-b0f7-31df43623afa", "value": "6144:M+MvoJXYsbLS1sYN1E7u4u8jsrqkHTk6ZGfv2HSwkITlcIABRDKvsm:M+FHbLS1TE7u2s2kXAfefxcIgWJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808106, "uuid": "a4cf2b94-f637-4bf7-9e48-80765839ebfc", "value": 337696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808106, "uuid": "92d473ae-e4e4-4bf7-a0cb-a80583649152", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808106, "uuid": "d7498170-0b16-47fd-a572-15bd5ef144c4", "value": "d75ed36fa6871750054a4c792233222c98d99ad595d51500465d41ce575a2409", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a94ae83c-196b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808561, "uuid": "48e7605b-0572-4b22-970a-7410c4f7e04a", "comment": "Malware payload", "value": "ece5613c1ae854b56de3eae3d8089873", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808561, "uuid": "e310d3b8-e818-4f49-a8f9-cd5019124a44", "comment": "Malware payload", "value": "d762e940f3c94951753f20ea4c23053a934e5fbbc8d9613fa837734f5ecbf837", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808561, "uuid": "9d75ac09-a6b3-48b7-a6d9-59e88dc446f9", "comment": "Malware payload", "value": "de9c333b8661fae03a4792e43d128a362ae25d08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808561, "uuid": "1c20e879-3ad4-4f41-a4d3-ac012e048dff", "comment": "Malware payload", "value": "c03d6f7878387bdbf683ff7a8dd77f12e36b2f557ddab6b08e597297c6fbfc7e356ac491f5f2ca669af0948e802bccf8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808561, "uuid": "634f3d6c-95db-4aba-89e9-1ac3b15199b7", "value": "T198D2D614A3D5E070C01B237027D2D9A122E6DDD65E371619ACC9FA6FFAF33152A1AE90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808561, "uuid": "e88616e1-f9a2-438b-b21a-4f2f052be897", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808561, "uuid": "94d0d89c-bd8e-4c75-9154-df8dc3ef2f9c", "value": "384:qQvVmF1Pb8a53MmqC8HRAP6tXl6sFh6Asue80e2QSUaepk0OOyd3z0zY:VdU9bXmxPHVFl6ssvDe1SUaq1LyJQz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808561, "uuid": "f8164987-5c42-478f-86b8-5758a2ee79d5", "value": 29184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808561, "uuid": "fe5eb449-8fce-4bf3-abe4-339719f9d18e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808561, "uuid": "7f454e23-914c-4612-8b5a-52f75734494e", "value": "d762e940f3c94951753f20ea4c23053a934e5fbbc8d9613fa837734f5ecbf837", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89dd0377-1970-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810656, "uuid": "cc5f8c34-4ac8-475e-9510-d0eedc96f13b", "comment": "Malware payload", "value": "25a3e7faa57b7426bb698233bf301a2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810656, "uuid": "c9aa2ded-1e70-4ebe-94d9-b16bcb5334b6", "comment": "Malware payload", "value": "d7c4d40667dada2508178984260a9569ecc60f38b76e291650f5bceddbf27bef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810656, "uuid": "73b6b4d5-37f8-4219-8371-2e56667e5edb", "comment": "Malware payload", "value": "9837cd0592183d6d4c0a0f6ec8f4ecb724ca8955", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810656, "uuid": "38c1b4c1-918b-40b1-9f4d-0a6e3a693444", "comment": "Malware payload", "value": "1bd95fc06edffaf55836423d4b96d49f637965e440ee6834aa1836804e5c1bb5e48a0740ead2acdb3bd6d229cc8618cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810656, "uuid": "8f32dcf7-ba4a-4be9-9e84-f7cca4e67217", "value": "T1FAD4E6576E828F45E3E42E7543EF6D18438694B25BB27B0B2F20337B98011E7ED99784", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810656, "uuid": "af5a89e2-9d71-4169-86cc-3f071e43798a", "value": "12288:qWVNLs2A2kLt9z1leILjz82XvNtMtRmowsKugES:qWVFs2ZkxDLj42lKtRdwGg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810656, "uuid": "d1088410-0615-4011-b6dc-9b15ca1b00be", "value": 624640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810656, "uuid": "fd732e0c-8767-41ae-ad11-8edd2fed0a09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810656, "uuid": "cd76532d-ffee-44e3-bb6b-404d727d743a", "value": "d7c4d40667dada2508178984260a9569ecc60f38b76e291650f5bceddbf27bef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f62c5a73-1983-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772818998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818998, "uuid": "0c29f3f3-49eb-466e-a875-549ef08cfa07", "comment": "Malware payload (Mirai)", "value": "cb74de6371afb1baca3d8b14ea40b58e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818998, "uuid": "aabd1db4-e3f5-4480-b6c1-f875628094f3", "comment": "Malware payload (Mirai)", "value": "d8364dacadc190757bbc10f2b932f3c3db6733a056eb45f4e1b947b0d38a8abb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818998, "uuid": "61ed1e72-bd90-49ae-bfb8-29aa8733fcff", "comment": "Malware payload (Mirai)", "value": "b52602edb2b29510cf08088a1f0056d8499fe18c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818998, "uuid": "6d99c89d-a42d-4d9a-9426-2ab90f78729d", "comment": "Malware payload (Mirai)", "value": "e531fe7b66a7bc9977745f5383b54a83a00909bef95a058f22ad21a133224083ae183ca54b4da713e82fbd6e83807589", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818998, "uuid": "dae57a9f-b2f6-4a05-8379-ef05c7e28ccc", "value": "T1AF935C02B70C0A43E0575DF02A3F57E2C3AA66E120E8FA89790EDE4596B6D325547ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818998, "uuid": "3c3a710f-2c74-4ab2-831e-464b5034ded9", "value": "1536:RcNACenYLuz400CO5W6j9SYNoGbOrbhDyBiJkBkb7M1091WrZ1aggofAlY:iClYS3rbJyeb7MgWrfiY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772818998, "uuid": "6dda3b1f-977e-415b-a6a7-9b806aa7f665", "value": 92048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772818998, "uuid": "911cdfff-2ea8-4ee2-b33a-3f2c1d03ca6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818998, "uuid": "2704d13f-6d0c-453c-8ad2-26fc680882de", "value": "jawirbot.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fe9fd9e-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1772811337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811337, "uuid": "1197c707-2966-443f-8889-280e8aaebfeb", "comment": "Malware payload (DarkTortilla)", "value": "e745df0c8be81837c89e236084e4a7b3", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811337, "uuid": "b729af72-e939-443b-a131-ca4af9ee6c9f", "comment": "Malware payload (DarkTortilla)", "value": "d864a30d450157ee025d97dcd2a6a6bf386719fc4c14ca361f85aa914665657c", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811337, "uuid": "34c71c5d-287c-490c-88b1-318695026ac4", "comment": "Malware payload (DarkTortilla)", "value": "0b83edfd3c70f1c62d2d670052ba0f2dd6ee0261", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811337, "uuid": "c0500118-4308-4b5d-a08e-388f6baf1626", "comment": "Malware payload (DarkTortilla)", "value": "a62ac934d8acea0dbe90bf108fa01e08b2787659443d0b9240e44f1ff01201601d93067561a62f576e97731f5441d332", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811337, "uuid": "7bcd17bb-00fc-4141-8e7a-361a20925fc7", "value": "T15A4622393E434505C63A57BD81268EC477F0DA8B9B03C71FBBDE01ECAA166A79721354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811337, "uuid": "2bdb14c2-2cf0-4eb1-947d-bef33e2daa6a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811337, "uuid": "4b958927-8da3-4c26-a374-1ccb563dfe46", "value": "98304:bm8dwNuAWm3GMvD+dHLR49AdY3WkYSyC:b9vNm7r+dR4WRyy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811337, "uuid": "46892568-d442-4116-98a7-8fa769da18ea", "value": 5579264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811337, "uuid": "2eb79da5-e0a5-4f93-9150-702da9521ede", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811337, "uuid": "344cf08c-af9a-4d20-8c0e-204741e403b6", "value": "d864a30d450157ee025d97dcd2a6a6bf386719fc4c14ca361f85aa914665657c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04f38628-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772809574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809574, "uuid": "825e2bda-5654-4b03-9b71-87bd29923021", "comment": "Malware payload (AgentTesla)", "value": "5aebaf6e99efa07c8ff0eb29045e7877", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809574, "uuid": "c7bdfff9-710b-4013-a013-04fd19eeef3a", "comment": "Malware payload (AgentTesla)", "value": "d8b8b5072f8e71f1a64cc49a184b21cc696e1f66f43af8cb0b978338395db263", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809574, "uuid": "7396276a-6236-4207-a340-0828387424c0", "comment": "Malware payload (AgentTesla)", "value": "47fdb15579d99b7237d2af6157b6ef89212864c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809574, "uuid": "1ae5b2e8-30fc-4643-9be4-a5229aeb8cb8", "comment": "Malware payload (AgentTesla)", "value": "7cc523dd963cd599949c27daf7cf9c9ea3d0f6a7229b0fbcf426ee0054a499f8a7732117c7c872980fd91cd4447e6f04", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809574, "uuid": "f9659db8-95ec-4117-bd9f-674e4552efee", "value": "T18E2501321D422A14D9760FBDC016149573F0D847522AEB2FAFFC41F8ADB3B49C82B6A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809574, "uuid": "d0d8dac0-ca62-4817-a135-15cc7e701310", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809574, "uuid": "cf1f463f-531e-4231-b445-f4469a774cbc", "value": "24576:O0UfhpLT/4PPH7caoc7373O/WoGYdonKJblNB1:aLzswaoS7uWvYd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809574, "uuid": "29fa3f07-9b24-48e9-873e-5b3c014fcea2", "value": 1024000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809574, "uuid": "9c76e8ef-f62e-4c82-aa1f-543e37d3f2c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809574, "uuid": "54fc8993-a965-4123-891e-2daeca1a36cf", "value": "d8b8b5072f8e71f1a64cc49a184b21cc696e1f66f43af8cb0b978338395db263", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "389e0d11-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772809661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809661, "uuid": "7e67438a-bd23-4800-9f4d-165c462bbf24", "comment": "Malware payload (PhantomStealer)", "value": "52c02f4d986355526bdc8117b2139e1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809661, "uuid": "f62c5ddc-3e08-45b2-985b-cd363e35812c", "comment": "Malware payload (PhantomStealer)", "value": "d8e20fa5422c4dc29fda1715272f124aaaa5a3bdec74ea6fcfe6fd7efd517954", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809661, "uuid": "0dd6c8d9-1f1f-4704-8004-e1fbd8d7ac38", "comment": "Malware payload (PhantomStealer)", "value": "e20753853d91de7fe20fe8693fad8b18b85cbc87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809661, "uuid": "11a85b1c-603c-4090-98a9-e4dc31866b47", "comment": "Malware payload (PhantomStealer)", "value": "7f8492badb640873356777ecb93a37f9a74b7a91c83089a98cf20d1629dbd54b475f7bebb773d7d18821af97296a14e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809661, "uuid": "d127b474-a746-4824-8f35-49f531775f6e", "value": "T1EF94E141F3C1ECEAE4A644B3EC3EC7101953EE6E8466871B325176066DA32D3169BEC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809661, "uuid": "4c4ddf1d-4f74-48e1-ae29-092e69de1bb2", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809661, "uuid": "cbef63fd-f9cf-46ae-bf5a-4e654ef2ccba", "value": "6144:/gORaJ1dhZ3qeDnpywO1hqrr4xLmt8UnkEh8KNv4JkeplFmpjHSyEGUDSNn:/gd6kpyR1Y8kaUnaKV4Jk/pjy3GUDSN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809661, "uuid": "3df3d320-5056-464a-8725-0d0e756d49ee", "value": 409504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809661, "uuid": "270a5278-cc37-44c8-975d-6f0b903107ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809661, "uuid": "8d54f2ea-ef06-4fda-a551-c23e7f3d9a2d", "value": "d8e20fa5422c4dc29fda1715272f124aaaa5a3bdec74ea6fcfe6fd7efd517954", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d0cd3a7-1974-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772812218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812218, "uuid": "e5809c90-53d2-4dfd-8715-2d0f3246f6b2", "comment": "Malware payload (Mirai)", "value": "5a3c1b8114cf3e4f31c68f9b7a0abf2c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812218, "uuid": "842fc079-aee2-4195-8c8a-58d8de3d7963", "comment": "Malware payload (Mirai)", "value": "d8f2e5562de49100afd32802b2e6c648deb77c4a7f8a6107cc0d213cb6a7e5fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812218, "uuid": "a2221a59-1b37-4e63-a73e-a78db77cef6c", "comment": "Malware payload (Mirai)", "value": "464b959083bd39906d5a1e9beb3290501bad4812", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812218, "uuid": "ace2941b-25cf-4c9c-a2d7-f9b9b39d6d0b", "comment": "Malware payload (Mirai)", "value": "0cecf3adfc1db96b7927d5754556764801ef3500b39ee2d99d25008021b409db38cdbfeca1a4b4fb2adf0d77a755ab46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812218, "uuid": "26da0b99-bb9f-4e69-8fdc-a0a95becac84", "value": "T122E30A56F8819F11D5C111BAFE1E128E37231BB8E2DE72029D246F747B8A87F0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812218, "uuid": "b3bbae51-7be9-4e98-bda0-9232d406a13d", "value": "3072:GkXqtOm1O/bN6UpXzkat8n2MkfBnexxtsvfwBB1:GkXqc/bNVXgaU2MOotgfwBB1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772812218, "uuid": "0a1dc5b8-05b8-4452-bcea-0ddb8670077b", "value": 149308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772812218, "uuid": "d0df0918-1db1-494e-948c-f37e9b76ad95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812218, "uuid": "5d76e79a-d9ba-4000-893f-7fc9791fdcf7", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9bb5752-1969-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1772807784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807784, "uuid": "4a8e72b0-4c04-49ff-bff9-2ddf8b79bb26", "comment": "Malware payload (a310Logger)", "value": "2d702fad37efcc62267e0fc75177f88d", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807784, "uuid": "27a6f1b2-4fdc-4c34-bd24-ea34afb0f6a6", "comment": "Malware payload (a310Logger)", "value": "d984e0fca6569f7db678f1c950bf46f86e393b8d182b87ea38db176836cb37d3", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807784, "uuid": "cd830562-b330-421c-b064-ca8db7c75f20", "comment": "Malware payload (a310Logger)", "value": "c3434536e91d258af8e2040cddf07c60054f099c", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807784, "uuid": "90b7a600-d009-4c4b-85e1-8ff823cea9c0", "comment": "Malware payload (a310Logger)", "value": "92691f6e5fe974fa35233db6a38da46c9899b73c5620d4427e99e63ce9ffcf668eed1d1feeabfa38c430ca193573cf9b", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807784, "uuid": "a7e6435f-d966-42db-b5c7-7fd1681ca470", "value": "T1A8845A23EA50A12EF1A3C9F1B9A5A25728263D395688EC5BF3415F5834711E3ACF131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807784, "uuid": "6376f55e-48bc-455b-913e-273beb61c160", "value": "252c027bda7298291893ceb108f11214", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807784, "uuid": "06428f03-0830-4512-a20f-f2866cb8cdcc", "value": "6144:I8d1/w5KA81IJ8GpF6nuTmOOUWTnZkNE4EnvFEsvyF6GCyHxxBT7k:LjYKkJj6GmZUWeCv0nCyHxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807784, "uuid": "4dcca7de-7dc3-4937-bfa4-16698973b300", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807784, "uuid": "e27feccd-e3fc-4393-bdc1-bc521968093a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807784, "uuid": "e2a2059f-b137-451f-8022-a56179efcc0e", "value": "d984e0fca6569f7db678f1c950bf46f86e393b8d182b87ea38db176836cb37d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bac823f1-1938-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772786686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772786686, "uuid": "a5ad8f6b-870b-4b42-9981-fbb1af84879f", "comment": "Malware payload", "value": "d4d7b0c75df9a3b3bca2dcc451884d16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772786686, "uuid": "4287519d-6410-4196-aa1e-788cd2ce1df4", "comment": "Malware payload", "value": "d9efde80761fc517f161691950d16e6fa9d3f6b3627dfb40b2e84561329b3f2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772786686, "uuid": "c078aeaf-4ef0-4949-b44a-45959638db72", "comment": "Malware payload", "value": "24b188dd8e996290bfa510a0a6a4b39b498f497e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772786686, "uuid": "2acbed15-5815-41ec-a6a5-527c1d69ae71", "comment": "Malware payload", "value": "d9d4e8b27034ec38ac76bbb61762b294c0cdbac204b2012a09b4b4479b0709f34665e9510c8f92d50b9fe196f13b7530", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772786686, "uuid": "7ef0989e-7d14-44cf-a9bb-f0361a05cf88", "value": "T1EF24A75E6E228F7DF668C73447F74A34A75D23D627E1D684D2ACC1101E2438E642FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772786686, "uuid": "a30b5edd-97a6-4324-a9b6-7ac2fb216241", "value": "3072:a/ZYD/7+1Mg1Omxz7sDfpA5f1qZxwpTUVsfqtMTeUxv9445:aazaM8fxvYpA91FEsCaTrv9z5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772786686, "uuid": "4398ed30-a685-49f1-8880-5116eb7d5898", "value": 225016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772786686, "uuid": "86c260d7-c654-45cd-b980-bdc12eb24bef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772786686, "uuid": "8631f683-7705-495a-a6b8-81d650e0fe2c", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feae548e-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772809993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809993, "uuid": "a9d5b255-a673-4dbb-9e1c-da01513ddc0f", "comment": "Malware payload (Formbook)", "value": "7ca39cef0ac48715e5556b3815718d3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809993, "uuid": "e5ec4afc-aaa4-48a0-a7e1-1d890079740c", "comment": "Malware payload (Formbook)", "value": "d9fd1f50fed9963d088804d0c5e4e1a59d272599542b5f27b054c93e43013b7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809993, "uuid": "73ecdd85-3eba-4ea0-8a01-1ac07c6b2011", "comment": "Malware payload (Formbook)", "value": "a9188a5238ecd18fd3089c01ad3cfe9cd77b9267", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809993, "uuid": "76cb9387-d158-48fc-bcab-a71a463e0b6d", "comment": "Malware payload (Formbook)", "value": "bf77a954ca84ec666adfa43919f10a5c5902cf2614a0d07677f15b4bb1b505dff9df254db384bed1ef73a5209da1aad5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809993, "uuid": "85ac4b20-c6a7-4632-ba36-c4e11778f1d9", "value": "T1553512281219DA23C5971BB59DB4E27807B41FCDA242D3174FD5ACEFF87ABE01486287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809993, "uuid": "68478747-fa9f-4cc3-b229-312b859802e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809993, "uuid": "b2f23a0a-a6cd-452c-9614-9f96c48bc359", "value": "24576:8EnN/9bRr5vCbd5s8iMnjlec1Um3nJBEy59o:8EnN/J1kC9KjoCbEy5y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809993, "uuid": "d7ac5154-b7bf-4604-973d-41fa1af894fd", "value": 1064456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809993, "uuid": "3de4b753-fdba-4ad2-8e6a-f24c4c155bde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809993, "uuid": "d649edce-62f8-4283-878e-4c363211b718", "value": "d9fd1f50fed9963d088804d0c5e4e1a59d272599542b5f27b054c93e43013b7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec9c7b8-18ff-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772762319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772762319, "uuid": "adcffe04-592d-4db8-80bd-699e870a227d", "comment": "Malware payload (Mirai)", "value": "c6821b2704978127d31cebdf9c10d95f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772762319, "uuid": "a49d75b4-8602-4c74-930d-722f636feb6f", "comment": "Malware payload (Mirai)", "value": "d9fda712b503c08e2a93db8fd7699dc935fae8e497682bd67dac8fc0f384ea63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772762319, "uuid": "6ebd686b-82e2-42f6-8105-22c852a7b807", "comment": "Malware payload (Mirai)", "value": "16cc5b28f20f956de327f33eef42e32c32c3f9bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772762319, "uuid": "998e965d-d059-456b-988e-3e91a61d0c94", "comment": "Malware payload (Mirai)", "value": "8d691f395eb39446ef963fe9642121d4571dbf2f8b1d8e96aea7e28c9a1dfb63f48b772bd67d8b9a867cb5b8f6f289c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772762319, "uuid": "ee6d2fed-71b9-4818-abf6-b67baec8c7bb", "value": "T15004971E2F228F7EF668873147B34925A75C23DA27E1D644E1ACC2105E6439E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772762319, "uuid": "727cee43-ae0b-4ba8-a9c5-9cd09ca2dea8", "value": "3072:BqaTaALobli1JqT65VPhONhWD4KXOUjnH:7mAopiVAhxKX3jnH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772762319, "uuid": "14631df7-e942-405e-9ca9-e1a341325cd1", "value": 177756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772762319, "uuid": "24151639-acd5-43b0-b74a-b43bdd73eda6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772762319, "uuid": "7be79f4b-8bd7-4c49-a393-f752447458c7", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62b9111f-194c-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772795128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795128, "uuid": "67743f22-2bd5-4dcb-b216-738621ac0b42", "comment": "Malware payload (NetSupport)", "value": "a5c8a088243d381330107409c77dbbda", "object_relation": "md5", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "gologpoint-com", "colour": "#C1A767", "exportable": true, "hide_tag": false }, { "name": "josehpjon-com", "colour": "#BC3BB6", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "quicrob-com", "colour": "#CC0988", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795128, "uuid": "c4a500df-3bb7-4aa0-9cd2-9bccc1fae127", "comment": "Malware payload (NetSupport)", "value": "da18635cbc35fbca53ba91cbed7b29e064915048fa904bd6b079f4ee43896fc4", "object_relation": "sha256", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "gologpoint-com", "colour": "#C1A767", "exportable": true, "hide_tag": false }, { "name": "josehpjon-com", "colour": "#BC3BB6", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "quicrob-com", "colour": "#CC0988", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795128, "uuid": "94b72c73-e754-40e9-90bc-2d5f04091a5c", "comment": "Malware payload (NetSupport)", "value": "571b9ed6842ff7a3110c1624442dd3aff0350596", "object_relation": "sha1", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "gologpoint-com", "colour": "#C1A767", "exportable": true, "hide_tag": false }, { "name": "josehpjon-com", "colour": "#BC3BB6", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "quicrob-com", "colour": "#CC0988", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795128, "uuid": "9afb9d4d-c842-4931-8115-a7e0e544b943", "comment": "Malware payload (NetSupport)", "value": "d54bfa1f6ddd366b31fc95cffd9534e025aaa81a7cd904018f9ebf598640d4ad980057f3d14c1d9593ceca19ec9c63b8", "object_relation": "sha3-384", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "gologpoint-com", "colour": "#C1A767", "exportable": true, "hide_tag": false }, { "name": "josehpjon-com", "colour": "#BC3BB6", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "quicrob-com", "colour": "#CC0988", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795128, "uuid": "d99b7117-3a87-4537-b450-099e802670c8", "value": "T10326339A990989DFC95B4F74C10B5E1AD33E3A41F25E7080F6728252CC89B9F4BB871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795128, "uuid": "c5ee5ca9-46dc-483d-92f9-c524ef9620d6", "value": "98304:I4quDSxPqusSeG/VYj3b2+30/wBeVHC/VYj3b2+30/wBGVn:ISDSxVsSPQy/2DQy/2o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772795128, "uuid": "5cda5b38-4d33-4632-8aab-9169de33a064", "value": 4429371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772795128, "uuid": "1307d0c7-c2a7-4aa3-a12d-23b816f977f3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795128, "uuid": "abf07192-c686-4518-a833-e889eeeb35fb", "value": "at2.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b58ef2be-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772809870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809870, "uuid": "02680c3e-4dd0-4f3e-898f-cc651b1061ef", "comment": "Malware payload (GCleaner)", "value": "8990110a0899f576f8692c314d32595a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809870, "uuid": "ed8c3233-9330-40f8-b6d0-6c19d22e207d", "comment": "Malware payload (GCleaner)", "value": "da1b36eeba7321703eba4074d9c4db0f13c19c7453119eaa918921167503830b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809870, "uuid": "af8c8a49-f2c3-4368-a4b8-198757ce09e3", "comment": "Malware payload (GCleaner)", "value": "f270efa6566e9482e8aee841c16efe8a463bd2f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809870, "uuid": "12ed5dcc-6870-4837-8eee-d8823d5d2b7d", "comment": "Malware payload (GCleaner)", "value": "1ad94e7837ce6989e4b5b02f378ce75857e4a51025b9e55a6399216478ee35a50423f67a4472236ffe9af2880a68ca37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809870, "uuid": "5739688a-c473-4d7c-a203-8fdd27ab753a", "value": "T1B4F48EE2A2F1D433D1236E7CDD1A626CB8267DD02D39BCC66AD4DDC89A3568074163B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809870, "uuid": "62264e5a-4093-4199-b58f-f57170ae3a78", "value": "855c002a8df581e0836bc0be1ec15465", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809870, "uuid": "169bb723-de76-4ae5-b6b1-6de2f896d6fc", "value": "12288:+Amht7cInjR4Nhf2lGh+F/ZVNwTA3MrA5Zmcs6XUpSK9ynwzK:vczjR4n2lGgFlweY1csEU8c6wz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809870, "uuid": "96f63a8e-c95c-40dd-b1f2-4689cb820d6f", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809870, "uuid": "3f0cf586-457b-4c14-bb6b-a596566bf942", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809870, "uuid": "ed4a579a-689c-4390-b910-da8859a54ff0", "value": "da1b36eeba7321703eba4074d9c4db0f13c19c7453119eaa918921167503830b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94e4f2a1-1995-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772826566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826566, "uuid": "5ab997cc-183c-4463-a3e9-fceca7195d09", "comment": "Malware payload", "value": "a1e8fb59e908cb11742a9d7b381d77a2", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826566, "uuid": "39940070-9761-4561-b5b7-6b6dbddee540", "comment": "Malware payload", "value": "dad82c05924ce79d6a9ac8dd51125b04020ad34dbd6ee888cd047f071cc55ce5", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826566, "uuid": "1d72416c-2ae9-40b4-bf09-b84a968429d6", "comment": "Malware payload", "value": "2fb46ab55de7975131130bb3b0537d97c97f0e17", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826566, "uuid": "b307ed41-9085-4be0-92f4-b5e7c98ac60e", "comment": "Malware payload", "value": "fdde857b9ff839cbabe10d438c5416cb6bcc93b815550b62ade679d3f5406084243160af9aa04aceb6792412c8527ba8", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772826566, "uuid": "3c568ebf-d98e-4214-b7e6-cead3807422f", "value": "T127352303FAE2FF6BD0435B726DC69041600EEC585B5C81977786B72828BA37792E719C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772826566, "uuid": "299b4416-d7da-40e2-a057-fe7a06390917", "value": "24576:8OaY0BJR8lffiwyega7UA3950cui1YqB:8Oj8GiwyeDogck1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772826566, "uuid": "b7cc2201-5fe3-4579-858c-9c9d2dbc5aa0", "value": 1074176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772826566, "uuid": "12d7e6ed-6d73-485f-a216-b333cde453a9", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772826566, "uuid": "cebe97b4-9e22-4f5c-a9b4-a9684c50623e", "value": "SecuriteInfo.com.Trojan.GenericKD.79632786.31061.25216", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb807506-196b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808592, "uuid": "c290c962-7cbd-4926-8f5a-3c506b7e214c", "comment": "Malware payload", "value": "7bd5667dbc7308c53a6c04fb462afcbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808592, "uuid": "0aec03b8-30b4-46ff-a9e9-073821b3d6ff", "comment": "Malware payload", "value": "dadf8aec84be9e50ddc899f30b0a5db908c24705bee06ab94904fa1624a24f14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808592, "uuid": "d5089361-4584-4950-a51f-a4db9cab0f38", "comment": "Malware payload", "value": "ca3d648833c819fd003d7183b1ee9c3c6f333ff8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808592, "uuid": "3f734b32-189e-42f0-a5c8-3983f62e216f", "comment": "Malware payload", "value": "21f8605925572995b842dac5b220b5b945cd1c983d578190751ea9dfa0963162e09531975c2863798a1bb1b701d57f0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808592, "uuid": "daf62e1b-7833-4207-abb8-a2baeccffb13", "value": "T1473512913319DC03D8621EF50AB1D2B05BBC1E9E9811D393CEFAAEEBF5796456C01392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808592, "uuid": "65779656-22cb-4bbc-8e81-2430908e101c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808592, "uuid": "4a29ae8e-3d7f-4ac4-9564-6a8eb2c96ca0", "value": "24576:Lqqu2VRTWD09NtAf2m1V3GJ+O7ilwfF1vLIuP+6aTgAFU:LqeVswH01BGJ+OYwd1vggAF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808592, "uuid": "fa0cb06b-fa28-4962-84eb-70bd6187868c", "value": 1090048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808592, "uuid": "df57605e-a9ff-4b8b-beed-1a3563fd78b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808592, "uuid": "a29ec11f-df2d-45b5-bf28-a75c74a7eecf", "value": "dadf8aec84be9e50ddc899f30b0a5db908c24705bee06ab94904fa1624a24f14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eacf425-1968-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807067, "uuid": "46c5437a-f724-425c-9c1c-3b6db20b5114", "comment": "Malware payload", "value": "22e9a9cae06b3331b7e3f352e1639a7f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807067, "uuid": "0cbbf373-c772-4f1c-908f-24e72d0b369e", "comment": "Malware payload", "value": "daefd0b3bd104eefec41e34dc0f7c4aa49c4d8cd6b68151ca37e226dab955c76", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807067, "uuid": "3fc77685-490e-412d-afec-b19bf1f07e66", "comment": "Malware payload", "value": "f6b8a8f7067b1bd62a3892363ffcfeb693625d5c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807067, "uuid": "f2d0d1b1-9e4c-4c6b-ac5c-77e98b2ff4e4", "comment": "Malware payload", "value": "711262274284de7eaf2a1eb8a51e72d3e2c4a24c1db3acdabebbad39ee936d3be898edf267f07530f24b99e12a1d3f4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807067, "uuid": "ace494ce-5c9f-4294-aa43-61fc23a26c02", "value": "T10CC35C1775D180FDC8DAC1B49FEAE226EA33B42D5138B21E27C86A671F4DE205F5D620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807067, "uuid": "78371a4f-1c62-42b7-ba32-e2d0b16b26df", "value": "1536:UrAFmGO0Ng7K+9CIiqDG11Bs0+Ndm1/lAqK3dtNI/xSeabK3j:UEFmSmviqS1Bs0+Nd6lAqktNMxSNbmj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807067, "uuid": "4284ad99-3931-4fb9-9a7e-25f3f47a3124", "value": 123464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807067, "uuid": "fae7895b-479e-47a1-b398-4d8519b637f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807067, "uuid": "51da65ef-c6b0-4c35-a79b-d4c547a2652f", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7ea58c1-196d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809472, "uuid": "9681ff89-4e6c-4baf-8161-41c5385a902e", "comment": "Malware payload", "value": "ced2b9a86bedae29134a3f8db83f8ba6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809472, "uuid": "11fab9dd-6023-40e3-b5e7-920890e20a55", "comment": "Malware payload", "value": "db601fb2a26e8c3e95ea63c57dc8d1f28b2cf9d61bd603b79be1cdf99f4d5a81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809472, "uuid": "5c0b0a48-8d2b-4928-bf08-aa7fb0b9080c", "comment": "Malware payload", "value": "08011726d5af71f1de39f53775f11ea4241adeb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809472, "uuid": "6a449152-3a71-41a9-8371-e34df1ccecf6", "comment": "Malware payload", "value": "64afd3ac47855b95041a8371d6d7939719c0d2441120690a37f5cb623a7628dc5c72c4d60345081cc56158aaeb263314", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809472, "uuid": "df4a2f8a-05f8-4fff-9eb5-bc81edcad7bc", "value": "T18A052360B9F0C167E69A4A314CA543761BF8EE4F80D1B1CB838076CE7CFE6615B26719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809472, "uuid": "08fd5d9b-f95a-424c-ae9a-e42fca29bb99", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809472, "uuid": "ad53b25e-74a4-44a4-9480-b652ba4dcd48", "value": "24576:Y3d5WbaORV8TNcjylCTsjJlsOSpMYWzAb76VAtuuWSgHI:Y3bWeA8Z35jJNzAc0WSgo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809472, "uuid": "068adfae-2f5a-4ff7-b5f6-1d0c9657343a", "value": 825112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809472, "uuid": "1315c7a5-3356-4b8f-9f7c-d4da8abaf81b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809472, "uuid": "347bf697-baf7-4d4c-93f2-a7147a30e6f4", "value": "db601fb2a26e8c3e95ea63c57dc8d1f28b2cf9d61bd603b79be1cdf99f4d5a81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16b26834-196b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808315, "uuid": "c85b05fc-bf55-46b2-a3e5-587b3c8ae957", "comment": "Malware payload", "value": "a5cb5661b7c9253da147033f101c4ad0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808315, "uuid": "519c11c1-d243-4715-b515-430f8bd39f4a", "comment": "Malware payload", "value": "db84c7d02fdd7c214a0e6f5467796dbe7021800d18e2f2ecb02cf53ddce7216b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808315, "uuid": "9f524824-9b35-45c8-ae7c-f4b15443ee38", "comment": "Malware payload", "value": "dfd8a4b0f81dff76ac2c3d66a9f88ef10d1ad8b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808315, "uuid": "1d50a28c-4415-48bd-a7f1-224174aec510", "comment": "Malware payload", "value": "09122c272fed5dd6fb3ef18233243f8b744f87ca64b2d49dbb863db6a69b3b2ecd479f3fc4d693e565ff3f6409656c8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808315, "uuid": "10b6fc9f-7eae-49de-9254-9a6afea3d6fc", "value": "T1C4B4D456E660B426F89344353D79B24779293D362681DD0BBB889F5A3AB19C3B0F031F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808315, "uuid": "b8bcefed-5d11-48cb-8349-caecc62ad55e", "value": "a7136a5845ae61093cf009a326d85fc3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808315, "uuid": "0e337523-06f4-41b0-a779-57961ee8c070", "value": "12288:TecsK+MrMGuRjPA1J4+S0r489WT5ZKKEs:H/1J4+LU8DKR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808315, "uuid": "9cbcbca9-dd0a-4cd7-b027-4d0d19c0b596", "value": 503808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808315, "uuid": "b5ea64cb-6c4d-4a46-a688-bed6a8cd26e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808315, "uuid": "45089b3a-5761-4528-8fad-bc30c635c2d7", "value": "db84c7d02fdd7c214a0e6f5467796dbe7021800d18e2f2ecb02cf53ddce7216b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35a3537e-191a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772773578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772773578, "uuid": "7408b711-1b0e-49ae-9c44-fd5bf3afd75c", "comment": "Malware payload", "value": "fedbac4768636be461c284e60f1a44cf", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772773578, "uuid": "8a0a5c3e-b5b4-490a-8d7e-1fa593a2cec4", "comment": "Malware payload", "value": "db8a4dcdf70d569e7df6d292336a9ba255383e0b87d2d34edf2a5481fefe122a", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772773578, "uuid": "c5e6d8df-6916-4b42-8e86-0e7cd7ea9260", "comment": "Malware payload", "value": "e3d9ce9615565ec2bc984bb3bef9db084f32d7f3", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772773578, "uuid": "b8a88859-a166-4e28-8435-392a4def11f0", "comment": "Malware payload", "value": "fb2dcbf68216a9b402c6852deb0c4641b4dc9b7e439a8b766b375eca6ecc972a6ac9f80e7733b48e72e461d98dd78002", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772773578, "uuid": "fe82c7db-a385-45d7-b93a-30e16cab0a0f", "value": "T1D9410BA3357093F8594B5056F629C886AD01BCB32F03490895B9BBCF3F4F0CE0486858", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772773578, "uuid": "913d2a3c-8a2c-45d2-b987-d7818d4cef03", "value": "48:ZSU+FdXW1VF1iHvVMEVQzynJX+gzkpE9tZv+7AOcqV4tUo/KRwrhjhj:ZSU+F41dkdMWQzOugzkYtkAOcg4tUo9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772773578, "uuid": "b82b0d4a-8c33-48f7-a677-218d18e66e5f", "value": 2204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772773578, "uuid": "6a55acf9-34d5-4f1b-9533-3231f50854e1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772773578, "uuid": "0500efdd-1e00-4f3c-adf4-2dcd5faf046c", "value": "DHL Receipt_57216218402.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbca26c0-196d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809478, "uuid": "0320f5c1-2fc1-4c7e-b386-c820e9515706", "comment": "Malware payload", "value": "3128bb11f7a8ba1f45002ce82d5ca40a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809478, "uuid": "e6f49fcd-46a4-4d2f-a14e-ed735b6bb376", "comment": "Malware payload", "value": "dc19c97f006376ebb5a3173aa30104a98f3abef2ee5787df69898afd37883e20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809478, "uuid": "a2eb99b0-7437-435e-86b7-482dc26cc095", "comment": "Malware payload", "value": "b760ed6dc2100f11f58ffad17cdfb824ebd5eacb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809478, "uuid": "e244997c-d860-4cc0-a387-a2c134d7aee5", "comment": "Malware payload", "value": "6e5c5a04ef1947c5712a42da0a919b3a80ac7eb364c2e9bb511b2d2ae0bd82e54d61519c3caed1d667ed8656a4306f08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809478, "uuid": "c57065a9-3a82-4d7d-be8a-bfb5c711279d", "value": "T17F641210B6D6CD25D9C60B704A3646F1EEEBAD924098974F6F407FAB7C31A71A80E743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809478, "uuid": "44691d00-b670-4ad5-9e29-d0b286096e57", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809478, "uuid": "8685ced4-5174-4da6-9fcb-ab7102329627", "value": "6144:JnPdudwDOpoJJsE7lldBUQptJl4hSxiLCmjSZmdkEAe+/WXj4YkBkDZFZNWQd:JnPdipovL1l78+muyRc1OD/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809478, "uuid": "c90a8d9f-6032-4022-aadf-f3c93aa32abd", "value": 334304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809478, "uuid": "199853a8-b616-4ade-982d-d7b7a4e42547", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809478, "uuid": "ca3e5713-de1f-40f0-980b-2721f6df7cb9", "value": "dc19c97f006376ebb5a3173aa30104a98f3abef2ee5787df69898afd37883e20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "095ade11-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772808722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808722, "uuid": "6bba5adb-b6cd-4041-9d28-dfea0b7e8c32", "comment": "Malware payload (Mirai)", "value": "54f6c3db6ec16331638038f918755b80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808722, "uuid": "62ec4f57-ca63-48e7-a397-6564fd989e92", "comment": "Malware payload (Mirai)", "value": "dc971a180d1fdb297a7221e2f451bcdca9f0e1c7e12ccc579dead2d8b1d5c703", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808722, "uuid": "7a342a5b-4197-48f0-8edf-4df8b13e2c5f", "comment": "Malware payload (Mirai)", "value": "a62434a015abe1f7485c88f9b5d4ff118dbdf8e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808722, "uuid": "bd0bcc2a-be6c-4a62-9dea-806e6d2a2da4", "comment": "Malware payload (Mirai)", "value": "89e8c511a31276933bb4401f13b4d866ffaab1a5512dbf37c55a5a7ec4fa0db585f6ced74e1392a613e567af935ea0fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808722, "uuid": "19ab8337-4340-458e-8ba7-b5ee704fc1ae", "value": "T12B1408C3B915FEB3F48AEB7204D3C72061F1BB614B531622B297B9759A3A2C43426F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808722, "uuid": "8ac7e58b-5e08-4737-943e-7a09863040b3", "value": "3072:+TXosRXPb8RyelempUYCDPAPA/IWIVQjbilLBIh5gafo5/cvw0GL+i41+l24n3z5:qR4RyeYmpUYv4/IW0LmOVcvw0GL+i41M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808722, "uuid": "82b94b8c-8c79-4da0-9065-e4f263018415", "value": 195461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808722, "uuid": "cc7c071a-9d9b-4618-adf1-b14969b4dd47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808722, "uuid": "da085bed-0759-4c99-b247-82a0819ec9cd", "value": "i-5.8-6.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "559ed355-1950-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772796824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796824, "uuid": "54390322-5fec-4b12-be22-03528a81df80", "comment": "Malware payload", "value": "5d3eb94e6e62c60eb176fa0f7ed76646", "object_relation": "md5", "Tag": [ { "name": "94-158-245-153", "colour": "#0E67A3", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ink-approval-com", "colour": "#8059F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796824, "uuid": "bff1fd6e-1429-43bc-9bd4-cc970930431a", "comment": "Malware payload", "value": "dd1144b76e60dfb5a6dbff70f3435ef3cfc0ef2a82dfe1aeb30d843baf2c0c4b", "object_relation": "sha256", "Tag": [ { "name": "94-158-245-153", "colour": "#0E67A3", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ink-approval-com", "colour": "#8059F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796824, "uuid": "037c257e-01a3-4483-9e8b-59ac1ea3eff9", "comment": "Malware payload", "value": "5c4c1b5d07f98508b118b96585ee53b0ff0c0b32", "object_relation": "sha1", "Tag": [ { "name": "94-158-245-153", "colour": "#0E67A3", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ink-approval-com", "colour": "#8059F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796824, "uuid": "c60dda1a-b11c-4966-bf81-1a6dd2d92973", "comment": "Malware payload", "value": "80496fb4c155b31780d96f30bd1d75146f25b1ec4464a1541319c20205df201d6f52d369ff3b9168a350ba12fb77db3e", "object_relation": "sha3-384", "Tag": [ { "name": "94-158-245-153", "colour": "#0E67A3", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ink-approval-com", "colour": "#8059F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796824, "uuid": "b50a2e0e-76fb-4ec7-a8ba-c9ca8559a9cf", "value": "T145023CF3030A3F5877B8036BF9C9A838B69AD87B2314D4AC19719D4DD11691FEE65A03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796824, "uuid": "76934ddf-6cc1-4cac-af72-a809849332d8", "value": "192:kP2S2R4FFG7NfwdEIoCNL4/TpnxXsYXOkj7l:UrMNAzAHsYekj7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772796824, "uuid": "31930e61-d059-4402-96d8-593b8799fed2", "value": 8568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772796824, "uuid": "570b779f-1c03-4510-baab-8299f850ff6d", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796824, "uuid": "ab37b2d5-ea7d-4d5b-92d5-54c0a7554d24", "value": "infant.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faddc2f5-1974-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772812564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812564, "uuid": "92f7d54b-e1f6-4e60-bdc3-fb540b62f843", "comment": "Malware payload", "value": "db1b11b63d631e2d0cebdefb322c2e7a", "object_relation": "md5", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812564, "uuid": "bf01db46-bbce-4bc0-bb6a-abb8ae3dee8b", "comment": "Malware payload", "value": "dd76fa4057fe80097239ce1083ad02470c95f8cc6f46f45625bea944d195f456", "object_relation": "sha256", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812564, "uuid": "d78f63a2-dbd6-4a9e-8107-67300ca9fc83", "comment": "Malware payload", "value": "962388fe6fc2ab711ca07e29e8b7728fb4b9c001", "object_relation": "sha1", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812564, "uuid": "3a882c6d-1930-4874-a0c2-8ebfe544a8aa", "comment": "Malware payload", "value": "0fa06d5ef4b9f656208e0c70ce7fd907defe11fc66c6abb30d6b9ae40b52ee3313215a3571954dc7e3c39568f041b77a", "object_relation": "sha3-384", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812564, "uuid": "11f63f79-b248-49e6-8ce7-107fe05480e2", "value": "T12B33F22DCB347614EE69A4B8C9DE0CF8B4AD4085E85C8D8E213BD2BB521A177504BBD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812564, "uuid": "433b1827-641e-4dbf-be30-2bcd72be0813", "value": "1536:AKStBxWqPxhJB1CmgOMDOuGRov5IMVp/59vJ0:KtBHKHtOu7fvC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772812564, "uuid": "eb1eed97-5bb0-43a5-886c-42f6fdc6dba1", "value": 54107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772812564, "uuid": "cc691977-4c08-47ef-b372-fcac4d948a86", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812564, "uuid": "cbaff062-9d4b-4b2e-9e4d-eeed1cf26bb1", "value": "Letter to Indian Coast Guards by Def Secy.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45a09380-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808394, "uuid": "59de3137-bd8a-47ea-9ab1-e0c272120f1d", "comment": "Malware payload (GCleaner)", "value": "1413873b75ad0d8720a64fd59f3aeed5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808394, "uuid": "1ea8c66f-b87a-484f-8800-8d04a242cadb", "comment": "Malware payload (GCleaner)", "value": "dda6b7c38558d19211070848aaaf21463c85e15adb7f4ba457a173491349389e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808394, "uuid": "afc084ff-3b09-4a09-bc76-132af8f67d76", "comment": "Malware payload (GCleaner)", "value": "3fdc6fd0edfe3d0a94d4decbcf16382ea838a5d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808394, "uuid": "fb5041bb-1757-4005-8a6e-85c95c5942a1", "comment": "Malware payload (GCleaner)", "value": "63bfa2ade125001f4d3b4b2763c31523e460e89e5f8a03952b5596fa11d60029146f53eab558293793b8d576cd116103", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808394, "uuid": "fe07add6-beeb-45fa-88ae-cec94f1ac4e5", "value": "T13646DF41FB95D168C6A8EA319232517F84FE3E24EAB4B5362B4777FB0D0B253241E346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808394, "uuid": "f1769113-f67a-40bc-af59-750f1003eb3a", "value": "336c69b6e8562d1c5231f219b62d7473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808394, "uuid": "acb0b943-356e-4140-8a31-737b0e8b737b", "value": "98304:l9zuzgT5WZr1kJA1515WeXt3WUBC6up2MBRrQflJjBIKHTFV0:lpgB8EWeXY6K2iUf/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808394, "uuid": "94a8e8b9-cbe0-4b47-99c7-83f99e575163", "value": 5356544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808394, "uuid": "d897c363-31da-4146-9340-e08db86105d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808394, "uuid": "cf6fff6d-f491-4a53-ace3-3a9c16db0fa3", "value": "dda6b7c38558d19211070848aaaf21463c85e15adb7f4ba457a173491349389e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dcbe016-1972-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811495, "uuid": "bc9f6f66-5737-463b-8330-f5df740830eb", "comment": "Malware payload", "value": "a22c64b8067c14caed5dc8544a678079", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811495, "uuid": "eb6b72d9-c0b1-4e84-8e57-4774d88b8468", "comment": "Malware payload", "value": "ddd9fad3934ca9888e4cd81c92155ef74621aa9229fc36898ea7c795de471a37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811495, "uuid": "5aae1a39-36e5-4be0-92ad-837bd4c5fa37", "comment": "Malware payload", "value": "e02af03ca3a33f14efc307e7e1dd1163f870648f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811495, "uuid": "388667a2-93d9-4b97-b530-81286a997008", "comment": "Malware payload", "value": "c6bd737c09ae5ae33c98f737afae0cee46fbc4d1ea348adde8c3056aa916ee9ae58a0713491f0e27ed71b035cadf74cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811495, "uuid": "afac284d-dc7b-401b-b5eb-ca0388ff12d1", "value": "T13594E616EB10B4A5F89349703D38A246782D3D3A2681EC4BB7899F593771A83B1F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811495, "uuid": "538c3252-dce7-4b7a-a9a8-7b62914f1fcc", "value": "c5ed9080cca50a136dcfe6698f716e2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811495, "uuid": "a8842e2f-0f2a-4cae-9e36-cd875cf2e200", "value": "6144:VMwdhZFI+oLswG5mu3XY1VywOtZKGziSrlkY9JxeP9xIzYIPuUa+HHj8:BfFLBmu3XY1VywOtZKUDePv+5a8D8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811495, "uuid": "c3fbc198-e50e-4999-83ff-c7f13752ed90", "value": 438272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811495, "uuid": "6c9553c5-2ef3-4ad9-b58d-860316b08f28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811495, "uuid": "027ff962-da0b-45af-b949-56cadb87c82a", "value": "ddd9fad3934ca9888e4cd81c92155ef74621aa9229fc36898ea7c795de471a37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d44c5091-196a-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808204, "uuid": "d10221d2-aa2e-4340-a252-d439e2ae228f", "comment": "Malware payload (GCleaner)", "value": "6bb872de0b5adbb2a7f1cc0c9f822d5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808204, "uuid": "8ecbe548-dbae-408b-8e2f-29911066b41d", "comment": "Malware payload (GCleaner)", "value": "de7ed29aa6d779df5b2dfa5861bdf594ca9c7681b93d0604cf68258565d6d160", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808204, "uuid": "2e54fe64-8ca3-482e-97b2-2121d52b0ffe", "comment": "Malware payload (GCleaner)", "value": "ad36f3f1b377495f0fc3e32917496f7945d129f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808204, "uuid": "ef22d27e-36bf-47dc-b45e-dc131609311c", "comment": "Malware payload (GCleaner)", "value": "857331ce5bddbe9918e5490488641813c988a2b1365cf2d1f95636f3021593e07cb41b8ff6efe6347b75035bbf4fe6bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808204, "uuid": "eddb5dca-6c2c-463c-8359-fcc50191dec3", "value": "T1EE36D0C322D03536E42A2EB0FA5E7F8706AD6555195C524BFAF00CC9FAE24C16B5DB0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808204, "uuid": "48e33087-6991-471e-a7f5-e0a5b6f9bc9a", "value": "e5f32a93ddcf3aa9009cd70911b0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808204, "uuid": "bb9419dd-6d06-47f6-8db0-a1f326f034fa", "value": "98304:j9Cexb3SSbTqYnfFvYSLWXlX/wTv63Z/WeO:j8SbGEgXlX/8eO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808204, "uuid": "b4e51dd6-ef66-468c-bc1d-4f761642d486", "value": 5097984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808204, "uuid": "32561b83-2387-46a9-bf89-a10881aacbe1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808204, "uuid": "40d6ac91-b0c3-47d8-aa90-846f147f01b5", "value": "de7ed29aa6d779df5b2dfa5861bdf594ca9c7681b93d0604cf68258565d6d160", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8d3e5de-192d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772782039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782039, "uuid": "1022c1eb-7f7e-43fa-b8de-15f52dcaee65", "comment": "Malware payload (Mirai)", "value": "fc20698e6cc42cbea449bc7c3c4cbd8d", "object_relation": "md5", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782039, "uuid": "822dae61-a633-498c-8b3b-8b534a7dae5f", "comment": "Malware payload (Mirai)", "value": "de861c9cea03153de855afd6866f95fbcbaf393eb89cc874585201264410e64a", "object_relation": "sha256", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782039, "uuid": "086b71ba-1382-4f98-8f08-ab3409e7b2a1", "comment": "Malware payload (Mirai)", "value": "f781bb5582a53a77118cd74f6155af121125c830", "object_relation": "sha1", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782039, "uuid": "26e2638c-955f-43f9-8a66-536c2887b23b", "comment": "Malware payload (Mirai)", "value": "20ab598cec2fa66f309a131ae37d0142e1e949d26ae6abf1e3e9307bc6e48c34e4a1c216c930bd193f9af0c474be2b03", "object_relation": "sha3-384", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782039, "uuid": "6fe01fc1-28c5-45a6-9a34-75f8394d4558", "value": "T1C3B32A4AF9819B12D5C922BAFE1E518D336357B8D3EE3202DD14AF2437CA96B0E77501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782039, "uuid": "fcf5e5e4-357a-47f1-bfbb-28991bccef9e", "value": "3072:M3M+i6tNOrShzLxNuWQzmdlHalGC37j4wDw9ysUJpa:M/TOrSR30wlHalGC378wVu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772782039, "uuid": "0d7f76db-026f-4b86-b6be-31845f3eb8fb", "value": 108044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772782039, "uuid": "10b365c7-8a08-47ee-b749-0f813801bde6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782039, "uuid": "0399ab9b-6dd9-410e-8814-31d603bb6172", "value": "tul.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f298791-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772809752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809752, "uuid": "b0663b84-869b-47be-a8b4-53216beb651a", "comment": "Malware payload (Formbook)", "value": "3595bcf8fb0eb64a8ee4db18e940f6f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809752, "uuid": "63c67f61-e43b-4bd4-97f1-d37893e78a91", "comment": "Malware payload (Formbook)", "value": "deea5beee6ffa503b1371fbad4662210caa2bd1c7574ce3708123d16ee916c3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809752, "uuid": "23c85739-6b4d-4565-b5fc-75046f167345", "comment": "Malware payload (Formbook)", "value": "e72e7035b30643008258caaa4b58fab8b0578942", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809752, "uuid": "99a02e42-2507-464f-986f-ac14353afc45", "comment": "Malware payload (Formbook)", "value": "f0ff84759ef7de11de434df57e11f41df8aa8894b9282d5ea264b87d97dc34e2c664570dcd9c80d6f7531c8ec81d49a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809752, "uuid": "c091abb3-0fcf-4d18-825d-807183120daa", "value": "T13135BE027381D062FFAB92334F5AF6115BBC79260123A62F13981DB9BD705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809752, "uuid": "1865afd5-fb95-4936-bf44-7075677c5fab", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809752, "uuid": "0633a848-e3e6-45cf-a1f0-0028017785f6", "value": "24576:u5EmXFtKaL4/oFe5T9yyXYfP1ijXdahF0OLYz+Lg:uPVt/LZeJbInQRahHUK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809752, "uuid": "6114980c-1cdd-4bd3-8b58-b91b2e03db97", "value": 1141760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809752, "uuid": "11aac494-8dd2-4d50-9016-6068f3a88abc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809752, "uuid": "accf5731-2538-43c3-a114-5bec423297b9", "value": "deea5beee6ffa503b1371fbad4662210caa2bd1c7574ce3708123d16ee916c3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3ca866e-1969-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807693, "uuid": "020c64ed-c22f-4300-9d0c-38ab5df5b298", "comment": "Malware payload", "value": "bd861dc82ac87f9318caac8d7a81869c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807693, "uuid": "70a12dbe-da0b-405c-b6bf-abc0511993e1", "comment": "Malware payload", "value": "df271a0039f06ce8142db508146927f6d93aa249ba3bba65f949042ea3efc52a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807693, "uuid": "f0a55753-e515-4b57-95f0-bcbe85a30e18", "comment": "Malware payload", "value": "1e6cd42130fecfaed9aa2bfb52638ae2c00feeb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807693, "uuid": "36576da3-78ee-424b-9dfc-69b6a80b1f86", "comment": "Malware payload", "value": "3fda9c0d25777164de68bb2647ffdfe9254ba15248078cff1f87db2794d743bfe62bb1fbcbebc503ad07f129155fd1ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807693, "uuid": "309633dc-06e9-42a9-aa5c-021c89176f0f", "value": "T19B1512600711584EE0630C74A8B57772F7A8AE6537ADC3C27BC0B9987D3B2568F693C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807693, "uuid": "777250f2-c1db-485e-9c6b-422c3e90b219", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807693, "uuid": "7c283845-37bd-45c1-bb4c-c232c4dd17e2", "value": "24576:mHO/MdQKUon/d1yD0afbnWdBz6kqd43jbz1HVkMIwSqLbBYNG5:mHO/u3/dpafbnWdBGzKb0wSqp95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807693, "uuid": "bec686ed-9a9a-4232-a928-a847fad11bb6", "value": 876271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807693, "uuid": "eec974fd-da7e-4261-ab5e-7b5e08169699", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807693, "uuid": "f307b3f3-0353-44e8-9272-a6c1e0eae782", "value": "df271a0039f06ce8142db508146927f6d93aa249ba3bba65f949042ea3efc52a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5578c9b8-196d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809280, "uuid": "b391fc96-1836-4939-b4b6-a35d013703d9", "comment": "Malware payload", "value": "c598e8e7c7b3c1b1894cc232694f7d1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809280, "uuid": "9b5287eb-21e9-43a7-aacd-9b32bbe9ed6f", "comment": "Malware payload", "value": "dfe3793aaf6bf376a76399aeed1f90afe821d9269394be92ff46aa058af7f3ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809280, "uuid": "c9269b8c-f406-443f-80a3-a07bb370efc2", "comment": "Malware payload", "value": "b39cbe3102acd136a0fd04cbe20bc4e6d671028c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809280, "uuid": "5a5a8369-f600-4cec-975d-e67715a43d73", "comment": "Malware payload", "value": "aa2fc8f7c2a36053c9d982a149c9f7ebc8b5251776a4b3ee92ee18b312cc189308153d5460d2d049dd8b32380881150d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809280, "uuid": "a22a87ec-5cd9-4029-9d06-56ed6bb24c72", "value": "T1E23501325D422A24D8691F79C17614D833F0C95B522AE76F5EFC01F4AEA3F4ACC276A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809280, "uuid": "6558f05a-c717-4269-a82a-b8763fb4bf5d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809280, "uuid": "b4d9eded-6a9e-4f64-9992-974599c62f47", "value": "24576:onEhpLT/4PPH7caoc70Xng07ehk7JblNB1:vLzswao7gGeh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809280, "uuid": "1bba144f-fd06-4e46-9911-8163212a3733", "value": 1095680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809280, "uuid": "6df584c0-7ff7-4e43-80ff-e17185dac422", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809280, "uuid": "26828624-9bcf-44aa-b468-c9c8582a398e", "value": "dfe3793aaf6bf376a76399aeed1f90afe821d9269394be92ff46aa058af7f3ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eed50f3-1984-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772819228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819228, "uuid": "d7cfe13a-8f00-4d20-b62e-df02a343dc1b", "comment": "Malware payload", "value": "fd9f972c036db65e6948f5ce0a96b4a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819228, "uuid": "c33c3769-ded0-424a-b8f1-7936c4548b56", "comment": "Malware payload", "value": "dfe40eb1ff04ea7ddfdba2eef433df1fc6e472bfdeac7ee75b5b1fbe287c40a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819228, "uuid": "efbe0eae-118a-470d-be5b-9778e6977568", "comment": "Malware payload", "value": "1067a81a330466fa41eb5eb9c1c70142918428b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819228, "uuid": "a3dd01a4-9e59-4d16-9f31-242c46cdf01f", "comment": "Malware payload", "value": "f87f9e0cafc932f2ae83cb7fcd852e4f30effc54f72234642378a80d6c783e9234e18a02a331421535b559cff16f92a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819228, "uuid": "739d0c52-5274-4c80-84d4-c8f649071cd8", "value": "T1D3A2E816A20D0997C86B1E702E3FB3DC970FAEE512D49189200EAE4EC2BAD35554DDDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819228, "uuid": "00e4137e-6a40-4cbf-aee6-931e4db79dd9", "value": "384:EzuGS34rrBksG4fjCbVhg/1ZBUPI13mf6wTqGh51Y5kgqu5e:RGigBkd4bCx6p3mCweGfq5De", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819228, "uuid": "2c4021d0-f918-43de-a1dc-4fc7c77a3e87", "value": 22548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819228, "uuid": "990f49fb-b658-4f54-b13a-d78f0cd83ea8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819228, "uuid": "fe1b8f92-f66f-4fe1-b079-41c4f05fff29", "value": "violetppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25b669d9-1974-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772812206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812206, "uuid": "dedca017-8adb-47e8-be31-89156bbd7c19", "comment": "Malware payload (Mirai)", "value": "6f3d8e76b17223e315eba541bcabf7e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812206, "uuid": "9c439808-0dd6-4a36-83e5-a472637efe4b", "comment": "Malware payload (Mirai)", "value": "e06bab7251734a687b55b2cc8e269e8e079db4fc74fbf2597509b5e7a0770bd8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812206, "uuid": "a6ad8f56-a976-43a4-87fb-f05573b6785f", "comment": "Malware payload (Mirai)", "value": "c0d1cd32ddd09c74b80e735a1739e7e4af41a77f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812206, "uuid": "8acb83c8-e27b-4dc1-a489-5106b718d971", "comment": "Malware payload (Mirai)", "value": "9c481c80a4997e434771e06b15f7f23c526a10e5edd38b524286f1211311ee83d4acaf2d2304a602433e7344303681ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812206, "uuid": "9ce9f0fa-9256-438e-a2e9-3b410c380fa7", "value": "T1BE935BC4F683D4F5E89701715037EB339F32F1B92119E642D3799A72FCA1A11EA06A9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812206, "uuid": "53029e15-da92-4850-ad96-2b83391e49b1", "value": "1536:eViCPoNcMmfW+B8hSgIa/41Qmikq/fdKcDSeU8MD/:miCPoNcM5IlgNAQxbfdbOgs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772812206, "uuid": "0198740c-b96a-4241-ab51-237dfd73bf5c", "value": 89000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772812206, "uuid": "e63e6055-1758-463d-a161-825803f5e54d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812206, "uuid": "b7f2b8f7-130e-46d9-a8f5-09d9a59828b0", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96d557ea-196b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808530, "uuid": "832be9fb-52a4-46d4-8291-bb692fe89735", "comment": "Malware payload", "value": "8c7c166974f92d5955fded75ef59d6cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808530, "uuid": "4a02b0b2-370a-44a6-a245-9b94c03192b0", "comment": "Malware payload", "value": "e0a7c224fcb25ecf89e90d1c00f7a8fd5192bd1ff63278754e2056549443b87f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808530, "uuid": "7be0c4b3-87cc-43c5-bfe4-787e081e86ce", "comment": "Malware payload", "value": "4ca822ab3a985bfbe76b85b0a44c8e0750026f48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808530, "uuid": "f9c3094e-9209-42b8-9538-feb59dad4c38", "comment": "Malware payload", "value": "ad677cf68908a35d76eea96f60cc54e4d49e1f10a6762f42f45fb55fe97f27b53ec2044a846682b0135370f3ab197eac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808530, "uuid": "7d194fa1-662f-47cc-acf8-6b5285eb786e", "value": "T14245BE0273C1C062FFAB92334F5AF6115ABC69660123E61F13981D7ABE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808530, "uuid": "ae171958-aa89-4060-b2ba-573e78513512", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808530, "uuid": "7819491d-2900-4eeb-a43f-2b19bbfa33c7", "value": "24576:T5EmXFtKaL4/oFe5T9yyXYfP1ijXdaZRyoDeuNm03VNyi:TPVt/LZeJbInQRaZYoV5lN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808530, "uuid": "b157b70b-037e-4e63-9228-d5a3fd703f90", "value": 1184768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808530, "uuid": "dbb6c919-7b92-4b4e-99a8-2b4ec16679b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808530, "uuid": "f779a0a8-62a6-481b-93f0-67960a73dca1", "value": "e0a7c224fcb25ecf89e90d1c00f7a8fd5192bd1ff63278754e2056549443b87f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ac105a2-1985-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819623, "uuid": "baadca47-7a0c-46e7-bd36-e161e8ccb4ea", "comment": "Malware payload (Mirai)", "value": "56d3f28f8f887eccf2ba26678423ee86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819623, "uuid": "ccb6591b-b300-4488-935a-df3e4c8281c4", "comment": "Malware payload (Mirai)", "value": "e0f508a9feff1e80ff985b78751921c2cb1608589c4800ad7e417719622687f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819623, "uuid": "0fd5c6d7-8b91-4566-b496-4fcfd44b819b", "comment": "Malware payload (Mirai)", "value": "2058bda5610dbdfb04ab20f1483d3e7d00e345a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819623, "uuid": "de138277-78c0-40ac-a090-2c9d11faa35f", "comment": "Malware payload (Mirai)", "value": "e659b0932bae6142d4cd385df40b9e695be9a9e47d0473e9b11e0b93654735dfc8d887791929c9354c8ca04bffebd606", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819623, "uuid": "60be3fdd-0c18-4a11-9d5c-6af090380108", "value": "T1D32633040AA7C7EAAD835236A08E9375CC5F8F2FF85D0A1C8EE574448C07959A1E797F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819623, "uuid": "006017b0-a2bb-483b-86b1-b2143740c222", "value": "98304:BfcBc5afb5dn/ZWfb3SGRRdeQUx+0WnOyyoiyWYl+7YIm:BiDnYSGRRgf5Yy9yzKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819623, "uuid": "d456eb92-ad96-474f-a3ad-d830046107c2", "value": 4475288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819623, "uuid": "72258902-458e-4196-808b-356f796a54f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819623, "uuid": "cd33abf7-1d9b-41f1-abb8-d8f318a30037", "value": "bot_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fbe6724-1985-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819632, "uuid": "83c22a5b-3a5d-4987-9684-b26f03beb92e", "comment": "Malware payload (Mirai)", "value": "d65331498987713c6d3296c64c06ed0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819632, "uuid": "a723305d-c46f-40a4-80ae-1e95b11484e2", "comment": "Malware payload (Mirai)", "value": "e132e4577ae244b7d62c96dcd13bbc3c13cb907ccff763b01ad6d0227a07f2ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819632, "uuid": "c4a44b46-7d8c-43f7-8753-a49bf78bccd2", "comment": "Malware payload (Mirai)", "value": "9c352014c7746963d75bd9a6b8eeb5229ed2264f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819632, "uuid": "19d1dcb0-ee67-4009-bffd-c81052d9b2e8", "comment": "Malware payload (Mirai)", "value": "5a83058248c89532bd68044ec2463d3d77ec26223dbc5cdcdaca28a6718e5ee5160893d24f4c018445bc1ea808e58c87", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819632, "uuid": "895b2f3d-4cda-40d2-9164-4faa865525a2", "value": "T1AC967C47B8924952C5E42637BCBE81C433634EB98BC7566A6D14FE387ABF1D90E39304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819632, "uuid": "0baaaabe-1469-42d2-8d13-6f3d6175d5fd", "value": "98304:t3fHHIoUcUvTc1cFVZrER6pV48WdJLLwNXgxm838y:t3goUcUvTc2FVOR6ArTLsNQsI3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819632, "uuid": "672697c9-304f-4085-90b3-436ce8cf0002", "value": 9398002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819632, "uuid": "17d36ed5-7d5c-4627-a68c-98a3ff9a4317", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819632, "uuid": "e0d00ab3-8d4b-4e20-a08e-2dd01ab28de7", "value": "bot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a88f430f-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811137, "uuid": "49751978-6224-47e9-884c-e5e68ba28ecd", "comment": "Malware payload", "value": "b91bc183b6b0f9a1bc0f91bcf7fb8465", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811137, "uuid": "73256839-2801-49c0-87a9-8a8fd6871729", "comment": "Malware payload", "value": "e137d595deec4e3f8751088d2cbb8f5fbb6a0f7eae9df3de7f2e40d9293d5c7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811137, "uuid": "a531b343-f8ee-4709-a954-5c9039bb2551", "comment": "Malware payload", "value": "05e68b6528d78f038ec88aa126a23889baca533e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811137, "uuid": "0d96cb4d-fbe7-478e-a588-4dafd84eb81d", "comment": "Malware payload", "value": "8b3ca12af91b1996dec0f32539a9dd3e1cf6a3c5361d214d387f4b0bdfd3b5d9dd695e90c28714a2fb14e65672912f17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811137, "uuid": "9e107e17-ebb9-49e8-913f-a1e381634572", "value": "T15445BF027391C062FFAB96334F56F6115BBC79260123A62F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811137, "uuid": "56f67fcf-7af0-4e7c-a8e2-816c64d8e512", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811137, "uuid": "016475d2-9db6-4615-a6f2-5303dcd1df4a", "value": "24576:T5EmXFtKaL4/oFe5T9yyXYfP1ijXda/jjFkQ7muHSSmTc:TPVt/LZeJbInQRa/PFtr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811137, "uuid": "6de7eac1-07f8-427d-adb4-54c7a1f89ade", "value": 1166336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811137, "uuid": "5e21016e-83c1-400e-b3b2-52297c57d5e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811137, "uuid": "e9a0dcc6-a07c-4817-b5e8-58584ce825cb", "value": "e137d595deec4e3f8751088d2cbb8f5fbb6a0f7eae9df3de7f2e40d9293d5c7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70342687-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819203, "uuid": "700a89b2-8848-4806-9a9a-cc819f241aba", "comment": "Malware payload (Mirai)", "value": "e8baa24905f72d517d6086e9004347f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819203, "uuid": "4284b80e-d06c-4bfb-99b6-52e52678230e", "comment": "Malware payload (Mirai)", "value": "e13877c33eb3d5cf94b669d967a72851a0bfe7c41e617b61c59c9ab73cb2c248", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819203, "uuid": "43c07023-0a25-4e5a-b737-4d741fb4f5be", "comment": "Malware payload (Mirai)", "value": "d2d997b098886433ec84b553437d6b853ee9a711", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819203, "uuid": "cd8fa8db-1b74-466a-85f1-ddc524901dc8", "comment": "Malware payload (Mirai)", "value": "f9c2339dba22990ebac6ed82b8820518d6c12763d053611f0161156d63ce37199cee49ad9f1b1340554c88e22752d82d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819203, "uuid": "0facaa50-938e-45a5-b9a6-e455c2be65df", "value": "T100144B53A8755FB7C199AEB965B35A310717E8154B4B0F8AB13AEAF4020F8CDF40E364", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819203, "uuid": "4221a056-3040-4ef7-a701-71ccf1ec9d85", "value": "6144:jwhbHH0k3M5/l8n1w5HBaf6EvZoooD+SH+hI9bymu6:Mxn0k85/y1aLEvZoooD+SH+hI9bymu6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819203, "uuid": "bf0c68c1-64ab-4e4f-9122-66e09fd0ba88", "value": 196926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819203, "uuid": "02b7d8e4-3b8b-4b23-9e62-4caf237ca54a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819203, "uuid": "c0b165cc-7e72-436d-804a-f52322b0f8cb", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "592512c3-196a-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772807997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807997, "uuid": "8f97fd70-19e5-4b24-bc1b-075f2cad2799", "comment": "Malware payload (GCleaner)", "value": "3ebe50b2bc3dddc443553a5f46ef5c22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807997, "uuid": "aa94ef28-95c3-4a33-b94e-bf1752fafa24", "comment": "Malware payload (GCleaner)", "value": "e1a0f8098ce04026e095b7245dc5554a792024c969db7b1a264dbebbdbe210e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807997, "uuid": "80281de5-2971-4219-a4c9-c2b776be6cfd", "comment": "Malware payload (GCleaner)", "value": "1c1438493699b4145d0fc9f4a9d7ab27b73ac5fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807997, "uuid": "0b0cf410-3120-4f29-9381-79135e6311cf", "comment": "Malware payload (GCleaner)", "value": "e0a8dfe92bb7e780fefd8018119692e359a0e7f60be29ce36111ba445e83a4405f280b5ed6f903eeae05abb6efa30329", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807997, "uuid": "33e89d74-e040-430a-88cc-bcc8f230796a", "value": "T1BA26E04729511123C3E1043E4CD719B05433AA1B6C2A546AB5F98BCCBE76AD1A73EFF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807997, "uuid": "7d3531b5-c8b7-43d1-8d71-a459a14b068d", "value": "e5f32a93ddcf3aa9009cd70911b0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807997, "uuid": "35d8927c-f564-488c-b839-67f196592c27", "value": "49152:z9CiLxu7+m9ZNSdSYz355H5NWdVt9sFmQDgad0O3QmGjAJMIFEJCxJvwaoxSQRYS:z9CexKsLHz+szZdUKnKKmxSQPRI9xS7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807997, "uuid": "9ab63d46-a5de-4579-b442-13b18a45653a", "value": 4562944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807997, "uuid": "fb4c69e4-0f92-4f15-a199-609b622c40d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807997, "uuid": "26992a4e-fb11-40f3-bef3-396b66564e85", "value": "e1a0f8098ce04026e095b7245dc5554a792024c969db7b1a264dbebbdbe210e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43cfd5f7-196e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809679, "uuid": "222c47a9-560e-46d2-a89f-42b184cf0dc5", "comment": "Malware payload", "value": "43845ca4370d81f7796679bacce9822c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809679, "uuid": "9925fb95-dbdb-4bf5-b669-a4e5c2c608d9", "comment": "Malware payload", "value": "e1ddd9e02a22e18919a099d9069b21d06cae2d8e2543e7476de4292c3f0df64e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809679, "uuid": "b4a22414-bb65-4711-98d4-fdb10df3fa75", "comment": "Malware payload", "value": "8ee7b452cea186394fb094f87d35b0c5b2433f0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809679, "uuid": "68b872d3-1c45-402b-8a9f-16c9e8a3e931", "comment": "Malware payload", "value": "11bd05cf902cf1ff777b4864f9a6b8f0759f2f76e595971a8d3b3ef8afd048998e0e97805a8c3ec10d6a171edaeb3927", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809679, "uuid": "b3e7e787-37a6-44ea-9ad9-6b9432dfb85e", "value": "T15645CF0273D1C062FF9B92734B56F6115BBC79260123A62F13981D7ABE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809679, "uuid": "b32ece29-ac92-4e1b-aacf-ed51db3a665f", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809679, "uuid": "c0e27cd1-01f8-4639-8c94-03169437b3c2", "value": "24576:V5EmXFtKaL4/oFe5T9yyXYfP1ijXdavFjICFDmFeWzrSV0/YaMJ4eef:VPVt/LZeJbInQRavPxqrSVGHMSe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809679, "uuid": "f9abd4fc-0cec-4aad-95eb-19659fe428e3", "value": 1260032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809679, "uuid": "8f809526-1527-4081-9a96-29874112bf7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809679, "uuid": "f5e769e1-ffa3-49a0-90a9-be631d07981a", "value": "e1ddd9e02a22e18919a099d9069b21d06cae2d8e2543e7476de4292c3f0df64e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1c7ff8e-196c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809032, "uuid": "0a1894e9-7686-46fe-9447-cea7fcd72188", "comment": "Malware payload", "value": "b0d5a23b8cb59643cab80a86f0b66075", "object_relation": "md5", "Tag": [ { "name": "res2erch-sl0ut-com", "colour": "#6451A1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809032, "uuid": "86a1ed92-6602-4a31-967d-d8e86b11b73e", "comment": "Malware payload", "value": "e1e4027dfb624ef1f0388aa4aacd9fef6c8f089499a7418a02d4c7df91fda86b", "object_relation": "sha256", "Tag": [ { "name": "res2erch-sl0ut-com", "colour": "#6451A1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809032, "uuid": "d5baaab8-0c4c-4097-8166-35af85dab9e4", "comment": "Malware payload", "value": "f8c35060d4303d7430449d9035c440b05ba2c788", "object_relation": "sha1", "Tag": [ { "name": "res2erch-sl0ut-com", "colour": "#6451A1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809032, "uuid": "1d7c52df-7efe-4566-80ed-5324ca4ea8e1", "comment": "Malware payload", "value": "18cfb979ecb2adebd6e0322a5fbb6b091df31550c6fafae4d2358edef3dd9876b4024d296da9a18f25f28cc0e5140582", "object_relation": "sha3-384", "Tag": [ { "name": "res2erch-sl0ut-com", "colour": "#6451A1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809032, "uuid": "312bafd3-2967-47d6-8f93-d76107aabfb3", "value": "T18221EA01C1B8A5C4E907B135AF8A54CF7EC340C8A124467F3D5C7843CD036A47690DC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809032, "uuid": "b829e1cc-2960-467b-937e-7adacd94b499", "value": "24:9YvxgvbLPK9EwT+qDk3Ew9m8UlANrALLKpXOEr4rm89P8QtFNsTChjxgvvW:9Y52+ta1p9rUldmpSvOgkChlN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809032, "uuid": "be095833-10f1-4d44-8194-61f12afc5b82", "value": 1286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809032, "uuid": "a28b860d-aa16-41c1-a1fd-644b438ca9a5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809032, "uuid": "35b5924c-fe01-4ec9-9db1-169380b3056f", "value": "9cb1ef8026ba8b847256d748b2c7bb17c64a9432c65f95585e9adfe13e1a8864.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "873a3434-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811081, "uuid": "412f1e0c-2f52-46a4-9b2d-bf4a335e215d", "comment": "Malware payload", "value": "4978119e125b8c7ec3a90145384525fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811081, "uuid": "972ea3ea-e8d4-47f8-8f48-5717d08322df", "comment": "Malware payload", "value": "e1f8ade4d055df65ca5e1a831307ec176d47546ab47e634eb7801fdfe3906e0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811081, "uuid": "f53b68dc-e296-43cd-818b-a86e1276583f", "comment": "Malware payload", "value": "618de8c1548684a9ac42640ccf50a5dd83d04674", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811081, "uuid": "e3c66f09-fba8-4652-9a91-b35df124ddbc", "comment": "Malware payload", "value": "181ba5bc19ad393243e05c9a6296cff02c8be8109af9e37c0f354a167692f23a2870e63777f6c2d86805c40fb300edff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811081, "uuid": "f22129de-fee6-4d16-b5a1-632a0cdfd066", "value": "T1693512686769D906C5A257740AB1F2781BBD6EEEB510D3078FD8AEEF7572B014C08383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811081, "uuid": "a237bb55-9a18-4a10-b89a-b48d05defd24", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811081, "uuid": "78649fa1-8b8c-469d-94f4-d648ab34c56b", "value": "24576:LJ2S0jzdACyl0cHRlAL8RjmNpccYRTTuPBvSwsLsDKgAdg2tgBAtu13Ybw:L81jKCymcrALAjm/cNRGPBYLsDKvt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811081, "uuid": "21dd5d15-cdc8-462a-bebe-2eedc7e986a5", "value": 1060864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811081, "uuid": "f2923045-5dda-49d3-8978-8d4e8170cff2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811081, "uuid": "3037348c-bae8-4238-88da-1392a2e4a218", "value": "e1f8ade4d055df65ca5e1a831307ec176d47546ab47e634eb7801fdfe3906e0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "987f2532-1995-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772826572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826572, "uuid": "9c254bea-8c84-49b1-841e-b032a2e23b05", "comment": "Malware payload", "value": "95ccc733a6f72a1c614843b9b9ec8b0e", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826572, "uuid": "b1e48e0b-ca67-4365-a7f4-d2543ec7eefc", "comment": "Malware payload", "value": "e221d54c29eeb7199eccbe8ce1984cae212ce37ee4e89559789f98890d88d2d2", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826572, "uuid": "a90fad5b-55ff-4dd5-838d-52765167f93f", "comment": "Malware payload", "value": "ca115a37a554b815b40f4e1f1b1bf78da6432fa3", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826572, "uuid": "1aec019f-b493-42d0-8a03-5fd49fa04d4f", "comment": "Malware payload", "value": "6913444f1e484235c733f519917c25414c0f6baa6dd4d90d8360657b1aefdfe7075f2c44e576c20cee6c1f40fd34d816", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772826572, "uuid": "9cde49b9-e453-45b3-8b8c-1a805f70500c", "value": "T152352314D6D9EEBAE101A6312122C48A64648C13F209F65B56D3342F6973FB0AFF6D3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772826572, "uuid": "72a4c77b-3480-4612-acab-4f42b8169783", "value": "24576:BX3Eytw2mKtdHR9dPMAYiEjbNzGYoIwIZSsXLxpApa:VXvPx9dPMAYiE3NyjIw0SKxpIa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772826572, "uuid": "89256a33-f50e-4ee6-ac9d-3f25d2ec68d7", "value": 1108992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772826572, "uuid": "97761d76-b5bf-465d-931c-f0c5d363df75", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772826572, "uuid": "c86e0412-0f9f-44a0-ae70-fea6bd7bc5a2", "value": "SecuriteInfo.com.Trojan.GenericKD.79643133.15625.17610", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5b70f9a-1950-11f1-a769-42010a9c0008", "comment": "Malware payload (CobaltStrike)", "timestamp": 1772797013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797013, "uuid": "e0b49145-5c03-479c-b840-5c5610a56d27", "comment": "Malware payload (CobaltStrike)", "value": "d46072f31c060176c5d88c2bf72a6027", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797013, "uuid": "8c67c027-ebd2-4e12-a96f-df0a86e16f27", "comment": "Malware payload (CobaltStrike)", "value": "e2aaf9caa253aff649fee80ed1e3ea826ccda7e65fbc39f4162f5e6d31dd6396", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797013, "uuid": "ebdeae52-0329-4af8-bec7-9febb8d5e1eb", "comment": "Malware payload (CobaltStrike)", "value": "e3d443b86963ca95d27051539e110f1c56c1266c", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797013, "uuid": "39e37d41-5682-458b-86b7-c89c071703f3", "comment": "Malware payload (CobaltStrike)", "value": "c40f4c3af6c6dd1cf8c44298a9a5c6ed7b06755a822abc9f6fa008d1975cad71f81ab1d0bad8a25041bc2f2d8b68880d", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797013, "uuid": "21121638-d0f3-4391-a389-e7fa90e5d307", "value": "T17C64D0D626015DE4DBC1E478193489BC27F6BD6CA9136923D4E0B52E80C3C8F6F6A7B4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797013, "uuid": "74a79ba0-371f-4d70-b06f-14c911242f15", "value": "f6243a15fa8eee8ee96b5e1144d461f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797013, "uuid": "0fe022d2-338f-48ac-8e6b-44dce06664b7", "value": "6144:fV3FezINt6c/VADWY79WS812T+iSKaIp+w:qzPcIWY79Wd12TZSKl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772797013, "uuid": "f371299c-6c8d-4f56-abf4-179aab23f827", "value": 310784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772797013, "uuid": "28f80555-9231-4f24-965d-9ded26231af0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797013, "uuid": "637823f0-f20e-46cd-b4bd-875ca0c43a23", "value": "a2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3265b75b-199b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772828978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772828978, "uuid": "bc89a960-d035-4014-a703-b15d80da147b", "comment": "Malware payload (Mirai)", "value": "72d5764d83daf17ff49a775309370851", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772828978, "uuid": "3e46953f-9e2e-47d1-8034-118a452a68af", "comment": "Malware payload (Mirai)", "value": "e2e6aef5b49a801d26f8b140f7b9a8d16c21c79acb2ae8471a38af70af0e57e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772828978, "uuid": "91a882c0-6c04-44d9-93b3-8a009efa5a60", "comment": "Malware payload (Mirai)", "value": "9f0faeb26c18513a77c1d82629c2263db85388bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772828978, "uuid": "5a72cf4f-804b-4c96-985e-5c306ee78bec", "comment": "Malware payload (Mirai)", "value": "5e514dae55124cca47c4d2e17fc362ad5c3c9e070d0416e4882a5c7934640af9ec01140255cc4ff540fe1d09cf6e79cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772828978, "uuid": "7e85a4e8-b93a-4f07-9b9d-d1f46ce160e5", "value": "T10F14298295517E63C1C29B79BBABC25437736B24D3DB3301AA18BFB02F46ADD0E2D115", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772828978, "uuid": "3d747856-d2fd-4979-8c6e-8376e8d37198", "value": "6144:RHnv7XRae99Ne/m9fAvrntpVmWOtkXZwtyKjvQj:RHnTXRagNym9oRpVmWOtkXutyKjvQj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772828978, "uuid": "efd5bcde-0b18-46ab-bfc3-f2f59f152156", "value": 204876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772828978, "uuid": "9a4aae7a-e169-41cc-8df7-f4f8c324f432", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772828978, "uuid": "282d0bad-6543-41e6-ba59-1a351dbf1ba9", "value": "a-r.m-6.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfd72e9f-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1772809941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809941, "uuid": "cbc2bb8b-069c-42a5-9b60-b3f4050f112b", "comment": "Malware payload (GuLoader)", "value": "ac0e44d9ae12d9fb5184e7d092b32fd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809941, "uuid": "f2a3b1b3-6b80-4cfd-9069-2dfd0788b977", "comment": "Malware payload (GuLoader)", "value": "e332eea4b6dc0e3623dc1aa6d33db82bec7264b4308b2d2d60f04feb8c4ce810", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809941, "uuid": "34333a08-7926-4f10-94a6-156018484dc5", "comment": "Malware payload (GuLoader)", "value": "2153ebdedda177192a35d4b1a49d6da6e47f6b40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809941, "uuid": "3efc4fb7-3944-47d5-9975-11c164b1e4a2", "comment": "Malware payload (GuLoader)", "value": "dc083bc6916fde346c03dc785fe65a4d67dd486b2eb505f259ddccc9265b35ee91a0ff65b226fcc5b29b27e7927c0165", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809941, "uuid": "cd2715c0-2177-4397-a3bc-a912385eba2b", "value": "T17F341216A270D487E571133099BB96BA9EE6FB2314B15B8F3FF4AF1C7C15360592A013", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809941, "uuid": "b1466cde-24e8-4176-8eb4-1033f2bd896f", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809941, "uuid": "df8a2005-9968-493a-aa22-a888cddabb6b", "value": "6144:+cBvWb0yCv3l1Om9LuIjfEBzRzT4beuo3LlCN0i:LO0TPOqLF7KRzT4qTi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809941, "uuid": "50fd8bc9-8481-4669-9e4f-0ed7e46623c1", "value": 248480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809941, "uuid": "9d68e977-cedd-4386-b4d6-dfa2da547daa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809941, "uuid": "944a8245-9e16-445b-9e9e-3ddcb11ecaef", "value": "e332eea4b6dc0e3623dc1aa6d33db82bec7264b4308b2d2d60f04feb8c4ce810", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b856910-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811035, "uuid": "9c2d667e-e173-41f6-b95d-4d551843e64a", "comment": "Malware payload", "value": "69015ebd72f2d904e606f8684522ce49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811035, "uuid": "e8225919-1b17-47eb-b2b1-8240b3a2a3d8", "comment": "Malware payload", "value": "e3432e0a226702f5d039c5db5c836f92f06094d3a81a10c09f2790dd20fb55e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811035, "uuid": "881dfea9-0bb8-425a-a26c-a35e5ca46baf", "comment": "Malware payload", "value": "de0431cf90129ea0249d394740091c48bd448a81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811035, "uuid": "8b4d1ed4-e783-4977-8c19-12b04d03382d", "comment": "Malware payload", "value": "7282631134f3c87ab84770abf031e56ce4fc5d78d8f477734fd98f0a1d28277a5a2b6d9fdd31d2b940fd4c33a2c5c0d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811035, "uuid": "dc679342-71f0-4094-864f-31ae66928e9c", "value": "T1106412267706E817D1C502708DB295F6D9AB9FA80424534B2F203FAF7DB27B14A1E327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811035, "uuid": "74eb4932-b93d-43f0-a3f2-30ec5f5461b7", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811035, "uuid": "5091f0c4-b04c-4ff8-b513-3480e5acdecc", "value": "6144:IR+xXxGYvpqhx1/OYWqdWjF3e30X1XtibgaBR9VKmrElOxqlNdG2t4SpQyjH/Mcl:AcG5hxsyEVIg1Xog89VJrElHlNdG2thh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811035, "uuid": "f6ae1535-4b93-49be-be6a-d3c6a3b3b6f7", "value": 327480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811035, "uuid": "b3e97f94-cbdb-4449-96db-b73f9f890dd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811035, "uuid": "cdf2420f-1993-4550-a51d-a2e6a3a10c7b", "value": "e3432e0a226702f5d039c5db5c836f92f06094d3a81a10c09f2790dd20fb55e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bb2115e-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810632, "uuid": "0872a1fb-2971-402a-afca-b1e30802dfd8", "comment": "Malware payload (GCleaner)", "value": "1b4629941fc495ff0fb0c3205dbc07c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810632, "uuid": "f0ef22a6-b6b8-40bb-be0f-099a75b35ac8", "comment": "Malware payload (GCleaner)", "value": "e35478b3d382eddd7cca8717093653f3fd2a3d052e610aaae35a5be8e3eb058c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810632, "uuid": "4b1d9741-db5b-4bc2-af74-3a4183b96b7e", "comment": "Malware payload (GCleaner)", "value": "fbbc8a8e1f5062ac5ac4473cb6728d98a72dfbde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810632, "uuid": "3a8ac2b1-1e24-4738-ab3b-c2e72f246b78", "comment": "Malware payload (GCleaner)", "value": "1bcbf2938cc0adb407f35983915e9afa3893e50e5d17a9589577c94965f8a1c71e0bf765dbfa67a6e7cb202dee2f8b68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810632, "uuid": "10a291cd-3288-4b3f-b4af-08350ff9247f", "value": "T181F4AFEEEEE08437D173597CDC1B8258582ABDD03D245C497AD8DDC88B2738E252E293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810632, "uuid": "d24d96d6-111e-47ff-a805-91bc3d2535ab", "value": "ca01ec09235c3305d2c87228ffd6db40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810632, "uuid": "5ae16acc-2e11-4755-a274-31e366530003", "value": "12288:OlOUK2LDqP1ft//fwykZznp1m+f60gPpSakxiEKs3tjGquaV7:nR2A1ft//f98n/AQauiEfl3V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810632, "uuid": "f83d984f-3a8f-4786-a198-267ba9b0b918", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810632, "uuid": "0591d70d-2bea-48d2-8cae-36a2da1182c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810632, "uuid": "2c1eadeb-265d-48fc-9339-88fa87021fb6", "value": "e35478b3d382eddd7cca8717093653f3fd2a3d052e610aaae35a5be8e3eb058c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d1b9b7e-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772810554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810554, "uuid": "8882e772-9182-4fa2-a699-aa0ea634ac39", "comment": "Malware payload (Mirai)", "value": "9217254bc27f7508ff6fa514772fda85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810554, "uuid": "a1921145-36b6-4c7c-a212-d1c5d76cff56", "comment": "Malware payload (Mirai)", "value": "e3c4a7d0624d9e2b1c6a7611e873d90438bb95f56096a2a560e18eb3d0fbcc75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810554, "uuid": "a22eadad-482c-43e2-88a6-68aa4eca4628", "comment": "Malware payload (Mirai)", "value": "bcd753128b2d8df3dbeb4db93be7a7e6523554ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810554, "uuid": "2a207afe-fe46-407c-baa1-dc150f450a5e", "comment": "Malware payload (Mirai)", "value": "23a429d1f5dfff1c39cb167ce2f20a3214119f1b476edcec3dbe7f6479b258f7714957e3a90d448e29d582ad9481240e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810554, "uuid": "f3a432d6-cb56-44a2-a2c2-77d925fd001e", "value": "T1E8C32A05B30C0D47E1633EF43B3B27E193DFDA8121E4E640655FAA8A91B2D32558ADDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810554, "uuid": "3b79748e-1972-4b34-871b-463b36a4efee", "value": "1536:6cB72AZ4ex10JrZqQ7UrZb6wI0vAnjiLVRuzae8Dhq6N2te5f3dyJ:6+B4exMF7oZKJnCNYaYJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810554, "uuid": "ca5c05c6-740d-4f75-bd1d-cfc416dc6307", "value": 121508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810554, "uuid": "7e03f329-9970-4b65-bc8a-3e9f476b4052", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810554, "uuid": "31e59092-7e86-4e7e-8be4-a84f06e63611", "value": "iran.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "100d106a-196e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809593, "uuid": "c6bdf1a8-a2f4-4c16-99d9-db51580e0d8d", "comment": "Malware payload", "value": "d05500dadfe1992c7cfbaa4a7aa5f04b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809593, "uuid": "2eb38d12-0d3e-4cc9-bd52-1da170904b32", "comment": "Malware payload", "value": "e452778b82daf87b24d2a7d10c8dc2597b67639dea635dad23c9821a79db6c8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809593, "uuid": "b7d8ae32-e182-427c-b9e3-787962a45982", "comment": "Malware payload", "value": "69c829381641faf57f1b061e3f73b90f4979bd08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809593, "uuid": "06dcc6ae-21c5-4017-b2fa-9519013ac9f6", "comment": "Malware payload", "value": "6e2d9ad88a0658b03e17b9014de4466df0d8ca7b2986352771784fbc9a4e3abba89db88eddefd2067734a929c4bd85bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809593, "uuid": "dbe10375-2ce7-4a9f-af57-09ff2e84aa10", "value": "T1B765D0027391C062FFAB92734F5AF6215BBC79260123A61F13981DB9BD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809593, "uuid": "113768aa-721f-41aa-bcc3-1ccea5c551d2", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809593, "uuid": "8b88e7d7-59ac-489d-8101-b4e4b05bdce1", "value": "24576:v5EmXFtKaL4/oFe5T9yyXYfP1ijXda4PVTF+qq1pjj04c4JaBvwYv2K:vPVt/LZeJbInQRa4PTtco4c/BIYv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809593, "uuid": "7d1be3e2-728d-4d65-987f-272c8eb86500", "value": 1479680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809593, "uuid": "c6bf319c-07b3-4eaa-9c50-e2f9183479ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809593, "uuid": "1f59e796-f71a-48ac-9681-3069275b037a", "value": "e452778b82daf87b24d2a7d10c8dc2597b67639dea635dad23c9821a79db6c8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94bbce9d-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1772808956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808956, "uuid": "7e7a74c2-0965-4acd-ad30-04bcf9dd0785", "comment": "Malware payload (QuasarRAT)", "value": "51a61230ce950c3c0e1fa73fee40a75f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808956, "uuid": "ef09f51d-0b18-4cad-a48d-86a9a567b5e6", "comment": "Malware payload (QuasarRAT)", "value": "e453ca50849a1ea40fd5da776c8437be61f5bc12cb0d9c93a8aa3903496c66f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808956, "uuid": "05449c23-c1e4-4eb8-9fb7-a2e3e5aa889a", "comment": "Malware payload (QuasarRAT)", "value": "d6572de00152f2f68afdde957c19495e1f153edd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808956, "uuid": "ca934318-a153-417d-a306-17944065d91f", "comment": "Malware payload (QuasarRAT)", "value": "e681dc1fcd036c00c54c1cd3fe9d2b83557a64baa293d517f300c114a5ab5ee69f601be4b59dc9d341972fa1cdd1cbde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808956, "uuid": "895da990-a173-4bf2-80b2-851540ff80c0", "value": "T1AC4623273DC35964C71847B4C03989C277F0A68B3B41C72E7ADE17F89E4258BAB23656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808956, "uuid": "27305162-423d-40b8-b1e3-542b44030ec6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808956, "uuid": "5a2e649f-4481-4cb1-80f4-0c6acd74b9ba", "value": "98304:klBKQ/2a9Or4cW+PvkNDHmuQq32yeDGWJ:AByagr4cW+P83QwnW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808956, "uuid": "a8a5fb6d-6763-4ae4-8b68-4544b9fdff96", "value": 5632000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808956, "uuid": "a0eb5ad6-7543-4e3a-95f9-3fc8bd4a334c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808956, "uuid": "116de488-af63-4df0-9de6-3aca470e95b2", "value": "e453ca50849a1ea40fd5da776c8437be61f5bc12cb0d9c93a8aa3903496c66f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "213e9dfa-196a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807904, "uuid": "0743f076-bcda-48d8-ae50-ab46b0dcfee3", "comment": "Malware payload", "value": "b465ea9d88b7641d80d9276ce45dd2fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807904, "uuid": "666746c6-c21b-4c9b-96df-a5e1f8ae90f0", "comment": "Malware payload", "value": "e45ecc5d1e5fa528a07ce81a2996b2f52834893ce068bc8a8947c635e2d050ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807904, "uuid": "638807ab-6f70-4582-9847-ae999ee97145", "comment": "Malware payload", "value": "58bda23b2a3c1a950b3410639c4374422b29df5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807904, "uuid": "294e712a-8c89-4679-ab43-de6719b701b3", "comment": "Malware payload", "value": "b6b25e4636017c94b9b195df3a661b4ddab01eb507a7dc16116f9f021f9c63d97ee1ea453bcee946ceff187ff2aa3dde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807904, "uuid": "0316a5e1-18ec-4b79-b621-fb7437c32120", "value": "T1031512601B45648FE0930C75ADF23776E7A49E663368C3827AD0B958BD3B3468F583C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807904, "uuid": "07e692a8-3cf7-47f9-aa65-e87eca58176c", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807904, "uuid": "61056983-8254-4aa4-8d30-a18820299aef", "value": "24576:rHO/MdQqxo6tCWdBz6kqd43jbz1HVkMIwSqLbBYNGx:rHO/uUWdBGzKb0wSqp9x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807904, "uuid": "4c05c90b-6271-40de-8221-6810eab5bc28", "value": 902944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807904, "uuid": "f31b8cb7-003b-4cb3-bb1c-fb6b26eba2a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807904, "uuid": "63778cae-1e57-4486-af3b-2b095ec5d045", "value": "e45ecc5d1e5fa528a07ce81a2996b2f52834893ce068bc8a8947c635e2d050ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "724034a7-1974-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772812334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812334, "uuid": "76cd135e-b143-448d-86fe-9d2f4dae9c54", "comment": "Malware payload (Mirai)", "value": "a89b00f49f546ac72b8303edf38a8ea6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812334, "uuid": "551cf12b-51db-4607-adfb-38bb75d65985", "comment": "Malware payload (Mirai)", "value": "e460b85b94571407a08ec020e542cfd546748642b3e99fae490a4e42e5ad3893", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812334, "uuid": "b90048c6-99f7-4c13-b928-0ffa64c445c0", "comment": "Malware payload (Mirai)", "value": "9fd5774b812384907e3a247e0bd6a1212e2e2af0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812334, "uuid": "0a50e691-4dfa-4509-b615-8b122818f8fd", "comment": "Malware payload (Mirai)", "value": "d09f7b42f3c5ab66c0f9b87797d9707966744f38c5c3ddfd430c670a4e21e8831d8b7b501fcba1f70e02247cbcf387b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812334, "uuid": "a24b2a6c-96bf-49aa-b9ab-81a3fd5c40bf", "value": "T14CE34C07B5C180FDC49AC1744BAFF53ADD33F5AD0238B16B2BD4AA222D59E205F2DA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812334, "uuid": "506f0596-2182-4b60-8fea-fd112bd09d3c", "value": "3072:pJQwuHgVtdAV0Y8iNklwoCEN2Q6qf9fx4J8KvIlgaO6ltbMf:DQwuHgVtdAV0Y8CkDnOXKPCf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772812334, "uuid": "b70e45d6-f1ca-40c8-81f6-6d6076f44a3f", "value": 147352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772812334, "uuid": "9a7d42c9-bab9-4576-bab1-bcad5dc824ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812334, "uuid": "69e99df9-9b4f-4a68-98fa-0dbf3a596891", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08c1ebc2-196e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809580, "uuid": "d79388d4-133d-4ae2-94c3-5c5c6a289dce", "comment": "Malware payload", "value": "73cd2107a203a7c7873540bc43766337", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809580, "uuid": "d07d40c5-9e93-4f3a-af92-c8b2922d4545", "comment": "Malware payload", "value": "e4813c03d9653820d12a164ec60184910df60cb5ea7d2978a7be94c68e47aa12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809580, "uuid": "9cfe222c-711a-4e31-bb51-cb7b8625c7d9", "comment": "Malware payload", "value": "50daa1b5bdd32177e308492b4c53a2d27c7feadc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809580, "uuid": "8c547ca8-44e2-4be4-9cd6-935551402270", "comment": "Malware payload", "value": "33fc22d93487018080d73245ffbaa70c7e5739e5002f7317a07de488fc954417a24145121ab6ee08cffb013ecd8ba36b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809580, "uuid": "9b6b0309-5608-4df2-8c9e-2dddf14ea02b", "value": "T124C4AF91F211DAEBE56B0ABA8CBBC43135A7AC5E85D1111E319DB22855F231211EFF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809580, "uuid": "13d2233f-83cb-46de-8a86-d183c24b56b2", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809580, "uuid": "7024d96b-2866-4664-b908-56a2573cd12f", "value": "6144:lwq3NpQ3wDIywUF5ykHERIe6MPKzZ9fhl4+NAQrQEwJU6FJWSwiomUE9ETww7V:lzcae6E81vrQXvWSwiZUaETj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809580, "uuid": "e0e3b8a1-d627-4355-86b1-971809e89439", "value": 574920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809580, "uuid": "6ed315fa-ae18-4240-bcd1-55826a816f85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809580, "uuid": "38c35ea0-2abc-4a45-b59a-d09142c23eaa", "value": "e4813c03d9653820d12a164ec60184910df60cb5ea7d2978a7be94c68e47aa12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01dab8fd-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1772809139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809139, "uuid": "6c89f0fd-ef65-4714-9122-b1cf028d77fb", "comment": "Malware payload (DarkTortilla)", "value": "2794cabd8341794106e90676a34ba86e", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809139, "uuid": "461f806b-9ac3-420c-807c-746a9d4510a9", "comment": "Malware payload (DarkTortilla)", "value": "e493000f00f812e32b778b48e429b8f9f7716246fb6f962ff194a4ff525e536d", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809139, "uuid": "c818b940-f932-4e7a-961f-b1a9e876d452", "comment": "Malware payload (DarkTortilla)", "value": "d6847247c4f87702dfd2806483f1a39eda238c23", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809139, "uuid": "dfda773e-2854-4a91-8579-53693cd43002", "comment": "Malware payload (DarkTortilla)", "value": "049386515d1236579acc57933f63484f45eabffcdc99db6a3032550a420c657767125d2bf38db14154af4e1731622f6f", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809139, "uuid": "6a22bb10-eb4c-40dc-9a0f-05e6e212cca9", "value": "T18D8512312D461A14D9281FB9C066118433F0C89B2266DB7FAFFC11F46EB2F5ACE275A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809139, "uuid": "42f58f3a-ac63-4578-a088-c9995ae3ac35", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809139, "uuid": "30462fa3-f8e5-4387-8e33-dde5a0ffdf0d", "value": "24576:nKtvbhpLT/4PPH7caoc7xKIcsjU6UsHMdrE6Jv3oqriYg1Ai4JXHaIW9JblNB1:nuLzswao+vjxUsHcJv3d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809139, "uuid": "6f19a241-4917-43c7-8989-29c0626a0014", "value": 1815552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809139, "uuid": "c3fe7af3-8924-4849-aecd-3e4f42307ed7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809139, "uuid": "ac820bf1-1938-41ce-ab00-b428c75077fe", "value": "e493000f00f812e32b778b48e429b8f9f7716246fb6f962ff194a4ff525e536d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7d38373-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772810814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810814, "uuid": "b2a926d4-b078-492b-b3f6-699578616bf8", "comment": "Malware payload (Formbook)", "value": "37f281246e93ad9c35f719329bd31a39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810814, "uuid": "e55a5bbf-fdbd-4e6a-8958-48e49fc32e7e", "comment": "Malware payload (Formbook)", "value": "e4a3b237440cb1b97ed871c1592eea16104af2996ad78efc9a406478c2aba41e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810814, "uuid": "c67f4991-7dc4-4025-b478-c7a5a1bcab87", "comment": "Malware payload (Formbook)", "value": "b123ec6d7c229ed16cfc4296347c6441b8460648", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810814, "uuid": "1d7595f7-606e-4876-bf72-c419b15d925c", "comment": "Malware payload (Formbook)", "value": "7ea4c8f121d79607cc540d0457c19599fd60af00078e412b613908a37f7036c5272743c2727c88dfdce3e19951f851b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810814, "uuid": "08b12525-b5aa-4f20-8bd6-2dc433974d41", "value": "T1CF45BF027391C062FFAB92734B5AF6215BBC79260123E62F13981D79BD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810814, "uuid": "62bb6d8b-df22-49a9-9d35-c6f6cf0d8490", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810814, "uuid": "e6d6740d-0020-4bdc-86a8-eb529b8c02eb", "value": "24576:45EmXFtKaL4/oFe5T9yyXYfP1ijXdaeaNajw+1xF+r9IOIeRvuW9vAIfI/+:4PVt/LZeJbInQRaedD1r+r2ZeRHAIfI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810814, "uuid": "171b7e94-388b-40a6-b55c-c52db3a7cc99", "value": 1238016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810814, "uuid": "9ba0061f-bb44-4f2c-8a83-9ef4c5f643ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810814, "uuid": "343ea434-4616-4352-a029-095993bb520c", "value": "e4a3b237440cb1b97ed871c1592eea16104af2996ad78efc9a406478c2aba41e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ca1c084-194f-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772796326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796326, "uuid": "e0dbcd77-2eca-410d-bbe3-14056d90ff9c", "comment": "Malware payload (NetSupport)", "value": "3905090ebd9f2373bdae3e18d6ad7945", "object_relation": "md5", "Tag": [ { "name": "94-158-245-153", "colour": "#0E67A3", "exportable": true, "hide_tag": false }, { "name": "cdn-westford-computing6-net", "colour": "#460872", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ink-approval-com", "colour": "#8059F3", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "westford-systems-icu", "colour": "#A494F3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796326, "uuid": "5f9b0969-1fbb-43a0-b190-1145eab3b6f0", "comment": "Malware payload (NetSupport)", "value": "e4a8947e4b42ac04ca4171c8189c617d145dc3ade6e9038465c8bf54e49b52b0", "object_relation": "sha256", "Tag": [ { "name": "94-158-245-153", "colour": "#0E67A3", "exportable": true, "hide_tag": false }, { "name": "cdn-westford-computing6-net", "colour": "#460872", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ink-approval-com", "colour": "#8059F3", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "westford-systems-icu", "colour": "#A494F3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796326, "uuid": "f65070fa-59bf-4aae-9b93-b477c821c6fd", "comment": "Malware payload (NetSupport)", "value": "3509d6919c09e3f8839c6609658ef63bc40fdfcd", "object_relation": "sha1", "Tag": [ { "name": "94-158-245-153", "colour": "#0E67A3", "exportable": true, "hide_tag": false }, { "name": "cdn-westford-computing6-net", "colour": "#460872", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ink-approval-com", "colour": "#8059F3", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "westford-systems-icu", "colour": "#A494F3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796326, "uuid": "92ebe471-7c27-43ef-bf7f-9e0faa5ed878", "comment": "Malware payload (NetSupport)", "value": "513b76a7d06cf24508b09726acae492874851b572ca2af28659eb68f91d168b6c277511c237b52f6e9e30205ba6c2c9b", "object_relation": "sha3-384", "Tag": [ { "name": "94-158-245-153", "colour": "#0E67A3", "exportable": true, "hide_tag": false }, { "name": "cdn-westford-computing6-net", "colour": "#460872", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ink-approval-com", "colour": "#8059F3", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "westford-systems-icu", "colour": "#A494F3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796326, "uuid": "e8b7ac8d-fc20-47ab-b4e0-7b9465a224a1", "value": "T140C533687D33A5F3CDC672E75B97703664B6048D0C1BFB3AA8295AF1928F3D62C42464", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796326, "uuid": "74e833aa-0a6e-47c1-8358-404981991fba", "value": "49152:dRN/h5rgjJxv7mQ70AXNLWdDeAK+fZZE2GP1za9wDhVzQiV4P26LREZjaBALWkdc:dHZ5gJp7mQ70A9aeApZZPmEuDLdV4+WT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772796326, "uuid": "2d1bb73b-5857-4249-819f-27f021e51a74", "value": 2590872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772796326, "uuid": "ac2ec149-142c-4422-87d3-315de1512d06", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796326, "uuid": "92dd9a0e-ac24-4823-80b0-87fbf95e52d4", "value": "essay.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7e177b9-193d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772788936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788936, "uuid": "dc3f57f9-754a-4e87-b885-9e1eaca40054", "comment": "Malware payload (Mirai)", "value": "bcf4709e5392fa5241705d0412c98467", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788936, "uuid": "e96ee489-9983-44e3-bfe3-7377f2de345e", "comment": "Malware payload (Mirai)", "value": "e4ccfaea72eb5c6e7b3ad40903de7e731ab8e270050328d476406a3ac9c71757", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788936, "uuid": "10fa4ca6-7618-4036-82dd-17c01f8ade62", "comment": "Malware payload (Mirai)", "value": "0e58b116a97602490432b49402f214fa6913ccbe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788936, "uuid": "f0e9a723-86ae-41cc-beb9-07facc8fdef2", "comment": "Malware payload (Mirai)", "value": "b2f1ee78b580283984c2127b2048e43778efe141a96d2c0dbd77ac16206971c1c5e6446daa7fafc00f6ebf39a554045f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788936, "uuid": "e00020e9-df74-4673-a2ed-19ab7e7a5f3a", "value": "T107B3AE97F74714A0C8624AF007C34B9E2E2322128F97D9E76C1E7A3E5A794DB091A7D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788936, "uuid": "13ead56a-0078-409d-b36e-09d3bd32cfca", "value": "1536:iA5IbKtCwBgHSPR3JL+FjTWGbTQ5b1qklUv94QZJBxclog8oyf/LWK:JkKtoHM+FP1bEB1qkmqQZJjg+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772788936, "uuid": "82e49bf0-22ed-42a1-855f-9a601217a33b", "value": 116392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772788936, "uuid": "0e37bf66-6394-41fb-a165-483c2569d76b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788936, "uuid": "bc2e9f38-8591-4383-8b19-789eadba873c", "value": "morte.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "004d1b97-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819015, "uuid": "f25aa2ad-c8ea-4efb-8cfe-609731e1b34f", "comment": "Malware payload (Mirai)", "value": "9074749ab89040f3cf5f1904050205f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819015, "uuid": "64f4f791-44f2-4f31-ace5-9f3f34f33184", "comment": "Malware payload (Mirai)", "value": "e4f7644370bb35aa6c23724c5c5384d3b0d44f719adf80aba315f64594bd4943", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819015, "uuid": "2bc5f088-5310-4ad4-96d6-78902b9a7173", "comment": "Malware payload (Mirai)", "value": "de88ea3975ac469aa9a1b5adc089ed4bbbf524cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819015, "uuid": "a3606a1d-8cc0-47bc-a6fd-e83c88e86a3e", "comment": "Malware payload (Mirai)", "value": "bc9f29eb0c57bb6c3370ddcb2ca45861a38dd674869e231f3bd2cc74554883b599830d600c955518e19fd13bb3f49396", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819015, "uuid": "b215e269-a471-4954-9e5c-49b102db8f46", "value": "T18EC3D585F8906735D7D3BABAF70C039D762E0358E3D772108E345E6173C9AA96D3A221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819015, "uuid": "85f7610e-ed61-498f-9779-e6560d330439", "value": "3072:CTiI59CeU99j/I/twx7wMujqLp9jK4iZuVBB:Ceuex7ajqLpZ3iZuVBB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819015, "uuid": "6a1ac5ae-3c51-4740-b708-570e95ce45e7", "value": 120632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819015, "uuid": "5e681b2a-3892-4ed2-92e5-3b583f41ac1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819015, "uuid": "e2f2cfb8-ad00-4d1f-9e4e-146445545488", "value": "debug.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7615a5ac-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808475, "uuid": "cb5b7552-c376-4790-8eac-452e321657a6", "comment": "Malware payload (GCleaner)", "value": "e50b31ca3cbbd2208e80ec9d691bc980", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808475, "uuid": "9a98d4fd-2b29-4c4f-a808-28b2676cf79c", "comment": "Malware payload (GCleaner)", "value": "e506f1142ff9a4019ddfef35c4dce8eb6683026a036dd5bf3d320ec47aab9176", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808475, "uuid": "698f4bab-dc3e-4938-a688-ff8ab2bf1ce3", "comment": "Malware payload (GCleaner)", "value": "e81b2ae81d2082850b7483e2a07c2367855e6041", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808475, "uuid": "9ccfa103-de48-4683-a936-309bce34cabd", "comment": "Malware payload (GCleaner)", "value": "2d262cf730001bac52e2e1acb400a6c6e1696aec1c7a2c5a03b4d0380636ca51d310661c9ec6a7a4db05c4286b63cf8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808475, "uuid": "bc4b1838-10e4-4ca2-ae73-868647d24342", "value": "T10A06F11029F1A4F2C0F9C83D443DD1048A377E647D219C5A61D9A6DCC53FB8AE9ECAAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808475, "uuid": "f0e4a6ca-8ef1-4a03-9a3c-76b7047e9644", "value": "099b2b7fa2a0044e2ca25418be2f8a70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808475, "uuid": "1c5c2eaa-9874-42b6-89b0-aa9c817b09cf", "value": "98304:atefoRVm3yGOff1mMt40GEmtKT6zzr69Lv115kV+Kat7:a8oRwaf4E40TmOqz29LL55KS7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808475, "uuid": "b6495b65-3707-47ed-ba25-e7a5f6baa790", "value": 3890688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808475, "uuid": "7c3a6e89-9051-4af0-8c26-39a188aa5bd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808475, "uuid": "4f724820-4e05-44e7-a39c-a293e74ce24f", "value": "e506f1142ff9a4019ddfef35c4dce8eb6683026a036dd5bf3d320ec47aab9176", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f62d6db9-193d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772788933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788933, "uuid": "4204652e-e004-42de-a259-64cc99ef0ae4", "comment": "Malware payload (Mirai)", "value": "a2bfd09c8e57f2b3958a8a4f3c18ce42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788933, "uuid": "bcc58a27-94e8-4069-a60f-4918f83c566e", "comment": "Malware payload (Mirai)", "value": "e53f3ae10f9e7156e0578493b3de2d61f44fbe9b4b712d12205899d01240737a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788933, "uuid": "25aa54dc-7d56-4f2f-b760-822400c91b06", "comment": "Malware payload (Mirai)", "value": "2ed5b4530395bef895f8055eb57072c775282d37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788933, "uuid": "33017f1a-be8c-4f83-a584-a9befeef1121", "comment": "Malware payload (Mirai)", "value": "aa0859014b3bc4bd40b412e41e171c449658fb2d7ae8fea0bb8a4b4febca6080a339f1572a8eb1dbf099107155f6bfc4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788933, "uuid": "e139f09f-760a-4d95-9c60-c8e81b31ec31", "value": "T14903F1E9A1436E13DAB99DE04D6A46C2BFF18F8E36D00DC6620D6B566917C2272C9CC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788933, "uuid": "9799973f-45a1-4edb-b244-c04244ac8202", "value": "768:K2U819nNz1p3DF1eRSrvjC9ydXc7nvsPJMhIo897QdXyGWR4uVcqgw0IC:Y819NZp3A2rcL02InGWR4u+qgw0IC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772788933, "uuid": "9a8e19df-0880-427a-b4f7-247759b03a75", "value": 39660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772788933, "uuid": "7d13cd52-bcac-4d8c-9904-84f4b4d4bb0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788933, "uuid": "3367cadc-84a9-4b5d-b95a-f1a332317b9c", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d653eda-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810877, "uuid": "ca14cf32-2767-41ac-bcd4-2bef67052c5a", "comment": "Malware payload", "value": "eeb7b17b13bb7f34e2ae20b4b9c9dae5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810877, "uuid": "37096cd7-a19c-41a6-a526-9138bbce2c9f", "comment": "Malware payload", "value": "e580561332a051089f842d0b6ddb0b260ae9cd021b74af3d52ecaad291267cbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810877, "uuid": "8403ceab-30b7-4c94-bc95-a5fbf83649a8", "comment": "Malware payload", "value": "3d2ce7060be0477fdadf3373b0e418a86241ae87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810877, "uuid": "23a44751-4278-4619-b451-0faa3ea15f75", "comment": "Malware payload", "value": "d567d54660323ea8a3fdf12d6aea266c4cae29a708c5b1dc2629b029425d5fb72d0aa872e95f1ddd3b6df6dc2f1a70a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810877, "uuid": "4cdcfd03-2e9b-4b9c-87ff-79f876cdbaf2", "value": "T1780833FC248AF937DA3D7D353E4610A64F5FB609B38E8017C5D4A9B6B5ACD0099B9230", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810877, "uuid": "a3cdd455-6bd7-4204-b769-ce32f52a9372", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810877, "uuid": "eb424bf3-9d74-4b71-a1cc-d64ad0e4e60d", "value": "1572864:02cNdtyku7oHgA48w4hxjAYXKEh+sRN0KxO4sm1HHHRXyCTrEYlo7:BI4kwSnhoYX1IW0NNEHrTr9lo7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810877, "uuid": "5f64358a-62f4-461b-8d16-0fd90c35e7e7", "value": 79590201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810877, "uuid": "f4b330ea-deda-4038-9c6f-1f128b9b0e0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810877, "uuid": "3f48d1d3-4326-45a1-9d2b-106ed181855c", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b5bdca7-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772808350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808350, "uuid": "7fd9d8d8-ed6c-4888-9332-39cacfff88de", "comment": "Malware payload (PhantomStealer)", "value": "31087567920482783ec82aea444ad7ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808350, "uuid": "8b756001-2c26-4d96-9704-b2368a27ba11", "comment": "Malware payload (PhantomStealer)", "value": "e5d98ed469c71dbb6e524f31b34d76e05b97f8b03d6c0bcc1c965a68c001b299", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808350, "uuid": "0fd006b6-ccaf-4265-91f4-37eccea5a683", "comment": "Malware payload (PhantomStealer)", "value": "4b905514c5946089c5432420481e774c77c67cc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808350, "uuid": "1ade73e5-37b9-4ef1-b589-01e2acbd1366", "comment": "Malware payload (PhantomStealer)", "value": "9ff51474764ef41fcd23c93ce9a9ccdc9f1efbf9dcb492d64e929ad1d20691cde9d8259d76db44f387ba607cad592a75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808350, "uuid": "c5510691-6d97-40ec-bc32-84bf4846aa95", "value": "T18985E00273C1C026FFABA6734B56F6125ABC79260127AA1F13581D79BE701B1463F7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808350, "uuid": "5761482e-ccca-4501-8b7d-ab31e0c9511a", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808350, "uuid": "b661c325-1970-4788-af00-684e0ade64c8", "value": "49152:gPVt/LZeJbInQRaQ10cecsAtyxXWPVc/7BvPL:eTYbInQvDTZyxmPVclv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808350, "uuid": "fd6d229f-60c9-4b5d-85f1-6ef9dca443a7", "value": 1732096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808350, "uuid": "57d8dcfd-bfcc-420d-a4ae-e19bb3313b10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808350, "uuid": "07084531-7a51-47fb-a3d3-812ec5f068d6", "value": "e5d98ed469c71dbb6e524f31b34d76e05b97f8b03d6c0bcc1c965a68c001b299", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed54e393-1969-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807816, "uuid": "edbbeb1d-4646-4346-979b-de9dcf415398", "comment": "Malware payload", "value": "cc7b5982a4eab6651d10a0ac8dab5075", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807816, "uuid": "2b01a593-0ad5-4705-9122-572d699a7aac", "comment": "Malware payload", "value": "e619bc4b10d5eadb84a1f3dd1a88034651ff3bb532463510c590088b449a5f02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807816, "uuid": "0bfe8764-3fa3-4a1b-b2ec-c46cb63e2f3e", "comment": "Malware payload", "value": "a565d750d29ff20916a0f245457b164c6f6f0e50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807816, "uuid": "adecd59a-edd9-42a0-a0bd-4524f3fb29f9", "comment": "Malware payload", "value": "ad9d65dd7dd90fd5d4b3ecbd2cf8ba3a704ef026787ccf85c12e464d3e6504b61015ed107d76dcab31ae5f7935371dcf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807816, "uuid": "bc9baff2-c0d8-4bfd-be91-b1781bedc625", "value": "T1CB941812EB60B465F8A345712D79A246392D3D3A2681EC0BB78D9F4A3771693B0F431F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807816, "uuid": "8030deb2-a077-4de8-85d0-a140bb9eccb2", "value": "71a0a1fa55de1bbc6a3ff93e434056b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807816, "uuid": "0a87fabc-1bf1-4bf5-8576-278043bdce53", "value": "12288:kshKNzwOmiTM/l/lPUl3rFNxXOsiTAS+tS:9XPWmi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807816, "uuid": "6ac0b4c2-051f-4b90-bb2b-76b759c356dc", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807816, "uuid": "20afe8a4-1507-4470-83ef-ce223afd084e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807816, "uuid": "12b14c29-74cf-44fb-b6ea-48e682a050f1", "value": "e619bc4b10d5eadb84a1f3dd1a88034651ff3bb532463510c590088b449a5f02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "464a9171-196a-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772807966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807966, "uuid": "439b2605-39c5-42aa-863b-7a08c7b9c56e", "comment": "Malware payload (GCleaner)", "value": "eace08cc7b262fe94be39c2027532bfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807966, "uuid": "0c39fac0-6f12-4a0a-b6b3-e22e2dd8011f", "comment": "Malware payload (GCleaner)", "value": "e647a6c94251db1a474dd9b4ed8dbe52c3e53f34f827bc56ae745cb7711b3d74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807966, "uuid": "7195c6a3-d45b-4974-a05e-6d7cd5761730", "comment": "Malware payload (GCleaner)", "value": "0e19d4c676fc560eb66a160265e1c5d4e43bb979", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807966, "uuid": "1b9c0892-6fab-4dc3-8a10-9aeae8d90176", "comment": "Malware payload (GCleaner)", "value": "b230e197a03f4204e2195dff54fe86d6ac2db863fbf275017d0a8370389862af61e2322bc295cc70335009b4201628ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807966, "uuid": "c266367f-08f9-4df7-a427-dfc1824f00cc", "value": "T1C316E06211BA1976F6822FBAAF759C886F1F2CDC965FD114FB4A84C18D272C0B1213D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807966, "uuid": "e1e105d9-edf7-4064-897d-f15dfed148a7", "value": "e5f32a93ddcf3aa9009cd70911b0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807966, "uuid": "15bc8b9f-dfc2-4ace-9038-82fdb047b393", "value": "98304:O9CextCzt6mAXLVlfa9wDnCPJAL/hBeKj4USysIyWU+3:OOzhARlfa9wLf/XvELGlz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807966, "uuid": "fbce9d6d-7dfe-4f69-9ee3-e7f6333f2ed5", "value": 4119040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807966, "uuid": "2b3950e2-68e0-4233-b2ca-37d0d74edaa6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807966, "uuid": "25a2c6bf-60cc-4eab-8ffe-29c659c98dee", "value": "e647a6c94251db1a474dd9b4ed8dbe52c3e53f34f827bc56ae745cb7711b3d74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4020882-196a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772808203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808203, "uuid": "5e957b93-f2bc-485f-8e43-e5b55423fa7d", "comment": "Malware payload (Mirai)", "value": "e5ccefa3f98b5e67a713a05e259dc22c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808203, "uuid": "8b5db0f6-9a59-4f6d-be4e-236869f8c47c", "comment": "Malware payload (Mirai)", "value": "e65da5b3bb6cef03a0f0a7abf43544de41a95dffb36bd04482aa2397358ab553", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808203, "uuid": "419d2c2a-6526-4d02-b89e-3d11dc553d3a", "comment": "Malware payload (Mirai)", "value": "961f85a016584ae2be135369b0f69521097e77b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808203, "uuid": "898dc6c2-c313-49ea-9bb1-67263f6334b9", "comment": "Malware payload (Mirai)", "value": "f4ebb3ce8015c41f5515fa26be8b0d3f5ddf4e52e06f6a3383a5e4df91c9118a0bd2eac78df2b2193f2714d6e1ca9408", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808203, "uuid": "5524e6a7-e644-4b07-98bf-3235d87eba15", "value": "T13E04188369927DFBC4C2DFB45BE7E11145F3F8351B622209B3E8AD951A4DEC82E0D258", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808203, "uuid": "5b2aa059-4654-4b6a-bc36-0b7e7bb2386c", "value": "3072:aXjla3S+zUXPjP8IU/z6D2F2XUJ1opGnj3EvbKGiELoeB0IC430k+:sQhAPCGyo4bEvbKGiELoeB0IC430k+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808203, "uuid": "c2a02b8f-938b-451c-b978-01cfd0a03728", "value": 188739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808203, "uuid": "7a0c9838-fb64-435e-aa35-ebf05baa38cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808203, "uuid": "9e58fc3b-f7f7-4cf2-9cbd-ce3ec58a579d", "value": "x-8.6-.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d648fd8c-196c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809066, "uuid": "d5e23717-76c8-4fea-8785-65e8c93b9c5b", "comment": "Malware payload", "value": "3bf808c0eb96d084fb4be68c9887bed6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809066, "uuid": "13e5ece3-3567-4bde-a64a-9ee5b4e37525", "comment": "Malware payload", "value": "e668939d6781ef5f331a01d80a7962bfccdf980072eb7cd616685c765bb1605e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809066, "uuid": "85a106a9-05cc-4518-98c4-fde2b94f3447", "comment": "Malware payload", "value": "5aeb25a77930c8d04515b2a819e459614be35b36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809066, "uuid": "62cce3cf-c3c8-45f9-ae6a-7e378719f749", "comment": "Malware payload", "value": "fbc5f16d1205c166dcb243be8d31d24b64a388836b5b4c90a779d1b512d81b31db7ab72b34c0f8d8ff013f285a403326", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809066, "uuid": "813f816c-8a39-4c7d-8d50-0bc8d2abe437", "value": "T1894502226E832624C6694FB9C06714D833F1D9572256DB7E2FFC01F46DA3B4ACD231A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809066, "uuid": "34e0c01a-8ec0-40e2-bd13-f69fbb568afe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809066, "uuid": "d91cc042-0efb-4000-aa71-d5c07466ec9c", "value": "24576:oMhpLT/4PPH7caoc7gKAxoivntWRCWJblNB1:PLzswaoFKIWR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809066, "uuid": "1372915a-ddf0-44af-b383-cdec71871fea", "value": 1252864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809066, "uuid": "d6241479-4a25-4ea0-ab40-bceb48df1fd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809066, "uuid": "89120bae-3009-4556-95dd-826a06bbd4c9", "value": "e668939d6781ef5f331a01d80a7962bfccdf980072eb7cd616685c765bb1605e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f66e3019-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772810838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810838, "uuid": "e05aa239-c599-4ccc-939a-075f28e1cf9a", "comment": "Malware payload (PhantomStealer)", "value": "2772d21d4155a0731cfdf9282a537cef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810838, "uuid": "13f80aba-cd86-4891-ae5a-6dfb1da03559", "comment": "Malware payload (PhantomStealer)", "value": "e6a56859a1ee8a390634cc2464d32b73b2dbc2119b25373044c26a4da65e9cd7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810838, "uuid": "9c1e63a6-116a-41e1-9dde-71764fc0dbb3", "comment": "Malware payload (PhantomStealer)", "value": "978444f38fc11a22ef976779a02762d9f25b01ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810838, "uuid": "e4932999-2145-40e3-9a3e-93bc0638db53", "comment": "Malware payload (PhantomStealer)", "value": "7eca4347cbfa360290e543acba7a71476b659b8775d007ea592c9a25c5ca8dddc05ce5c7a2bbc9c0c5a71c7adb3f3a70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810838, "uuid": "3167ef05-799b-478e-8e48-8c02a210dbc8", "value": "T1007402077DA2D816C46204B00DF6ABF7DAA8FD691816C313F7A1BB5EBA731145A4C3B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810838, "uuid": "26017de3-f5fe-487c-bf28-e15e90ee030b", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810838, "uuid": "b7a3b37f-bfa3-40c6-90f4-95a40aaddcd0", "value": "6144:nwq3NpGrAREEUIj8dOO3KSNzEzW2hpvYhBhKTvDgDhe6Za6D35IEnFZqj:nzSiEEUC8JKS5EzLvYhBgoDhe6ZVDpIR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810838, "uuid": "68c63697-bde6-46fc-8db5-6e2adf9a3298", "value": 364501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810838, "uuid": "f4e276c2-1e52-4f92-b686-8dc04c347e8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810838, "uuid": "47591334-8953-4a45-9dd5-5f3b228adc13", "value": "e6a56859a1ee8a390634cc2464d32b73b2dbc2119b25373044c26a4da65e9cd7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6a05e63-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772809416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809416, "uuid": "6ddb0136-6e3d-485c-9b90-79f0cb7a20b4", "comment": "Malware payload (Formbook)", "value": "02931e0cd2830e8ebb6692b8cdb309a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809416, "uuid": "8f5de032-e693-4f5f-99bd-9b06d4c9b012", "comment": "Malware payload (Formbook)", "value": "e6fdffe28f0258421f36bdc1c8d03f9af16d8190f013ca50eb0b623860baa224", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809416, "uuid": "f90dbdb2-4777-4427-aee9-17350a6686f9", "comment": "Malware payload (Formbook)", "value": "2cce937a13dc1fa3c0fa6d5336b7a265fbafbefd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809416, "uuid": "11d6671d-de4c-4474-8ddb-37620d08096f", "comment": "Malware payload (Formbook)", "value": "c1aeee7fc7da7fd1159a8bc43d159ad9584f9c31156c50c396d5df7af99102185b8168cdf08a48c046ae3e58daecce27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809416, "uuid": "02882e23-b9b6-46c5-8757-54690814bfde", "value": "T10C35BE027391D062FFAB92334F5AF6115BBC79260123A62F13981DB9BD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809416, "uuid": "9166a105-510f-4480-8196-5c466dbe5178", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809416, "uuid": "a4452d0e-01bf-4da6-9937-eaab904a84da", "value": "24576:x5EmXFtKaL4/oFe5T9yyXYfP1ijXdaiLlV9odCSQge:xPVt/LZeJbInQRaiv9oX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809416, "uuid": "686215e1-9283-43da-8fd2-d81bd2b348d3", "value": 1147392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809416, "uuid": "2cf75279-7c88-436a-8cee-7404d5149fc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809416, "uuid": "4f629652-ebe4-480f-889e-47f3bc778307", "value": "e6fdffe28f0258421f36bdc1c8d03f9af16d8190f013ca50eb0b623860baa224", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bb3c046-1985-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819625, "uuid": "99ea955c-502d-4826-b913-0c3e228dbf47", "comment": "Malware payload (Mirai)", "value": "d451bf60a6b1ac4cbb6cde6e15f7f9ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819625, "uuid": "4a49f8fa-76c8-4dfb-88da-ff1d33834ece", "comment": "Malware payload (Mirai)", "value": "e7051358dc65057352b0f6df5fcf4214b37fc9f561374a55e79fb4ccfd902bbc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819625, "uuid": "d303c124-e259-4ae4-9a08-0ac12c938a4e", "comment": "Malware payload (Mirai)", "value": "7227ef0d1f6beb3ec8af1fcdc1768c9dd76a31a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819625, "uuid": "1805c298-5a9b-45ad-8a73-7d47eab217be", "comment": "Malware payload (Mirai)", "value": "ead44d517c2a661e24a2c524569ca7b66fdd0f8cf4362453ad21b18aa7055824f904df9abcdc2c32061be7b0d886ff8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819625, "uuid": "c0217b7c-c035-47ec-b0c2-e9484eb874f7", "value": "T1351633B417E2AE57C0FDC34947B18E947A836F8D7ABAD2533192E170DCE1A09B1520AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819625, "uuid": "f0c102a0-9a0a-4ec3-9312-1e89e7a4c413", "value": "98304:H36ysIptgmiDVu22UBIkIDifvpwJS/pHz7+8bq3aIUk62hcI712TH5qFNWW4j:H3zsMipuerI4wefaasf12TH5qFNWW4j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819625, "uuid": "3c3573dd-f54b-4e02-b4f3-6ae916b81333", "value": 4184816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819625, "uuid": "6eb1d016-1e83-45e1-ba65-d94e3671404b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819625, "uuid": "523c415b-5b90-42eb-a025-7e2385020197", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e85300f-1968-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807013, "uuid": "a62dfe34-dc34-45f3-9dd5-df7223aa0125", "comment": "Malware payload", "value": "3acfde977b134d476e93e127ccee0c82", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "wiosyrondaty-com", "colour": "#68F1E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807013, "uuid": "44cd78f3-d1aa-4889-aa03-f2268d8373cf", "comment": "Malware payload", "value": "e74b5a87f2902930c1c53052f498ddd832bbd39d5fdd79487699d2cae8ee9748", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "wiosyrondaty-com", "colour": "#68F1E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807013, "uuid": "3d0641e7-3140-4c1b-b9a1-56daf8a8947d", "comment": "Malware payload", "value": "524c55b3750a42e1ea6a09ec263d09f2cac26d43", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "wiosyrondaty-com", "colour": "#68F1E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807013, "uuid": "a12d9071-8412-43a2-9316-406c154bb100", "comment": "Malware payload", "value": "fcc563dc13d32cb4d259baf3c54fa2416e6e3cbc03cfc07ed224698f5343f063e918927dd8fe3e665d4c27d0a5d4e00a", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "wiosyrondaty-com", "colour": "#68F1E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807013, "uuid": "117920da-a962-45b5-986d-39014f557c7f", "value": "T1F3900210441010B99E1A45349620445405267515D89665D7310146A6064296A959881A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807013, "uuid": "ac1257fb-61cc-4842-97e4-d65532a173d1", "value": "3:VSJJFIqF1F65IF/OD6Xn:s8qF1FQD2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807013, "uuid": "dc017cd7-781e-43e4-aa9d-b8c341db71e0", "value": 50, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807013, "uuid": "d4ae15b1-ed34-4eac-ba56-c321843978b4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807013, "uuid": "a0533902-2333-49ac-ae8f-06738873175e", "value": "e74b5a87f2902930c1c53052f498ddd832bbd39d5fdd79487699d2cae8ee9748.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cafd2a76-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1772809047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809047, "uuid": "0a4ab5af-bbcb-4f12-ab8b-93d7db73f27d", "comment": "Malware payload (SnakeKeylogger)", "value": "60f366e4a00f402a10c235ddcbb87d47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809047, "uuid": "a6ed9903-88b3-4dbf-8e5e-e071be9874ae", "comment": "Malware payload (SnakeKeylogger)", "value": "e79f60f6f3a467e4c8ae0c37c12604b31a6ae9872884d75ee069bd22f8aa8d7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809047, "uuid": "37955d6a-ec5e-4220-a2ea-1ffe9c4a14e6", "comment": "Malware payload (SnakeKeylogger)", "value": "3512e576e4988a3f6830b9d081c2f173a087e618", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809047, "uuid": "8b35fa6f-d5cc-44b5-a3d2-4a9de8ec3bc5", "comment": "Malware payload (SnakeKeylogger)", "value": "94597e2a0f790d8a475a771e1f1a23a9d2ae6a84fff84d678bc697de3ccf5b8e8ca3fbeaaba0dffc447d89515cc1e7c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809047, "uuid": "19217cf5-c1dd-498b-9e47-4acfa5023e47", "value": "T1A25512152776ED02D4B64FB05971E3B44BB16E86A821D307DFF7ECEBB8663603905282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809047, "uuid": "86a044c0-96c2-4eea-a2f0-ee4938f7892b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809047, "uuid": "2e415675-e6fe-401d-a85d-0e5c553aff6b", "value": "24576:tqu2Vo92AdKCubUd+Hjs7xrpDlPyrN25APY+K2xVn5U7:teVDgKDM+Hjk9ptg2WbxM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809047, "uuid": "b9789753-9395-4c6a-975e-3c13ccdfe603", "value": 1340936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809047, "uuid": "a479574f-7a21-4e66-a578-360e57e01083", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809047, "uuid": "25dc3fa6-5137-4c57-bad5-69759e8fce4e", "value": "e79f60f6f3a467e4c8ae0c37c12604b31a6ae9872884d75ee069bd22f8aa8d7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c37f546-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (Neshta)", "timestamp": 1772810230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810230, "uuid": "2cc35896-a31c-43cd-a783-6f48ffc193d7", "comment": "Malware payload (Neshta)", "value": "e06b6406b6735d07cf5dfb028f4373a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810230, "uuid": "d42c5e6f-c4ed-4424-970b-6b76f3d30299", "comment": "Malware payload (Neshta)", "value": "e7b0fdac15c138aa320465801e5da50170d4b44bb1d4c73ea15a95b27fa3f3bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810230, "uuid": "ba8e095d-20d0-4013-a46c-c2a78e59ffaa", "comment": "Malware payload (Neshta)", "value": "cf696f7b381e52ee998451c00ee6fa2d0f1c19c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810230, "uuid": "040f407a-8dee-445d-beb5-ce6df51a8edd", "comment": "Malware payload (Neshta)", "value": "05f7e3ae4ef5ea6d8ecfd10c6e63cd919418896b13db8dc79e3a0fd9521ba20294644e85caff6398dbddc343d748d8ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810230, "uuid": "17894cf3-44a4-4c8d-bb82-f1fdf047bac3", "value": "T151B4E616E660B03AF88709717D79A25A642D3D372681EC0BF7489F8A3671983B1F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810230, "uuid": "ccb40cdc-4db6-4ea7-8c18-0b53c1b85a36", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810230, "uuid": "d090fd9e-a614-46d7-980c-d359f9ebb10f", "value": "6144:k93awE6N6xMZOg0d9RxW2/rOUhxDRvxFX7pzC6S8H10YC8A6g35ra6wdUoDzg:IaEAgM9RxW2/rOUhxDv+78Ap51wo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810230, "uuid": "144afa4e-41e8-40c3-97fd-dc8513dd2f4e", "value": 532992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810230, "uuid": "0e47ea85-4998-4b5d-acd9-402368f4758e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810230, "uuid": "9bea91e6-37b4-4626-bac4-d16fd7221754", "value": "e7b0fdac15c138aa320465801e5da50170d4b44bb1d4c73ea15a95b27fa3f3bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a85a826-1963-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1772804886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772804886, "uuid": "8046cfce-81e3-457f-87cc-c8183a3079fd", "comment": "Malware payload (Gh0stRAT)", "value": "6bdec1194d7b6c55f7adfedec473e8fa", "object_relation": "md5", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772804886, "uuid": "5de2fc82-607d-4cef-b79f-94f4cb9686e4", "comment": "Malware payload (Gh0stRAT)", "value": "e7ded2c57b7c2fe62525454d832a7cf02c65f897d963fc6a8a1feeb163ddc0be", "object_relation": "sha256", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772804886, "uuid": "8f8f972f-c1d2-400a-a6df-994f5efa7767", "comment": "Malware payload (Gh0stRAT)", "value": "2b2b1d281850c63fe9f7cfbd4d7294443ba878f4", "object_relation": "sha1", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772804886, "uuid": "a5baa08f-2d42-4c77-b120-7196f4c12764", "comment": "Malware payload (Gh0stRAT)", "value": "286aa8480b17fd9a53ec570d85612d08be49cba11138807b78fc6f6a893d3e71f4d13f407b8bfdaec5d513d90630fb4d", "object_relation": "sha3-384", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772804886, "uuid": "d20221f4-0e56-4f2b-bd64-6a890298374a", "value": "T152273323A28B253FF07D4A3A49B7D216443BBB3129128C27A7F44898DE161D52E3F757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772804886, "uuid": "e7c69ad7-a8d9-49d0-ae0a-3a7cddea4d4b", "value": "efd455830ba918de67076b7c65d86586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772804886, "uuid": "d2d659b4-ffdc-4817-a510-33f659a4720e", "value": "393216:s+bViOAWeVd3/rsN9wY5vhOKij3dPZp3Rto3+Q9VV7nRKPpx9zTLhja7ZzSZYi:JoOAW8voZ5vh3IJfu+Q9VVrinhjaNhi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772804886, "uuid": "c41c5b18-bceb-418b-b817-62aeb1e30bd4", "value": 21781751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772804886, "uuid": "c27ef4f0-a2eb-4140-a36f-cd672353b30a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772804886, "uuid": "b84f5a30-7b91-4533-960c-2b48391ef0d5", "value": "cloudflared_installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2038837-197a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772815126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815126, "uuid": "8d3e164b-a062-4d84-a5a2-7f910c47c383", "comment": "Malware payload (Mirai)", "value": "6b24e887dd44f4351363f9c836723e95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815126, "uuid": "0cb37ebf-d259-49b1-af09-fd0834aeb9a5", "comment": "Malware payload (Mirai)", "value": "e829080dd50edae18396db24a6637d4babb8f5849a043f017ef12ee3a725b644", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815126, "uuid": "0d769344-9e8f-4e59-b2e4-58d3d2ff2641", "comment": "Malware payload (Mirai)", "value": "73d569ffc11a96190439f7eb4ed7b1375ee3e4a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815126, "uuid": "ab304fca-9d43-41c0-a7ad-8cb3724d5c95", "comment": "Malware payload (Mirai)", "value": "b310f2cec6aa35a9e038df5210b27dbea7c48646a0a594e0424764fc1a4990dbdcf8e8946c23135b43cce050da04f200", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815126, "uuid": "96305869-b77c-4ae6-a964-2ec55f26d810", "value": "T1C5C3D74E6F218F7DF768873047B38B21A75933D626E1D685E2ACD6045F6034E241FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815126, "uuid": "803fc959-a110-41d9-9006-d094795240bc", "value": "1536:I8cT1Lkgwe4eSZjkap6Ijj/Cr0ubgpa5zD49LHR88HFveK7HG9tp0SN:I31LPwvJkCPe949LHJHF89AE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772815126, "uuid": "19f9688d-d65d-4beb-8e74-2e287905d595", "value": 118400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772815126, "uuid": "9d9059cd-1828-4b5e-88e1-2c5c3df1d85f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815126, "uuid": "c206c70a-c3cc-4ad1-9d23-bbf253b38aea", "value": "titanjr.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92030a07-1972-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811529, "uuid": "8b068a76-9c7b-46b3-bf23-dc378eef8696", "comment": "Malware payload", "value": "c9587f1c4413213a291e8fee32d76e4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811529, "uuid": "50900036-b882-4aa0-a5b4-0f17e618861b", "comment": "Malware payload", "value": "e85141e15adad3daa73740a2cbd816efcae182f93f9569cce77f2a49764fa12b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811529, "uuid": "a36c03b7-73de-4fcc-a599-f85aa0cd2571", "comment": "Malware payload", "value": "1f2e5d4d141643c37082a807e0e536d3eeb5aa3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811529, "uuid": "4546a954-7df7-447b-87f3-27731fa843c8", "comment": "Malware payload", "value": "df91d062369d678c7ec3584a9236b0eedabd26d9d44f753bef4a935ec09b06c0b6e4286982514d2b4455a03df22e37fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811529, "uuid": "49150a07-31ea-4b4f-bfd2-68d02e5579ab", "value": "T15DC428343DEB502EB273AFA98BE474AA9A6FF673370764AD106103864723D41DEC1539", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811529, "uuid": "1661a346-e40e-4b68-baf8-063b3710a6f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811529, "uuid": "9112d79d-06be-4c25-97bd-5a95348fdecd", "value": "12288:3PoQe/fXOVSHXwA7gyW0Bc0mac9RMUBWmYYb9Tagtp1FKHsCcEi7rTUi:OIcjma2tRK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811529, "uuid": "709ef8f5-c996-409c-9ea9-c2010bc327db", "value": 562688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811529, "uuid": "bdea0fc3-7952-4b7f-be47-5cbbf3d84220", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811529, "uuid": "e7abef4a-befa-491f-8306-02130e9cf0be", "value": "e85141e15adad3daa73740a2cbd816efcae182f93f9569cce77f2a49764fa12b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f555ea2d-196a-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1772808259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808259, "uuid": "ccead0f7-26d6-4f45-b7bb-3a368dfe0cc6", "comment": "Malware payload (GuLoader)", "value": "44720b0bfee486562929641dd4cd9fb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808259, "uuid": "a7a5b3e5-c3ea-4bee-b621-3b0c69266411", "comment": "Malware payload (GuLoader)", "value": "e86de309f59e9073d3a873e6fae7e9c00e3c1ba6aa530b458f48c4219d74b2ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808259, "uuid": "338ada8a-4136-44d0-8d52-abb48bf9dc84", "comment": "Malware payload (GuLoader)", "value": "5228a6ef47a2bae097ea1c1a1828ac2c5d8647c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808259, "uuid": "3fef15e8-4261-4108-a591-330cb9191a6b", "comment": "Malware payload (GuLoader)", "value": "a124ff0592243114241dfc3f07853b1816e86ff3cffadd7f72d1eccd9dcf3d59460b1c46b4afd25479fd18a35e4dfaf5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808259, "uuid": "3f366e30-7fa2-4c11-948c-af2bfd065860", "value": "T17F0512651701589EE0A348749DF2B376F7A89E66336CC3C27AC0B5987D3B6058F683C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808259, "uuid": "c60b0ff8-782e-4826-b9b4-86eb28562a79", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808259, "uuid": "70929ec9-9176-4351-a2f7-f1dc9b32e9dd", "value": "24576:mHO/MdQS3oIcsp1EhJAWdBz6kqd43jbz1HVkMIwSqLbBYNGR:mHO/uos7XWdBGzKb0wSqp9R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808259, "uuid": "631dcba8-a622-402d-a7bc-99ccdf85e606", "value": 874289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808259, "uuid": "54535a26-b563-4883-86aa-b23f4300368b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808259, "uuid": "40e30b5b-4019-4d0d-bd5e-7bd83cab7340", "value": "e86de309f59e9073d3a873e6fae7e9c00e3c1ba6aa530b458f48c4219d74b2ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac3e8b90-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811143, "uuid": "6e599248-6cc7-419d-9a2d-39e41035f6d1", "comment": "Malware payload", "value": "2e86be759b425f63012fbca309855858", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811143, "uuid": "4c38590d-a464-4132-9213-f00cbde6787f", "comment": "Malware payload", "value": "e8820842245aa61fe41e60c52a449290218bc60b79f3a5c809f19da1fe3f48f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811143, "uuid": "7f4ad733-3dc9-44d9-bb29-9766241a0a92", "comment": "Malware payload", "value": "8227e89b196200a1e1b4aea58334b6f51ea4c1d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811143, "uuid": "063fe402-8c33-409f-aa22-81ac07b16930", "comment": "Malware payload", "value": "ccb47534088a1ec70f64479eea95bb0deece53eb24d7c7f808f583aec32a7280e046976c5c1784c384409e3500975dbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811143, "uuid": "304ded1b-c4e3-4258-91af-f27ade0d8eef", "value": "T1FA25BE0423D8C664F1BA6FF8C17400544FF6BE069AF5D61FEAB975E91A36B809912333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811143, "uuid": "add6c3f1-696e-4455-9335-e50d059f4a0c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811143, "uuid": "695d8b84-dad3-4a35-aafb-8673a0c2853c", "value": "12288:iOrTRVs3IrmN0Nw1HBY7sOft8VHVr+3oxhdOsYhhvRvhrh9aaaGb+RYC:z7s3saJ1a7bfhEfJkvRlapGbqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811143, "uuid": "b587555f-3a9b-4326-b323-bb30946ab365", "value": 1014272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811143, "uuid": "87f3891b-1453-4ece-baef-d66cde4d40d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811143, "uuid": "a6fb4a29-5001-4b38-84c4-7436ae8c5549", "value": "e8820842245aa61fe41e60c52a449290218bc60b79f3a5c809f19da1fe3f48f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8af03336-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819248, "uuid": "7afd01a0-5b99-48bc-bdde-6df386a45ca1", "comment": "Malware payload (Mirai)", "value": "9bf8c212d640f31d795b8b888800165f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819248, "uuid": "4346e8f3-b7ef-488e-ae05-8495c7c810ec", "comment": "Malware payload (Mirai)", "value": "e8d9d88adf485f0568fb9a7ff0d5b1d92c20ffe9584f5afe6dff32c80d0e5b46", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819248, "uuid": "4d8d315a-780e-4cb5-920e-08c658f4131a", "comment": "Malware payload (Mirai)", "value": "3561ae45d76a639d963d3a4b5819c105362e5edf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819248, "uuid": "8a8c1aaf-5654-4a6e-8a67-9059309facad", "comment": "Malware payload (Mirai)", "value": "270a89c04ae2e64a3ab53a204b96b35e486f7162e421dd3be221ddfc9772afe5813b608025fe443bcb81969969e76703", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819248, "uuid": "38a66855-6cca-4cc5-85ef-382f4b676ab6", "value": "T1D7043906BF110EFBD89BCC3B45F9270625CC581A22EA6B36B974D918B54B24F16E3C70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819248, "uuid": "03e81134-6136-4bce-8b62-9f9a0ed7173e", "value": "3072:wg06miYqdm8j8eGmPoepvF04WY2/MKINhlV7wGuW:wg0jiYqdmGGmh04WpInl9u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819248, "uuid": "83e67950-f2af-4b69-9eb4-37c1ff20b11a", "value": 182276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819248, "uuid": "6a486601-6f63-4ede-adbd-c444159771ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819248, "uuid": "aeb6e211-b617-4229-a5e8-272c3ad5be40", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2a9ac2e-18f9-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1772759641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772759641, "uuid": "fc9a9269-0205-410b-b890-bf3c65501bb3", "comment": "Malware payload (Joker)", "value": "4f59962d90c50bcfd81966f34ea78cb1", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772759641, "uuid": "088eb123-2802-4323-ae23-823814e48ea3", "comment": "Malware payload (Joker)", "value": "e949fe42f103b0802ccb99f7c421e98c5d00a378a7a985909ea018757df4104b", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772759641, "uuid": "b680e5a0-ba14-450a-8294-5c899d6cc8e4", "comment": "Malware payload (Joker)", "value": "b3ec2e787600cae267ac02b1043d51d9b81f8823", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772759641, "uuid": "93b6fad7-5ff2-4c27-9b55-963f0027c017", "comment": "Malware payload (Joker)", "value": "c54bf38f5a0ddd5117f8befcf4d04236b4c00e43164387d2e11829a74e624e41e9e790fc3d6585bec08ea757bbd3c870", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772759641, "uuid": "2bb8f85c-6518-4bc9-a4df-bc35b4cfe704", "value": "T19BA62347F30D582BC9D6A13D892A0261232BBC785661D39B5D11B228ADF7ACC5F2DFD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772759641, "uuid": "6b57fd0d-5e3f-48a4-9ca6-ea021507db8c", "value": "196608:dWRpJLFNPegg1g5zbVMDjft+yl/Kf5lUnmN0Nh3h91eX7G2b:wRpPxVzsAyqPm/MXaa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772759641, "uuid": "c0afbc67-7412-479c-9468-08c8a08e0cf7", "value": 9969344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772759641, "uuid": "5ab531d6-2eb3-4185-94d3-5d56b246af7b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772759641, "uuid": "0ad3a33b-db9e-4e4b-bcab-fd937c840393", "value": "com.phone.daily.storage.deletor_1.2.1.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "084a06e5-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819029, "uuid": "0f93762e-62e9-4820-bd9c-6a7295c42138", "comment": "Malware payload (Mirai)", "value": "42822010895fa1a71dc51d62502752f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819029, "uuid": "ded80f21-9371-4b9e-a435-bea3ac6a31e9", "comment": "Malware payload (Mirai)", "value": "e966b61ff82002d2b86b2501fdd97e0bb53ebb8f79a48d18c704513202d6af20", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819029, "uuid": "01e9d040-bb18-49f3-8d43-0fd2ec28a370", "comment": "Malware payload (Mirai)", "value": "1b7fba9b01bc741464c3cbe4e328b468fff95cd5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819029, "uuid": "8eaa353d-2f72-433c-b4d6-fc91dd22363c", "comment": "Malware payload (Mirai)", "value": "369700709c089ad38a83e8862e3b0c5a34ab2486df00fbb748a57b1befe8d78e3e24c36af9c5d1b0b55828c326465488", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819029, "uuid": "8fc0615d-7a1e-45a6-b0a1-7c8739812bc3", "value": "T1B583B686F8503B79D7E1FAFEE748139D723A0398A3D7B211CD38656267C8B58AD34124", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819029, "uuid": "997a359e-c0ed-4ecd-8097-0715363152c1", "value": "1536:Wtnb9HXFKOg7mXc8qYouOnN3epq7Yc2PBWM4DeC5uVB:WtJIO3Xc8qYouOnNikYc2ZWM4DruVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819029, "uuid": "91e01098-1f4b-449f-bc3e-b9d1687fd86e", "value": 84756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819029, "uuid": "68d667ea-1ea3-4697-b15b-74dc9523a8a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819029, "uuid": "4062af2f-2904-42b9-8134-97b7952e6869", "value": "debug.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "073fe17e-194b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772794546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794546, "uuid": "bc95b8c0-eac5-4c37-ba2c-426ed4a5d776", "comment": "Malware payload", "value": "f0078fc3e63f155935517eeb71e64d3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794546, "uuid": "c139bd41-38b0-4f7d-9414-3d10231311c5", "comment": "Malware payload", "value": "e9c45ef53cbc74ed58bfccd3e1722f70240d50b7c95b7f3ab6031d8f01961cdd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794546, "uuid": "82da5afe-5eb3-4f1f-bdf5-a4ca27583c86", "comment": "Malware payload", "value": "ea279ffb1e109acf587301ac7eb61aa4fd038c2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794546, "uuid": "79546120-c29e-4211-8348-62720d654be9", "comment": "Malware payload", "value": "52d82b0cd64b4eede822f32194c1de11f54457e7902e48f55638cb6082edf696300b23fef8e42beac54083381c954a66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772794546, "uuid": "d49fd68c-4512-4e75-a243-a7a7df976a25", "value": "T16755CF107580E033C663117186B7FBB64E9E9E701B66A2CB13D8263F6F215C26B35B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772794546, "uuid": "26512984-5985-4145-a671-894cda8dc7fc", "value": "5d4dd1478e21a3a81f7c41a20e6b34f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772794546, "uuid": "fdafc7cf-a304-4c2e-b392-3a0f96f104ac", "value": "24576:NSFQozxmzD1Q5O2WpiorDZQz+8ApB/5A/sQV4sHDGGfUBLRVAZ:QFQozxmzD1Q5O2WpiorDZQKpB/5A/sq9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772794546, "uuid": "f8dd37be-b6aa-475a-a610-8ebc5857bb5e", "value": 1356800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772794546, "uuid": "4981ed1f-0066-47d5-8095-8032b38864a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772794546, "uuid": "c9b6e9c7-e861-47cb-bf90-14d8e0258c68", "value": "xe9c45ef53cbc74ed58bfccd3e1722f70240d50b7c95b7f3ab6031d8f01961cdd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78faad8b-1963-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772805044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805044, "uuid": "ea7351c0-cd6e-4108-a314-ca4cb566c517", "comment": "Malware payload", "value": "3490febff3213745c28d857a73dd4214", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805044, "uuid": "d2bee97b-1c67-4946-b108-cca32327f170", "comment": "Malware payload", "value": "e9e817da7250ce513da7a70abfd339803dd8fab7612702cbbf2d37b73ad83604", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805044, "uuid": "955f1d03-5dba-4ec6-9407-d16b18dad4b5", "comment": "Malware payload", "value": "33d0031f86e4d6146e6d016e23468ed35bd72385", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805044, "uuid": "83488be1-b717-4901-8001-a544e7d614d0", "comment": "Malware payload", "value": "3c60e21781791fd0954c76e712b199c0216b44fe010c3f967360dd39197ec3749a78430c5a8e46a7c390a17403f2de4e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805044, "uuid": "dbafd5c8-8728-4d38-a875-bc963365dc14", "value": "T147219B5F6452C03276C3107FABEBF1A0B87620471091CD28B89F3A467F69C512D1294B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805044, "uuid": "62168885-8460-4fb6-a66f-060697c307c2", "value": "24:8R49sDMYrlG8MYBzMYCiMY19MYcwMYTTMYu0MMMY7s/MYn/MYyJMYFIkE+D+17t7:D05rlG85Bz5Ci5195cw5TT5u1M57s/5n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772805044, "uuid": "b580f37c-3f15-4fe1-951b-a721eb9252a4", "value": 1254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772805044, "uuid": "2b5efa65-3b3e-408c-945d-d26b56010572", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805044, "uuid": "7ec57543-5664-4a3c-b653-9198f8250112", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d58bb9d9-1970-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810783, "uuid": "b19d5750-0c3c-4c8f-820a-85fbe9223461", "comment": "Malware payload", "value": "7559f27558d31ad3577b24b966c9fb5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810783, "uuid": "aeef550d-d631-4563-b54b-b4b655da4f23", "comment": "Malware payload", "value": "e9fbda7e2baf80ee0052c338fae176860d49e561898d8336f423b46162129fda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810783, "uuid": "d6585022-9d36-41c3-be99-44058bc15ade", "comment": "Malware payload", "value": "e0f6f4fe387e1690517125de24d87edf0acb6213", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810783, "uuid": "3512ca24-ab11-4c80-834b-80c986b0dbb6", "comment": "Malware payload", "value": "4c13d6c8e18ca1326cd36ccbefdfb0a001d4ce72720dba5159bbeae607989c5253fd0ec03472c8d2867b11b2571b2cfa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810783, "uuid": "ade6abba-4991-4507-a6fe-8d841516fedb", "value": "T1C435F1024EC36A15C63A5F7CC072149463F1DA87A392E7AE7FD812F5AE63B85CF16412", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810783, "uuid": "739a73b6-d297-4865-b5a1-f2122ba94003", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810783, "uuid": "d8645878-f70a-4e3b-b773-6fa29378f070", "value": "12288:AzVm5TdCPQIvy3IrmN0Nw1HBY7sOft8VHV08T9i3gzAxcJivnlCypWNecZqmbzah:AJGkPNy3saJ1a7bfxKAxoivntWRpz5K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810783, "uuid": "8619b385-c9de-463f-a014-07d56ddf3715", "value": 1061376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810783, "uuid": "f7fcec28-3272-4e4b-b984-cd8864fee81e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810783, "uuid": "69640d24-3dd6-4858-904a-7b05bb9bd5ea", "value": "e9fbda7e2baf80ee0052c338fae176860d49e561898d8336f423b46162129fda", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c21f438f-196a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808173, "uuid": "96f2968b-b494-40b0-8ef2-c434d8edd56e", "comment": "Malware payload", "value": "b7e9dbecffbbc8cf738973f33e141652", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808173, "uuid": "c938c414-c49e-46c1-adc9-a7a1f038a302", "comment": "Malware payload", "value": "ea294f94990e4382b0786af0f693a2012909e25fa6699278bdd4b4afeaeae791", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808173, "uuid": "84b89b4a-840a-40e6-bf36-c983cca57b53", "comment": "Malware payload", "value": "9a859869725efdeaf1e134b8783287388ed2320a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808173, "uuid": "ed59f2d7-78cc-4ec7-b212-a2e310dcf85c", "comment": "Malware payload", "value": "add1e23f0a299ae0fb4bcb5fdbd0272fabaad8c2a3dbe53aa39198fb3a309bf55697fd78d960b40738716fcba3bfd6d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808173, "uuid": "69ba6b76-e740-41a9-80e4-db13e79dc137", "value": "T1A294E412E760B426F89345702D79A28678293D362681ED4BB78DDF4A3B70983B1F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808173, "uuid": "c4d6c493-8727-491d-a163-2133700ada0c", "value": "bab696212d8465e8fde091ebb14e07d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808173, "uuid": "23386e47-5d99-47cb-b93f-b7ffc5106b76", "value": "6144:03N5pqmInQ0CTIFc3ri4TrYk5qAKexPPlhCd3j/buJ4RNlvg14GNXcQcyJqTl:0d50mIajTrYk5qAKexPKdxRNljlQcy8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808173, "uuid": "1a8ffc72-4847-4b0a-b636-2080c4a1d09e", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808173, "uuid": "dab9d4e2-2f3f-45cf-a550-f4ba34cea4aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808173, "uuid": "4437275f-61eb-4535-8e88-ec3d42da01a7", "value": "ea294f94990e4382b0786af0f693a2012909e25fa6699278bdd4b4afeaeae791", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf8208b5-196d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809484, "uuid": "5922c05b-2200-46df-8abb-e6a2c7e97235", "comment": "Malware payload", "value": "69412b3793bff5b617161b34408540dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809484, "uuid": "7660f3a8-cd48-4a2a-bd62-c8a5d9378fee", "comment": "Malware payload", "value": "ea883b9909cbacaef56e415abff1dd0cd3a405e9beb9345fa6f5f76bdf1b17e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809484, "uuid": "a2ef01da-40ef-4762-a4de-49fa9153a999", "comment": "Malware payload", "value": "4675e2214f57e1c28dd32ce1617a065eb05749f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809484, "uuid": "48fbf98e-0291-4c54-8d40-066665266d11", "comment": "Malware payload", "value": "18b1a4d9a3e75e2da257ddf924954ecb2fce61b8b1f6226d1965a989d78865bf04dedfc86ba0dfac02bdc506f63eaa03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809484, "uuid": "1f9f99aa-a656-4a46-a316-6536802eeb87", "value": "T17EC4AEA1F711DAEBE5A606B688BBC43135A76D2E86E1111F319DB22815F331211DFE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809484, "uuid": "742908a1-f42f-4883-be46-13d6da622531", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809484, "uuid": "d76d9e25-e4c8-40bf-8770-086e8b973993", "value": "12288:Nzcae6h0TT0et1ldkDg4H9GuEbcDl8FVdFtk:xhEjkDxH9G5bcJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809484, "uuid": "4685b78c-6a68-49dc-9564-b5bd7f1a23d6", "value": 554232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809484, "uuid": "d2121a60-3cfc-4718-9ee4-bf6f0baf8538", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809484, "uuid": "15cd09ae-bffc-4c9e-8b14-b3868edb569f", "value": "ea883b9909cbacaef56e415abff1dd0cd3a405e9beb9345fa6f5f76bdf1b17e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1289dae-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811125, "uuid": "aac65699-1033-4422-8818-1b868d8f2cf0", "comment": "Malware payload", "value": "59bd11f005fd58969e0b648de1779e4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811125, "uuid": "af3c9cf8-694b-4672-8b3a-c61857ec8f83", "comment": "Malware payload", "value": "eaa05edd26b74d6934a0d6626161030b526b35cdd379f136afb689d3de84766d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811125, "uuid": "f7859c4f-384e-4e1f-8d54-c39f09b0ae43", "comment": "Malware payload", "value": "625a010ccf4eb2ff0e490e0696ff0cf528c52998", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811125, "uuid": "3ca9987d-75b9-46df-b504-aa698b23d58f", "comment": "Malware payload", "value": "ca374abc56cf30ee0dffc35cc1994d5d29a1243b24021ed15fcc78e7efcca89a9ed75a49b973facd08cfbf1cc2bfbfaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811125, "uuid": "a542149c-2efe-4e05-a13c-d0aea4a304a8", "value": "T13C4533553370BD17D763307EFE79E6881B22909601F0A20B75E035267E4A8DBE22E65F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811125, "uuid": "631ce8a4-66f6-4a1c-bb92-a351d3b28e76", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811125, "uuid": "4d6d3fae-6b6d-4159-b971-5a652a471e08", "value": "24576:x2jvAJU7QSo3FY2aZVfGmPIti6/KXvezY6HuxfCIeTmYAs9oLN7BwCArAWA4+uMJ:QjvAJUUb3lwGmwM6/We0quxfW6wonwCF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811125, "uuid": "2b28a7c6-e60c-4a88-a12d-f69569084098", "value": 1240163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811125, "uuid": "bb8b5e8e-4e36-4fbd-b1ce-8e6013792237", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811125, "uuid": "83b275af-75a8-44da-9932-7e201242ac6e", "value": "eaa05edd26b74d6934a0d6626161030b526b35cdd379f136afb689d3de84766d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03f07dfc-196b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808284, "uuid": "7b5ce7c3-1017-4ecd-8048-5a7c5580f4fb", "comment": "Malware payload", "value": "d34f449388a3e933001c7a3a50764a73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808284, "uuid": "c152dbcc-65ea-44b6-8961-a5d7d9a3a2bd", "comment": "Malware payload", "value": "eadf7a2f67010134241ab571587e0ff30dc47c96314c3e64720440faac74285a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808284, "uuid": "af0801e6-7638-4c5e-8e48-2b7a42917012", "comment": "Malware payload", "value": "c23bd1d2cf0e771ffd1b784cafc3eade6886ce5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808284, "uuid": "8bae758a-c87e-4c7a-a53f-6cce61a3ba75", "comment": "Malware payload", "value": "c7e1b5a356f6849cc355667e91834500530edd522a143e15dc3e55aa5a86b5ba7f602e8433b61ed1aeefa9724503ce05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808284, "uuid": "cea81fa5-800c-4f74-badb-4275a5592b5c", "value": "T13194D612EA507826F89349B03D78A256782D3D3A2A80DD0BF74D9F8A367169371F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808284, "uuid": "a93287c0-bf14-472a-96f1-4f9bd7cbe6fe", "value": "6a1e0dda24f6c8cd3c3e3019fb8e68b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808284, "uuid": "72bca2ff-7cdf-4997-b438-23a363a718d9", "value": "6144:NvYxF7uSqbczjGwHaPb3bvN7GUSw6/RlNIvWzngY3v+7gIR1FE7S/qGmjb:NvYj7RHaPb3bvN7w1n3v+xR1FE76qZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808284, "uuid": "7d2424c5-7358-40de-af1f-fbd8598f17b8", "value": 430080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808284, "uuid": "dbc9829e-a059-442b-94b3-a083b8ddc39b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808284, "uuid": "8f4ed38e-32c5-4729-83c2-c49dcb6387f7", "value": "eadf7a2f67010134241ab571587e0ff30dc47c96314c3e64720440faac74285a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "811e7276-1959-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772800763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772800763, "uuid": "5ff57109-f851-4dc6-8920-59bb49fe504f", "comment": "Malware payload", "value": "55e0960a3e4e8e74b08580ef5fbc9adf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772800763, "uuid": "7df301d7-2ec2-49a8-b996-9beb3511b656", "comment": "Malware payload", "value": "eaf020843f72140f722875135d2ce63c723afb22c7dfc8e04794182d7f398222", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772800763, "uuid": "57255aed-742e-46b6-b34a-d4af14ceb635", "comment": "Malware payload", "value": "7afd08b8285fdde9f2c51ef710b1f4745fb09882", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772800763, "uuid": "d195fdc2-6c6a-455c-9814-01b30ede6708", "comment": "Malware payload", "value": "50e413dcde49f792170b6be1ab601704250a1a6cc7bec8c6e44c438c4cc049a29e176deffaa7115635e003e1268cbc0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772800763, "uuid": "aeac6ac0-7810-4102-ba20-249552922c51", "value": "T113D3E1AA997C01CDE1462AB064D1CF47B578AEC35B66CC8F0C06A9D21F61392733D7E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772800763, "uuid": "35e1df03-5b59-4810-bdea-22eae708a516", "value": "3ff7f3b391f8291257c83518cafe1759", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772800763, "uuid": "e871d031-9df1-42bb-aa64-c5781e3fb92a", "value": "3072:JIgzQe02NUGl7Q+coE878O5E74UrOVtga3:SgzQe2D1yT5FVaa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772800763, "uuid": "dad5671b-2bfc-45a6-9456-30115c6108df", "value": 133080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772800763, "uuid": "2b2f21b5-c4aa-4fb7-bd36-d0560aa6b5fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772800763, "uuid": "164e0ec4-8720-4810-af4f-6cf485284405", "value": "Ndavio_Contract_Viewer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22502946-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808764, "uuid": "8dfe6702-e2f0-4cdf-94d6-cf2ff33479ca", "comment": "Malware payload (GCleaner)", "value": "0cd06409c47c5acb95509c5630f862a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808764, "uuid": "5e3f99e2-2140-45bb-a6b6-e22e60f3f73f", "comment": "Malware payload (GCleaner)", "value": "eb32c924369c37a54f820c7b0e71b839754302c0edf8722154318c9bcc7e74f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808764, "uuid": "00714acc-60bc-4d0d-ad24-5300bec19086", "comment": "Malware payload (GCleaner)", "value": "0177a59ef5116218f2241029d5b3e203573519bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808764, "uuid": "b9abebb4-7a4f-4746-a19a-db8774739935", "comment": "Malware payload (GCleaner)", "value": "4813810fb6e84c132eae0323e6125177ca521ae22bd1e6530ae09c7b388043093cbf58d8228b0cc0f227d00ab8870f55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808764, "uuid": "2d05c62e-d6e8-44e4-a89b-55ffdaffd3eb", "value": "T15D16F116E3B06B22D268C332FCEA896D4F27BD4F592C600847C735D45EAF341665D2BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808764, "uuid": "4a14ca8e-07ab-4b5b-b574-90eab094e05c", "value": "099b2b7fa2a0044e2ca25418be2f8a70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808764, "uuid": "fe54d21f-451a-4906-b4ef-ed6c347ba238", "value": "49152:sto5h50MMm/Cbzm7wdIZPCSKQ2BzrJ7r8fpSRhafyz+Am4JOffpimWhS7:ste+M3rw+Za/XJypSWyaBfximW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808764, "uuid": "78812531-ebd8-4cd5-9820-3ecbd47f9efa", "value": 4413952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808764, "uuid": "44074860-f176-4259-b31b-3a9c44de9e59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808764, "uuid": "a7df1667-6a6c-4774-ad41-3eb40dc979eb", "value": "eb32c924369c37a54f820c7b0e71b839754302c0edf8722154318c9bcc7e74f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35932f21-1930-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1772783027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772783027, "uuid": "acb77711-f991-4dd2-aab2-6ba85c15343f", "comment": "Malware payload (Gafgyt)", "value": "83e8317a746f6bcb625456d181f42b1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772783027, "uuid": "dffca90b-022b-4a2a-88d9-cebed37bc4f3", "comment": "Malware payload (Gafgyt)", "value": "eb75b1b90807d353ff7ae83e2ab8ed22ce3a58de604e4cc0fb8b1df40dcae30f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772783027, "uuid": "672b8e5e-1dba-4038-9639-7ea69a858773", "comment": "Malware payload (Gafgyt)", "value": "cb4943083902d33c753ab8e91a81a47f7e1604f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772783027, "uuid": "b31ec20e-3334-4e71-bdfb-c477a9c8be5e", "comment": "Malware payload (Gafgyt)", "value": "e1c95f97c5d6d9d4df3dc5fea30667faabd6c5ccab8a4d114b77da06efad52db426df23d9c88af93aa912409664663bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772783027, "uuid": "5a808cda-0a43-40f0-b55d-844d8193d494", "value": "T1B014D909AB510FBBD86FDE3706EA070539CCA55722A43B3A3674C528F54A54F4AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772783027, "uuid": "5e8839cc-0f53-4ba4-a0be-4aa5fcb8ec6b", "value": "1536:2M/noJoQEiJaFmNosgesLkcqeJytkCf7SmI+RNK1JZTZ+J2gfty8fczsim3MzY4h:2opqNos6V7INKJTUxbx3IQXZqYrY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772783027, "uuid": "a2f58d26-a087-4479-bcca-e337351d8516", "value": 203460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772783027, "uuid": "6a484b9d-b31f-412e-9664-80ff6a1a1411", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772783027, "uuid": "1feb2200-68ca-4ccd-947e-e2b810a13431", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ebfa246-1973-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772811818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811818, "uuid": "7d28a7a3-d9d6-4e93-9ac0-78e25cb76dc0", "comment": "Malware payload (AgentTesla)", "value": "3f15a2ea931aa83108a97d2e9f5eb6e3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811818, "uuid": "b9cc741b-bd5f-4814-b1de-d596d4dc034c", "comment": "Malware payload (AgentTesla)", "value": "eb7c4202e50a72bdb5d4f607f66b53573f2ab5aa68a9315f2b92a2c9656700a6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811818, "uuid": "e0b13227-7d36-43a5-8824-cb0871b7861f", "comment": "Malware payload (AgentTesla)", "value": "eec632c02eba73d5a035dbc46e5e797345255b77", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811818, "uuid": "f5e5dd5c-129a-448d-b716-7ac25698e818", "comment": "Malware payload (AgentTesla)", "value": "1681274020d44fbff51f3f901d4217e494d02150d6eccae6c237d2083af371a81a3bae6e9248312d486dd2d730c013d0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811818, "uuid": "2c954a68-153d-4bfc-9153-5020bd1f86c1", "value": "T1E345BF0273C1D062FFAB91334F5AF6115BBD7A260123A62F13981D7AB9701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811818, "uuid": "7a9cfdaf-eda3-4258-8b3a-5c95cb101c06", "value": "c1ce208b1192bfcf652c179f34f034d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811818, "uuid": "9a85c579-b134-4dc2-9997-3354a9ab7cff", "value": "24576:e5EmXFtKaL4/oFe5T9yyXYfP1MAXDzfETAyVMAh7BYtApy8Jbx+:ePVt/LZeJbInGizfeA+JBry89", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811818, "uuid": "b8d464f2-df38-4496-aa42-450c7bb30db8", "value": 1248768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811818, "uuid": "f98c3371-372b-429d-b3a0-6a73349e570e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811818, "uuid": "6509dec9-3abe-41f8-8cce-0a90730de017", "value": "3de6916c996862fca34d1e1be8fd826371ba94fffd6b51d1f51cfd7398b6b1d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa38a3c1-196f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810415, "uuid": "c0a8e069-f86c-45c0-8290-2a80c76505e0", "comment": "Malware payload", "value": "ab8b35ff2d89ee65964c3912f4994551", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810415, "uuid": "ca54370e-d255-4d2f-a42b-4b4791bc9992", "comment": "Malware payload", "value": "eb839d728c15bbb09bb2a0a5c5803c13095cb3e46d3faa4b39936bafd9543d58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810415, "uuid": "419da34e-2021-42d9-94e1-9dab676bdd21", "comment": "Malware payload", "value": "47bd445b34a44ffd984a5337be2335950fe4c74f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810415, "uuid": "c9949c92-432f-45af-a732-cb806c54122c", "comment": "Malware payload", "value": "2470efc27abc34dc2becedc219178d55ead4b61909c65da407a158363a9f7b44cf3642a83eb07ada16e860bb34bf81b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810415, "uuid": "1aa24f97-9891-4298-89e6-1f3fb611ef16", "value": "T11F452313B784D4DFE59552B2D793D2F95BB6FE08D428860B2B0D3F99303A1618B252B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810415, "uuid": "beefbd36-4972-4bc1-8491-7d4a3d84b9fa", "value": "4f67aeda01a0484282e8c59006b0b352", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810415, "uuid": "d80c21a7-e2ba-4f0c-999f-af85b166339a", "value": "24576:4oLLF0f536w/LmpQwz5/vXBNyZ0UH40KVInwyyi0Mof81/ONZb:4QLFempQgBXfyZ5Y0krIDo01/O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810415, "uuid": "8be11546-f059-4df2-98fa-ad0dd0512f11", "value": 1262632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810415, "uuid": "3e348bd5-1271-4fca-a354-3bc997acdee5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810415, "uuid": "08f30452-10b7-468e-b163-395b4bfd8cc5", "value": "eb839d728c15bbb09bb2a0a5c5803c13095cb3e46d3faa4b39936bafd9543d58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ec0d86c-1926-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772778720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772778720, "uuid": "f7496d43-76d5-4726-9efb-bcc904a0a312", "comment": "Malware payload (AsyncRAT)", "value": "af18bf28ce953902f50533bc27a704b5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772778720, "uuid": "4d8ba51f-9ff5-4839-98d3-da47761148f9", "comment": "Malware payload (AsyncRAT)", "value": "eb904dc1f915fd1f21c5eb7f4abb61b9457228f46fd8ba092c27af85cf5599b7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772778720, "uuid": "41f6abcc-9201-416e-a550-6bea61b77523", "comment": "Malware payload (AsyncRAT)", "value": "25616e8461e829f7085a2b49f672035f3dca89c0", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772778720, "uuid": "b4c778df-fb40-4a7f-a1bf-b678656fa0cb", "comment": "Malware payload (AsyncRAT)", "value": "f3ec11f262b5ea52ece387b24dff6ef7f19d452451e7d823f62302c8645302a2e18b9e8d93ca726f3a1fe70b58bd13ad", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772778720, "uuid": "d8f60025-1b67-4d09-9a41-b1bf0058ed5b", "value": "T191F2390573E58665E1FD1BBD5C3686044376FA478D23DBAE2EC450AE2A23788CF15BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772778720, "uuid": "fa36cd1d-e428-46c2-b48f-5dfb3afd739a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772778720, "uuid": "b4fa7bdc-1456-4dcc-8ba8-cc90f74c84ea", "value": "384:DMThIAu41Jr2t08hulE1bdcWOebX093bayseHQxnC7O+WmlIuufGfrfCxGWWsEQ+:DihIAbzr2tvhR1hV4RbJwB+WW9HQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772778720, "uuid": "5d355a97-3601-41c7-b140-1dfc19c11071", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772778720, "uuid": "bda9ba7c-f0e9-470a-931b-839a0f718160", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772778720, "uuid": "ad6065b7-ce3e-497d-ac89-6735a7a94c3c", "value": "MalwareRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f07d2cce-197a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772815123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815123, "uuid": "5c333cb5-3ba8-47a5-a1e5-e4d6c2a64ca8", "comment": "Malware payload (Mirai)", "value": "906fd91a78b299b20babe66a0a381e77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815123, "uuid": "5b98b6af-a890-4d55-aa2f-7d9cefbe7e71", "comment": "Malware payload (Mirai)", "value": "eba4cfa1129e43c6683d047b3c2644f0286bb564e3b2ab3d00d05ec72ec157e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815123, "uuid": "9be2f042-ecf2-41f6-99ec-8cb5dcaae6e4", "comment": "Malware payload (Mirai)", "value": "36750dd8d58fa69a3adea0d77af849a7171aa1c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815123, "uuid": "11b04278-5d10-4fd0-96e5-2469b3528a96", "comment": "Malware payload (Mirai)", "value": "56926690dcfd91f70f515174397be0dd75f696c859b8575482f74bcca5527f7e1e8001b9ec22f707f78451ab7bda5cb3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815123, "uuid": "a5091663-6bab-4dfd-bf7a-688234d0142b", "value": "T125433C96FC9245A9C7C117BA771A978A336263A9C2CF7313DC080B5136C9A4F4E77B42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815123, "uuid": "ae2c185a-fb81-4325-8c7a-19c6581fa0e5", "value": "768:8jRWcVgYik7nshvFUhhyE8dGLf/qkZzlQrdJKrn4vbk9Mz2F30ntzg7:kRBVgYik+veKDk7qU5QrdJKrJ9cOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772815123, "uuid": "290019ef-8255-4fe0-954f-be23d0e58816", "value": 55324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772815123, "uuid": "64d7d0ac-2aee-43fe-8bd3-f2c1b57bec2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815123, "uuid": "68d5810a-b845-41fd-bad0-e49ac3f624ec", "value": "titanjr.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63712c99-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808444, "uuid": "49e810c8-e247-4d43-9e7e-aa7ecb2d67f5", "comment": "Malware payload (GCleaner)", "value": "f7875a556afdaa7f4e156164225bc6ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808444, "uuid": "0acbaab3-16fa-4040-b055-46041685bdee", "comment": "Malware payload (GCleaner)", "value": "ebc59d56623931d66f7839be791f418ab6f7f801042dd82381ec0d4f5af31c92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808444, "uuid": "a60f9f11-399c-4f13-94a6-7d28c762c3bf", "comment": "Malware payload (GCleaner)", "value": "14efdc44c21ba1a3c67da94b4974b045d04a0d1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808444, "uuid": "023c8311-f065-4c50-b444-1d6a3c3fffbb", "comment": "Malware payload (GCleaner)", "value": "8586ebe974bba598030dc25687c5e4afe2d2e8ac8d9d4305e24827c972617f5da4ac9144d5786a7ce7a52894b7dfebe1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808444, "uuid": "f47f809d-42d4-4da0-a183-8819d19196d7", "value": "T1D136F1A811BDD432C7521DF94FE6C3C909E7EC121B798C51C7BC2BC81AA5978642E2F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808444, "uuid": "65576cbd-e6c4-4dfc-9649-83c19185c657", "value": "c243d5a6283f8eb7bff20dd0797e21c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808444, "uuid": "fe89b926-7266-4a09-b2aa-255f6bf2b474", "value": "98304:EH55fcr3RvydQnm+7JKwVtgYqDdvk2Ckg:E3foRvWsd53XqD+2Ckg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808444, "uuid": "a02ee31a-448b-4637-af07-4ac31fedbb12", "value": 5187072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808444, "uuid": "5ace6387-8ada-4320-b34d-bca7d2111221", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808444, "uuid": "cfe643de-3bdb-4606-8958-60b4b1f762ce", "value": "ebc59d56623931d66f7839be791f418ab6f7f801042dd82381ec0d4f5af31c92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0656fb9a-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772810006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810006, "uuid": "a3450cff-5e98-48e2-8ad0-53240e787110", "comment": "Malware payload (PhantomStealer)", "value": "27d08c32cfb6b1da731646b5fe5344c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810006, "uuid": "b86734d7-725d-4887-abff-52402557cf58", "comment": "Malware payload (PhantomStealer)", "value": "ebd0f08ec6981bc6a47b31b36753c9640bed64a9fd785c8af729e3e10c30cb53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810006, "uuid": "a16ba945-7d11-4990-8dfa-0f4388b6721b", "comment": "Malware payload (PhantomStealer)", "value": "fcd9922d9d9f3a99d7f3325221e86af165c8b292", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810006, "uuid": "9462877e-d53d-4d3f-9b82-b0f1ff7e0237", "comment": "Malware payload (PhantomStealer)", "value": "f6c53be825c9489168f5ef9fc0fbf57aedb9d65406a53c43d856dc5f36cc12dd535214dbb1d7d45a4f5907e4742e429d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810006, "uuid": "6ba380b0-be99-4931-8fea-9833169b4dca", "value": "T106752284229AEC13C8E64FB80531E67627F81DD89922C3469FE47CD7B87B7E014D536A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810006, "uuid": "abd4daae-4971-47a7-b107-07c6735fb753", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810006, "uuid": "bd5e6292-e288-4e1f-86c8-9a1a81c7e601", "value": "24576:VSwvTVtj0QGsDPsP9aa2tw4gCEoEawE51Bnh4oYqylDXmjrOffwX/OAGh8aRU/:VSuTVJ0QG/Mxma9Bneo7ylijrOffwPL9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810006, "uuid": "1a33a9cd-62dc-4485-a6e2-d0a113f7e87c", "value": 1549824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810006, "uuid": "de1ffff1-6dc3-4988-ab73-183487951cbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810006, "uuid": "07f9dde5-a963-40d2-8588-b21f602da174", "value": "ebd0f08ec6981bc6a47b31b36753c9640bed64a9fd785c8af729e3e10c30cb53", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d6f7439-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819225, "uuid": "cf3434d8-fdb9-4bf1-93eb-485529b9e2cc", "comment": "Malware payload (Mirai)", "value": "915d4a87e9b18280fb2f725d07e41a75", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819225, "uuid": "b3bb0122-8666-4039-b7ef-93d01bae7653", "comment": "Malware payload (Mirai)", "value": "ebe4ec6479c04dec9f624dd8a9b69b19980556ffc832a91cea7afee695387be3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819225, "uuid": "ad19b027-4b70-4d95-8db1-f763f80b507b", "comment": "Malware payload (Mirai)", "value": "bbcff5659351094b39c8625c94e5d17690d7225b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819225, "uuid": "309d94c9-90fb-4054-9ca1-5dac74d2a751", "comment": "Malware payload (Mirai)", "value": "bae502d6239c24a834845ecee8a05a213788155e0f4e79ee4d8a02847e8e8b8e51ece809cf07eea9694185e35f12ad83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819225, "uuid": "d5103fef-a8ce-4d52-b1af-e28e9e60e003", "value": "T10AC3AE35D42E7DD4C0A58534B0B5EE7A1B61B1C442461EBB2AE9C87440C7EA4FA0EFF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819225, "uuid": "cfbb217d-f2fa-4a4d-9869-f4cc2b16d001", "value": "3072:Jj7AdZCj/9VS9w4zvCUXSXx27VAac2poNR5Kei:Jj4ZQzSd9VAa76Kei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819225, "uuid": "d21ffd8d-9cd7-4c77-bc16-8e3489d66fe6", "value": 124472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819225, "uuid": "39e749e1-5e7c-48a1-adbf-44e2bd30adf2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819225, "uuid": "cbb322ac-a896-4515-83dc-62836edb3883", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bd453a0-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772809800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809800, "uuid": "1ce78266-50de-4cb6-a4c9-967377e3ff27", "comment": "Malware payload (AgentTesla)", "value": "797c35b0b21a327b79f2f3721569d617", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809800, "uuid": "be3f1238-64f4-4188-baf2-419429060ad0", "comment": "Malware payload (AgentTesla)", "value": "ec2694701e7c9d8e15390290b326f482429572eb88b64828cccc27955e488f47", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809800, "uuid": "673241b6-280e-4e27-88a6-cd7ea863a50e", "comment": "Malware payload (AgentTesla)", "value": "59cc64dff0a6ba17ba225442eef0286f3c1fb741", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809800, "uuid": "f9bfdbe3-762b-4c85-9358-a8cfb003712d", "comment": "Malware payload (AgentTesla)", "value": "4cdea9c686ad3527c9fb94f814c3b43189c98516a4bfcae505a3a8cd5b4bc4667bc8409f8bbeaa6bbd18d32e7a2cd9f1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809800, "uuid": "3b6fc60e-003b-496b-9538-0df370d52c2f", "value": "T1E784D042F7D1ECE6E05240B3EC7EC7541913EF5E8466472B226672162CA32D3166BECB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809800, "uuid": "38ff8e2d-a069-41a5-9cd1-dd989aaf02c2", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809800, "uuid": "b035fdce-083a-49ac-9d59-e347eef6329d", "value": "6144:7gORaJ1dhZ3qeDe+HKTQwgdLF5tMMAsR1qaF6hwFeaYIpWUPE:7gd6ke+HwQdLF04R1qpw5L8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809800, "uuid": "9da77944-2eee-47f7-951e-ea02febfc044", "value": 383688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809800, "uuid": "c7b64116-d972-4569-98ad-cb0dc4255e1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809800, "uuid": "3bbc918f-bfe8-4bf1-a074-9c7d5ccfbeaa", "value": "ec2694701e7c9d8e15390290b326f482429572eb88b64828cccc27955e488f47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d8543dc-19a2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772832110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772832110, "uuid": "8be9791d-29dd-4534-b217-5a9e600c5cab", "comment": "Malware payload (Mirai)", "value": "e8cd8fa829a847d102f60d009ed2b42a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772832110, "uuid": "d9a6a0e6-f45b-4ae4-9f04-3b7c472adda2", "comment": "Malware payload (Mirai)", "value": "eca46aa0994f2c5f649927342f510174f40964e2c686fd0d8345af0dde8f4f81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772832110, "uuid": "dc6e561b-ed5c-442c-920b-f539ab4ab145", "comment": "Malware payload (Mirai)", "value": "eb80eab776f6274e0e30ffe514f236afc97d1596", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772832110, "uuid": "5d643eb7-2fd2-4128-9d6d-01fb60fdf037", "comment": "Malware payload (Mirai)", "value": "dc7661c5185be53ea25e739d3272a73c3420107b763607216262caa159b3fcc4709b36257c0f84d41974fd9c3d62c4b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772832110, "uuid": "2008a185-4fff-4d6f-98ad-d2d492766d0f", "value": "T133C3F872B800DF66F40B96B604E78B227E30BFA74E631662731B39669D331D52867F44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772832110, "uuid": "21d5f11d-c5f7-412b-9ce3-9ea1d9431cba", "value": "3072:qSHslvkvr8501VB69VQ4ylDPArSmm/Qcud+1ninNb:qU/I501VMZylz2Smm/Qcud+1ninNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772832110, "uuid": "40d0426d-a734-43d8-ae37-da4be99a322a", "value": 119140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772832110, "uuid": "74213a7f-082c-49cb-8537-26b4bb616fa3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772832110, "uuid": "587d9ede-802c-4a0e-b861-9f64f9b7f254", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a95b1136-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810279, "uuid": "695359bb-26ae-4b12-b82b-87008adba5d1", "comment": "Malware payload (GCleaner)", "value": "c4a1f72bda9497c8a671de7d80a3de08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810279, "uuid": "e70270a3-cd70-4515-bd37-7f0a1c5852f3", "comment": "Malware payload (GCleaner)", "value": "ecd91288f71170ef8df19e63f945469a29974167573d2200e9c7ce70eb905b16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810279, "uuid": "593b2f03-118c-4cb4-b52e-fa8f00897794", "comment": "Malware payload (GCleaner)", "value": "466e8a6b511d82d944d3e98fc307fa6a38839399", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810279, "uuid": "f4bab350-3ed7-4cba-a63b-8aea74e4a990", "comment": "Malware payload (GCleaner)", "value": "733d6afbadee704587d2b2b0b601127d0501335f71118a7392d83b1b4a26f3974ef936ad760032b29d2c2f4aa6f15fa6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810279, "uuid": "b627cab3-0aa7-4b9d-bcce-cbee5a668b14", "value": "T19855B02AB2924133C1F2D6789C2757E5593ABE133E38984A27E51ECCDF3464279342A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810279, "uuid": "2c1a0820-0ae2-4233-b619-31e35fa8c4f5", "value": "0eefadf8e9087d6d95cc4aedf30a5018", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810279, "uuid": "19aaa1f0-fe2d-40a8-9e46-7514aaeea4f8", "value": "24576:qVwXV4HSmYq7MPPfEd+epghZ7TcQi1IbGAHZo:7cOfmBgHYiHZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810279, "uuid": "fadf6bac-f7e4-405e-b2a0-209fd012061b", "value": 1331200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810279, "uuid": "3bfa04dd-6609-47bc-9473-4d30fb19aa2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810279, "uuid": "8484cd2d-c61c-4513-b44a-d9e2a2d342e5", "value": "ecd91288f71170ef8df19e63f945469a29974167573d2200e9c7ce70eb905b16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72526da4-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819206, "uuid": "af4d6672-fe40-42b9-b295-1a0545fbdefc", "comment": "Malware payload (Mirai)", "value": "e902f7fce3f99ee8519b0e4547155fe4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819206, "uuid": "937c976a-953d-477a-9b6e-c46f2c74d34c", "comment": "Malware payload (Mirai)", "value": "ed31a8ee8c716cdbaabcb4d1e6cdb7e64c891b5987af5de77cba4d654414ca51", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819206, "uuid": "594c77e7-3c4e-47be-88a4-6638bd7ec54a", "comment": "Malware payload (Mirai)", "value": "f6c6495868ecda27878c211195463eaa82705786", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819206, "uuid": "6a1cc44c-4637-403f-a241-7e2f1dfd4fbe", "comment": "Malware payload (Mirai)", "value": "9af7bd94689830d09773fdec74f7fe8e5d2105268ffcb59f4f7a29eb0266763101b12ac2f54cb6fd82d350040c636db1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819206, "uuid": "a16565d9-a2f0-4b7f-ac00-f68b73bc17b9", "value": "T15BB338C0E643D4F5ED1602342137FB3B9F72B1B6522DDA87D7689A33BC52A42990639C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819206, "uuid": "615db25c-a2fa-49b3-91ec-677808e6d307", "value": "3072:Bh0t+J8WIPc3VvWJCnKrQvHiJFqiItREVU4YQxs:Yt+bIP6VvW8KrQvHiJNRTxs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819206, "uuid": "45e2e0ee-a062-4d28-8fc4-e5987d7c3ab5", "value": 109296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819206, "uuid": "ea90d009-86ad-4c8b-9b04-dbd36ac1877e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819206, "uuid": "f1b30bfe-0b7c-49ae-99a7-663926861df7", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ee38a6a-1971-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772810906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810906, "uuid": "454930cd-8e96-4c6a-811f-df809f7daee6", "comment": "Malware payload (RemcosRAT)", "value": "7c955f11dfe732bf83e8d053efee4d7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810906, "uuid": "7df24748-de96-4995-ab09-5952ff898d76", "comment": "Malware payload (RemcosRAT)", "value": "ed943be4340ab01e7d0dcf8fc2ae75300803744a290dd926100ac665ae59e535", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810906, "uuid": "d72570eb-d506-4a23-a436-50d48d7053ad", "comment": "Malware payload (RemcosRAT)", "value": "c06f438a6c377a70eb2ba14a887427b332f57a28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810906, "uuid": "b00eac2b-fda7-4d4f-b1d3-c979418398cb", "comment": "Malware payload (RemcosRAT)", "value": "f3664625c87b73bdb3652908d5652f8b66c93a8f295a597b2e5ee63fa18cc42e1f7b73857294c349578b2bbd13369da7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810906, "uuid": "84a09eef-7116-4e00-a8ff-008b4eceb871", "value": "T13C55331372D5F3A7C28D41B117E4E736CBF382C21A0A154A5696FA673AB1FC3B54A342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810906, "uuid": "313bd1c5-a03f-4664-be20-c71f35185781", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810906, "uuid": "3de56da7-1650-41dc-ab96-225cd8de924b", "value": "24576:aytvKQHsNSXHf1addyCm44mt6rUqXbvMvlw967IE4SzEbhVYFYSkVnjn7Jk:5dvP1aoQQtLwlw96x4gChVu5mDlk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810906, "uuid": "1327b0b5-b1b9-460b-879d-7bacd2ed057e", "value": 1307600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810906, "uuid": "0c504549-7a69-4d48-829c-ef9b729fc28b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810906, "uuid": "6fe5f41a-046b-4fe5-9ed4-433caef8def1", "value": "ed943be4340ab01e7d0dcf8fc2ae75300803744a290dd926100ac665ae59e535", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "478c0eff-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772809686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809686, "uuid": "58dc483a-f1ee-4614-98ef-62a82ed6039d", "comment": "Malware payload (GCleaner)", "value": "97c19cd25da7867b5eaa45555cb65afe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809686, "uuid": "89477e9a-4a07-48cd-a4bf-0d572362b52f", "comment": "Malware payload (GCleaner)", "value": "eda2a3dca14ea21a76aee03d6c133562ce0c4fa55fdb70163ee54fcc6b500fbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809686, "uuid": "2607f114-628c-4e08-bc5f-e11ab0777c30", "comment": "Malware payload (GCleaner)", "value": "2dce800e90267984407ae0beff685725bd90ab1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809686, "uuid": "c8b8ba0e-bd69-47c1-b3ae-c06a3488bdb7", "comment": "Malware payload (GCleaner)", "value": "d471047f6f98e3c0c8c0418afc2a8a2eadcb3e206d05bbe5a90f4bc3e6b7b5b54142a463e29b50413ccb55fc431f151a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809686, "uuid": "cb1e8c11-829a-4bf7-8682-ff9e460d71d4", "value": "T1F3F48E62B1E144FEF163DA7CCD5EE25CB8157EC1392BA8066BE45CCB5F36680341A293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809686, "uuid": "30c1a71e-4c18-4080-b7d3-afab5a9b32ea", "value": "855c002a8df581e0836bc0be1ec15465", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809686, "uuid": "266c3823-875b-443b-b86b-13bbfd8c5e46", "value": "12288:BAmht7cInjR4Nhf2lGh+F/ZV1wT5Qm55PaysP5T5XKpOQVJN:CczjR4n2lGgFNwDLaRypT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809686, "uuid": "433e3693-fba0-4673-93c4-d96a98bfa91a", "value": 734208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809686, "uuid": "3858edcf-bee5-45f3-8663-cc687a2c8bf7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809686, "uuid": "f329f17e-b2cf-4d0f-bbaf-044e24df704a", "value": "eda2a3dca14ea21a76aee03d6c133562ce0c4fa55fdb70163ee54fcc6b500fbc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dda87016-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772809079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809079, "uuid": "a556e6d0-9c65-4200-be7a-69c3db7ebbcb", "comment": "Malware payload (AsyncRAT)", "value": "b10c13eb7e780895c19a2be0688b77ba", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809079, "uuid": "e8bee190-5cab-474f-9f09-15aa9904f8f4", "comment": "Malware payload (AsyncRAT)", "value": "eda35ef9c1d7cf112c5c051af7ff0ac959745db989ea446911313b3e53f8a751", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809079, "uuid": "1a3f8304-a3f2-4377-8702-adc5721f27a9", "comment": "Malware payload (AsyncRAT)", "value": "63527821a7fa3e7349975a7ea122b36b4f7ae812", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809079, "uuid": "5df46090-4f58-4ea9-aef5-8428a24500dd", "comment": "Malware payload (AsyncRAT)", "value": "502f5aad818733423bfc6dfbaa4a5d83555d33fcb977b2aafa4c1d40fee02925991ffd3805611efd21a0a5e50dcb92c7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809079, "uuid": "c17ba581-c13f-46bc-be6c-fd33ae384d23", "value": "T1652502182729DD02D4EA0FF40972D3B45BF96E89E515D303CFEABDEBB8363405985292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809079, "uuid": "fa37a9a5-d027-498e-a861-634a675450de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809079, "uuid": "614edc25-7375-496f-be15-3b27a69f4c26", "value": "24576:Wqu2VHY7qm0mnCNYmKFCmihOwpfAYz7OwE87xgVGjI:WeVH+qm0MuYtodhHfAYzqwWVGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809079, "uuid": "2a77f863-e0f3-4711-ab7d-7167c91b8738", "value": 1050624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809079, "uuid": "fe0c644c-e453-42a6-890a-f70b87512bc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809079, "uuid": "1873386c-9a0f-400c-9d47-5826d1df79ca", "value": "eda35ef9c1d7cf112c5c051af7ff0ac959745db989ea446911313b3e53f8a751", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bfc5bca-1982-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772818391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818391, "uuid": "3ed91dfb-b1fc-46fb-bab7-5d07c91c45b4", "comment": "Malware payload (Mirai)", "value": "cb4c684a9e00bae50a43bf7373d22527", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818391, "uuid": "c8df5468-12ea-40d7-bfba-d3f0183f1ecc", "comment": "Malware payload (Mirai)", "value": "ee33447ffab0f2b62be26fcedbfdc575d1e5f6c2966d0346edd824538ab065a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818391, "uuid": "cdfb8a22-0f91-4cee-9f2f-04c48ad15ab7", "comment": "Malware payload (Mirai)", "value": "a0808040f06dc54e43335551993289fd814bc16e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818391, "uuid": "621d864d-a269-4fa6-856d-c3162a058c30", "comment": "Malware payload (Mirai)", "value": "df66de3a871b3b79ae2250fa54f44c63130d4ac1d3adb6872574c1bc67e66beff0f5b836196b2bda2ab782f3b0eca84d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818391, "uuid": "b381df26-319d-4bc7-8aa6-a432fe17f94b", "value": "T189E34A55B8828A22C9D513BEF92E018E331367A8E2DF7213DD205F2477C796B0D77A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818391, "uuid": "1c0234fb-3c6b-49e0-8ec6-bf1c95fc9d87", "value": "3072:CotWnBLigk1Tc3bCC0DvZe1k6aU6zL6EiueCo2ke:VWnligqTcrCCqeS6axIuecke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772818391, "uuid": "c0f92503-f469-4738-a8ee-f332a2937949", "value": 146256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772818391, "uuid": "ff3693b5-fbd6-49bb-b3f2-3e3e4a071f90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818391, "uuid": "8fc82d2a-ffa2-45b4-921f-9070dcc5c95a", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c46935bf-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811184, "uuid": "ef8dfbd4-f280-4bba-93a0-19ecf7405330", "comment": "Malware payload", "value": "db3a688b5681b7160e0d7e3dd781f484", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811184, "uuid": "fb7e35df-2ea6-424d-990b-413f1c331f76", "comment": "Malware payload", "value": "ee54d8607554f83468b88d4c277e4f56031c57f60ab6563a8b881a53e328dbfa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811184, "uuid": "97340461-8c67-4831-bdf9-136c5dca2a8f", "comment": "Malware payload", "value": "25d39c4051d020dd4b7e5214666f98fc8710f3ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811184, "uuid": "4f3a4cdd-e04c-48a3-bc6d-2189c693609b", "comment": "Malware payload", "value": "030fe304d03c96816941b7103d4acac5a8e6e368a48bf48dd60e5de7743e89620fe23373ac983fbdb747b47bf4bf2dc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811184, "uuid": "4a9f3615-bbcf-45d2-af1b-930230907e07", "value": "T17FD539177E90CAE5D19FE339A9A66582BA347C0C0B3137D32F516B751E763C01A3AB18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811184, "uuid": "dc5aa8fd-3571-44f7-aa2f-ec16157719cc", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811184, "uuid": "947efd63-38b7-42db-baf8-c7dd378a5d4f", "value": "24576:j7uFa7JDkRsWZ6TXnyHvgxDIjhkvhyD4fDQQJ0lgSaqhelet29m9cJMSQ:j7uaFDHWZ6TXagxDIj+vhLaGq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811184, "uuid": "2b042c69-346c-4671-b873-cc0b7efa1fc1", "value": 2824192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811184, "uuid": "d331d471-fe52-4221-a302-c14f200f3ee9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811184, "uuid": "f3f5f6a9-49db-4549-8daa-e443d4d9debb", "value": "ee54d8607554f83468b88d4c277e4f56031c57f60ab6563a8b881a53e328dbfa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffc4cb6b-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1772811713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811713, "uuid": "87e13fe3-c1fb-44af-ba8e-1270e855637d", "comment": "Malware payload (GuLoader)", "value": "7c44f23e8aef98cce70a19c3d53c536a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811713, "uuid": "9c49b848-d14b-4a62-ae9b-e3de927983f5", "comment": "Malware payload (GuLoader)", "value": "eed38cdd5e1cb46655f11fb5ca3d55d9ed9df1e47ef63781cbdc0370d9df5e22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811713, "uuid": "c398c1cf-ab8a-4922-a78b-d9c73fc578b2", "comment": "Malware payload (GuLoader)", "value": "48580d7aad3017376d6339f49ef004b26b2124c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811713, "uuid": "8ef84335-a6c7-4af0-8ee0-67ec1c3cbbd1", "comment": "Malware payload (GuLoader)", "value": "6779bf62a14a810f85e83411a1f34b9c1da9cb9814891c703fa4551eac1f3bd208faa47ba95f3e234842166351d4f595", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811713, "uuid": "730b7dd2-25dc-4667-b74c-abf6a312ca1d", "value": "T117A4D092F691D9E6DC3643B6D93B1A301763BE3E99700B0F27AD725D69B33920026C47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811713, "uuid": "dcf56431-a8d5-4c70-aa0c-151b94d50808", "value": "5f0c714c36e6cc016b3a1f4bc86559e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811713, "uuid": "9b830cb1-e0a5-4b26-8243-df890da1dcb8", "value": "6144:IDfe6EKGDcqpyf5TeDgdygNGiQfxSjxLOdzXMafeswLr0m0WBuzwHUc4T2Rl3f0Y:QnqpyMcdbTPjxOcafesgrYWB+M4VP0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811713, "uuid": "d8f624f2-840e-4c3e-9cca-117a63220164", "value": 487656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811713, "uuid": "b34fd85e-fb7b-41a3-aa20-5da730894cee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811713, "uuid": "0388a9d1-eee4-4dba-8fed-3179bcca4eef", "value": "eed38cdd5e1cb46655f11fb5ca3d55d9ed9df1e47ef63781cbdc0370d9df5e22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afe7e756-1971-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772811149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811149, "uuid": "e2b4ae10-0853-48ee-8b5c-50c2edf13604", "comment": "Malware payload (GCleaner)", "value": "d9bfb9f760bd3ab537f51c9a3b8e968f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811149, "uuid": "2835eb99-cf8e-4dc3-8894-f330813f6ebd", "comment": "Malware payload (GCleaner)", "value": "ef02d334775ef69ee99b35d0ecf6da4edeee1b754127075b96df9f1e02783d0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811149, "uuid": "9accf289-769a-49e1-9050-e1c14549c41d", "comment": "Malware payload (GCleaner)", "value": "b13899a02dfe419907e9c613a92275ec5879bfea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811149, "uuid": "b8cd2fec-517e-4e56-9b12-b84adaa9c68f", "comment": "Malware payload (GCleaner)", "value": "5cd0fa043839213b00f3b2f9afca9a373d290cb170a09b9d56792ad1da9e56f79e1faaa4de360b1004a0b9ce42786344", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811149, "uuid": "63ffdac1-a6dd-4fc5-ac34-de7c5b7f5581", "value": "T140058D25FED38032E132E9389FDE52B59B2DBE41E9287475EAD81CC88F273812516357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811149, "uuid": "a77d97ec-a4d3-4bae-a5ab-646e6ee78573", "value": "ce7a1d07b14b49824555865592c3af45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811149, "uuid": "c8dc8656-7149-4859-954f-0a7a118b096c", "value": "12288:gkAJdZJGY+5K/Lo9r7WTB+rP+Ei/yPUv3ac9yj78CZBUqo:6XZJeK0Z0lL/yPUSc9yj78e5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811149, "uuid": "0a612da5-1b3e-432f-a6aa-320a2dd8bc2d", "value": 860672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811149, "uuid": "20f6374a-35f2-41e8-bdf6-b1a5465b509f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811149, "uuid": "b160e7a9-312b-4134-8784-14910ed82e46", "value": "ef02d334775ef69ee99b35d0ecf6da4edeee1b754127075b96df9f1e02783d0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70e1a7f0-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819204, "uuid": "c6726ab6-dd4a-40be-a777-47584bd47e34", "comment": "Malware payload (Mirai)", "value": "270bdf157a4cecc0496fab640db32717", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819204, "uuid": "be21bd0f-0303-442d-a25d-914a22b6b99e", "comment": "Malware payload (Mirai)", "value": "ef7e94444375782ae50177894afe504b0e3ae958e64110429e50331a92ed5b1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819204, "uuid": "c40fbc0a-af75-43d1-90d5-7a9f9ed14cef", "comment": "Malware payload (Mirai)", "value": "0f225ad7e30444024f9537ffbe8349b0e6297d7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819204, "uuid": "7c23d8cc-6015-490c-903c-9c25502f9173", "comment": "Malware payload (Mirai)", "value": "087980a2eb4b9e648c010d91a5ed8acadac4bc3b238e582240d7ea52f2edef45c2284dc1851b2c8680c48976921d3f8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819204, "uuid": "8005681a-2029-486b-918d-bf7251721ad6", "value": "T1F8A34A23BE328C3BC4C1653A31E75326E9F643DA51B8951EBD700E8C7B79610361B7A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819204, "uuid": "8ce1993d-c5f3-4afc-8256-894355e29831", "value": "1536:GnwIqqN+B6nK0FB8niwbiQIz4rUt10o75ougzyKtkGe75s8:GwI5BWiXZj0oV37s8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819204, "uuid": "525a47cd-f80c-4b47-929d-422ae25b3cb0", "value": 99684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819204, "uuid": "8d93f055-f0fa-4f13-91cb-6ebe4521c1f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819204, "uuid": "62836a45-5f42-4b1d-b173-a7b9602c36c2", "value": "violetspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6251a4a7-1970-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810590, "uuid": "8364388e-f3ed-496e-85c4-26840aee1a50", "comment": "Malware payload", "value": "4a24f8bac2bdf8fa62dbee43e7a5906c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810590, "uuid": "a52e5036-a098-4912-9f3c-72e3656deb21", "comment": "Malware payload", "value": "ef92a54e4e1497948b2096a2a37cfa5be096283e63b8275366c7dfdb0dc58922", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810590, "uuid": "ad855a4d-d30a-461e-9b40-8c5e3f2d43d9", "comment": "Malware payload", "value": "b3a56b01eaf918924b5273f839f3b91ec0e7bddc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810590, "uuid": "2e7f3e47-9923-49fd-8d7a-d6ba52980ae9", "comment": "Malware payload", "value": "73fe7ac98c8f99073652a25c1bc776c4c9dd0a31317a45fd48fac5e7cd944654d0fcf2145e2504b7d0e0f89f0efe039d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810590, "uuid": "5a94bc7e-88cb-43ca-bc9d-86e68d4549d8", "value": "T1184523413A64BE2BE593203FED71E98D2B3294A104B0F30BB75436553D9A8D3912FE5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810590, "uuid": "f5b836ed-80c1-434b-a67f-85c83f2ec1db", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810590, "uuid": "67faed2a-fcdb-416b-aca2-5e0e9e615fe1", "value": "24576:0Ea34nLs/FY2aZVfGmPk0ti6/KXvezY6HuxfCIeTmYAs9oLN7BwCArAWA4+uM2:PAoLs/lwGm80M6/We0quxfW6wonwCAEE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810590, "uuid": "77c3aeba-6401-4695-a267-19fcf082c851", "value": 1271632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810590, "uuid": "9317568b-7f3e-46b2-bec0-ae5aaaaa5644", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810590, "uuid": "2db4d746-1a49-4e15-b7d4-483ef52a8593", "value": "ef92a54e4e1497948b2096a2a37cfa5be096283e63b8275366c7dfdb0dc58922", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21f50a2a-1974-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772812200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812200, "uuid": "1683efa7-b764-41db-83b3-a855d60807a3", "comment": "Malware payload (Mirai)", "value": "e522e90cc96307073b10c61ccc46ee4a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812200, "uuid": "d7e5582d-742f-45f7-9fd0-311883d85b1f", "comment": "Malware payload (Mirai)", "value": "f01285fc815c1c8bce75a56604ae3a2b2a6b196274a1242540533aaef0e8705d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812200, "uuid": "be3be1bf-d70d-46ad-8767-8cf5ec9de73d", "comment": "Malware payload (Mirai)", "value": "5518bb99a080ee81b00770d8184ed25ca0e4cf8f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812200, "uuid": "9f1bc4dc-0a93-4e06-bfde-bb57bb6371c4", "comment": "Malware payload (Mirai)", "value": "85031af8063898adda3604f44a6d9ad6bb4a1dfafcad0e3ed8c269103eef77c3ed1bd4eb9f67a0eda4daf43aac356fb6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812200, "uuid": "fdd3ff50-8649-483b-9b2a-3d1ea44ab3a8", "value": "T18701D8802172237434E6D8EA4A330D3C75ED9497BDC71EFCB9E5A0E60E99D01B4820EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812200, "uuid": "7b559d2d-09a7-458b-933f-fea7581674e2", "value": "12:YkF1kcClZF70SKUbCHFAUbCHFHUbCHFWAbH6FSAiabH7MFM5gF/bHbAbH6FSiia7:ZDkH/FbnbCHF1bCHF0bCHFWAbaFmabby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772812200, "uuid": "5566579b-8a56-4832-9971-2e08d5919a8a", "value": 762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772812200, "uuid": "7f7313fc-9b53-4f43-8900-29dc039e866d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812200, "uuid": "552bc288-073c-49b3-835f-a9758ca09309", "value": "all.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33530631-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772810511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810511, "uuid": "5a62941e-9b1c-48d8-94e2-914e375d1d9f", "comment": "Malware payload (PhantomStealer)", "value": "65d292245ec47f77a5a03fafa8fda6fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810511, "uuid": "5140a25b-b7b6-409f-aab9-8223f006637f", "comment": "Malware payload (PhantomStealer)", "value": "f062bdf365bef07bd945e7fad8475a3b86a1d543f12d37479bc2df9bc640e2b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810511, "uuid": "eb022f2d-4f5e-4163-b73f-0b5bf2c23241", "comment": "Malware payload (PhantomStealer)", "value": "7e7fb0bd6736952037f80d82c162a5ec1377755f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810511, "uuid": "60a492aa-6c54-4bb1-a6c7-9ffd211a34a0", "comment": "Malware payload (PhantomStealer)", "value": "2fb723fb030a6c801dffee91c952fb836af3a89ea9de7c31400f8730357910650034e75ba593c174b98ab5289141a927", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810511, "uuid": "66f0ec14-46e2-4013-b602-fd7131311fe4", "value": "T1B46512902714DB27C8A487B81E71F2792B7C0EDEB901E3078FE56DEBB566B150E84187", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810511, "uuid": "7a521b34-dfdf-4f14-9a9b-cca496aac48f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810511, "uuid": "a9d4cf07-df01-4c2a-8f64-b5e008666afa", "value": "24576:gIjbfchsjTPks+/pUZe2G7/eEcaAFhpAS4232+sii9vJte0SNsRrcIzezP:njikTPkvph2GOFTd2Vise0Qsbzez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810511, "uuid": "5b49a1fa-6520-43a0-a402-f753b82b8cb2", "value": 1509376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810511, "uuid": "e07864f4-cbdf-4291-9823-b8ffc09d4a57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810511, "uuid": "59775b3e-f485-4f57-b9b7-5c55ce1c732d", "value": "f062bdf365bef07bd945e7fad8475a3b86a1d543f12d37479bc2df9bc640e2b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b23d961e-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772811583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811583, "uuid": "876b4f6c-ce62-4718-bc84-b403f5c70f01", "comment": "Malware payload (Formbook)", "value": "0edf6b89d800cdcef731e39459167262", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811583, "uuid": "3f920d0c-9d39-4f48-a8fb-2e2a9db33395", "comment": "Malware payload (Formbook)", "value": "f0757f9b971d1ccfa215a48ee8f95647e87809603f153e5cc43ffc1fc9b4f078", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811583, "uuid": "de0ec566-340e-4c9b-b748-e98eacfb6dcc", "comment": "Malware payload (Formbook)", "value": "a12e162c02b131a7cbc9f5aa32e87fba2ff37bea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811583, "uuid": "cdf4359f-4706-41eb-bbbd-758d074e6d63", "comment": "Malware payload (Formbook)", "value": "1cc18aeb38f2bc97883b3c7cea6719e07bda037b82d5ca7c781afb32f17b8c4f6b9ff46f0c912ef17a663ba6be7f4d18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811583, "uuid": "e9cf72c8-a226-4009-b4d5-ad34e5c5e7cd", "value": "T1D42512285789D403C9A9437A1DB1F2B8077D6ECAF515D31B8FE8BDE77D22B520808396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811583, "uuid": "8b567208-7b01-44a5-815b-221c61470fef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811583, "uuid": "1d295596-ffca-40b8-95d4-913446f875ef", "value": "24576:O8I5aOXnfRTN5r9jwad+6A/azUUu6dK27yUs/:8UunfRTN5rdrd+muv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811583, "uuid": "ee885dbc-b635-4022-98f5-d6f28233ff57", "value": 1047040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811583, "uuid": "4f09d20e-3014-499b-a6e0-169eca28f781", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811583, "uuid": "2d375a29-0e15-47cd-84f6-0d9374285f70", "value": "f0757f9b971d1ccfa215a48ee8f95647e87809603f153e5cc43ffc1fc9b4f078", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "860c4e58-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808932, "uuid": "04ac0165-c16a-46a6-85b2-75ab4a71fdd1", "comment": "Malware payload (GCleaner)", "value": "e5c8df774dcd1ba8fc8b503e9c1c9921", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808932, "uuid": "befb3bf0-e60a-4c63-937f-63e0ce6b5aa1", "comment": "Malware payload (GCleaner)", "value": "f0a7b3b66a40102d12bae341cf965c341d76c9883af3849458f634defcd5cbaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808932, "uuid": "951eb0e6-897e-477a-a017-13c19fc3d5bb", "comment": "Malware payload (GCleaner)", "value": "5d6e49fd1ba24e460ed4b2642c5925f3111e73c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808932, "uuid": "25724437-12bd-498f-8185-e7c136dabbb8", "comment": "Malware payload (GCleaner)", "value": "f399ea750da847a584f096e2073815644dea33f5f650818bd02348c38bca8155d5e287c832039d326bbcab7d182ac518", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808932, "uuid": "a47641eb-9f53-4de5-80f1-8a67a573441e", "value": "T19116E07562355631CDB95438F8CA5CA12E8AE6A01C0B6B012BD127F459CEE4EB740BFF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808932, "uuid": "5260c776-5d18-496a-b1f4-e73084da6547", "value": "345624d13ffc2b7f296b9d2972b1c0a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808932, "uuid": "dc1904d8-219f-47b0-b50d-c6b102dbecb9", "value": "98304:ViZYoko+iw1xkBfs2ojNtdZEXwKcf8y7qr4nTeu0Rm:VP9opw1xklsNtcXmOrT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808932, "uuid": "7eb1086e-6fac-4cf8-8536-bca20a304585", "value": 4379136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808932, "uuid": "40d8b796-faf4-4799-a66a-8f7233f53782", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808932, "uuid": "2ecf4701-ab45-4467-91e6-9954c77b90f1", "value": "f0a7b3b66a40102d12bae341cf965c341d76c9883af3849458f634defcd5cbaf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3028e914-196a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807929, "uuid": "1f341126-e759-4d50-a0f2-8f3e2aa29992", "comment": "Malware payload", "value": "e3934f56ed0a4fd0a275706d71e953ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807929, "uuid": "d46cc148-5f65-4748-8e94-b16e2b49f853", "comment": "Malware payload", "value": "f0b53c8bc902424b42fb165a041f58a713ba427bb2e9b47ce56fe8e061f32a16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807929, "uuid": "5c86a7fa-309b-4b98-b2f2-02a3af573145", "comment": "Malware payload", "value": "d2f40e2d34cc17972eaff1996457043c3b9f44f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807929, "uuid": "57b92c25-c7f2-4e52-94e5-c1b8cc63e603", "comment": "Malware payload", "value": "f83a47cc6ab551450cf99a166c98ff032b9a923c996c45fe179f29b9532facece52683d87147f09e4f6da1f4688822fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807929, "uuid": "5fc64fbd-10b7-4e8a-81bd-af5b2f1d964b", "value": "T10B85E0027381C062FFAB96734F56F6115BBC7A260123A62F13981DB9BE705B1463E763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807929, "uuid": "7ba44dd0-295a-443a-bfe3-3bd8c44385da", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807929, "uuid": "135ace48-d42c-4e53-af18-f3ee86138b79", "value": "49152:VPVt/LZeJbInQRaOaLf0tmrt8T9I8fXRK:dTYbInQwfkmCSUX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807929, "uuid": "12f236a0-5694-463b-b605-2b4cec0a6a44", "value": 1730048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807929, "uuid": "a9853e6c-3d51-4120-a2bb-d170f6180447", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807929, "uuid": "8ad9ff36-fc84-4692-b046-ef98ea0b7a6e", "value": "f0b53c8bc902424b42fb165a041f58a713ba427bb2e9b47ce56fe8e061f32a16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "428048dd-196a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807959, "uuid": "9d59e2a7-f453-4239-b01e-0306e8ebfded", "comment": "Malware payload", "value": "ebaa1caea95cb610db800bba489f751b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807959, "uuid": "7286831d-7d1d-459b-ae02-34843b8de8f3", "comment": "Malware payload", "value": "f0c6238904d6c82f4d9c524b646abd3761aeb8303a5f5829939f1481f6d06311", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807959, "uuid": "eb3a78dd-21f8-42b9-9d09-ad4232a30dd9", "comment": "Malware payload", "value": "034ba2c93b6b8ae601d9542f362a946836820202", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807959, "uuid": "09c8e388-639e-4f0c-ad6f-6b3f8521a1c2", "comment": "Malware payload", "value": "42eb6d086e0e7d615e1f0f790639fc0004cd0d4a2f888e0e42b46e0819d74474d0822daa3bd0cc78748c8f14b2c23488", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807959, "uuid": "51026f2e-1852-4071-9f0e-8888617838ec", "value": "T17C75232122ACCD46D9AC1FBA64B2D33567F28D4F6116D3478EE83ECB7D097818968353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807959, "uuid": "994e8cf3-bda5-46b3-be55-df9342494687", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807959, "uuid": "68d798d4-1621-4869-86a6-41d515c77958", "value": "49152:8zHBuG8QbE16z3R/TvyHQaMTKTXA30J7WVR/ufVQcY:D3n1Ch/TvyHQrTKA30NWv/mV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807959, "uuid": "c45da87e-03da-41ed-af46-f67a6ecca173", "value": 1616896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807959, "uuid": "4997f12d-d0a6-4122-acf0-0895b32a3f74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807959, "uuid": "f59b4aeb-d49f-4d2b-99a0-ff7da9599587", "value": "f0c6238904d6c82f4d9c524b646abd3761aeb8303a5f5829939f1481f6d06311", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35fdca92-1935-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772785175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772785175, "uuid": "57b82061-bdaf-44dc-9092-d13c044e9e7c", "comment": "Malware payload (Mirai)", "value": "a43171f099cc3e3e9039a1b22a8ae080", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772785175, "uuid": "0761fb03-0b46-4efb-b6e8-7f9df2b1d88b", "comment": "Malware payload (Mirai)", "value": "f1566911f42bf94e814c386594e7f709bac8c93436043eb4152060ffe2ef8f08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772785175, "uuid": "adebfcee-e660-4266-b3ef-0b8041e0a383", "comment": "Malware payload (Mirai)", "value": "736ed352f06c73730fa48428762d1b0334c45cbc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772785175, "uuid": "4e31ce21-c517-4d8b-9822-6c4c6a2409a9", "comment": "Malware payload (Mirai)", "value": "84f295466850860fb17a0e77eda39baee14ce58b7393da560199689ab28eba31bdbf172f356264d7f98ad070aae8f98d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772785175, "uuid": "4531984b-6569-494f-a84b-940b5a93a52f", "value": "T1CBF3F745B8519B17C6C616BBFF5E42CC772A1798E2EE7203CD256F20378B95B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772785175, "uuid": "1a48cec4-b05a-438e-8e89-230bf7888376", "value": "3072:pQGPwMS7OozH21Lun4j89dTRp4Znw081NO6XxtQK:pxPwMS7OozH21Lun4j89dlp4Zw081Nno", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772785175, "uuid": "f94b5a63-d2ac-4598-81ce-87f537bedd79", "value": 164632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772785175, "uuid": "22d407d6-48bb-4386-b4c2-eeaa33d52646", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772785175, "uuid": "42dbb3d6-e297-4714-ac3f-9b37a6337402", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fb06e4b-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810988, "uuid": "6abf1209-d98b-4db1-a15b-6384d330dbab", "comment": "Malware payload", "value": "7d9cd307647ab1c26d4328871386719d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810988, "uuid": "91c0b246-edf3-44ed-b7a7-1dbe2a8c1ffb", "comment": "Malware payload", "value": "f1601bbb98c7ffd8c55ea339882b3bee989598ade9a897c9eb63237609652ced", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810988, "uuid": "698243b4-16ba-40fe-b906-c72691e358be", "comment": "Malware payload", "value": "88ae7fef0946310f299c892f248a907c56784d81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810988, "uuid": "899d98ac-7be1-40fd-b18c-80dec0249372", "comment": "Malware payload", "value": "1709b65512afdd41d44d8f058b6d4d48b3b9a886be7a7fe7dc6ad4b638f2f0db364efea03045b288dab62012a146129a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810988, "uuid": "888a1c4f-5106-4e02-8c34-b6f7ed81ccd3", "value": "T14AE48E3DE7B08532E162EE3BDD16E6649825FE806A6878C76EE41D494F38381F439353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810988, "uuid": "96265ff1-950f-45d8-a22b-6cc3eecaebf9", "value": "ce7a1d07b14b49824555865592c3af45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810988, "uuid": "be93c492-4bf4-4d95-9a10-c5cd50c79179", "value": "12288:ikAJdZJGY+5K/Lo9r7WTB+rPLudNAC5jqpRuoM5E2TDA:AXZJeK0Z0kurR5jFR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810988, "uuid": "42eeb2c2-10ad-4da6-bf2b-3dbd72c777f1", "value": 691712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810988, "uuid": "db94e57f-2e77-4b64-a2fc-40d089960355", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810988, "uuid": "50d53b0d-f55f-4bf7-9d45-4fa546253134", "value": "f1601bbb98c7ffd8c55ea339882b3bee989598ade9a897c9eb63237609652ced", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f0c6937-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772809188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809188, "uuid": "636f4226-ffc4-423a-8097-513735d1868c", "comment": "Malware payload (GCleaner)", "value": "fdd3b0be8edb5f84976c130a2ddade81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809188, "uuid": "a5737b6f-14cc-4bb7-9081-79a1a12149ab", "comment": "Malware payload (GCleaner)", "value": "f1993c4d3e41f557c7a17ea98df999aa369ec9571279bd3b515898d2171dd28a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809188, "uuid": "79261dc3-2c65-4ddb-84bf-97dc114954d9", "comment": "Malware payload (GCleaner)", "value": "5816cc53717603b9ee48891e5cf796ac92724d12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809188, "uuid": "1aa8ba01-758b-4ef5-badc-d6ba29b5a809", "comment": "Malware payload (GCleaner)", "value": "b6e7930eea1d58910e2a7429e67e5ccf2184789aa6fc24f1a63ca2d1ff0bbf56c20703cec9b81aa81cb411cc4b9facc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809188, "uuid": "d950fdeb-f75e-49a3-95c5-fe6230f23eec", "value": "T1D926E13474D1F977D9CA4E3BCA3B2231B8236BC86412A6616B501CF43E9A7DBF951072", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809188, "uuid": "e2c72369-6b5c-4804-ade3-a9e0bda52f6d", "value": "345624d13ffc2b7f296b9d2972b1c0a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809188, "uuid": "d246a171-bacb-4860-bd12-cd9c34b5f3a7", "value": "98304:KiZ+okfPOCLpLZNg5icPfc9Yx+v/PGLLylAY/xMdPccU:K19nTxg5nPfyPv/+L2/8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809188, "uuid": "9ae6f4c3-0dcc-467e-8cb1-2efccd3bcda7", "value": 4686336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809188, "uuid": "cc4a772c-51bf-4c03-9212-f3934b603821", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809188, "uuid": "6d1c9ba0-2b52-4e0b-b8f1-28703b2521cb", "value": "f1993c4d3e41f557c7a17ea98df999aa369ec9571279bd3b515898d2171dd28a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e67aad5-196a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807872, "uuid": "d50416ea-161c-42f3-a49a-23d11248acaf", "comment": "Malware payload", "value": "8938cfd687153c59cd8d6e034ab708e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807872, "uuid": "bf4ce10d-87f6-40ed-9e02-937623e05e03", "comment": "Malware payload", "value": "f1dfe0fe83ce0afe4128352c8cc2afae511c65db867840ea373e5b08fdf283ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807872, "uuid": "d4f31547-da04-4698-8cc1-a54b997439cd", "comment": "Malware payload", "value": "ec477d91d19026223a0ea8524047a290f569476f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807872, "uuid": "5bb51359-70e6-4766-acaa-f946cebb74eb", "comment": "Malware payload", "value": "1881e4018fc98903a6980180fa7929e44ecefa86f8ce59fc5fc0b1ba849097186e5bf3cc529756d5d1198a2173fdf8c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807872, "uuid": "efb7ce2f-3a53-4827-8cad-0867b1d8c0b5", "value": "T1EA1512905752588EE0930C74ACE277B5F7A89E613369C7C276D0B9983D3B3168F583CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807872, "uuid": "389fa98c-dade-41aa-8b06-3a0c7b1e7ec6", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807872, "uuid": "49b18801-fa17-497c-9485-6cf15dad9ea6", "value": "24576:mHO/MdQE5oX6jwa7q1Lk1WdBz6kqd43jbz1HVkMIwSqLbBYNGe:mHO/u0a++WdBGzKb0wSqp9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807872, "uuid": "4f02a262-c860-46ef-a2a4-a888b48563d1", "value": 877914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807872, "uuid": "0e4cd06e-0bda-429c-b84e-b486d18adcfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807872, "uuid": "02ebae48-82f6-4027-b27e-39d1c200e5d4", "value": "f1dfe0fe83ce0afe4128352c8cc2afae511c65db867840ea373e5b08fdf283ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e75d2bc-196a-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808087, "uuid": "5741eac7-7c43-4311-a332-bb71eb8359cf", "comment": "Malware payload (GCleaner)", "value": "dece88b0edcea21fb02af487f0bdd73f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808087, "uuid": "50407fa1-b9d4-4b72-af64-d6e17c09b869", "comment": "Malware payload (GCleaner)", "value": "f1e81821f74fc598366bdd9142f237404b7dc7b32c794d9a6d76ebc718d7a20b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808087, "uuid": "95bf878c-c130-490e-a880-be65b19f1f93", "comment": "Malware payload (GCleaner)", "value": "bed40aacf3294fda7aca06250cd5504599f77b10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808087, "uuid": "25181934-f5dc-4267-8269-f055c339a711", "comment": "Malware payload (GCleaner)", "value": "cf1cee5e27e818f20cd86a838cb6813cc9b3d4ab46301a9df4faca6dc53e779bacc99d29c7b7d279b80728bea4fd46e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808087, "uuid": "0cb335cc-0eed-45a0-811a-40f008517fd7", "value": "T13916D053BBA34162D81E22750569A29868C56D205F3CD57F6FDA79EC0EF50082CBCCBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808087, "uuid": "e292a538-9607-4ecd-8d38-9c3a4198b94a", "value": "336c69b6e8562d1c5231f219b62d7473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808087, "uuid": "7f8ae588-032e-4e7c-afc0-ea35f1c23038", "value": "98304:W9zuvmCgsW2mGqrped/O5p6Voo4DEtvVU:WBrsfYp4O5p6VobDEt9U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808087, "uuid": "953800f3-65b0-4cec-8131-b4f1e1e5b026", "value": 4240384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808087, "uuid": "f1038516-8f01-428f-b6f2-1839d488826a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808087, "uuid": "89b72e30-67c7-4811-9d55-00d1ac1e1006", "value": "f1e81821f74fc598366bdd9142f237404b7dc7b32c794d9a6d76ebc718d7a20b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3190003a-1943-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772791181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772791181, "uuid": "cc21481d-53b9-463a-8ecd-da5eb4daa4b4", "comment": "Malware payload", "value": "80d688d7e12424f72922f8697662f481", "object_relation": "md5", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sonosuiteqr-net", "colour": "#5B0FC8", "exportable": true, "hide_tag": false }, { "name": "sonosuiteqt-com", "colour": "#50A2F3", "exportable": true, "hide_tag": false }, { "name": "tronantivirus-dev", "colour": "#ED7EA8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772791181, "uuid": "5c2c611a-c677-4261-8f8b-7326313be48b", "comment": "Malware payload", "value": "f22d7463130889c207c90734d3c6ebc99ce3ebf743eb5e73ad3d0fe8285a3a1f", "object_relation": "sha256", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sonosuiteqr-net", "colour": "#5B0FC8", "exportable": true, "hide_tag": false }, { "name": "sonosuiteqt-com", "colour": "#50A2F3", "exportable": true, "hide_tag": false }, { "name": "tronantivirus-dev", "colour": "#ED7EA8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772791181, "uuid": "ba7ee44d-5e19-4040-ab80-8042ae7e74b9", "comment": "Malware payload", "value": "233145c5fdc580ee721f0d0a26e8a14961c32c46", "object_relation": "sha1", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sonosuiteqr-net", "colour": "#5B0FC8", "exportable": true, "hide_tag": false }, { "name": "sonosuiteqt-com", "colour": "#50A2F3", "exportable": true, "hide_tag": false }, { "name": "tronantivirus-dev", "colour": "#ED7EA8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772791181, "uuid": "de115e58-be10-4605-9c6b-059e87d884f9", "comment": "Malware payload", "value": "76b9e3c83c31e17e544e611b562e040c99784856cda6ea4233187c3f51077730dd5a25a858bd709b10958cb3ef60fd60", "object_relation": "sha3-384", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sonosuiteqr-net", "colour": "#5B0FC8", "exportable": true, "hide_tag": false }, { "name": "sonosuiteqt-com", "colour": "#50A2F3", "exportable": true, "hide_tag": false }, { "name": "tronantivirus-dev", "colour": "#ED7EA8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772791181, "uuid": "bab3057b-f97e-497f-9b77-eed97aa96a58", "value": "T1AE31852BC5886C3ACE4B884A4DC4D1211E8F855B830F3D90BF9C02093F9277CC9A802F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772791181, "uuid": "d0959a83-2120-418c-975f-30f20b723fcd", "value": "24:Sy2A4s9+NdmXAETsAA70da2A4Ax2Ag0qGaQH6xvu2AQ2ANn2qhLPLGJtXIwswh7Q:SlI73TsX0bA6JQcpDRwqwJ//aGbi/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772791181, "uuid": "4f86dcdf-1ca2-4c4f-8280-34f3a5703bf7", "value": 1545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772791181, "uuid": "1a33c027-1343-45a2-ab21-8f59cb9e6b32", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772791181, "uuid": "d9d10e7b-c480-43d5-baf5-1778fa1e5ee3", "value": "f22d7463130889c207c90734d3c6ebc99ce3ebf743eb5e73ad3d0fe8285a3a1f.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b808199b-196b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808586, "uuid": "7f2b9b75-ce2a-4636-ae6b-bce18f8f6404", "comment": "Malware payload", "value": "06c5bfcda406eb507afb74351c8105f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808586, "uuid": "4e325b40-fd7d-4730-bc2f-3f21f5ba24c2", "comment": "Malware payload", "value": "f2317508e45edccc7a7fc41be9a88f4dfaafa9b4f45dd0cb627a538586a0941c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808586, "uuid": "6a46c8ec-c981-47d1-81fb-f0e675533c7b", "comment": "Malware payload", "value": "fb46ac4432004c47692a751c84c38c5eae0b1aa5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808586, "uuid": "8e73ce1b-7270-4fc4-8c6f-d351a00650b2", "comment": "Malware payload", "value": "83b245002a65d145d0635c5b3912742fa3dbc1df5d6107cbba8191d7166e3714134b607e0dd96fe153e24bd451e47464", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808586, "uuid": "1fcfcae9-45ee-4773-b8f7-a048b0a2b7ce", "value": "T12D14E882A9017E73C1C3ABB6F79FC2553B736A1497DB3301AA59BEB02F4678D1D29101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808586, "uuid": "542722cd-26c1-4785-aaa1-44ab579f07a4", "value": "3072:pTtLjFZ69GF4UtfQPGEicr28krXIp1La69BzRyc9FvV0G6ZgZNK6Tav2Kmq+:JZTvF4EfQOEL28krs1LavcXvV0G6ZgZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808586, "uuid": "17d18787-b795-48dc-9c16-91a67b90b67d", "value": 190403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808586, "uuid": "91f1443a-0ab7-459f-90b0-2a536e1019b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808586, "uuid": "6c6e1e5c-e5b2-4c76-b7c8-b643d9349fdd", "value": "a-r.m-4.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51da3a28-196c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808844, "uuid": "6771e65f-f40d-4750-9406-11f7cf9c74eb", "comment": "Malware payload", "value": "1b13f782bdaec3beaa234f303f68fac9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808844, "uuid": "ee8ffa80-2516-44c6-856f-816cfc2507c7", "comment": "Malware payload", "value": "f2435ae7164c1600812913ac8db04c8db2cbf4075756c0e3dd514ac754ad15c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808844, "uuid": "65a4bb50-303d-4705-86f1-07c9f61e520f", "comment": "Malware payload", "value": "e6337c4345fa30f8ca6fb9925d72f242042e05cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808844, "uuid": "6aebcd68-da07-4570-8235-e31bec183b9e", "comment": "Malware payload", "value": "bc8b9f6e89fd0fdbfeb01113586b39ca58c6e81be18cd4e86264b765cbff23415dfb4d3dcd84d7197593a02d3cabd9d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808844, "uuid": "6b5472e3-c170-4e5c-8369-d5d191a74136", "value": "T1D98522142729D903D4F61FF40A72D2709BF5AF85E902D7139FF5AEEBB93A3811905282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808844, "uuid": "bb1123cb-34f1-4725-bcac-742ac28e9d0f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808844, "uuid": "c9c9485a-a1ce-465d-8aff-83a27ec83ddf", "value": "49152:6eVms6thYKKSI7fT3FkoAJcAKFvt2kSF53YIy8Qv2TTQjgt6JJesx:4thYFSyT3uoAKhvt2kec8QqEEOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808844, "uuid": "e538b805-52dd-4712-8ad3-294753073a05", "value": 1804288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808844, "uuid": "7d02c46d-2b33-4ebc-ab1b-3a0d923f0a15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808844, "uuid": "39e05970-c574-49f6-b300-f7d3392799f8", "value": "f2435ae7164c1600812913ac8db04c8db2cbf4075756c0e3dd514ac754ad15c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "503167f7-1970-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810559, "uuid": "32bcf400-4fb6-4e1e-9602-ecdb2f971b01", "comment": "Malware payload", "value": "4510308cf5f71ae30219f5320c863dc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810559, "uuid": "b98e1469-54ba-4551-9aff-b8211c67b0cc", "comment": "Malware payload", "value": "f2785ee4120447a0a7a229c14bf92e000aa852e4458db5a58eaa2df0c2864da6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810559, "uuid": "a2d57e76-d349-45ec-b317-a19070c0cdb0", "comment": "Malware payload", "value": "a6aa9de97a346ae1ce233d96eddc91bc1f779a8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810559, "uuid": "388c1ea7-2d89-4b0d-bbe3-cd0354d52e7e", "comment": "Malware payload", "value": "d2a2134e29bb3121b07664754184ba81b326e4f0bccc18347cad618475b440e145daed7c0ec52cd5ef802a10666c5d9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810559, "uuid": "fbb14466-5907-4103-bb9d-bc7ce09fd2ae", "value": "T1C694F616E6507865F89348702DB8A25778393D362680EC0BF38E9F5A367168BB1F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810559, "uuid": "652c583e-0b9d-45a2-9b62-525eefb4bf45", "value": "76eae729dfe65ccfd123857dc3a37ea4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810559, "uuid": "f264f1a4-a029-42a1-84c7-a43214b03ea7", "value": "6144:8s/s7iBMqaJNPiNBXbeJvNkHlUOS5r5+Igrj9z53wl2fMD9cqNXqM5evnOhn+KI:8mMwXbeJvNkHlUOS5r8IwCd9c2Wc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810559, "uuid": "37277105-b2b3-4d61-b7b2-c14be8b93012", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810559, "uuid": "8982b0b1-0f03-4e2e-b611-7a535473e5e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810559, "uuid": "818086ee-f8fd-49d6-a285-788f832a03bf", "value": "f2785ee4120447a0a7a229c14bf92e000aa852e4458db5a58eaa2df0c2864da6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61d80484-196a-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772808012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808012, "uuid": "b3acf4d5-7c29-43c5-9adf-cc024f93453e", "comment": "Malware payload (Formbook)", "value": "8285b953d86b3246b4d1d6a993c179c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808012, "uuid": "6ce5cd3b-f4e1-4bea-9d15-f6e2deda1c4a", "comment": "Malware payload (Formbook)", "value": "f2aa9c2e871d2106e99630dad238a98c585ebe92ca131fa15b64711b285683ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808012, "uuid": "082d56d4-696e-4fb8-84f5-6fa389ec5844", "comment": "Malware payload (Formbook)", "value": "3539c5978ef4aaddddacb583de66ef9072ba60b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808012, "uuid": "45b27f44-5dec-42e6-8afb-9875f76b0745", "comment": "Malware payload (Formbook)", "value": "06e597f7f101c1db3b74adef6257d2388c77c09b651a0bdb41b0938932d98a82db0d17f0dc29c4d2dc2e91d3c41a1383", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808012, "uuid": "7ce572ea-dec6-4129-aca1-f02c0160aee8", "value": "T18855CF0273D1D062FFAB92334F5AF6215ABC79260123A61F13981D7ABD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808012, "uuid": "dbd62077-8a70-4d56-b5fc-1c423691568e", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808012, "uuid": "156dc782-f57b-4bd7-b9fe-fd13243b304b", "value": "24576:m5EmXFtKaL4/oFe5T9yyXYfP1ijXdaU+v5juCOtfhhSun:mPVt/LZeJbInQRaU+v5juCOXE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808012, "uuid": "8170a4f3-eae8-446a-b648-f64edba73e25", "value": 1284608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808012, "uuid": "a737c22e-050c-4adf-9152-67491c56313d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808012, "uuid": "feaa127e-eb62-4fa7-b480-2a182531edf8", "value": "f2aa9c2e871d2106e99630dad238a98c585ebe92ca131fa15b64711b285683ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9adf859f-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810255, "uuid": "999f33f0-2fea-4ca2-87b6-1bfdc06fd9c0", "comment": "Malware payload (GCleaner)", "value": "951f7fbf7ad8e6dd82831deaf0435e19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810255, "uuid": "53a605a2-ab16-4b32-ab4e-6dec38fdf603", "comment": "Malware payload (GCleaner)", "value": "f2f05af1caf9b59907997afaee86be065943ce499c202eea2c2e882cc0a87c15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810255, "uuid": "9bf7b5b4-004f-4a45-9045-5c31e1b067c2", "comment": "Malware payload (GCleaner)", "value": "41a52cfb9efbc95f2b5d71b86fa9e8ad8d30efdb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810255, "uuid": "6f3f5e5e-d3b4-49ad-9292-977e95e1bc08", "comment": "Malware payload (GCleaner)", "value": "589f9720b94eac6068e80a1f044cbe0fd75b5ee37d99e3695a8312962462cae2c3899842da9f3cbd83b63ad2347001fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810255, "uuid": "aed97171-2900-4bae-8381-a6260176b13e", "value": "T1C815AE32A2E14437D12B2A796FDB7F5C9935BE18292B58862BE83DC84F3534237151E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810255, "uuid": "727d6f46-c5e0-4db6-b710-713552f641c6", "value": "fe4280c06246cc873fe89746dadec91e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810255, "uuid": "b5bd0097-b7f1-4ec6-9aee-7f0529a61369", "value": "24576:zlluEBpPj6o4CPbE9taCb5IWntlskGWUFL:zlwa1V30tl1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810255, "uuid": "b2755237-dbc7-4f53-8ae2-dc888ae62761", "value": 917504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810255, "uuid": "627d3b59-e5f3-4e4a-ab60-b7676a420a2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810255, "uuid": "41d26585-30e6-44d5-bb5d-95aa103bc0bd", "value": "f2f05af1caf9b59907997afaee86be065943ce499c202eea2c2e882cc0a87c15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5015ab1d-192d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772781783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781783, "uuid": "9d2bd873-af6d-4516-bc4a-0e65b7a7510d", "comment": "Malware payload", "value": "204cd2f9c4e4d6e699f34586e60ffb76", "object_relation": "md5", "Tag": [ { "name": "api-devx-help", "colour": "#8AD189", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781783, "uuid": "b90dde99-f729-41c7-9625-5c43f96b5ce2", "comment": "Malware payload", "value": "f305e85d0220e2d97e91c052873b530504b98fcdcda6bda6db5dddd30677fe61", "object_relation": "sha256", "Tag": [ { "name": "api-devx-help", "colour": "#8AD189", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781783, "uuid": "4895debb-8e39-47b2-81ac-d2b3eed0c699", "comment": "Malware payload", "value": "a198fd24bb07806e84c5c7eac4df1102988e83db", "object_relation": "sha1", "Tag": [ { "name": "api-devx-help", "colour": "#8AD189", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781783, "uuid": "4078683b-2a87-4742-a27f-136f864441a3", "comment": "Malware payload", "value": "de98ad71cc8c8178741a90440515ac5938158ae53023cdb09168e8656b36489117271f964c6ddc2795dcd732edf1cd51", "object_relation": "sha3-384", "Tag": [ { "name": "api-devx-help", "colour": "#8AD189", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772781783, "uuid": "4f7c45b7-7d5b-4e19-b6db-bd0bf6ae0129", "value": "T1DE183312B7E4C07AF0BB173295F1A7140A7A7FD95E34E20B7309924E4D75A80DA39B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772781783, "uuid": "df6d40f8-6be2-4278-8a4d-b92be3f22350", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772781783, "uuid": "f44096df-e47b-42f0-b20b-1064c1105814", "value": "1572864:++e4h7TL9BHfVLLSIDLwCXiaBcSrufGanp7GgtcQ3AsERCqTC:Pe4N9PPwCyaBcSruZkUEVe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772781783, "uuid": "9fe09b83-ef0a-437c-aeb4-a04148cb4813", "value": 88748820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772781783, "uuid": "1ef36203-4681-49d3-ae62-65db1850b46d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772781783, "uuid": "3f7ead72-a998-405d-9b48-97981cd0c5df", "value": "f305e85d0220e2d97e91c052873b530504b98fcdcda6bda6db5dddd30677fe61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda4925b-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810850, "uuid": "a9adbfde-b41a-4eb7-9118-8959794da46f", "comment": "Malware payload (GCleaner)", "value": "0ef0273f52376866aa046d82f30b4733", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810850, "uuid": "4cc87849-b565-4b26-b0f0-bccedae3ae91", "comment": "Malware payload (GCleaner)", "value": "f32036ccf5ca8ecf1f70207f398fc3d01fffe6fcdd217d3fedb43923119d8044", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810850, "uuid": "280bc906-d633-403e-acfb-037d24d84104", "comment": "Malware payload (GCleaner)", "value": "1af94a771f0135486572549a7c7619e8edbf36a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810850, "uuid": "0c4cd0be-3f04-43e1-97c3-bf8744c44159", "comment": "Malware payload (GCleaner)", "value": "3cc4e7f5403168b5868a09279b40bf1d8773d99f6bc2efd4fa9ccc74c1966df038b5120b94781ab40c5c0316a2b9a9b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810850, "uuid": "3b1fa979-6391-4ebe-a3c8-9998e0522201", "value": "T14E15AF26F2918432E1635EF8CC1B56968C35FE813A29584A2BED2FCC9FF974134D5293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810850, "uuid": "a6310d47-4f8e-4c34-b6b3-f7c512cd27f8", "value": "ce7a1d07b14b49824555865592c3af45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810850, "uuid": "a2454f78-73af-4f0a-8349-d44438be9174", "value": "12288:WkAJdZJGY+5K/Lo9r7WTB+rPLzYNoFbrUnczFcPEI:EXZJeK0Z0IzzblOP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810850, "uuid": "5475e8f8-0e13-4a0f-b05d-473966d0a8c4", "value": 910336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810850, "uuid": "4a3c8fb3-7536-43ee-a465-2a8aed6c7813", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810850, "uuid": "e07eeb2f-d3e9-4b00-a4c5-791e76e26c3d", "value": "f32036ccf5ca8ecf1f70207f398fc3d01fffe6fcdd217d3fedb43923119d8044", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fe3b870-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1772808814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808814, "uuid": "cbd61e07-97af-492f-ba32-7b3685b7abf2", "comment": "Malware payload (GuLoader)", "value": "3f8359b0927d42743f0c3ead43c0a312", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808814, "uuid": "340bebcc-7e95-4eb0-82d7-6a811f582645", "comment": "Malware payload (GuLoader)", "value": "f338f5aaa23e689ec4e10108c0dd257346435204b07d1a64b34d6b615c22dc50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808814, "uuid": "d58df1c2-a2a5-4590-8d55-c341dd4e40a1", "comment": "Malware payload (GuLoader)", "value": "f2abc6b943c024d4edf465766f9c3a5f668c2441", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808814, "uuid": "3e826db6-9fef-4036-a593-77d427b62572", "comment": "Malware payload (GuLoader)", "value": "50666611cd376ebc872eda2ea93f6107fdee857c88bd6153d3366ccb65951f16a72b9aff98bbacccfe2e5ad163eb8623", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808814, "uuid": "0c699b74-9c50-4fa9-8c93-83a8160667c5", "value": "T1234412E6B161C873E6360F301EB747B63AE7CD122589974333513F5E3E2374A962A261", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808814, "uuid": "178d74fa-93a0-40f0-9ca3-5a79b174b027", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808814, "uuid": "9e3d3444-c197-4ff0-9c95-2ea7b1c9d06a", "value": "6144:kcBvWb0xvqR7SyzdOnILVkjhjtVeGTpOsUNaCtcGiDFRre:tO0xiR7SYwIRk1XeGOV0CtcBF9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808814, "uuid": "ea89e801-0dab-44eb-8bb6-56cb07c432a7", "value": 261612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808814, "uuid": "6afe1364-ce9d-4b91-a410-cb78f689351d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808814, "uuid": "e28741d0-04c1-4f6c-a632-138a8831ec7c", "value": "f338f5aaa23e689ec4e10108c0dd257346435204b07d1a64b34d6b615c22dc50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f11a2d58-1969-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1772807823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807823, "uuid": "f1a9d0f3-b24a-4ace-833c-d556113e3eb0", "comment": "Malware payload (DarkTortilla)", "value": "1292f35799d31c9509a20365130197b1", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807823, "uuid": "6b7b6e76-66b7-4888-9ec7-8d9306838f6f", "comment": "Malware payload (DarkTortilla)", "value": "f34e81d573034fef98a4a952b348a581d5d3ad1d95aeeea8131804378df437eb", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807823, "uuid": "381845c1-2c0a-4b6b-af58-8ae9c395de3d", "comment": "Malware payload (DarkTortilla)", "value": "8ff2efcb6b64c8c7f930a25be2db4ec267d5a2a8", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807823, "uuid": "3743dfeb-e777-4584-b222-b559a515532e", "comment": "Malware payload (DarkTortilla)", "value": "f33b4c8531d63ac8c056d6c19e9631f54d468366a0f35b0dde56db22dac34a2e785b384588b4d4cd5ad8c7f719068b87", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807823, "uuid": "9fa57199-477e-42fc-831b-8cd75ec55f01", "value": "T12785F11327C44E68E9BC57BA846950D153FFBB46AB32DB0DB90A10DB0D22B52DF44B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807823, "uuid": "d8fd3c1e-98ff-4cf6-9319-ce5c8080d6d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807823, "uuid": "ea1fcb3f-0af3-464c-b215-25e71bfc27b9", "value": "24576:5ifZNC8ZHKJCX0fI8mVS7kKIcsjU6UsHMdrE6Jv3oqriYg1Ai4JWH/4As:yZWWgI8mcgvjxUsHcJv3K/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807823, "uuid": "c523ca3f-fa5f-4f47-9dc8-27bf5cdc1bc1", "value": 1860096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807823, "uuid": "9b0532b1-d4fb-4dde-b832-b5b5b84c4d86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807823, "uuid": "ec36ccfd-fd91-47f1-8058-e81cb2966b22", "value": "f34e81d573034fef98a4a952b348a581d5d3ad1d95aeeea8131804378df437eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3271a5a1-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772811368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811368, "uuid": "c6864079-06ae-4302-9ce4-e97ff46622ed", "comment": "Malware payload (Formbook)", "value": "9c5bf99ac63b6e5b3ec8380ab7fc06df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811368, "uuid": "45d7fa68-8489-4631-99a6-407b27919f4c", "comment": "Malware payload (Formbook)", "value": "f36217e5911e064caf8bb59cf1aca91b8d88ebfbd475d5c5cc1cd88798a45e1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811368, "uuid": "1d11b217-1ae6-4d8b-9fc4-2207226f12d9", "comment": "Malware payload (Formbook)", "value": "612925ca836ca42712d2f844ce420dc56ef707ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811368, "uuid": "57b0bebf-b919-4e20-b877-8087ffe21195", "comment": "Malware payload (Formbook)", "value": "96bbcdff31358ffed09237eba5bc60acc8d275378e4d2b004de3e83ce2af21ccf0a5da47272a012b57504320dc167328", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811368, "uuid": "1a778624-7770-4fd3-9938-1a3c8e61ce17", "value": "T10145BF027391C062FFAB92334B56F6115BBC79260123EA2F13981D79BE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811368, "uuid": "146f5b3d-8b81-4624-9a7a-07d8cce2839f", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811368, "uuid": "fc2b6db3-6b34-4381-bdd6-624a2dcb9791", "value": "24576:J5EmXFtKaL4/oFe5T9yyXYfP1ijXdaQgimsuChqaDZ0rWK6:JPVt/LZeJbInQRaQ5mTi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811368, "uuid": "d0b9569e-7860-4d7e-8b03-1a3c69659e7b", "value": 1273856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811368, "uuid": "3f75cd27-8b15-4c14-91c3-dcb9f0edf679", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811368, "uuid": "2be1836c-02de-4222-8e1c-f61eb7f1b5d7", "value": "f36217e5911e064caf8bb59cf1aca91b8d88ebfbd475d5c5cc1cd88798a45e1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b777921e-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1772810733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810733, "uuid": "ca72974e-096e-441b-ad59-7e4269fe0c94", "comment": "Malware payload (GuLoader)", "value": "f53b81f31570e400280e94145e2df101", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810733, "uuid": "936e0fe5-add3-4af8-93f1-3bae686f9898", "comment": "Malware payload (GuLoader)", "value": "f3a1a67e646cfa12e62e273c6e57fe66367fccbfea538a02aa2c66f4669e24ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810733, "uuid": "ee7a045c-09f0-4902-a6de-d7a19c92ae25", "comment": "Malware payload (GuLoader)", "value": "6fb0354a24c1c97873ed96a465cf9bcd1b4f5dea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810733, "uuid": "07ff89e6-eede-465b-a5be-a7381d7fde74", "comment": "Malware payload (GuLoader)", "value": "9e90c60d7fa233daa1cc20d1707fa77ff2f4f25db637ce729430520452504e1b5e45abcefbf47e3c6aabd0fb0a0087da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810733, "uuid": "c44419c0-604a-41c0-a2e1-01dc6dfa7c8b", "value": "T1A22533010A94D872F1C883727F682DF3B89BCC3457C56743EB8CBD95F8B5E86584AA42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810733, "uuid": "fbec0b7a-ab3c-44c8-97d3-3ddbc94a1015", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810733, "uuid": "6e2999c4-88c0-4ed2-9a58-ed76be01e5c6", "value": "24576:uzznAorYwFOpayBbKNktCWlI2cZYuNrAFP+o8Okrp57asDF4cYe3O:ubAyAVPCWq26NMmoRQpha8F4Ne3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810733, "uuid": "271c1ef7-2deb-4d2c-9e1a-26dc5cbd0d21", "value": 1032272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810733, "uuid": "e7de1c5a-8668-404b-bb48-29bcd044522c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810733, "uuid": "cc1965b9-c0d9-4ea1-a5f1-290af277a906", "value": "f3a1a67e646cfa12e62e273c6e57fe66367fccbfea538a02aa2c66f4669e24ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b422ac0d-196b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808579, "uuid": "88f8cf05-7d65-4d06-a573-a5c391d8ad0e", "comment": "Malware payload", "value": "6dc6b0579075da6a120d58486fc323d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808579, "uuid": "b64400c6-0fe5-42c4-8777-2064965f78bc", "comment": "Malware payload", "value": "f40531f4e9c16e7108e8d7fb163dcdcca40fa1ed2713dcaf5349fed277f777b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808579, "uuid": "02e19277-4a30-4c08-ab03-f20248754334", "comment": "Malware payload", "value": "6509e853c694e4290f356778161e5a523d152dbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808579, "uuid": "a55832cb-2053-47c7-9c82-68890d437407", "comment": "Malware payload", "value": "138e699a838ac9f48dba619bc40134ff845c46c080ba8fe897df5e258469146b6348f87a86d3bf3f8ecaf5deafb902af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808579, "uuid": "764e4b2a-02c4-4a9d-9804-05a4e8af657e", "value": "T10C94E716E66070A9F89348703D79A256692D3D3A2640EC0BFB8D9F5A3770993B0F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808579, "uuid": "e958c5e5-8438-4564-8b28-e1353cd53729", "value": "e3c091d09f71e07baea79686d8762715", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808579, "uuid": "d57bf550-70af-4116-b766-59661f4b871b", "value": "6144:CB6PKBCyEvFJMZLDV/aeubcAqSWgMkQCgaSsrmKaVKvF3KfBuRv3ia:cU/FM5/aeubcAqSWgjpSsrLyfmf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808579, "uuid": "05b46ba4-0455-4120-8fea-0992a04e491c", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808579, "uuid": "155d6e12-a93e-42a9-9de3-b1d5b8cfd246", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808579, "uuid": "8e5a21db-8de6-4635-b684-2748e3152208", "value": "f40531f4e9c16e7108e8d7fb163dcdcca40fa1ed2713dcaf5349fed277f777b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8de53b0a-1942-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772790906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772790906, "uuid": "39842ffd-927e-4683-a2f9-e429229ff98a", "comment": "Malware payload (RemcosRAT)", "value": "85bb51e9603e218f4623cdcc04a32a64", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772790906, "uuid": "e61982b2-e996-4add-b6ce-119286ec6002", "comment": "Malware payload (RemcosRAT)", "value": "f42a7201a6f9d1a0bb2b5e4467690d63aea67ed968feb87fee30d6de46a3dead", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772790906, "uuid": "db8c4cef-0a69-4cc2-bcb4-d7562dfdd47c", "comment": "Malware payload (RemcosRAT)", "value": "5d37394208da4074a41e29b3d36bbecd46e2f9d9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772790906, "uuid": "06e77c9e-626e-4b59-a176-fc7930ab70d7", "comment": "Malware payload (RemcosRAT)", "value": "b8268b3ab9d10c4b7ffb0d7c2e75e523884c1ddcfbfa8d6b94138909b94a711aaf92b8b70976ef34f9a07171852148d2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772790906, "uuid": "ec7c0812-9366-4e23-9d5a-ea8c79370cc8", "value": "T118E59E44A9C47ED973482906137E2A5FB2F06E9D5F43B21A1B17FA0A193BE50037F9D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772790906, "uuid": "3ecc2d23-1861-47e8-a276-96d33e6f57ae", "value": "24576:NudrF0yO4bBt8MyqZAm/YTFwpR233iwW44OtQh+dSxXPC6kVHTQ/kKz7/2nE0Noa:AOi3S1vR0ivYrKtZvCw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772790906, "uuid": "b92de110-f3c6-40b0-bee3-e510c92cf6e2", "value": 3121486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772790906, "uuid": "189360e5-bac5-47a6-8111-20273927a6a2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772790906, "uuid": "c87a10ea-6d04-497a-8a66-86d82545fc6b", "value": "ProofOfPayment.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "105a150c-1961-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772804010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772804010, "uuid": "f54ba66e-8544-4928-b8bf-42cae7ea6b6b", "comment": "Malware payload", "value": "8dc6fd1ff57da48891d9b56ef5ac984c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772804010, "uuid": "2ca9ffea-558d-4236-9202-662a3d41dbb6", "comment": "Malware payload", "value": "f484e632d64cc6559b74441219b92c6d11266b176abc728eb424607e62fd4038", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772804010, "uuid": "2badb31d-ad64-46af-8cb4-0accecb8150f", "comment": "Malware payload", "value": "f1ef422ee8744bef502626238b33466c181afcf4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772804010, "uuid": "ea37fc1c-63c2-4085-a687-186127fe94d0", "comment": "Malware payload", "value": "03b0dd8155fc9dff8a82bec1c2d360fca054fd1e6dea9c633fdf61373debd42f7115701b8aa25fefa5ae2159536bab47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772804010, "uuid": "b1e1297e-e82a-4a65-b368-90e9e06832a2", "value": "T1C1C35C1775D180FDC8DAC1B49FEAE226EA33B42D5138B21E27C86A671F4DE205F5D620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772804010, "uuid": "91be1a8c-d8ed-491d-879e-cd210ad68bc8", "value": "1536:UHAFmGO0Ng7K+9CIiqDG11Bs0+Ndm1/lAqK3dtNI/xSeabK3Y:UgFmSmviqS1Bs0+Nd6lAqktNMxSNbmY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772804010, "uuid": "db968f0c-b23f-424b-bb2e-1dc59eb4b7ea", "value": 123464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772804010, "uuid": "74b6ba4a-1c26-4c6a-a00c-8db06ebc50d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772804010, "uuid": "43438fbb-dd5a-4a1a-9ced-5fb5417bab99", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c905db0-195a-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772801077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801077, "uuid": "65ac64ce-1994-4f3d-8349-00729180c919", "comment": "Malware payload (NetSupport)", "value": "d3891dfd91db31a8115ab6f1f493c2e8", "object_relation": "md5", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "nayellowillusions-com", "colour": "#9294F5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "squidswithknives-com", "colour": "#64CC67", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801077, "uuid": "ff0ff424-849e-4d1c-9430-b140871ea8c7", "comment": "Malware payload (NetSupport)", "value": "f4989b4262700d7796e199b88a33ca18cbb47dd30a24d64511c94c86e918a2f6", "object_relation": "sha256", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "nayellowillusions-com", "colour": "#9294F5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "squidswithknives-com", "colour": "#64CC67", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801077, "uuid": "11954419-d119-4f7f-ba53-fc5d5cdb71d8", "comment": "Malware payload (NetSupport)", "value": "9ff381eea7f83d63f30c478336ec8c292f5e5b64", "object_relation": "sha1", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "nayellowillusions-com", "colour": "#9294F5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "squidswithknives-com", "colour": "#64CC67", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801077, "uuid": "a8e2e628-9891-4624-8644-06d55ee8ab32", "comment": "Malware payload (NetSupport)", "value": "370de9e3045e013d9b78f630e025b2686fece6f21854e822ef607e882a3b5e3b497c30a709490ed3d3e7c9403ac8dbfe", "object_relation": "sha3-384", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "nayellowillusions-com", "colour": "#9294F5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "squidswithknives-com", "colour": "#64CC67", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801077, "uuid": "92438931-f0ca-44f4-a32d-0487355fbfdb", "value": "T118D533C32705D6E7C36B2EB3628C2BA7911A3E81DD334BB7863188BC75F9D4A1950B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801077, "uuid": "a48d6ef6-af75-4cf7-84e0-97033a78fa68", "value": "49152:SUsEgn3F7Pt8x7RCc47HYrp7oT67Vdsyhrj3D/ebPMsUFlykEXiYKHflCvvC:SQg32tCHSQ6Psyhrv2b0sUrkDINgC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772801077, "uuid": "c11c35fe-06f5-4d0b-a76a-d7fb0acbf230", "value": 2904274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772801077, "uuid": "ad1e3fc3-4d37-4ae6-ab28-02aca05530a3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801077, "uuid": "1f75ac6f-86d3-42b6-9924-75a48f302ba8", "value": "at.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b0db24c-196a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808054, "uuid": "fdbee9a4-1c79-4161-8a71-45c3036d4192", "comment": "Malware payload", "value": "603681c427618e1e4620e555eae2e667", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808054, "uuid": "76e9c7fc-bbc6-4a51-a7ba-716a1f7d63a7", "comment": "Malware payload", "value": "f498a7a8f462712adb4ce6f4c7c1132e05a4cc09386eee44a122d54b0379ecf5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808054, "uuid": "d8e885c8-a404-4f31-8d38-2b3e846b2969", "comment": "Malware payload", "value": "0fa2023e21cedac56c949ebcc11a47c725cfe1c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808054, "uuid": "1a225ea4-95e8-4139-b7e7-a978188d4194", "comment": "Malware payload", "value": "2086f826d1a5a87b6ffd01d9a7c509a57405fd3114fd9074cb851d615f1e4d6b4844fc4e2a3965c805c709f967d34c73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808054, "uuid": "90f32697-f873-4bc9-b434-a162c16be8ef", "value": "T1B094E522EB50B4A5F49345702D79A246782D3D392680EC4BB78E9F4A3771A93B1F431F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808054, "uuid": "71d06638-0cfd-4aa4-b19e-645f47b29902", "value": "5c58c458322beca017d462dc521a3b93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808054, "uuid": "29eff0db-1329-496f-af82-2e64e796007d", "value": "12288:Rhk30YEpJ18Qbk1pn4rj7JZMV6YEtYaCic:030ppDvw8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808054, "uuid": "88791d95-975d-4ca3-9fa4-21463b5a99dc", "value": 409600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808054, "uuid": "d09b7364-f92e-47d7-9d6d-5a0b83bbc326", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808054, "uuid": "414d892e-ea21-4a87-9657-d2a43edb6ffc", "value": "f498a7a8f462712adb4ce6f4c7c1132e05a4cc09386eee44a122d54b0379ecf5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cef2e12b-1985-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772819791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819791, "uuid": "37b84b20-06a3-43d1-82e4-14183f1d4b38", "comment": "Malware payload", "value": "7d010a082b9ce26d22d5e290481b149b", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819791, "uuid": "b67e6af8-0812-490c-814f-f18cc514eb19", "comment": "Malware payload", "value": "f59fc31bf08083dcb75f94935ef3810371fcd76c15828fd41dbe1240bfd9952b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819791, "uuid": "03b6b7bc-51a2-43f5-950e-5fa26482f84c", "comment": "Malware payload", "value": "07e660d25103ff64b2288f9659f056c1d252d698", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819791, "uuid": "9c2b32dc-2cd9-44a8-9ac5-f9e9e682a86f", "comment": "Malware payload", "value": "8a04e3d2e6fbbc057e34edba9fec0c74cafe76c4ba7ec9b24e8caa74534a78409e4bc729eac2d036001a95b4c65bd8c1", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819791, "uuid": "9cb0588e-3e85-4738-808a-85a7fac88ce0", "value": "T1ECA5331729A5C800DBD55B66035877AE6F110CFF2CD79B2461CFE38ABCD2489A90C9CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819791, "uuid": "99984728-6289-4ebd-a8b8-ea8f166378ee", "value": "49152:M5N3vjwibaelulCWejasGZMOSWQwAysBqmVeDPRaXFI:ofI4926uPmFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819791, "uuid": "3f06b3c3-bacb-45a2-af81-fa49a3ca705b", "value": 2215597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819791, "uuid": "5f12c16a-279e-4ea5-9c61-7480df778772", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819791, "uuid": "9891b570-14aa-43e5-923d-1ab6880316f0", "value": "m_lock.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "706db5a9-1985-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819633, "uuid": "1e1316dd-05c3-44ae-9e3c-b3b997b131a3", "comment": "Malware payload (Mirai)", "value": "e1d54242748ef7b18563388bc802d9f4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819633, "uuid": "ab4f3563-5234-4eb1-94e5-47737cb2426b", "comment": "Malware payload (Mirai)", "value": "f6f9bbab0f6788a1c1cf8eb51427a8221db6c97cb4154a6b198569d3d8dc4857", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819633, "uuid": "edccb81a-efb1-4879-93d5-fd7b85953ba6", "comment": "Malware payload (Mirai)", "value": "a882da77d5d208e6db6c68804d2aa41a1f8f38b3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819633, "uuid": "e9af3f44-9080-486d-89e7-6a49791bbde4", "comment": "Malware payload (Mirai)", "value": "84e3125793e181907736fd40b85e120bffbbcf4bf402d21e0757f83352cd1f22e511d512100be64f6bbdd0eacbc0dc62", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819633, "uuid": "e5b65d74-982e-4518-af04-209a6558e3d2", "value": "T1CB310ACBB39206712DE29D2B76E58C84B184E0966DC0AF25E5DC78E9894DF08BC49F53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819633, "uuid": "68a53e2f-8d08-4fc4-95d1-051add5ced63", "value": "24:IGRROSpIOSNFwoOSZpOSkOSbsGOSOOSbeOSnOStU9Ol:BrRGRNlRZpRkRoGRORSRnR2e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819633, "uuid": "a1938b09-98f9-4ee7-a581-a0354a7efcb3", "value": 1778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819633, "uuid": "d93f080c-ce6e-404a-80bb-9472316898fb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819633, "uuid": "56de73e1-dbb4-47c4-ab5c-351b1483163a", "value": "yarn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8227e2e6-1984-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772819233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819233, "uuid": "2b350193-d181-4620-8830-0b19ae8feb24", "comment": "Malware payload", "value": "fce57ba0b7d3afb030a6fc608c54362e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819233, "uuid": "75a3df35-5286-49ae-bca2-53d080021661", "comment": "Malware payload", "value": "f72221fb2f867e6fbd1220ea71ec49e597485021e01a9570b9da8dce59092e35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819233, "uuid": "02f84f53-589b-4220-8799-b9e21cd06d1a", "comment": "Malware payload", "value": "d423b1acc061355dabb11529d75d5ce2c11c77ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819233, "uuid": "f0866cf0-0d62-41b3-ae54-42e2dfdc2b09", "comment": "Malware payload", "value": "fc851c5e465200d457f641bbc33438b8cda6f7cfc3dbb28c4abfd3be9505f308a4089bd33dd1cf9739dec64dd1f6cc17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819233, "uuid": "3cc30d62-ed47-4714-8d98-a4d9eac4d3c3", "value": "T1A8A6394BE8A545E5C0AAD675CA66D212BE717C884B3163D32F90F7242F37BD0AE79700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819233, "uuid": "73bba6ac-f8fe-469a-bd50-2cb34fbbb5b1", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819233, "uuid": "aeebf645-e430-41dd-93e9-9a2e7b99fe37", "value": "98304:m2V9HLDFYjwfGQAoHdArSzdhXw0VZc2Pt+f/KYBiCc0/5E:maDWjwfpQW5ZnwfBBiT0i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819233, "uuid": "38e0fe68-c156-4aaf-a3a8-b7b7e783c8fb", "value": 10279936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819233, "uuid": "fa5c20af-02c8-40bf-9424-85e8aff1b73b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819233, "uuid": "dd42e626-a6c5-4523-b009-5c9f7d23d6ae", "value": "SecuriteInfo.com.FileRepMalware.51444381", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc51ef77-196c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809023, "uuid": "9d77f951-d597-4b03-923a-3940e86aaec7", "comment": "Malware payload", "value": "373505b5eebca72c8cdc70697ef438d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809023, "uuid": "eaead7a8-754c-4c70-8612-b70392e77265", "comment": "Malware payload", "value": "f7278de146714fe6f7eda96c380542b340c4d67e9962848ecd6162eadc33f0b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809023, "uuid": "5267cf48-df99-4c5e-b197-f39ffcc44472", "comment": "Malware payload", "value": "0455c8db84d21c01790e1fa3dedb80787bd588a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809023, "uuid": "7b8c4712-3ddc-4693-bfd5-ac908c1b71e6", "comment": "Malware payload", "value": "4087133a7aa016e78dfee82a9517fa7cd5ca283d4b972d9550c1e05bb4ce1b42615938e458b5bc278dc35250d38517eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809023, "uuid": "0d704618-344d-41d1-b7e4-f5e619443322", "value": "T121F4BE4527E84A58F5FE9F39297464144BF9BC63DA3AD71C2A5844AD0C72F40EA22F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809023, "uuid": "27f4e9f9-3c36-4d1d-ba11-2009dd38cf17", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809023, "uuid": "839a88d8-13b7-4489-8617-cdf985132392", "value": "12288:+XdY0SyKMt5eZHZGszIMjy1j89CFnLT/N0HPNI0iAxxrKXBxoo1C7KJJYK8q:L1HWhpLT/4PPH7caoc7Iqq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809023, "uuid": "21ef1176-8f5d-468f-ac30-b771a25b0f2c", "value": 766976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809023, "uuid": "166f75b9-4c06-4b02-81a2-932fd6d03544", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809023, "uuid": "22605cd8-053e-446f-ab40-18878d9b658a", "value": "f7278de146714fe6f7eda96c380542b340c4d67e9962848ecd6162eadc33f0b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a3ab4e7-1955-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772798845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798845, "uuid": "0f9027f4-852b-4ef5-bf95-f4d6c19ed978", "comment": "Malware payload", "value": "d18308105e0c7b694601062389bbd51f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798845, "uuid": "b67bd1bd-ae08-481a-91ea-f612bcb6223d", "comment": "Malware payload", "value": "f73a26ef7a01f7fc6fa61e3b38e656b755f913d66734d2484a4a8550b834d561", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798845, "uuid": "be3a4d8f-f80e-46d7-b874-73dd4f9d12dd", "comment": "Malware payload", "value": "201ac9e4fd36450f07ebb132df30d36911d2f516", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798845, "uuid": "fdc87379-d517-4705-a570-d8bbb8d0b513", "comment": "Malware payload", "value": "c1bc2d2bc70ef2f0028ec3769a9cd14b02a27a949d393bbc98aaeba4e3eb1bb28dad5ee0744401ff387f7c8f392f0c15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798845, "uuid": "5a0080f0-c751-42da-8976-17db8786c2fa", "value": "T176D42BBDAC60E376F60CD0BAE286D3538F2139011236AAA319BD97241245473DB577FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798845, "uuid": "df6906ab-e3a4-430d-8947-a2e16d9eb400", "value": "e6a9ea00f059c8f148d2aaa9d51e3613", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798845, "uuid": "43d6da5f-a0bd-4910-bb53-f660e265cf34", "value": "12288:CEyurkSSu5EkPm8b7k4ao/CXjp4JgtU8F6CmSYw2g:CETrk5u5EkPb7jgjp4JS36UYw2g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772798845, "uuid": "ff9e254e-8c1f-4553-9b81-efbf39a86d3a", "value": 629760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772798845, "uuid": "607343ad-3239-4145-b294-d298c4e04f5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798845, "uuid": "d40f6b58-404d-445a-8557-466f039a5b5f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ab52213-196a-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1772807866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807866, "uuid": "f268e9e0-12f4-4040-9d44-646f41c59c8b", "comment": "Malware payload (MassLogger)", "value": "39dc94416d628122eaa07b97cb959036", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807866, "uuid": "2743a76e-0c3b-493b-8b72-c299df7f50fb", "comment": "Malware payload (MassLogger)", "value": "f793d57a82f5ddbae9f1555b500d3e4d7129adc070d8e69ee5dc45b3be054e97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807866, "uuid": "ad5f7b25-f8c4-40f5-b44d-d9feb8007657", "comment": "Malware payload (MassLogger)", "value": "ab6f826fb5e440e918cc4f914b2a470b3efd4c4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807866, "uuid": "ecc40ce2-42e1-4e17-87d4-40bf74f36b4a", "comment": "Malware payload (MassLogger)", "value": "213eb5ae971ffa5b98d555936df74548ec6fe43ebd78036ec54fe347f918bb00f14689574caa20994a50f5a64392fa61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807866, "uuid": "a7df95dc-0926-4c55-a60b-cb51f262381b", "value": "T1A6151220236DCE12C5D91BFE6470E33517F69D5AB023C31A9EDAADEB79667C14888313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807866, "uuid": "448e8e2a-4ed2-4faa-8052-5f1bbe7f9eab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807866, "uuid": "3587c01c-99ca-4334-a0ab-8bb0f3320933", "value": "24576:uzHcguQJ9T0SPWEnAEytcaYykYVB2KQddetzVictCw:uzHxua5PpAcaJkYVB/lzQcH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807866, "uuid": "ec7b2092-fd11-4a45-ac5c-e7ef8e839399", "value": 925184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807866, "uuid": "1ee522ff-5cc4-4957-a86b-c7276e20b7b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807866, "uuid": "b7f7bdbe-3d0b-47a8-bfb4-77b1d6f55645", "value": "f793d57a82f5ddbae9f1555b500d3e4d7129adc070d8e69ee5dc45b3be054e97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7888264e-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819217, "uuid": "8d6e74d8-278c-4d26-9ee7-79238b1208a1", "comment": "Malware payload (Mirai)", "value": "c0e04219a903baf87ca6d473a92a2fa5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819217, "uuid": "0c1d9a7e-4949-48b4-b8b9-aa7bf108b2d1", "comment": "Malware payload (Mirai)", "value": "f7b01fb0eb308b0a2da28a89e5d327c29173b2671b4db1bde1423c0b5dd4ee71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819217, "uuid": "a5415b94-e943-4efa-82b9-a625af5f7104", "comment": "Malware payload (Mirai)", "value": "2d7f82757effcb8b5e3af43c0cd29a6a4b383b26", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819217, "uuid": "58ef101b-f343-46ae-be27-201c9b81d4b9", "comment": "Malware payload (Mirai)", "value": "d20d58c14987746107a277d2b4eb8861ec07429247162692eb5ce53093d958d90017f3933a98f773f2da451929c904cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819217, "uuid": "b46050fc-598f-47a7-8ce9-bc810612e9e6", "value": "T19DD34A2234791F2BC4E4A8BE22F74365F1F217C925A8C90E7EB20D4FEF216506547AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819217, "uuid": "7e6db166-79ab-4d26-951a-4e22aed94c6b", "value": "3072:jGGuDAG/Go3wOmFNajLXePLU305QjDFnlsmvI4ht:7+AG/dg3NafQQLnmq1ht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819217, "uuid": "9a23437c-4a22-4ed4-a100-f3a27d8fce70", "value": 142336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819217, "uuid": "2861f30f-31da-4ea6-b35b-90ea3d7dcd54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819217, "uuid": "0de78f67-ac67-4f5f-8604-4babd5891f99", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ada2c839-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1772808998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808998, "uuid": "2d361b0d-00cf-48d3-a69b-30989bd2f5e4", "comment": "Malware payload (DarkTortilla)", "value": "0b8b643f4421e3126370261baa4fd013", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808998, "uuid": "9cfca96a-c5ed-4cd4-9d37-5ceb2e04282d", "comment": "Malware payload (DarkTortilla)", "value": "f8583fe7094e3147b963e2199551bf4d9c1544d0f863f2fa63d4f16facc4c525", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808998, "uuid": "0d247543-b05b-476a-8af6-79b25df29abb", "comment": "Malware payload (DarkTortilla)", "value": "dd04f5de6d6c2aaafc03d9d0f4009ce839258a7b", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808998, "uuid": "1bfa3600-a2b9-47c3-a753-2cffd9c5a345", "comment": "Malware payload (DarkTortilla)", "value": "a7769c8288fd75520215f30818f888564174652d4d705947a182c3dafc979b6c55546200a87467deb951ddd628608b04", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808998, "uuid": "56eb0ad3-56d1-4011-83f8-8b06fdf5c458", "value": "T1F795010127E80A58F5BE5F381878745567F9BC67AA3AD72C2A5841ED0C72F50EA21F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808998, "uuid": "80981ca0-3455-410c-9b17-5d50c62a7c5c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808998, "uuid": "816bc205-c7c9-411a-aea7-838f22c8b0b7", "value": "24576:iThpLT/4PPH7caoc7c+//eu9BrV7qIt4E+q9La9lW:ivLzswao1o/VVmIho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808998, "uuid": "1f8d3daf-4003-406c-a66f-b67be25be58f", "value": 1909248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808998, "uuid": "f6ebaa5b-abb3-4e11-9fc3-b6e6548dab5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808998, "uuid": "d895ebd6-768b-46c5-979a-86bc9134c5f8", "value": "f8583fe7094e3147b963e2199551bf4d9c1544d0f863f2fa63d4f16facc4c525", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b83d03ac-192a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772780669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772780669, "uuid": "10eb5982-360f-4048-a5ad-c19996b339e1", "comment": "Malware payload", "value": "90ae629daac427d1a45f0da70da361d2", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772780669, "uuid": "c18f3d8d-89a6-42e7-b073-e064df8e0fa7", "comment": "Malware payload", "value": "f8789608f1e00dd5696dda2a29e5fca75cc3b386dd9b180895c8324088ac2305", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772780669, "uuid": "ca376332-5530-461c-9f56-04a4a99b21ef", "comment": "Malware payload", "value": "3acfcde567bd7cd7090bb73713272ece15913bcb", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772780669, "uuid": "87b00c31-66a1-491e-a4a8-cf63b4e9880e", "comment": "Malware payload", "value": "0fd1a85a89b3cd9fea4529fa886950828525bd516199558c1bc05ef785d4e4ea5ffdcc2bd67585e81f86450b030d7446", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772780669, "uuid": "89d82167-7e12-46b5-b33b-4e0620f4603e", "value": "T1E1083393AF4635E4E8CD73FAE6E540F5E6C28DD214396CA32E234875F2A4E5E2C184D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772780669, "uuid": "bd0467e8-f3ee-4fd9-9f5c-f818d611e9ab", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772780669, "uuid": "9c028977-e9b7-48dd-a8fd-9a1f97c5e0d2", "value": "1572864:A4gPXMoGOhGpaPyR/pk/PmJz6NGiVfZW8xS8Zyjfg8QixPfYldO1dX1lr7:A4AcpOApag/pkmJz6YiVfgVmybgDoP4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772780669, "uuid": "097384ec-db50-418a-9059-6b21313e688e", "value": 78115175, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772780669, "uuid": "b020416c-3502-4acc-8f72-7517bb7f8101", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772780669, "uuid": "9c4a1c08-1c40-4b01-b953-56e5e0f45f09", "value": "f8789608f1e00dd5696dda2a29e5fca75cc3b386dd9b180895c8324088ac2305", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d93a752-1958-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772800166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772800166, "uuid": "c261ebe5-3e3e-444f-a830-8470bdaefe23", "comment": "Malware payload", "value": "f10240b9388654c119df28021b8d45b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772800166, "uuid": "6999e180-49e2-4018-8da0-4c47372b9018", "comment": "Malware payload", "value": "f91a3bb4e97697f22386b845aa4f6eac8e5d3b65fde00e898270d58c5f6a5564", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772800166, "uuid": "ec45da18-c65b-4912-bea6-204299eb2d50", "comment": "Malware payload", "value": "e5ba70eac24b59bde3da54abb8d0159e756bdbe0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772800166, "uuid": "f77089fd-76af-4cdc-8d7c-2c57f2174893", "comment": "Malware payload", "value": "177b6baf34ac0e5d66e9f0b11b5f8cec6bd714948739819e23f79b850125a2879cec2dae2d83f856d1bd867187e19d0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772800166, "uuid": "e25ff3cf-1fa4-4466-9623-ace3d89372c3", "value": "T194F47D57EA8011E8C079C17E8B529727E7B1BC0616A0F65F2BD05B161F33B58AF2EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772800166, "uuid": "74c2cf8b-fa06-4187-8788-0cf42e7b7c2f", "value": "67fce0b72ecd026f47fce47bed0d9515", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772800166, "uuid": "6f3a1726-e4b8-41ed-a68d-8a7f9657b04a", "value": "12288:PV6naIDKGXG1+cPrl92Yhtsj/tj08Cb3eQFaBrPdMafgNcrCxfM5o07bup:onHGGXG1zTHfhSjrCjtarLoNDE5omi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772800166, "uuid": "24473ebb-8a0f-4247-8430-9f3e418b0f20", "value": 737792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772800166, "uuid": "b73da50e-08dc-4464-bd4b-eb15c12934d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772800166, "uuid": "c5684a7a-8338-4ee5-a020-51c6fc2749a6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d893a1c-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810608, "uuid": "726fe6e5-e849-4434-aa26-c58e7cc45712", "comment": "Malware payload (GCleaner)", "value": "2ab713d3fd233af5817532a0cc7bc5a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810608, "uuid": "67eaea49-75c4-46a6-bd98-cf4457b5b9b1", "comment": "Malware payload (GCleaner)", "value": "f93a3df698869d6cc627fa3d5161995118612b33ba92dcdb013638dab0f92774", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810608, "uuid": "acba593d-fa86-41cf-a8a3-23b0b7ef3dd1", "comment": "Malware payload (GCleaner)", "value": "a34d51e61207bb9bf3b3d6bd763105a45ccaceb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810608, "uuid": "46109e0e-ed0b-4f28-b98c-1ad70f5277b9", "comment": "Malware payload (GCleaner)", "value": "4238ee85a3af55591d5688f6c31ed6b0e9af415f7aa3f8877d7759be17c6d96e93540545e80214e1e22069562c9b4053", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810608, "uuid": "4f1cb945-128a-4be4-a511-44f1d634a727", "value": "T102159E2EE2B19437E1E31B3CBD5B526C5829BD013D29684AFBE85DCC5F39341742A293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810608, "uuid": "e19e33f3-9884-4e63-9968-575f5f748773", "value": "5343399a39928268750ade4858cbd1d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810608, "uuid": "d5507ebb-7922-407d-969a-6afcd72379ea", "value": "12288:c2d0/V6Chk61Wd0Mv6jE/h/9kcfRy5xC4jcqrmJ0YS:h6N31WB6YJWcX4I0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810608, "uuid": "99b27757-b22d-4f52-acee-ae50270e103e", "value": 933376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810608, "uuid": "7c10758c-97b1-4f0f-95ec-cfac0def8b5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810608, "uuid": "014801be-c432-4f8a-98f8-74db5905857c", "value": "f93a3df698869d6cc627fa3d5161995118612b33ba92dcdb013638dab0f92774", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dfec980-1974-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772812220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812220, "uuid": "281e5271-a70e-458e-a616-038fe548467c", "comment": "Malware payload (Mirai)", "value": "f150424f91b2f2b73a10610c069c3424", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812220, "uuid": "2773be4e-9dcb-402e-b2fd-b40c714c9bec", "comment": "Malware payload (Mirai)", "value": "f98026a7081ac332dac91822baca49491f7fb87c5fa649ef3f54ecfc55c34c78", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812220, "uuid": "201d9ee7-7669-4ee8-aa2d-60866a5345c2", "comment": "Malware payload (Mirai)", "value": "065f5c3cb9ff4ce9449621fe70760c319cb111a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812220, "uuid": "f4a3639f-bd30-4e89-99f3-48f969f5a417", "comment": "Malware payload (Mirai)", "value": "deaef3dffb5e0c028af3df15b16cca6f652db3a9a88c9803c1d75b2913719321f8fe311c44f4e0a3a0360fc1b5a32cc7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812220, "uuid": "61d24423-681d-4313-a2ed-87a38f1e2f34", "value": "T1B6E33A06B71C0947D1632EF4363B17E193EF9E8131E4F640256FBA8A91B1E321646EDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812220, "uuid": "e66b3673-9cbb-4b07-b065-37f235fb8a49", "value": "1536:eFskQLQQVKV4RLUzk2qPTYxSWUFN5fy5Xt3eXIbxaJZo7kKEJg9RRAdAWfC+nB88:0skQLdYCaz3q0x+VySXIbgk8nHsWP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772812220, "uuid": "f3d708a1-2efe-4954-a319-75d8d3ec4e10", "value": 145604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772812220, "uuid": "bfbecdc9-a7c8-4e7f-8e23-079d059a8554", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812220, "uuid": "e5f8cc37-d891-4cf4-b699-f94ff79ed8b0", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b214ee1-199e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772830254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772830254, "uuid": "cc733865-aebc-44c1-adcb-31d4ecbceece", "comment": "Malware payload (Mirai)", "value": "6de423acee8448c2c4d2a957e1fec89d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772830254, "uuid": "4afe944c-0c46-47f4-85cd-1d5ac5c60fd5", "comment": "Malware payload (Mirai)", "value": "f995aeb621b7b8df35484e81c54de0c6792a598f8c656b4ff338fec438b64232", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772830254, "uuid": "b3b31899-792b-4b02-907c-3bfe52a3b762", "comment": "Malware payload (Mirai)", "value": "9eb47559e13ba4f768e17e9f913725ef754d1331", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772830254, "uuid": "4a35637c-444d-494b-b4bb-a221cc3fe9fb", "comment": "Malware payload (Mirai)", "value": "46fae847fa1020861c7f6284565f99da913dac2f1c75119465f9c34ec4ac589c855d56a4c15e5a6881a53995dc91950d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772830254, "uuid": "081be133-cf6c-4445-89f3-d56ee0a2fc76", "value": "T121E32A34D4104B2BC2D213FAA69E825E3F321F97939733115734BAB41FE279E1E69924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772830254, "uuid": "6dfcb708-2f7d-4deb-bac4-22167d859c1a", "value": "3072:A942CJmadzppbMD4epyyKP598IGzMeRkmhxQwK8SwNu:OFadzp2yyKPAkmhxQwK8SwNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772830254, "uuid": "13422931-c2b3-40e1-8614-2d1dc27bb23a", "value": 144133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772830254, "uuid": "857cb95f-7899-4568-bbe9-87accbae5163", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772830254, "uuid": "188bdd49-7789-41aa-af27-5e0a2aa275df", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c9ce697-1970-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810553, "uuid": "f8772b67-58c6-41d6-818a-970dd76f6340", "comment": "Malware payload", "value": "4662e5124c69a2ae19b2548e984f6a54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810553, "uuid": "5f9b9031-bee7-4d2e-8078-96bd183a90df", "comment": "Malware payload", "value": "f9d44956f5150e8bf070d97721fb509dd3eadd2d33bca7db96feab2d33150071", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810553, "uuid": "f48ce35e-ad5f-4c3d-b285-aac1a16f239e", "comment": "Malware payload", "value": "3b5b3bb8aa5539cc05dbc6f0595c1463f5fa604b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810553, "uuid": "f5b24f8f-4adb-43a0-b89a-da8e26c2cb43", "comment": "Malware payload", "value": "a7db3657435407f07f17dc722fa95ace25796c255248e63b401ac47966c9dea54cbb33e5eeb881794a3a26a600525402", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810553, "uuid": "7f665ef7-ceb8-404a-ab02-2b93bb608163", "value": "T1D345338A3B70BE27D693207EEE75D5C92B32D89900B0B70B725034267D56D87D51B22F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810553, "uuid": "15fcd637-4048-44a8-af81-b4f361715f5e", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810553, "uuid": "742bf689-5e64-49fb-b147-e1be883a1a9e", "value": "24576:x9YXm8MuFY2aZVfGmPyti6/KXvezY6HuxfCIeTmYAs9oLN7BwCArAWA4+uMs:Om8hlwGmaM6/We0quxfW6wonwCAE3cMs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810553, "uuid": "c499403e-3638-4d5a-94dd-ffcb917318d8", "value": 1269528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810553, "uuid": "d53771b7-3584-4bb8-a97d-c81eeff4b590", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810553, "uuid": "897919fb-5aa1-42bb-832f-b5eecf6b898c", "value": "f9d44956f5150e8bf070d97721fb509dd3eadd2d33bca7db96feab2d33150071", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3d0a36f-1969-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772807720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807720, "uuid": "10ae86e6-e5bf-4805-a23b-343390de9f71", "comment": "Malware payload (AgentTesla)", "value": "c290257e8d2f6202ac4717a53195997c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807720, "uuid": "d302a6a9-5a31-4bc8-94a4-88bcd6ea354e", "comment": "Malware payload (AgentTesla)", "value": "f9ec4a38ce7cfeabf581dab7d37cc517d87d43d517c5ded00b333889241beccf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807720, "uuid": "e3ed45ce-3007-4c93-8614-5e8598cb5d7a", "comment": "Malware payload (AgentTesla)", "value": "4bed7b726d2b24f764ac4ce1c0b365fa17a71fbb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807720, "uuid": "7d63e3d1-9ff0-4906-a0d4-4c2405e35d37", "comment": "Malware payload (AgentTesla)", "value": "333770bb0bdbecf6ed1b9446bee5bb4d548a50e9ccbf3b301ff756761f5eb0c6ed1778f9e511586868d89f0db0070699", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807720, "uuid": "6e40a45e-6949-47b2-85f4-43a496162625", "value": "T1DB35AE027391C062FFAB91334B56F6115BBD79260123E62F13981DBABE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807720, "uuid": "ec49341d-1849-42d6-b37a-9307fcde82ce", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807720, "uuid": "6d444da4-1554-40c9-8b5c-c8e63c1c650b", "value": "24576:O5EmXFtKaL4/oFe5T9yyXYfP1ijXdax6WgSzLL+CGRz:OPVt/LZeJbInQRax6Wzv/G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807720, "uuid": "20b25bc6-5c7d-4457-bdfc-da4b77a4a516", "value": 1107456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807720, "uuid": "60e9b8dc-fae6-4f45-85cd-3709e4f8c141", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807720, "uuid": "d9585641-6428-4b57-be6f-0b4e8450a775", "value": "f9ec4a38ce7cfeabf581dab7d37cc517d87d43d517c5ded00b333889241beccf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bc3f3fb-196d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809398, "uuid": "e3e5e3c0-ee50-402a-a578-79c473f595d3", "comment": "Malware payload", "value": "51279edd2261417f50469a2db9536b24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809398, "uuid": "4dd251aa-b642-45db-937e-22705aa6b2f8", "comment": "Malware payload", "value": "fa1bc10dbe11c9ee2696323fa786112d1039f5ded98e3732d824494558b4ebf4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809398, "uuid": "44a94ac7-c014-4c61-b816-e1a4e7c3976c", "comment": "Malware payload", "value": "2160d440694b5e8479ae0d65f97ed6f21cfc030f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809398, "uuid": "19a33bf0-f778-4895-a1d1-a55c13d5a03d", "comment": "Malware payload", "value": "235c8dbdc8f20b0dcb55e7bb9682434d1e3b837f016030544e94a56424c416e0d3e28acfff51a3ac1ec82bdcf1361bde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809398, "uuid": "8aba779b-c008-47e6-a8c5-0500145606a1", "value": "T103C4AFA1F715DAEBD5A70ABA8CBBC43035676C1E8992111E316DB22825F335211DFE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809398, "uuid": "48caaa06-fde0-4ff2-9659-30800d6b6c50", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809398, "uuid": "8b993438-8ae3-4575-a8dd-75ebf5a8fad8", "value": "6144:owq3NpQ3wDIywUF5ykHERIe6Mzm0Rh4Na4CcM/LwV8BOxz/Tio6T09LktKUnTv:ozcae6ImGh4Na/xLA8BgDTio6A0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809398, "uuid": "69b0d3f1-bf0b-45a3-acf0-3862de3bf7c5", "value": 589240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809398, "uuid": "901ed234-5823-4fa2-ab33-7f5da2ffda57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809398, "uuid": "280b0782-5fdf-4f97-bca4-a37ef98c119e", "value": "fa1bc10dbe11c9ee2696323fa786112d1039f5ded98e3732d824494558b4ebf4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4690faa2-1934-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772784773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772784773, "uuid": "5be03516-c960-4ab9-abfb-a5c4e800d42d", "comment": "Malware payload", "value": "f772d47312a7d993e67b985a3adbb86b", "object_relation": "md5", "Tag": [ { "name": "app-64-7zp-dll", "colour": "#80A805", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772784773, "uuid": "a7450e53-6514-47f4-bccd-f40e5792125f", "comment": "Malware payload", "value": "fa46fd2e46e3fe57b053e767e3b68dc1b1b2f253f9bc07af59658175250f905b", "object_relation": "sha256", "Tag": [ { "name": "app-64-7zp-dll", "colour": "#80A805", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772784773, "uuid": "838f1f76-5ad4-4e27-be1b-9e728c65bbf8", "comment": "Malware payload", "value": "872a812abe57397953eb7a98dbbe1cffc58b7106", "object_relation": "sha1", "Tag": [ { "name": "app-64-7zp-dll", "colour": "#80A805", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772784773, "uuid": "38214081-7e2a-4f41-bab1-1e141ed2ac20", "comment": "Malware payload", "value": "d9e343739f2fc0c10edcd45f11cd91050e28db218f5145c904c0a8d485e6c1a6b442a61cf682c5099f011e5e5804fb89", "object_relation": "sha3-384", "Tag": [ { "name": "app-64-7zp-dll", "colour": "#80A805", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772784773, "uuid": "f3c8d575-4f5a-4651-a049-4524b4b18fc2", "value": "T19E183322B7E5C57AF0BB073194F1A7550ABA7FD51A34E60F3348924E0D75A80DA38B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772784773, "uuid": "56d96a09-1d38-4d5f-8ba7-554a67226ca3", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772784773, "uuid": "2add6afd-e87c-46e2-a8a2-e46ba6072062", "value": "1572864:p+e4h7TL9BH6PLLuJvBpMLwCXmaBcSrufGanp7GgtcQ3AsERgqWZ:Ae4Nq3uJvBpowCWaBcSruZkUELM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772784773, "uuid": "f146647a-9d53-46ca-93f3-d1a4c155bc3e", "value": 88555525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772784773, "uuid": "e47e03ed-40fe-48c4-94a5-d563b8d8f8d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772784773, "uuid": "6e9a0952-e3a7-4ab3-bb9d-a0f6595cdd91", "value": "fa46fd2e46e3fe57b053e767e3b68dc1b1b2f253f9bc07af59658175250f905b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94cf7673-1969-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772807668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807668, "uuid": "5f34805a-6b61-4ef3-8ad4-70463d346145", "comment": "Malware payload (GCleaner)", "value": "03bc6435dd0e105fc9d7a46a487381b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807668, "uuid": "1ebff5e4-865a-4426-bb33-f9d000317900", "comment": "Malware payload (GCleaner)", "value": "fabaa28f352d69edb367ceda2e37b1a19b51e8cf51be3c1ec8a09758fb9ec6dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807668, "uuid": "45b6666b-adf6-4085-abeb-2a895d0906ec", "comment": "Malware payload (GCleaner)", "value": "53280baefd311a43257f311127aebaf95e475120", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807668, "uuid": "a1bce2a8-578c-4bc8-bdac-35159a32da48", "comment": "Malware payload (GCleaner)", "value": "e9a4320d110ffdeb2d2f291f5fb557f07a14e75b32376772dcb0581ab1dfaef782fa894eb604303159449ec4ed5c9e66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807668, "uuid": "436b2b1b-1e78-4516-a492-3a4a5dbb6611", "value": "T13D26DFE5D3820A36D42919FB1D1ABFEB5A035F0B18D4E9D520EC8DCABA2C734385CD56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807668, "uuid": "7b8523bf-ff73-4ca7-9d7a-aebe69552f85", "value": "66d4174db3b382b1ff6e32a72864c0fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807668, "uuid": "a85d766a-e03f-4886-9e4e-e8935f0e0052", "value": "98304:U5rui+au9KthBSEX/dVywg/gfmtXzTHb:UbCw6m4X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807668, "uuid": "4afc3e83-0a19-47a7-ad0e-c1c58cf5bfb5", "value": 4610048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807668, "uuid": "92a86c49-2571-4b5f-a0d3-87df1bbedf13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807668, "uuid": "1f874eff-173f-481b-8d0b-b63471939ac3", "value": "fabaa28f352d69edb367ceda2e37b1a19b51e8cf51be3c1ec8a09758fb9ec6dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d6a51f5-1935-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772785241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772785241, "uuid": "63741907-022e-4d53-9584-563ef7c86525", "comment": "Malware payload (Formbook)", "value": "93647df4922735f2605d9d5fcde97e28", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772785241, "uuid": "c6f99ebc-09e8-4c81-83df-da7fe7b39af4", "comment": "Malware payload (Formbook)", "value": "fae2176a66e0f6842f1adb67e0ebd7bc0dc5c3ddfd4bd5657a596b6fa7dd6538", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772785241, "uuid": "3ad2ddde-436d-4b6a-8bc6-5ee51084e122", "comment": "Malware payload (Formbook)", "value": "ef3162203cb9f8a105728c228a7ea1bf5334ee7a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772785241, "uuid": "e0cbe609-c760-44a9-87ae-471269a8b206", "comment": "Malware payload (Formbook)", "value": "f719fe306ff5a12737bb4ea5411608160f10b34e233fa1eba3e8705a664d6b1461a3e974675488e8491c5707f9d55700", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772785241, "uuid": "0aad88b7-c0f6-4afc-95e2-91fef9755985", "value": "T162733AB0CD2215BB4F87BB88FCE44661C57DC315852604B1F5CD870D920A9ECEBB96AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772785241, "uuid": "ff5d9db7-d4d5-4c76-8a2e-5fb8fa504629", "value": "1536:1njgptXuOCOI5wayhqzsVH2hHpmUB/I9BE4kxrB61EXyzH+j:1njgpLs5waNzsx2hJmWIbkxrB61EXyzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772785241, "uuid": "978367e4-641e-4a11-8cd0-74e069a4a764", "value": 79204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772785241, "uuid": "f49a3342-075a-4a01-bae5-f86399ca2ada", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772785241, "uuid": "ff9a5dbb-96f9-4d73-84e7-efaeafd03e7d", "value": "2026 els\u0151 negyed\u00e9vi k\u00f6lts\u00e9gvet\u00e9s.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fc39136-1982-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772818263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818263, "uuid": "eaaf17f7-4234-457d-b239-f65b785823a0", "comment": "Malware payload (Mirai)", "value": "ef497a6307b32abc1c506abb4dfef587", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818263, "uuid": "a004b9df-ce7e-4bbf-817f-2833fa7e039c", "comment": "Malware payload (Mirai)", "value": "fae2af91bb541a192db75cd9eba0540552386c3a77064647f6ad1c12e294d0e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818263, "uuid": "77fcb6ca-f003-46fe-b6bd-074d8ae77764", "comment": "Malware payload (Mirai)", "value": "44323d7854bfe25b031d6dd578769eb1cd0fc95e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818263, "uuid": "bff4e163-4a91-42aa-b833-944db98d2e66", "comment": "Malware payload (Mirai)", "value": "348d2cd6eb16d9623e46ebe2795b93d46f7d5d600409affa46bce83cc25410bb7e9581cc951dab34593ac4e4467d73ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818263, "uuid": "9d106501-8c14-4488-83c5-5510dca6b518", "value": "T162D33A2275791E2BC4E0A87E22F74761F1F157DA25A8C90E7EB20D4FFF212206517AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818263, "uuid": "0b67fdf6-10a3-418b-848a-54ec3f43fab6", "value": "3072:nZUlV+Fawd99IVWFjKc7RgyWOFe30Hi09lshKwTh:ZUH+FD99IVWFteOgEmhPTh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772818263, "uuid": "54c40d13-39a6-4d38-b186-ef8b91a9a5f0", "value": 140776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772818263, "uuid": "40ed00ae-ddea-4e86-9404-ea1fe6258b0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818263, "uuid": "5dc2cc00-57fb-474b-961f-1959a28dcecc", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "961dde42-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811106, "uuid": "c98de328-4d6f-4810-b2bf-e014c83d7e5a", "comment": "Malware payload", "value": "2fa2561a94cdd3cd0fef23abac044b87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811106, "uuid": "0b83ef1a-0668-4f89-a075-a37f6a42713e", "comment": "Malware payload", "value": "fb1162badb68c0f21846eb626c881373010e650a6bea2232cc549d823013f534", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811106, "uuid": "d0f230d0-d8ee-4b9e-99f5-d6acbf287f85", "comment": "Malware payload", "value": "7192098be93f9571b5ffef450d22d926d488f5a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811106, "uuid": "91a004f8-aa34-46d0-82e5-3a901dfa1f68", "comment": "Malware payload", "value": "ba26e4e7b66997c78c343ef6c0cfef0119f68e52dc5db1efc07e2f0164ff5bbacf20db36a3b04b1621fbc735775186dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811106, "uuid": "be70180e-9611-4ec2-b3ac-1a093bc33578", "value": "T147B423053BE08843D5BACEB216B399332B798AD215608F077F619B4C7FB3752A69D314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811106, "uuid": "427b664a-0f45-4f43-96c3-becf9d0d2018", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811106, "uuid": "ac106b20-5652-43f8-bb81-9350b2c585e6", "value": "12288:I1yDJ9A1+NzYNu0dX9RRbzGOqApJARcM2wNhWnhJjfgi:I1yDJmCzYP5/Ra6JAdQnhJTgi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811106, "uuid": "83b2b9ac-2be8-4fe3-b037-c724f18acf21", "value": 541184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811106, "uuid": "dfd6de68-89df-4017-ad0f-2e73b73fcb23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811106, "uuid": "884803be-7880-4c4c-b21e-08b6c5f41f3f", "value": "fb1162badb68c0f21846eb626c881373010e650a6bea2232cc549d823013f534", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "046ace5d-1961-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772803990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772803990, "uuid": "d04a29a5-8e63-4b72-ab8f-b9026a622f8c", "comment": "Malware payload (GCleaner)", "value": "932cdcd224ee785fe8ebfa2f42611a71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772803990, "uuid": "2d90b5cf-f328-4250-9a77-1ddc2c03c3bd", "comment": "Malware payload (GCleaner)", "value": "fb4e9bc59cbf0573ab4660b37002a065c5b3af451590ee25541e2302c8dc4e60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772803990, "uuid": "1abf9182-7fb8-4c9a-9a2a-f7aa656925d6", "comment": "Malware payload (GCleaner)", "value": "664e62aab6a52733e324cd412c59e13ce4ec02d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772803990, "uuid": "2e699fc7-144f-481d-9da0-6ccc2a42a90f", "comment": "Malware payload (GCleaner)", "value": "1051f51a33cb7be6eff5887350a4e2024c358d9365e717ebc5c333471f0fc42117c195020a4eee9e347ff1e2fdf8716b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772803990, "uuid": "58e2fa3c-6ffd-4cfa-a4ca-e420049c25c0", "value": "T16826DE31A79E2739E1F2363EC8B752AF02347B432511EAC4D3AD19C55B1AE116C7A36C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772803990, "uuid": "9c184c51-f1fd-421c-8987-811000e842a0", "value": "4eeebe9c7cba6cf85504d75366422a5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772803990, "uuid": "e3e0a6ac-ff83-48b8-a062-b2e50edf732a", "value": "98304:lLJ1dEXpSkkN5pyZ1xzoMY6Xgrv+euLSBJA63stJyAhLDgG9Y+R5Nrsl1Ps0qY3i:lkpSXN561xUMYoG2SBJARtfhLDQ+R5Nv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772803990, "uuid": "8b115266-730e-4306-a65a-1693d229629f", "value": 4597760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772803990, "uuid": "e59c5159-7fc1-4551-adf3-70dd4f3204f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772803990, "uuid": "7a0553b2-71c1-471b-a686-efed0908b0c0", "value": "fb4e9bc59cbf0573ab4660b37002a065c5b3af451590ee25541e2302c8dc4e60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eab72b2-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772810449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810449, "uuid": "c557c024-b521-4993-be81-80055f9534c7", "comment": "Malware payload (Mirai)", "value": "5bb36fdbe24754522786c850047462eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810449, "uuid": "262cd096-ff49-456a-89ac-a854e6fad3e0", "comment": "Malware payload (Mirai)", "value": "fb53712105b4972dfac508c7f5e322b28591e768fd6255ab554ec7549f37f958", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810449, "uuid": "4fdf62d8-da4e-4735-a6ef-881742cd3db9", "comment": "Malware payload (Mirai)", "value": "acc807da4cd6b39ce4cc9443f90e4a43c688b5b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810449, "uuid": "82f0334a-11a8-4222-adec-ebd20d174474", "comment": "Malware payload (Mirai)", "value": "cd7c10ccba5c8ad252b507d3f80531d14d85bfdfdb7e28ecd3da597a51d5eabd5a735ee34e10823eca083a374f58accb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810449, "uuid": "9a892557-b773-4f92-9587-e548ad63c963", "value": "T170333C4DF783E0F0DD4B0571115BF77E96349E025124DE7EEB98BE62AE32A02711B618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810449, "uuid": "ebc2447f-b570-4906-a35b-aa47d5d2490b", "value": "768:VwheNR1eCZWUJ2S7pRflrFWwqTlFNB5azjYvzNeVMU2331ANA0B7RhuqDV98EN+s:VwOt37pOzwLMU431ANA0BLBCIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810449, "uuid": "71b3674c-174b-463e-8692-2255e57a79a2", "value": 50476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810449, "uuid": "dd7a179f-1942-4b4e-8c20-c9a0e640ca36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810449, "uuid": "ca2e6ce0-d35d-4b4f-9f90-508b3500e3ab", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b325fbad-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810725, "uuid": "8c0fa717-0d8a-40d6-99e1-989abc3959a4", "comment": "Malware payload (GCleaner)", "value": "9d2cf061500d73c83dcd3bdd59af3c03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810725, "uuid": "e519bbd3-5c94-43b8-b6d4-9dc40858d897", "comment": "Malware payload (GCleaner)", "value": "fbf45016a255d9860379bc02023860c98cec04834aa0881af05be285a82f4adc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810725, "uuid": "a74708c4-436b-4c04-a65b-36ad468eb143", "comment": "Malware payload (GCleaner)", "value": "d696f4212facd2a448919358f7cad8dbd6b9d19b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810725, "uuid": "cd750d58-31dc-4300-913f-a3d6191e7693", "comment": "Malware payload (GCleaner)", "value": "0f3f35c7891776e66e6a22baa71a979f4412a63a526079a34b72105f3c7871b0a823fb179085194a2c531e2ebc184ef3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810725, "uuid": "6ff0ff3b-7701-4f08-96a0-4c95be6a0b0a", "value": "T1B9F47D62A6E18C37E162DA3C9C7B965C5C197E803938F8576ED81CCD9BF93423429393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810725, "uuid": "4a57c9f9-6646-44e3-bc8c-ba53d0af2dc2", "value": "ca01ec09235c3305d2c87228ffd6db40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810725, "uuid": "e36715cf-b682-4e17-add3-c0b0278593f2", "value": "12288:/lOUK2LDqP1ft//fwykZznp1m+fE0gPzFGc0r+qtJ4qPlx37VP/O4jHlGDc:MR2A1ft//f98n/KRVYHRPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810725, "uuid": "15d0bec1-29cc-435a-b7ec-4555c448f0bc", "value": 728064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810725, "uuid": "634b8f62-dafb-4737-9e9c-f275a52d475e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810725, "uuid": "4c46e763-aed9-4f4f-8788-42cf85b595dd", "value": "fbf45016a255d9860379bc02023860c98cec04834aa0881af05be285a82f4adc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e029889-1943-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772791201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772791201, "uuid": "3fc37bdc-0660-4706-8bc8-84e34df8968e", "comment": "Malware payload", "value": "6ec976864374a18fab900eb28f413918", "object_relation": "md5", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "apixrpconformator-com", "colour": "#EE8A16", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772791201, "uuid": "a160f376-4e3d-4887-84d3-65288a2b798a", "comment": "Malware payload", "value": "fcc0ce5334947f04191bab16fe6509d71471c530f639158ff048a043d5355800", "object_relation": "sha256", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "apixrpconformator-com", "colour": "#EE8A16", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772791201, "uuid": "e99afbba-1522-4b0c-8938-36d76197694a", "comment": "Malware payload", "value": "248590b2fed5f17c873332885707ca9dbdb00a66", "object_relation": "sha1", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "apixrpconformator-com", "colour": "#EE8A16", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772791201, "uuid": "88673837-705c-4a38-ba52-1ede45f216df", "comment": "Malware payload", "value": "9c3180b16fce610b03860ec24b50610e393d2ffd18f5d389d73d758766bb75b5cf0c7fde4f1002c82d6168ce21fc75f4", "object_relation": "sha3-384", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "apixrpconformator-com", "colour": "#EE8A16", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772791201, "uuid": "52e18369-64b8-488e-a491-6d660444f1a6", "value": "T1D801BDAFE1A02435E9470DC86DC61541518F464B484F3958FBAD89450FA7F3CDAB862E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772791201, "uuid": "ccd2791c-9944-4d7b-92d4-837662db4704", "value": "24:1y2A4s9+NdgIfBtZP70da2A4Mx2Ag0qG+cTKvu2AQ2AA:1lIyXh0bM6PAKM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772791201, "uuid": "7ec0a04b-574a-455a-8bd9-3e824c57e4f9", "value": 828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772791201, "uuid": "2089b176-b2d8-4a91-b5b9-4835fc807242", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772791201, "uuid": "66b3fffa-06c9-4d96-ac5f-1f0ac61a662a", "value": "fcc0ce5334947f04191bab16fe6509d71471c530f639158ff048a043d5355800.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f619c308-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1772810408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810408, "uuid": "116b1d3c-911f-483b-9e64-5d3cb8d4c357", "comment": "Malware payload (GuLoader)", "value": "406408c4a6c3920362a7e0d4bbce0560", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810408, "uuid": "278e0922-3bbe-4556-988d-7ad42b29fac5", "comment": "Malware payload (GuLoader)", "value": "fd47d0155c7979a735fb0a377cb48198d714df851ef9d7a09f6a47349ef867da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810408, "uuid": "bec8443f-969b-4c03-b050-d7a0e01f8d09", "comment": "Malware payload (GuLoader)", "value": "4c5390bfc29fd5dbd3f722ff1059f47255b6b05c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810408, "uuid": "fa3254d1-e53f-460a-a0db-a453e88afdcb", "comment": "Malware payload (GuLoader)", "value": "b896e7fa040a901e7f205cc57d755cff077ea22043d048a7b6a50b88c2b8eaa01900881c084787a6105b7678d4a6f177", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810408, "uuid": "87a0c19a-84ef-4e62-911f-e5e9d9c6e7dc", "value": "T10FB4234A1ADC0527C8E70DB227E7148AAEB8D6371425C7033311DE4DBE636E6F94E396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810408, "uuid": "54f3d74a-cd33-416c-a861-87088af79a26", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810408, "uuid": "7c43a7b4-6426-4df6-a7de-dfce3e4aa5a2", "value": "12288:F1yDJRzRruS6pWCkGO3dqFQV50A+SfTNiNXK0Q:F1yDJRzRqdY/3H1xfTV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810408, "uuid": "5d7b7298-5181-4c77-aef6-cc973f72f515", "value": 534344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810408, "uuid": "6e05732e-b2d8-4279-a3bf-ef5b27b9d50c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810408, "uuid": "2a8c09a9-0ac7-4713-bc29-3a5e1d43ed29", "value": "fd47d0155c7979a735fb0a377cb48198d714df851ef9d7a09f6a47349ef867da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00b6ea89-197b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772815150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815150, "uuid": "176f3ab4-da3a-48b0-8c7f-5f8283fd0f43", "comment": "Malware payload (Mirai)", "value": "6b2834d0305231fcae44dce99daf8159", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815150, "uuid": "60999671-94e2-4f6f-b252-9bc09f695f60", "comment": "Malware payload (Mirai)", "value": "fd64ac296d61656e43e0d2ff8c012779b1ec8615fb63af2fa8f952d6cbad9c70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815150, "uuid": "b0dfc822-d6d4-4a21-af80-a4bab00bfa8a", "comment": "Malware payload (Mirai)", "value": "a637d6fcad8efc7e609c3707f2ebd2ef7a4c3322", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815150, "uuid": "6da3583a-4046-41fe-ac14-47f49bd9720f", "comment": "Malware payload (Mirai)", "value": "158494b0fcf0d60f96b085e398ae203a707c84ee054c9114548ca19f32720c9302714a4a0072831cb6e51a8b24dccbca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815150, "uuid": "ab498fdd-da56-4c62-b368-d62b3943e543", "value": "T1E2935B13B9C480FCC889C13087AFB536D963F17E1279B25B73D4EA167E8DE511A6E680", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815150, "uuid": "4f1ed213-1ccc-4669-b426-3ce0b0d5d453", "value": "1536:bai2ZdojAKS6eTMxMQQ+jcW4yxAw/1h1ss6fuftHnRlGJHaBs:bjTjAKeTMxhjyyx91h1ss6feHnvGQ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772815150, "uuid": "82fced42-5abd-443c-ad2c-d4dfee87c555", "value": 88928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772815150, "uuid": "8ed78f78-9421-4575-a87c-cfa972c462be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815150, "uuid": "427d9483-9292-403d-b1bc-d7981d196829", "value": "titanjr.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba4187e7-1900-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772762634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772762634, "uuid": "4e8be9ca-c2db-4156-9fe6-f6b1da49b220", "comment": "Malware payload (Mirai)", "value": "8382c75d2af1b602a9935c8fc79a178f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772762634, "uuid": "af60ef22-0f6c-40b4-b77d-ea9dda8fcf8a", "comment": "Malware payload (Mirai)", "value": "fd78729bffc56f9801c75072511c81bc29c530d05af5b614dcde352b6f1dbf5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772762634, "uuid": "0e6f4401-c5b9-4138-b65f-f1076254e94d", "comment": "Malware payload (Mirai)", "value": "b29c258b7de7c37c73264b9faefa14557693ea8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772762634, "uuid": "c425f3b9-6734-4ea8-9c4c-a650d15f0590", "comment": "Malware payload (Mirai)", "value": "9f1923260ee0ba2afc8787606b1e44785f35bb31e68f01c1f7c623af93ef0dbedd5d63fbeeb2fd9df728c013f0340f1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772762634, "uuid": "b62ba785-97cd-4fc1-8219-8ca5cf56b726", "value": "T172E33A55B8828A22C9D513BEF92D018E331327A8E2DF7213DD205F2577C7A6B0D77A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772762634, "uuid": "dfed7132-48bc-457b-8ad7-13603f6246d3", "value": "3072:8NMcOPLZDozjefDoHwreWu1gSa0lI7TEy6KuImkE:IOBozje7oHWuOSa5F6K4kE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772762634, "uuid": "173e7f03-dfa6-4156-be29-b3a39e98ab38", "value": 145552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772762634, "uuid": "78eacd45-aa43-42e0-b476-c2349183d66e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772762634, "uuid": "4344e14e-2547-4afb-8f05-ced10cd3d4b9", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdef2b8b-1954-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772798744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798744, "uuid": "e2aebf55-06ae-473f-a762-7d3d860f3da6", "comment": "Malware payload", "value": "c0b8e075f4bdec0f724b0d04da836dda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798744, "uuid": "092e3139-539c-444c-836a-1232c0dec287", "comment": "Malware payload", "value": "fd7eb1100c2c981f70c1eaa30b6f31606f8501c31473d6f55412969815f0ec87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798744, "uuid": "f7a46341-6a2b-4ee0-8f82-c834fc3c6ed1", "comment": "Malware payload", "value": "47ca11be1f1cb1692b31832e9412449748993013", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798744, "uuid": "ace81ac3-ddb7-429f-8aa8-448996da21a2", "comment": "Malware payload", "value": "ae1c1dd52ccc931ab5552ec1e58c40ddce96166bce45fbe8a28f9b1b9be68c95f5bdf6287925957d93dd5220f37a3025", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798744, "uuid": "7f433b53-a717-4f49-8244-a04e253d38eb", "value": "T121D42BBDAC60E376F60CD0BAE286D3538F2139011236AAA319BD97241245473DB577FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798744, "uuid": "725873fe-d869-4f10-b7ab-0277f6409b67", "value": "e6a9ea00f059c8f148d2aaa9d51e3613", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798744, "uuid": "27b2478a-ae90-452a-93f5-a83f43a2a2cd", "value": "12288:oEyurkSSu5EkPm8b7k4ao/CXjp4JgtU8F6CmSYw2g:oETrk5u5EkPb7jgjp4JS36UYw2g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772798744, "uuid": "f1cfbb09-f4cb-4aa7-bcfa-21a919db86d2", "value": 629760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772798744, "uuid": "acfb6825-984d-4577-b4f3-979b0edeaffe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798744, "uuid": "285a54ad-4351-4418-8285-5d3500424b3b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a124e47d-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772809836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809836, "uuid": "1b3a2229-728e-45dc-93b4-5cbd65b2505f", "comment": "Malware payload (AgentTesla)", "value": "8cae41bcddcfd17a9c6bad9a264b7cb6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809836, "uuid": "39595244-4d71-4284-b5b9-7d35af4b2614", "comment": "Malware payload (AgentTesla)", "value": "fdb5f65b86c93754b642aa54fa2628355c0bfd389bed24e435fef2d49ce6c8e4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809836, "uuid": "bef9c052-d1dc-444b-b6f1-159701ac615b", "comment": "Malware payload (AgentTesla)", "value": "9cad11deddfec33fa56f7a0c4560b2dfc16ae848", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809836, "uuid": "614f1658-e561-45a9-a0b2-09bac8bbe203", "comment": "Malware payload (AgentTesla)", "value": "fd331ca42fe922546a3105351ed3e7e742a10e226125e584e5d057d26dec773508c0a5067be9b7740fe55768c022717e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809836, "uuid": "3f53433b-53aa-4e55-9386-a4fc3067d46b", "value": "T101457C2C23710544E1FF47348F3D3E180BE269298D6BF6CAEE7305A8B5256726729B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809836, "uuid": "8f36a18e-83d6-47a1-8f0c-b2eab11b8d80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809836, "uuid": "94b55cd0-a782-451f-972e-e40c238273b9", "value": "24576:y2P4lTp3YHdCvVGEpt3HdvaHNXMMuI5qjUAw+o:pPYp3MdCvMTiUe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809836, "uuid": "9a76bdb4-a0ed-41a9-8442-1c4eb6457c6e", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809836, "uuid": "ba8c6b8e-a68e-4c5a-b2ea-4ac9c37b623c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809836, "uuid": "5a8213de-602e-4e41-8a5b-bb9733eea118", "value": "fdb5f65b86c93754b642aa54fa2628355c0bfd389bed24e435fef2d49ce6c8e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25430ef0-193e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772789012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789012, "uuid": "f014ecb4-1cb0-448c-8394-c0f0cd6fc325", "comment": "Malware payload (Mirai)", "value": "10951facebde4d50a7b2bf9afbcf0d18", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789012, "uuid": "b35edaab-5f94-4774-ad8c-2c60f0470ede", "comment": "Malware payload (Mirai)", "value": "fe2d1ab6ac6ff22c31f9111d3406f851c75dff44c93f4ae1b9ecebbe7f6c324c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789012, "uuid": "3b7d7d0a-1863-4837-b4f1-fe2b72fbeed0", "comment": "Malware payload (Mirai)", "value": "03536bfff81668265f227f399272dd81aa21ac84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789012, "uuid": "4bf2ad98-f973-4e99-9a64-ed1b0bfd2772", "comment": "Malware payload (Mirai)", "value": "713e9277c449acb42de75f25935a4aff412d7e985879b8abfc1ed301e92434bffd7de18d8cf56b705f1cd947c313038e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789012, "uuid": "17c483ac-e9eb-4cf0-9086-7e873d44f79e", "value": "T1B8043B46EB414B13C4D227BABA9F424533239B64D3EB33069918BFB43F8679E0E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789012, "uuid": "ae105bae-ccb7-4383-b959-1bc0f911cf04", "value": "3072:W+YBJIvNNC6N/yFad33L57z4S9Ll21AoEnecGvvBKFM/9wOwmhwwD/Y:WdBJIvNwCaFad33L57z4qLlFoQeFvvBs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772789012, "uuid": "d39760e4-82cd-49fc-b275-7011a86cf7fc", "value": 173447, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772789012, "uuid": "6ad8fc70-0c95-4036-8232-7f856f3c7783", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789012, "uuid": "d0e44051-9d64-436c-a7d3-85da3609e00a", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca5b77f-197a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772815144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815144, "uuid": "89d0c1e9-b7b6-4f0c-a81b-666252f7488a", "comment": "Malware payload (Mirai)", "value": "2c83476e22e78b4f30e00acbf95adaca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815144, "uuid": "8717463e-2c30-4080-966d-1d09ce5e2f23", "comment": "Malware payload (Mirai)", "value": "fe2d31d8e9db5624dd994fb7ccda1e044f6b8645ff7b4106b56f1ca1ac64dae0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815144, "uuid": "8614ed77-2110-4f1f-805f-eb484a5fce74", "comment": "Malware payload (Mirai)", "value": "ab301771870179e557ef1196d6d6e28f383647aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815144, "uuid": "1096db42-3077-4602-abdc-8b401bbb226e", "comment": "Malware payload (Mirai)", "value": "468e1b23ba18001c51c10d4f5ec264c8367f0de807147c96d6ff6ad6cfb579f489dedad242c29da198aab2ccb41c058d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815144, "uuid": "4ac0f715-073b-435f-953a-4bd5ef69242b", "value": "T171936C42B70C0B43E0575DF02A3F57E1C3AA66A120F8FA89790EDB4596B2E325547ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815144, "uuid": "512279e8-99c3-45b8-84f2-47c062367dac", "value": "1536:6hSlTzh8nutu2NMq1B+z6Xls0kyb6X6TX+jWMuo1biIiGMX0l1WrVlPfAOFEB:LKa1BHTXGWeiGMKWrDcB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772815144, "uuid": "e51f63e2-1a39-4e95-9b0c-ae716104d2e3", "value": 92048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772815144, "uuid": "611b8253-88e4-4fda-9b6d-d93d521743ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815144, "uuid": "f6a4f12d-a2c4-4826-a198-2de018c5f7b5", "value": "titanjr.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "269f084c-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772809631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809631, "uuid": "7b90cf66-f168-4c45-ac75-482d3c0e72b1", "comment": "Malware payload (GCleaner)", "value": "ea306fd26f10bf18a3c65b930d7cf9f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809631, "uuid": "a589b2bb-9515-42ca-b875-5726e1962c8c", "comment": "Malware payload (GCleaner)", "value": "fe35a4e1ec686ff695beadd8707e2939a4bdc98b4a690affdad32737ae30d899", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809631, "uuid": "7f3b3d8d-8865-4ac1-bbb1-6d135600de42", "comment": "Malware payload (GCleaner)", "value": "3f1fbf5c9516537923e4c6d7e34c5ae005fed01f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809631, "uuid": "b035781d-bea6-4400-a508-6f9e8594e5c0", "comment": "Malware payload (GCleaner)", "value": "4bec07372bb965e16870db47d536e7f9751ea40a1bfe8216d035f268200a5a3c48e52691ff1521305ad38cbb2222f89e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809631, "uuid": "f4422a82-7cd5-4b79-aa3b-3ecdb888fc4c", "value": "T18536D0095938662BEA587E3EAAC007DE2C4BF71D0A85D340D1AC49DF7FC82BB115717A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809631, "uuid": "0694c4a4-5039-467d-aad1-0dcccd3a8651", "value": "345624d13ffc2b7f296b9d2972b1c0a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809631, "uuid": "7d72cc90-dfc4-4fa2-b0b1-1c770d80aa4f", "value": "49152:DiZHJokElnGqyvDod5ri2N8Aac3csqS+e+KN1SG08NeNp9KmuRzhSzm1686Afv+E:DiZpokElnN7r3hac3PaGSCGaw+qOX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809631, "uuid": "f2004298-1497-4d87-8b2b-ecf348b0226b", "value": 5324288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809631, "uuid": "6715c42c-4d8c-4ef6-9952-f03c30f24e88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809631, "uuid": "0cb4da40-328f-4c11-a91e-03330f8c6de4", "value": "fe35a4e1ec686ff695beadd8707e2939a4bdc98b4a690affdad32737ae30d899", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "178de15f-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810894, "uuid": "87f39eb3-7d93-4a0b-a132-d09f4f702ff5", "comment": "Malware payload", "value": "3ce8b88a07f80159ae9336b29648c23c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810894, "uuid": "6e29870c-2823-468b-bd5b-8a8ec39dbd31", "comment": "Malware payload", "value": "fe4441f0eaf57e9a677872b3898e14fa3bc0121a67632cae0eeb6444de9dae23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810894, "uuid": "56aadca9-5444-45ed-a61f-005fa47c7691", "comment": "Malware payload", "value": "b2372e32317b184a81ec257a6a721fc5d7a65597", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810894, "uuid": "da15bfa0-78ed-44b3-a5f1-a09b425a9f1a", "comment": "Malware payload", "value": "ea22cee1c199767d1e90d190aa2adebcba03589e0da5506f3629165f5a058aa1b76f6e520ba59671bd89d57ead1c4ba2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810894, "uuid": "a54ae0ac-9f2f-403a-9ee1-af758fd6dde1", "value": "T1B6B423050BAAC807E44B4C7466B6595B56B8CA3B1E31FB4BB755CF6D3F23BA21099380", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810894, "uuid": "25dc3b84-0b3f-42ad-8224-1ee98c80bc21", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810894, "uuid": "1e2ad003-5025-49ac-893c-8bfe9695728f", "value": "12288:f1yDJca5qIOp/x+HPBed1jO1rLlTppDN:f1yDJcVIixWPB41jO1rRH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810894, "uuid": "1a3b50cc-dfdf-43ce-8b77-ba3044146298", "value": 531944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810894, "uuid": "c5887e12-cf06-47fd-af8d-1f305c44a676", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810894, "uuid": "28591c35-60a1-40e5-a812-9f47c99bbd15", "value": "fe4441f0eaf57e9a677872b3898e14fa3bc0121a67632cae0eeb6444de9dae23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc65e434-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1772808647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808647, "uuid": "79fb0ca4-8ef4-4a09-90e0-1e061686b67b", "comment": "Malware payload (DarkTortilla)", "value": "18096a04ae4020c262e21502799da9c4", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808647, "uuid": "cc9e628b-0faa-4c58-a6eb-9ea6b5fbab89", "comment": "Malware payload (DarkTortilla)", "value": "ff52312e72af166dae5b22396204262b127ccb031d7d4b3cc9a73f2594eea481", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808647, "uuid": "1d150752-f58b-4d14-ab2c-c39fcc2bf71a", "comment": "Malware payload (DarkTortilla)", "value": "e4f74b3959490b2ef7729d06882c676b65b0de38", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808647, "uuid": "38df2f92-5f1c-4928-9bb3-22059b5a8c7e", "comment": "Malware payload (DarkTortilla)", "value": "a5b0584c5e172fb376a1ee908ef760b3420194682b1829458102fe4cf96ea116eda9edc0620da69c69a3b18b49c2ae5a", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808647, "uuid": "11466c42-1f77-4a7f-a915-8277d8eca027", "value": "T10545D05527E84A58F4FE9F39657824140BF9BC779A3AD72C2A5841ED0C72F40EA21B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808647, "uuid": "b2b384d6-4d2f-4b74-a0ad-a0a3c7ccee20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808647, "uuid": "559b981d-977b-4e2c-84c1-4de4e8f9206d", "value": "12288:PFrgJyKMj56UGszIMjy1j89CFnLT/N0HPNI0iAxxrKXBxoo1C7q1K0XGeglq7eht:+hhpLT/4PPH7caoc7eXng07ehzudAV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808647, "uuid": "c1dd40c5-ac95-425b-a9bf-43efd69cf6e6", "value": 1188864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808647, "uuid": "0a04937b-b52d-414c-89b1-209a44823e2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808647, "uuid": "6c392e4b-7ee4-494d-932f-8cb0d375045c", "value": "ff52312e72af166dae5b22396204262b127ccb031d7d4b3cc9a73f2594eea481", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "642d2339-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772809734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809734, "uuid": "fe309f11-30bc-40e1-be60-5af7e7955749", "comment": "Malware payload (PhantomStealer)", "value": "b676a068c48606281c4811d6b709d495", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809734, "uuid": "d0fd01dc-4f34-48a6-92b4-e218ad071849", "comment": "Malware payload (PhantomStealer)", "value": "ff74b4a966ac6abc2edf65059b45f250e93bed22d4738968716ed2a8db4cc24d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809734, "uuid": "cbd9b118-17da-40f8-8150-02dc6afe1bb0", "comment": "Malware payload (PhantomStealer)", "value": "18124618ff4df66cf25c86eb01b11383de8b36ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809734, "uuid": "2889258d-4f9a-44ca-959a-22adc256212c", "comment": "Malware payload (PhantomStealer)", "value": "c86cf7622d0668b97f3e7b52a5a781991a63af2e86fa814f332bf9b7f18074aac5e66a657bee97aa80d1642096050238", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809734, "uuid": "b161bf3c-029f-4eeb-9949-c1722fe2304d", "value": "T14065231822A9DC07C0FA8BF08A61F17697B41EEC9865C2434FE9BCCB79767F02585257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809734, "uuid": "fbf21139-cca7-4ad3-ab71-a9a99265e7cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809734, "uuid": "84741305-63d8-4fe3-9612-d47869e9de0f", "value": "24576:c/ODdmqTWOMzqgqvGF2GlAffGEmi/tuYiJNGtikng7PgnWViaNb5:c/lq6O65qvyxlAWE3/ttaP5VlNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809734, "uuid": "6bdc0a41-aee4-473f-b87b-db088c6c93f3", "value": 1548288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809734, "uuid": "ae6a656e-14b7-45da-95e2-c80ba18466af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809734, "uuid": "14334f70-ad7d-403f-9df5-e37c23fc7bbf", "value": "ff74b4a966ac6abc2edf65059b45f250e93bed22d4738968716ed2a8db4cc24d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf4dcdf3-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772810316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810316, "uuid": "34673c5d-6fbc-4147-a7d8-fbec6b655107", "comment": "Malware payload (RemcosRAT)", "value": "66908c0e6c30364a2c466e21277ba855", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810316, "uuid": "f379ded0-31d6-4e54-bd10-a0bc7da937ab", "comment": "Malware payload (RemcosRAT)", "value": "ffb889f23a489fc2ea0988ad2f99e8ceb17398b1c3b0d450438dbcfa940698ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810316, "uuid": "7f6432ae-3581-4db5-83e4-4919e9929175", "comment": "Malware payload (RemcosRAT)", "value": "cbec20300f6fbd2a6c3bc94923a628c05a8facf3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810316, "uuid": "9b60ef99-510a-4981-b936-af9f7551c961", "comment": "Malware payload (RemcosRAT)", "value": "cfe8de6a672e36d7cb422f7b6967ff257200ca14c2fccf6ee44aa28b82ce6df8bd3c5f2b4f42dc3a431d767718e683aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810316, "uuid": "86a1004b-d025-4284-9d46-94ce94ffee96", "value": "T1140512542299CA03D0974FF84A24E1355BB04ECAB462D21B8FD9BCCFB97B7E05990397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810316, "uuid": "9ae59e3c-2f73-45d4-9035-0e3a77437396", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810316, "uuid": "78a521f8-74b9-46e9-8906-1be4ecfe9112", "value": "12288:oXspJ5pZ+MmAyJreSugywketQG0HTL/2zvVBE/OGfHunZat0y8NIiWeEZAIYvOpX:X/4rJRNtd0zD2X0tCIS9IUOpg6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810316, "uuid": "e39e13da-4f55-45cc-a09d-f6d24a590811", "value": 841736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810316, "uuid": "bda0bea0-5d4a-47b6-a828-3cf2f40590af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810316, "uuid": "9e51f1a1-5651-464d-9e05-09d394a7bf9a", "value": "ffb889f23a489fc2ea0988ad2f99e8ceb17398b1c3b0d450438dbcfa940698ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8dcb757-197a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772815137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815137, "uuid": "f9134d6d-3ec8-45e7-9ebf-a4e6916b8860", "comment": "Malware payload (Mirai)", "value": "120cef502371f455f89170fad1598574", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815137, "uuid": "a71fbc4d-242a-4d6e-9442-2951038bf588", "comment": "Malware payload (Mirai)", "value": "fffc0aa05ef975cbf0ce936aff9da63fc3ac05fef7f0260306011338f09d09b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815137, "uuid": "227bd5a7-fffd-4552-a0b8-d3b52e7a8d8a", "comment": "Malware payload (Mirai)", "value": "3a9eed2b024bf42061292a69e898e566fca426a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815137, "uuid": "e9dbb805-2f79-4e08-b918-e51c590600c7", "comment": "Malware payload (Mirai)", "value": "6bb57b8d50c5e0d3ba2aeb7b9f7801695f6944017963768a29cb9dbb75348f9afd0c71ee75913fe9f989e095062b7f6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815137, "uuid": "571ffe5e-c361-4fb0-8ff8-37d5d1877352", "value": "T1BC933952FD814622C6D116B7FB5E028E372713A9E2EE7203AC155F2137C795B0EBB642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815137, "uuid": "f649f553-f4f1-4cf5-bd3f-fd39b979502b", "value": "1536:rFwsDRxijJ+CVvEwEUojsAA1L9gBhZ30wK6/r1oPD7vj+ZPJ:rFwY8jJ+YWsAAFOvZ3fpYGPJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772815137, "uuid": "5a0af5d9-2aa0-4e09-b09f-57ab9edd54db", "value": 93344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772815137, "uuid": "eb340b84-3163-443a-8afd-f84afcd0139b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815137, "uuid": "f85728f5-15c6-424f-8c84-174b840482cf", "value": "titanjr.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }