{ "Event": { "published": true, "date": "2026-03-06", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-03-06", "timestamp": 1772841781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "21040572-f08c-4c6a-b3b3-6c50c3b84717", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01a4e355-1905-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772764471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764471, "uuid": "310c1f9b-9ce4-4d0a-a445-f424ea5af6fa", "comment": "Malware payload (Mirai)", "value": "124a3af41b4eb8d5b8b3f7e7701dfa49", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764471, "uuid": "06bc8c1d-29e0-4d0e-814c-acf2e013a466", "comment": "Malware payload (Mirai)", "value": "002755d98cede8bf9bb7fa3dd4665cb35aaa8ac3b7b3ad4a81befb64622cbe55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764471, "uuid": "b49dc50b-aefd-41f8-9061-d84ca254c376", "comment": "Malware payload (Mirai)", "value": "dde18a945f021c6a3357d8f31592a0951aac3613", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764471, "uuid": "3561ca42-86cc-4a08-8c46-5d018840b782", "comment": "Malware payload (Mirai)", "value": "b3053e0ec77bd328b17f3c1c2960350410068108ec1abbe998f388d70da5b7395fd279f15a1f998255fcb4d07f622a07", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772764471, "uuid": "40b4bdc2-079a-4028-a8c8-5c351d44df22", "value": "T16FB339C1BA43D4F5EC1641306177F73B9A32F0791239DA87E7A89E327C92A419D0A39D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772764471, "uuid": "f03b085e-80f8-4268-aaca-868e97dc018a", "value": "3072:PbKW4dCLFaGFBu3/45g1rcV2w4zSr9bMFfln:Pbj4doYGFB0/45gdQ9uln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772764471, "uuid": "9c6e6612-d3f5-4828-85f2-0269c8839174", "value": 107824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772764471, "uuid": "1fedc882-f59e-4b0e-b004-9ee31db41bb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772764471, "uuid": "63973fb8-e4e2-458f-a226-83f385b9c46d", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8af8544-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (DDoSAgent)", "timestamp": 1772809017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809017, "uuid": "578d557f-a47d-4f8a-a4f0-b1909069169f", "comment": "Malware payload (DDoSAgent)", "value": "c5f518f180b5178d08b77dfafe0ce340", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809017, "uuid": "b1c1c685-b8ad-4672-bad9-23a80669f987", "comment": "Malware payload (DDoSAgent)", "value": "007d03943732fab4ca97c45fe367bb043ece03fde8576bef6ce727dc4dd68980", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809017, "uuid": "da82ffce-0dbc-4be2-8313-99fa5a4d841a", "comment": "Malware payload (DDoSAgent)", "value": "2162bc554c27a4a0a781244b52b4ed1bcfde6cab", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809017, "uuid": "a5bc4fe5-8bcb-424a-9bd9-3b98058a1618", "comment": "Malware payload (DDoSAgent)", "value": "2abdc1d4576be6e876547e24d49ce4881ea7222a968189b447cf5a904aa7c83f1a917c460f0fee458d3d0d7ca345ac8e", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809017, "uuid": "6e173607-131d-4a12-b302-b23213acdf58", "value": "T155571B14AD856BF6C86D4E3490EACAA512701E1059F14B7A22E0FFACF8772757F4788C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809017, "uuid": "ee75f55e-9c87-45de-975a-47eca0935daa", "value": "196608:BSYXnhQqZ7aCNXPvcrIgoz56xeTaSI/48zH9:BSUgozUx/ZzH9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809017, "uuid": "44ec076a-ea7b-4933-84c6-6a2d260d7d58", "value": 29425879, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809017, "uuid": "8a8703df-0a9e-49a0-86c6-f00da3c8888a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809017, "uuid": "86d4c53c-6f2c-4d2c-8509-fe0175177c13", "value": "apex.mipsle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f6fb1dc-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819202, "uuid": "73d6ad39-4385-4aab-9c29-6f77d0ff8f51", "comment": "Malware payload (Mirai)", "value": "d48a6a6a486f1772e4bb79e0cc3967af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819202, "uuid": "a72b95cc-09d4-4d10-8b5f-a0b75557cdae", "comment": "Malware payload (Mirai)", "value": "00acbcb5360b8614e6109b9b75d7ff88faef746a50144bb0ab1c30b9f25d091a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819202, "uuid": "0117ae57-29dd-4613-a73d-9ccdc5dc7c03", "comment": "Malware payload (Mirai)", "value": "ffb7a27072510fce7f7ba0473d7f54ad15b6180b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819202, "uuid": "1e06e9a7-454c-4a9d-84fd-1ea02d46cefd", "comment": "Malware payload (Mirai)", "value": "1b644422e57478f621b55374e9e60885eb3fcb8876e16d0562cdcfb59f1b8aa04c252653fbdc538e48018b706102496f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819202, "uuid": "52f68657-09b4-4fc3-bb7e-29a77dbb2fc8", "value": "T1CE258D5AF2B371BDC057C030439BD7A16935F47851322D7B62C4AA353EA2E701B2AF66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819202, "uuid": "41b8396f-488a-4881-b2ea-4444e204b875", "value": "24576:3aQyxk5Ns2zQow3GLFMK47zqyc+ItU2xx:qQyYN7zQoYGLFMK2+0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819202, "uuid": "42aacf27-a126-41dd-bb95-29f58b3dd947", "value": 1032192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819202, "uuid": "5a9e390a-5f71-4f7c-8985-9ef0711d1518", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819202, "uuid": "b9e55ec7-36e5-425b-85ad-1e53f151bba2", "value": "sora.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3644dc83-196b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808368, "uuid": "d95948cc-fc0a-42e8-b568-2ca754753381", "comment": "Malware payload", "value": "936ae0a47bd03a733baf225089daf8e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808368, "uuid": "10ab10f2-1d50-4e17-8ca7-fc846d2bf5f7", "comment": "Malware payload", "value": "00dcb399c586c167e4b979b4ea1ffb1847889c1f610a3c4d02223f0aadbf92b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808368, "uuid": "aee510e3-a6de-4d9d-bdb4-97d1648413e8", "comment": "Malware payload", "value": "0cfc104c4c50ca844bd121d92b40e0e6c369d461", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808368, "uuid": "8dd3a28e-bb1b-4d1e-b279-f960d2fbc8ef", "comment": "Malware payload", "value": "154ad2a84510d3e2e372547b126be5d2a930cefa91e861676cbd8b96bd5a6a994fc9101e6a34c71b31e3dc83100850a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808368, "uuid": "12458a90-abd6-44f4-9a28-d157306d2be4", "value": "T1E646E14650F050FBF27439F8CDBBA6600C3C3E575E64886FF6C09AC59B62D426531AEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808368, "uuid": "d66f811a-2a7a-4cb2-a0f1-0359eab2639e", "value": "336c69b6e8562d1c5231f219b62d7473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808368, "uuid": "90f2cbda-d5fd-4c90-9212-ed527bb98e30", "value": "49152:r9t9ux578/tr/FgJfxoBKCfpqHTItkcecLwWq8KhQ7S3fIjRGOS+L5JV4J3BESyF:r9zuxWFxuopwRcEWq8K4S3H8Jk3BZy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808368, "uuid": "afe625e3-ab19-4362-a91c-632c3686c0f5", "value": 5419520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808368, "uuid": "714f8449-e822-4759-bb95-3043f8c762b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808368, "uuid": "5fd44de1-9007-4479-ba01-58f001b76199", "value": "00dcb399c586c167e4b979b4ea1ffb1847889c1f610a3c4d02223f0aadbf92b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95969c4d-1972-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811535, "uuid": "fd3e1337-64af-4951-becc-e671bdb9a91a", "comment": "Malware payload", "value": "e9feb497ea4fa824f3e58c5abbfd8a6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811535, "uuid": "4026eddf-7fcf-4b61-a705-10f83bb0eb15", "comment": "Malware payload", "value": "010b5a6dc4eb1014bef46f68c4aa1fcc17cc9abb0ff3613e1446cf03f4410abe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811535, "uuid": "b0a0e4fb-7af2-4c47-8a2e-59f7f978d326", "comment": "Malware payload", "value": "e76b037d9b5b76775713b1bfe352b1f4ea3fb59d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811535, "uuid": "79eb9185-e7cb-42d5-923c-f13b0c27bfab", "comment": "Malware payload", "value": "ecacb2b577945924de8255e948c7e7d64feacdb3317d0c0d5f2bac60fbd1a615bff0a9f514d8824c453a0c4cc57a23ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811535, "uuid": "b803bec2-2c7f-4af1-bd41-a847e770aea8", "value": "T10742E8017BECCA3AF1FE0FB865B2521007B6B6255821D35E2DE824DD4CE1B58C6217BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811535, "uuid": "138d9bac-e9b5-40fc-9887-5562427a54f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811535, "uuid": "30e9cdb6-75f4-4ce2-b7c8-d74bfb9f7635", "value": "192:CwdD+mQKxOflEHkeX7zdAcC32S+76RrTYX9/bi5yNBruadbP9P0QxVECfBn:CwdkflEHBVAJGgRXUFb9NBruMPvXf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811535, "uuid": "e463be03-ed0f-4f15-b62f-0d551c09b900", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811535, "uuid": "e3236fa6-7e95-4fcb-b7f9-46fcf68a66af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811535, "uuid": "71aee1f5-8cad-4579-b2a4-44ae1be2a0cf", "value": "010b5a6dc4eb1014bef46f68c4aa1fcc17cc9abb0ff3613e1446cf03f4410abe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ef20608-1982-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772818261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818261, "uuid": "d0037cd4-387c-4c1f-9d94-aaf0911fb4a9", "comment": "Malware payload (Mirai)", "value": "fd418cf0c00857ddccea1713e31256ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818261, "uuid": "4c78eb67-03c6-44e9-9512-63bfce662838", "comment": "Malware payload (Mirai)", "value": "01254fb72eba1a001cff23fe94a1d93918d8668d2f0fdc68e13473f5b150bfc1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818261, "uuid": "6c210fc5-d654-4101-b90e-2d2efb321b94", "comment": "Malware payload (Mirai)", "value": "7ba65d3948b38f9de30e6884e9a2c56539741a56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818261, "uuid": "be1b72f6-547b-412f-9046-c41d125789fe", "comment": "Malware payload (Mirai)", "value": "e1f8719a11437c4ed711f1d8d2eff67f10250d4f859d5d91e9bb042d89a2b936c67b068d44618f050b93396bd6c0c284", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818261, "uuid": "65c150aa-52ee-4d7d-84a7-838d772509b2", "value": "T10EE35D8AF4029E7DFD4FE5BE44670E09E931A39131831B2A53DBFDA3A9311990D17E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818261, "uuid": "10264ded-0cc1-4a3a-a426-c2ba385e3b69", "value": "3072:noDlIyA+oy+ZGiTgnlXkgt7ZLgLq2e9FdlJcNNg:RDy+ZG2g7l2e9rcNNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772818261, "uuid": "ce063d21-333f-468f-91d4-759dfb0c1f59", "value": 147336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772818261, "uuid": "acb920c8-61a3-455a-b79f-118eb8e74125", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818261, "uuid": "25204f36-2772-4143-a507-b8d795b3a68f", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed261b76-1971-11f1-a769-42010a9c0008", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1772811252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811252, "uuid": "fa67ce83-21e6-463c-8ce8-d10932ff80a3", "comment": "Malware payload (ScarfaceStealer)", "value": "b1e5f92206ae569dbf5190174029d395", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811252, "uuid": "7c65bb6b-85e7-4d6f-993d-1c64318f050f", "comment": "Malware payload (ScarfaceStealer)", "value": "0194d6a8297949f7fafe29ff0a1c48ad9126607c47a8516fb84dd86f4a886c75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811252, "uuid": "1280f4f6-30e7-4bcb-b631-1236ce7db72d", "comment": "Malware payload (ScarfaceStealer)", "value": "14c4c92012116819f7a2b433140a31da3d2f2b3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811252, "uuid": "d417b445-977d-423e-b1a1-2f6bb84f78d5", "comment": "Malware payload (ScarfaceStealer)", "value": "9b548f1e6ffa601f174d63e4b8b89f05ae453face2319e5cb0132477939980df1b28995de0328a251bb7d4b3465bd544", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811252, "uuid": "1d7957e8-fd0a-4518-8c94-8f214a604782", "value": "T17BF7594262EA04C4F9F7DA359AE65217D673BC166F3081CF325C172A1F736E08976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811252, "uuid": "d9543cbb-06be-4004-b7f7-d13c744cad2e", "value": "772ec87d3452991a9933a3ba0d9963a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811252, "uuid": "0a2f1dea-58f8-4311-9880-d56fd636524b", "value": "393216:dn1XQgPR2k3m5C507G9ITEc5eAlkLbQurxMWhAsIyNOPS0B4AycWsCYaxFzwW/tb:d1XR7AsxYqt2oRGj5rs3wb8/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811252, "uuid": "f05cae16-a3b6-4ebb-abf9-491f8b9d0cdb", "value": 71542272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811252, "uuid": "f2c0a54c-9998-4904-9d8c-f7e3fac295de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811252, "uuid": "7acdde0c-4832-472a-9903-244747cbaa18", "value": "0194d6a8297949f7fafe29ff0a1c48ad9126607c47a8516fb84dd86f4a886c75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2fbaf39-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1772811665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811665, "uuid": "20661dd4-3376-42ff-b762-1e5e9c38f2d8", "comment": "Malware payload (GuLoader)", "value": "4b23315f8f95d371e8f4e27deeb20333", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811665, "uuid": "e1d73150-469b-4877-9fe1-e0a11c5b4dac", "comment": "Malware payload (GuLoader)", "value": "01d7a671885ca694434ac2dc2a1612dee663decb7389a258006ff194314c0af0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811665, "uuid": "ca57b91b-7aef-46ac-94d7-289e3f0b9af3", "comment": "Malware payload (GuLoader)", "value": "bdcfc65f501e321fb390db2371170e5d687f3831", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811665, "uuid": "a90e2aa6-4ffa-4b1f-9303-0ee3d9ea2c82", "comment": "Malware payload (GuLoader)", "value": "eb65134d4c77a6bb1b0627a2ede314ff1731c97b3d85aff5b717a097bf08860085e598850fa08a1a19a731233be1d52d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811665, "uuid": "281afa04-7acc-48ce-99be-8b35ad2fc074", "value": "T197B4E191F756D9E6E8360375993A6E311763FE3A98700B0F329C726969F33A20027D47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811665, "uuid": "98831f4b-0474-40b8-82c1-3e7065efe504", "value": "5f0c714c36e6cc016b3a1f4bc86559e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811665, "uuid": "722b386c-1743-47eb-a8ee-6785be5a4485", "value": "6144:kDfe6EKGDcqpyf5TeDgdygNGiwJX1bWIxTt88pmgsmFgat/CwFz84Ken2syf7ojY:MnqpyMcdbTSd1pmcFgk1zY2F4VP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811665, "uuid": "a90155c0-7289-453b-819f-2782604cf71b", "value": 507672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811665, "uuid": "feb2c050-a816-4e3a-9a52-5e57c299db9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811665, "uuid": "9926cc2c-09db-4e53-b119-cd039583a29e", "value": "01d7a671885ca694434ac2dc2a1612dee663decb7389a258006ff194314c0af0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ab9dd22-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772810094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810094, "uuid": "8f9337bf-cf1e-40f2-a372-4c7085805aeb", "comment": "Malware payload (Formbook)", "value": "e3f941468279bb428a8ecad3f583b3e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810094, "uuid": "ccc76cc7-7274-4062-a9f4-9f894cef754f", "comment": "Malware payload (Formbook)", "value": "01f107c87c2769533bf1e5c2f31868ab298511fa195276e4606483fc087a335c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810094, "uuid": "37e4dc92-aa8b-4483-b294-75ddee4e9d0b", "comment": "Malware payload (Formbook)", "value": "6beb2e148abf6fc580741cb0acfb16b93aa6dad5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810094, "uuid": "cb8d3298-db0e-4d05-bdce-67482a664bd5", "comment": "Malware payload (Formbook)", "value": "972cbb9aa867fcac86e5d043c243c1d59e27822f990fadb5dd7e4b327ad906568cddb718da12b1876fdfbd890aa99ad3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810094, "uuid": "4dca5478-aeca-4a19-bc9f-1371496fe200", "value": "T186A4E101B65921FED29BC874C6025A52EE3278470B61BADF07904BB76F53AE89F3D701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810094, "uuid": "800f7417-5d66-4d7b-ae50-25a606f94d0b", "value": "15305bfbfba9b7bf4b30eee53c3c0d17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810094, "uuid": "cfb6b456-8557-4d44-b593-a6d1199c290d", "value": "12288:fMn6RzDHi/MZJdhX4fNzclgE4qw57/9ol9R/:fMnBUZJdB4fJqgXR1lojp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810094, "uuid": "23653670-206c-4aea-9fc5-7a7e640d3d59", "value": 489997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810094, "uuid": "39ece591-1814-4c87-9523-7024d85e1141", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810094, "uuid": "f0566f7c-6ddc-48be-bebf-ce3e583030cd", "value": "01f107c87c2769533bf1e5c2f31868ab298511fa195276e4606483fc087a335c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f072dd8-1967-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772806665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806665, "uuid": "ed64156b-5a15-4380-8852-08e3d98e8bfe", "comment": "Malware payload", "value": "30d6fc6c86ca0b45a117e104197e6cf7", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "wiosyrondaty-com", "colour": "#68F1E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806665, "uuid": "80e5e6cc-462c-49b8-9420-fc2a40fb9922", "comment": "Malware payload", "value": "020ced99e043bb97799619962dc488420ab34e406595f7323d3f2226e6d5d94c", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "wiosyrondaty-com", "colour": "#68F1E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806665, "uuid": "2ef70c38-58c6-49df-81e6-3770a1567227", "comment": "Malware payload", "value": "db5242fbfc8a977bcdf12026186aa9b4ca3f7752", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "wiosyrondaty-com", "colour": "#68F1E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806665, "uuid": "a5b638cd-e9a9-4811-a007-df1d53ddcc33", "comment": "Malware payload", "value": "5b7527d7031f4efbff88f5aa5a89ebea5b46d897f6363dfd80153a8c855dc629153b45125f2a9d736a3612803d8f2c43", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "wiosyrondaty-com", "colour": "#68F1E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806665, "uuid": "b4e25c27-4daf-463b-a8ff-1f6c6305eab4", "value": "T1FA33C7F61944C4860687571420C6FD7123D9E96B7EEC57AB02FE73CA22C098B92FB4D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806665, "uuid": "ba631b05-649e-46f8-b025-8dd4e90d6910", "value": "768:tc86PsbOWJIaTYplP5ywaRv4evenB4L3dVsHG4WiZ4w+IfbEM579aPPGLolXSwKS:tc0KWJHYpJaRvK+3Ib47X67wnCdYcu5J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772806665, "uuid": "8920c12d-a519-4b33-a55e-41f2027c009a", "value": 53766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772806665, "uuid": "5f6f4372-07f9-4578-be3a-dd3519f8410b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806665, "uuid": "fd6fda32-e68b-4ec3-8a1c-d048100faacf", "value": "020ced99e043bb97799619962dc488420ab34e406595f7323d3f2226e6d5d94c.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c9f9bb7-196d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809157, "uuid": "4fc1aa78-1e45-454d-bdca-b56f18b03379", "comment": "Malware payload", "value": "df0a6df9d876a941694272e442eb012b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809157, "uuid": "88db0cc3-1907-45f1-a524-7940fcc2b040", "comment": "Malware payload", "value": "0250aba960605a96caf7840c20b3d102353dbaff5880e1a1f039e0d298950171", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809157, "uuid": "db8e097c-df0d-430e-be91-1dce658a4dd5", "comment": "Malware payload", "value": "9b1b030a98b4cfc177f5fbb206f7aaacd2ad188c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809157, "uuid": "1fc75918-75ee-4a5e-8af7-116cbaf6154b", "comment": "Malware payload", "value": "fed7bfb0396597b25e61bfd0dc8c59ac4901088e81d4259d37713b2b1528a282bfa31f1b53e3866eef4c737796f6a313", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809157, "uuid": "20eb8eee-d809-4702-beb2-6cad5c19e78d", "value": "T17A4412233364E4A7E1B51230557B9527DFF3DB244AE44A5B3748BE3E7436382863B892", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809157, "uuid": "621bce82-8627-4a62-a973-b77a5de12996", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809157, "uuid": "4815bb38-5fdf-48b5-9a99-66ee56e3c475", "value": "6144:mcBvWb06v7/cj83Iw8vvYHEQWOc4WvXw3Ou+B7P2Ox3WNP/d4u4:DO06z/cIR8XYHEW/W+994u4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809157, "uuid": "9467dbba-e290-4cc1-b2bb-2e5c90bb22c1", "value": 277696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809157, "uuid": "8f57a1f1-0263-43a9-9cf8-56b978bb31bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809157, "uuid": "2860d19b-650b-414c-9507-0543db744c97", "value": "0250aba960605a96caf7840c20b3d102353dbaff5880e1a1f039e0d298950171", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a8d1148-196a-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808027, "uuid": "dd58afb3-e213-4fd3-aa26-aa965d613493", "comment": "Malware payload (GCleaner)", "value": "9d9fc7f29806ced13568b07b00e4c23c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808027, "uuid": "56101dfa-f062-4694-b098-040b0e0a4db4", "comment": "Malware payload (GCleaner)", "value": "02e0d5f00e3a6b85238906e35f1b5037191190ff4fd054467a496399e71b1572", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808027, "uuid": "e393717d-b71a-4af8-9347-b0c2141b6063", "comment": "Malware payload (GCleaner)", "value": "f38df4e5c0b1ab1963ec47d18e9710cc65d33ac7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808027, "uuid": "f7ac9fa9-ba85-4f32-8949-06df95329113", "comment": "Malware payload (GCleaner)", "value": "ed1e65343fdec0a138702f3cd6df88b0e784889390551bf52d57bfe3f76ca7bd3fc15d93ca6d2646944cc09b98f38978", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808027, "uuid": "08ae2c0a-f72f-4dd6-b172-fef8732365e3", "value": "T14906E0D3DA59002DC3BAE1B439F39678D40C9B141A6BEF3815ED6FC9172A1C9333A691", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808027, "uuid": "3b361fbf-8750-4423-96bf-c8c5a6870f36", "value": "e5f32a93ddcf3aa9009cd70911b0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808027, "uuid": "ed77eaac-6a88-4067-baa0-4c070f39379f", "value": "49152:f9CiLx9yuif+5DS75mDhadmyM6BTfgP8tv/bIIG+aPnr+RIfRf/Z0As4Ol2qaaI:f9CexoQW7oezpvNG+WXf04Ole", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808027, "uuid": "e027e8f4-fbeb-4edd-8c7e-eb95a92ca666", "value": 3821056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808027, "uuid": "2e2388a0-a26a-4483-b610-6e5ceb1f401d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808027, "uuid": "d92af7cc-5cf8-4454-be36-1b4f41906d40", "value": "02e0d5f00e3a6b85238906e35f1b5037191190ff4fd054467a496399e71b1572", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6b992ec-1970-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810758, "uuid": "a7080c15-8d46-4264-8bd4-2f37e948668b", "comment": "Malware payload", "value": "de866ab506a2fd1568a16612ed21cd2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810758, "uuid": "b67a1fa1-3637-4b10-9053-ce2cdbfb5b10", "comment": "Malware payload", "value": "0320749b9a15ad5d4ea691d3cbb01aca2a484a2886f5df4e1aa907e04bee4385", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810758, "uuid": "fe7dc4fe-2280-4048-a5a8-62987b247518", "comment": "Malware payload", "value": "29e4cec27cdd1578fa75d6c570ee3681c799bb3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810758, "uuid": "5389ca08-3ac3-4834-8a8a-6fb16646be3e", "comment": "Malware payload", "value": "5d739b3644f78350c667d7fcbf41145bca8dde2f82d110e3540060f4502df0db7b6e41c20f93e691fe207e58b4f1b431", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810758, "uuid": "97f3c3c7-3808-4a12-a354-6677a1440918", "value": "T11C55CF0273D1C062FFAB92334B5AF6115BBC79260123AA1F13981D79BE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810758, "uuid": "b42fc4b7-3aa7-487a-8875-479e2a2fb892", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810758, "uuid": "db6e5537-ecfe-486f-930f-0c739ebe1a56", "value": "24576:D5EmXFtKaL4/oFe5T9yyXYfP1ijXda+3WNipKQB17W43DU52lZ:DPVt/LZeJbInQRa+Eipx7P3wo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810758, "uuid": "d7bbdfb5-a35e-4424-bdcb-21e5383e137e", "value": 1292800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810758, "uuid": "8093b40f-1537-47ec-9cd1-77a97091164d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810758, "uuid": "3febd5d9-a908-40a8-900e-6205866c0a80", "value": "0320749b9a15ad5d4ea691d3cbb01aca2a484a2886f5df4e1aa907e04bee4385", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b676ce39-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (DDoSAgent)", "timestamp": 1772809013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809013, "uuid": "cd6b4b9b-5f31-4dfd-898b-8369e78fc2d2", "comment": "Malware payload (DDoSAgent)", "value": "23bfde69eced4eb3b1ef37430bc6b002", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809013, "uuid": "aaed4b1c-f9ee-4a57-9172-0afd48faa41b", "comment": "Malware payload (DDoSAgent)", "value": "0377d82fed702278699764f0a16b5d5fa566581f9f6e4d147268c019293b7388", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809013, "uuid": "a2f91050-a7be-4ba0-bfb9-2bb197404af1", "comment": "Malware payload (DDoSAgent)", "value": "84c77a10d911d0ee296e0a0a1d38242f7cd289d9", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809013, "uuid": "fd5887e5-d6d8-4fa4-9d49-fe84bcb68386", "comment": "Malware payload (DDoSAgent)", "value": "ddffb1fcbe20b570673f3db85490f74d2b41c6f2395a97a0c43aefe32d8d95f85e18de278159f5b3682e4346dec58d92", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809013, "uuid": "257d4e4f-28b5-4df2-845a-caf5a7654024", "value": "T141473B51F9CB04F6FA031D3140ABB22F63305D458B28EBD7DA447F2AF93B992493615A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809013, "uuid": "7f9462af-fcec-4f72-a99f-c5457d4310d1", "value": "196608:cRlr9DrKm9aybwRT3Frq5RUuy6x5XZf8HbDTsJKj:4/qbtuRxrIvTsgj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809013, "uuid": "8deaba44-3f13-4fbb-a1c1-25bc8f5b71c9", "value": 26267832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809013, "uuid": "8c274431-8f2f-47c6-87c9-3858bfa6015d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809013, "uuid": "6bdf7c2e-a2dd-4a96-bb29-9b9b0b352ca3", "value": "apex.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "073c6379-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772811296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811296, "uuid": "0791f765-c634-41de-b790-ced30e7d68ba", "comment": "Malware payload (Smoke Loader)", "value": "c7413fd3690789cb2bb318f7ddcb3778", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811296, "uuid": "7e6a0251-aa9a-4479-bd63-2ef47ebe406a", "comment": "Malware payload (Smoke Loader)", "value": "03ceed8719bdcef60a9a3b46fee00c2f02df9035e8b9f37b7058e1fc022bbbe9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811296, "uuid": "67ca5fe9-cf78-4a4a-97e9-ab269f7bf99a", "comment": "Malware payload (Smoke Loader)", "value": "119660dcf6a8f8861d0cd64c07d20219a9640105", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811296, "uuid": "58e4f24a-8bda-40a9-bf33-2751968e135b", "comment": "Malware payload (Smoke Loader)", "value": "6e5abad89fa75c90991ec00939c4c513afebb6a2a8ccf3b57416c2b7af695262264aac9d40957eba50bd11b8b2160599", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811296, "uuid": "b5f08c3d-d7e0-45a7-9a64-52ca7d2e26b3", "value": "T10BA5380F7D9508E5C0698676C8B6D1927B33B8490B3E27C31E907634AE726D59C3FB1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811296, "uuid": "73a97f15-1b5c-4c43-9df8-c59fcb194ea5", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811296, "uuid": "57553f13-9f32-43c9-b275-5cd37c689ae7", "value": "24576:32kwbTKlpDXwmugpH7W4RalZFC1rtP/zqS+/O5lsHC:32k4TKlpDXwmuaW4RalZFC1YDJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811296, "uuid": "ffa97416-0e27-4a1d-a1d2-90be8d039fd6", "value": 2113536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811296, "uuid": "95979939-30f5-4b19-a500-4e8acbcec987", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811296, "uuid": "bd946e31-b567-4d43-904a-1afe0b8415e1", "value": "03ceed8719bdcef60a9a3b46fee00c2f02df9035e8b9f37b7058e1fc022bbbe9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0806b85-196a-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772808198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808198, "uuid": "5e2fb4f3-b182-40ac-b853-eb474e258f61", "comment": "Malware payload (Formbook)", "value": "1c75ada947b45971f3db807ab4ce30e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808198, "uuid": "90f0ec7c-2bb3-49ad-84c9-5979cbfa5d13", "comment": "Malware payload (Formbook)", "value": "03fcf4d1928631193b9ef5fc41984317e7b0ba5248dc1f50e0e2b6267d4e19e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808198, "uuid": "fefea705-5fe0-4d0e-b787-33528daa67f8", "comment": "Malware payload (Formbook)", "value": "436a5d7c25ad0bd8d8ca70acdbdba34215968936", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808198, "uuid": "b8a76485-143c-4bfd-a821-c194bf4d9990", "comment": "Malware payload (Formbook)", "value": "88742314bda708ab6bf9caf9d5d03861ee3fad7b5943c36c9a9feb8737ee8524a8d904e79d33b312c6e2718b05c0727a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808198, "uuid": "25cca92d-a83e-4422-aa4d-458f5cc0423a", "value": "T19935121073AFCD23C2A41BB254E1E77003B58E59E513D217AEDE6DEB3A27B964D80643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808198, "uuid": "b93e3740-c7f6-45ee-9bb1-0ebace1857e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808198, "uuid": "63c5f011-64e5-4496-b59e-10e0c6460ac2", "value": "24576:qAOFOEyQBpq0+7wZRTjZzxqZyysEhzG0rTDCrHMQsguQlVict:qAS5hq0+7Ud9x4TX1tzouWQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808198, "uuid": "1f110421-c3cd-478b-895d-4611fbf4eda4", "value": 1091584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808198, "uuid": "c4108c4b-9583-45df-94a2-feae9575ab69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808198, "uuid": "16672e43-9270-4043-93e8-da227f4f9f4e", "value": "03fcf4d1928631193b9ef5fc41984317e7b0ba5248dc1f50e0e2b6267d4e19e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbf44e99-197a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772815142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815142, "uuid": "914eadff-a938-4337-84e3-9dbad996d2f5", "comment": "Malware payload (Mirai)", "value": "46df6c34e1abbd693aef6e0439ead502", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815142, "uuid": "b7651bd8-b5da-4454-ade5-441231957349", "comment": "Malware payload (Mirai)", "value": "04457096271432b6c1253bcd11e02fabf97b303f579c299e01d2ef9d9db3520f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815142, "uuid": "1b687972-b261-4dad-8db2-f8b560daccc7", "comment": "Malware payload (Mirai)", "value": "cc707695a3aa5d637b78e19033733e3be1a0b352", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815142, "uuid": "c2e2fa29-ad8b-4340-8a1b-18838199ad7a", "comment": "Malware payload (Mirai)", "value": "65f326dd1f718a8013b49a076c2e684ffcd22a12dfa80dfe1f7aa6f3e1cd4e97fe52d67c639e84ea1654a209446d10f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815142, "uuid": "492276c3-8305-48c6-b46d-d23cc1ddb1e1", "value": "T139837CC6FB43C4F4E8120A712177E7318A73E53D502AEE83D769A872BD12641E75A39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815142, "uuid": "5b9da220-9261-457e-80a3-812637f59ba7", "value": "1536:4NGfle9cPS4HSY6iAXVE143RrFUCeWtsrswWdZc:4cEWS6SY6iA6143RhUCeAszt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772815142, "uuid": "812115f8-0bd5-4174-a50a-2b560080167b", "value": 83600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772815142, "uuid": "832e8000-088d-4331-add7-39f4be0ab9ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815142, "uuid": "8467b01b-5ea0-4e8e-b5e8-6da78a78a627", "value": "titanjr.x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69260a90-1963-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772805018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805018, "uuid": "5256747f-e30b-470d-bfa6-10fe195e3643", "comment": "Malware payload", "value": "53610c8951b951464d4c6c67f71c7a79", "object_relation": "md5", "Tag": [ { "name": "abcknIe", "colour": "#31F8E7", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805018, "uuid": "025cc194-f3b0-4caf-9f65-164d359724ad", "comment": "Malware payload", "value": "046ef1c213aae4a5a7758af1e1ebb04ec8500ed1c1ff6aca4d4c91ace06602e0", "object_relation": "sha256", "Tag": [ { "name": "abcknIe", "colour": "#31F8E7", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805018, "uuid": "5b13bee0-52c0-4822-b5cf-f3e4e54e563b", "comment": "Malware payload", "value": "6725450fe18efe7af94c4bed479d81867009ac43", "object_relation": "sha1", "Tag": [ { "name": "abcknIe", "colour": "#31F8E7", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805018, "uuid": "508af3a3-b6c3-4614-993c-380f6af91bee", "comment": "Malware payload", "value": "65928a6d5e1ad8deba53d1fa068cb5eed7f2f9c0734908066e974af1b0859cdb8f2281dbc8dff4a02aee75674f473127", "object_relation": "sha3-384", "Tag": [ { "name": "abcknIe", "colour": "#31F8E7", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805018, "uuid": "79d00b2f-7183-49e7-bb35-b1dd063ffa0d", "value": "T13AE260E2B130C13942DDC8001BFAE94CC15D05E09E05540AF2BDCE8DBA7674A7BDA7AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805018, "uuid": "8e4e1ab0-35e7-4191-8eaa-4012c9c570a1", "value": "192:2FROgp1Mt1sz4M33UF3zBAM2JqXWdImah73ZORBUAc:WROm1MtsUF3zBAM2J6Rh73ZORRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772805018, "uuid": "bfaf8a85-c5ab-4769-a1e5-8b44523dd9cc", "value": 34066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772805018, "uuid": "a98e9523-4622-4448-829d-7f2adb01cf6d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805018, "uuid": "ebfb2fdd-ff12-4321-86ab-b4e08d9391ab", "value": "Bank Transfer Form.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcd1911a-1970-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810795, "uuid": "07f097a5-cc4d-4dc5-91dd-0d9d7e6c473e", "comment": "Malware payload", "value": "898f717a70ef5c3918a79744cc0ac692", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810795, "uuid": "71029896-2219-4ec3-a0c7-3ee54f66ccb6", "comment": "Malware payload", "value": "04747c51231d4890e70faab31fbd1ee37e31890c64b19f01ef60d3c17ec2a773", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810795, "uuid": "e647cef5-69f3-4356-af4e-d50adc86b569", "comment": "Malware payload", "value": "29e1c5640299c0a36d73bc0c8be45046160a78c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810795, "uuid": "33ea8de5-3196-41ec-b5b7-380db7206172", "comment": "Malware payload", "value": "93cc580bc5638980ceb32edce3bb247f011f4d59a2144af9a78b10f015084fa9dcfada9c6f2bad18a0906c44dad8e79d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810795, "uuid": "69de5db8-f1bf-47d2-a033-b00154d8e5d8", "value": "T1E6C4220607B4E917C9221DB619E31B9BEFF8DE031530A3176B40EB2DBC7765069463AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810795, "uuid": "6cc56469-f717-40e7-bcc2-c329ee5b6140", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810795, "uuid": "9629cd7d-9ec0-450f-89e0-387889866a85", "value": "6144:RR+xXuhPqBFlZPR3tLxljrv/8GvFv8L7DoonDkChfFTskVF7+EOQn+hx0UcWMLO6:f1yDJxzviDkChFTtVFPOaVzch2SsFx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810795, "uuid": "ecc08d18-5d2e-47b3-ab33-7c3c3549ecaf", "value": 549472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810795, "uuid": "fd7d806c-74ef-4359-8934-e9399afded7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810795, "uuid": "2235b8f4-9f9e-4919-9970-5303356f27d2", "value": "04747c51231d4890e70faab31fbd1ee37e31890c64b19f01ef60d3c17ec2a773", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02f931ee-197b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772815154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815154, "uuid": "bc417759-e02d-48dd-82d1-1eb254bda395", "comment": "Malware payload (Mirai)", "value": "ea9902e016999ffbf4b4bba5513b0b0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815154, "uuid": "0816f0a2-fc2b-48e3-9920-1cebcbdce36d", "comment": "Malware payload (Mirai)", "value": "0474b0ce5ba46379553327c202548576b2b3f69d63cd9111e41a5c0fe12f7f0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815154, "uuid": "3b641056-2d43-474f-af6e-3a8c0daa6f65", "comment": "Malware payload (Mirai)", "value": "3031a980850c9533292128a260aebe1226ce9ce8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815154, "uuid": "4935672d-4cc9-4478-9eae-28c26c006462", "comment": "Malware payload (Mirai)", "value": "4e881d494ec0b6942e365e7b9ee9845631da8ef4304f55efc944bd13d72dfa7b2b65d6ec332c44416e5778dea071c7fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815154, "uuid": "be0403cf-4424-4b3c-a740-9eede66461e3", "value": "T1FFD34A07B5C180FDC4DAC1744F9BF53AED32B1A91239B16B2BD4AB221E89E315F1DA44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815154, "uuid": "8971aaa9-af18-4caa-aa58-a19f0823f78e", "value": "3072:SxhiZfgBgmcGKAXvypbS2rrE+lxV7BMgQyF5iMUeZGXx:SxhiZfgBgmcGKAtReFUfx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772815154, "uuid": "29296eff-cf5e-49b7-bcb8-0dbc0be28ee2", "value": 141784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772815154, "uuid": "d6dd76d6-fbbd-4247-b3f7-9726c2abbc90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815154, "uuid": "332f95d0-f07a-464e-866d-722865e8ffab", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81d7a811-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1772819232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819232, "uuid": "4183bdc8-1fe3-4484-8337-d08a95caf258", "comment": "Malware payload (Gafgyt)", "value": "a58b6e6957fc494eaaec12184bcb8af7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819232, "uuid": "816e80a6-f766-4ffa-9e85-fdb7d6ae0584", "comment": "Malware payload (Gafgyt)", "value": "0480e1be9f8e591c414c82cbe8717b3a81afacca4c141d2b454e14b390332257", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819232, "uuid": "8d46d3d8-9270-48d2-8f32-5dc1000618e8", "comment": "Malware payload (Gafgyt)", "value": "1c36a9328327668b0f8057e36d8213a1d3ff5160", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819232, "uuid": "34a88dca-e6f2-4c25-b63b-721b3a647c4c", "comment": "Malware payload (Gafgyt)", "value": "36c9f6e61efbc49d49f887af6b0eb8f8adcb217584eccb1b39dff0e94ac7593834f83478673d383c01467d592cadd8dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819232, "uuid": "12c27ee1-c565-4e63-abb1-c8a03e069603", "value": "T12824F901A9518B57C6D22BBFFB8E429D37365B1897DB33019E24BEB02F8578C5E3A111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819232, "uuid": "8478437e-ac4f-4fec-9ddd-a89fe4e926a8", "value": "6144:qmFlJ1TX+/hlxq5oI3ntDG13r+MvjOjRbeZBV/rgUMX08C:qm91TGsn9KTvjOjRbevV/rgUMX08C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819232, "uuid": "747b3277-68c1-42fd-9324-28552a03e2c6", "value": 228577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819232, "uuid": "1cc75b83-d3b5-43aa-b109-f1a1e81d10d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819232, "uuid": "2ab5c139-e29e-4dd2-83e2-368d0acd8547", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "680c4d2b-1972-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811458, "uuid": "3f38c62c-34b4-450d-b9b9-b9c7f7d14d8a", "comment": "Malware payload", "value": "aef2a16082d0302646aa9fef390d2d1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811458, "uuid": "53fba689-2d33-44c2-909b-2688dbcd7627", "comment": "Malware payload", "value": "04abd60e49b28e5c6eab8d3445f32e444d09a95324cb0d06a1695185f74b004d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811458, "uuid": "f3d14d16-31bf-496b-a020-0b92fb537e24", "comment": "Malware payload", "value": "d5473434e07ec25dbf10f606b141dbf661acc122", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811458, "uuid": "21b7569e-0418-4ee1-b35b-2f65cef8fe7a", "comment": "Malware payload", "value": "97e29f854101da1e5875ca446778ff76fc3d698b41beba9f19a03e441cb1cab369ec43fa2117e0276bf27694bc404805", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811458, "uuid": "1a54b07e-3228-43b8-8346-e752a9c498ff", "value": "T12525332A9374EDB7E5B21B309CCE20263AF4700325B983DF1350AB956C1D7A49A2F7D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811458, "uuid": "5b89162a-7c4c-43ef-b358-9474ccdf87d0", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811458, "uuid": "d17ffd12-7726-446c-b49a-9acea16aeca0", "value": "24576:Lmr/GquJ6RmgJ3aloHw+djApl/kT57wBRhJSfVl/Xio9E/v:gQJpgolaRWHkT50LEio9+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811458, "uuid": "5614341b-9b18-4f26-9a2b-6b7d4c808e87", "value": 1040584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811458, "uuid": "9265f1d1-4c2d-42aa-85a9-5ee59ed19b3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811458, "uuid": "a7821fad-b537-4110-a248-e42a760bcbfc", "value": "04abd60e49b28e5c6eab8d3445f32e444d09a95324cb0d06a1695185f74b004d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e3a389f-1964-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772805295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805295, "uuid": "2c09121b-19e3-4f54-9ca5-5b804e953550", "comment": "Malware payload (AgentTesla)", "value": "b6b6676130a7a79ae8be4a940cc7ac35", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805295, "uuid": "7a5d6194-3d14-442e-a600-0bfa58a028d5", "comment": "Malware payload (AgentTesla)", "value": "04d2c4a9718298c1e38be2061c3e5afc958532162aba22020c189c98a6594726", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805295, "uuid": "349afa08-d0ab-4c1b-b096-a6ea0ced7c06", "comment": "Malware payload (AgentTesla)", "value": "72ebee399feed0415a92317696c768dbb5dcc254", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805295, "uuid": "1fe99c3b-695d-46c3-bd12-dfc889a9ede3", "comment": "Malware payload (AgentTesla)", "value": "afce2c936053fb8d0fa0109d4ebf9354f605c3acc40eb4616de70d6b07d306c0f9b12eb7dc4aa45d964e972024208406", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805295, "uuid": "1c3816ec-0d29-4566-80bf-78ec458ddcaa", "value": "T19945BF0273D1C062FFAB91334B5AF6115BBC79260123A61F13981DBABE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805295, "uuid": "66f89174-a7cc-4a22-9699-49969f4cd501", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805295, "uuid": "df24210b-cbbf-43c8-ae3f-0071045468ae", "value": "24576:f5EmXFtKaL4/oFe5T9yyXYfP1ijXdaxIhP4GD2YD3Q0o:fPVt/LZeJbInQRaxIhAGDz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772805295, "uuid": "a14ad424-8aa3-4016-a1de-46f5e123f26d", "value": 1249792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772805295, "uuid": "db06fc12-bf0e-4eaf-a646-42f1eacaa5f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805295, "uuid": "2fafa7b8-6a35-449c-9d1c-5462b9baa096", "value": "04d2c4a9718298c1e38be2061c3e5afc958532162aba22020c189c98a6594726", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13e61369-1971-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772810888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810888, "uuid": "6b59509d-3947-45f8-b105-190fec89f58b", "comment": "Malware payload (Formbook)", "value": "aa08efd099f444e79ac40bbb1a87580a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810888, "uuid": "d276ceb2-eb2d-41ab-b117-cd884772c1be", "comment": "Malware payload (Formbook)", "value": "04daf75499c786239f5f2c25dd1ee4ad7d15d750518e319b69597a73824676f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810888, "uuid": "2f5378ef-ce67-4947-a5ba-c40b28d99af1", "comment": "Malware payload (Formbook)", "value": "3974b95190ef4f2f062fe3be394e0cb67758416e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810888, "uuid": "20a5118f-878f-4214-b06c-7feff07f0eb5", "comment": "Malware payload (Formbook)", "value": "5aa0047f39d7d99110bb83a54adb9f79f0d6063f85de0adf8430eb9fc0857b350fb12dfb1f5816a9c53cc0995f90ecf9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810888, "uuid": "dad6712b-4dca-4cae-a134-f54fd989c918", "value": "T1CB45CF0273D1C062FFAB96334F56F6115BBC7A660123A62F13981D79BA701B1463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810888, "uuid": "41f576a7-7374-44d7-a96a-a6f7e0255fca", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810888, "uuid": "a82cd056-d21a-4142-b676-a6fc23326d2a", "value": "24576:i5EmXFtKaL4/oFe5T9yyXYfP1ijXdajRCGysuM05f:iPVt/LZeJbInQRajRgW0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810888, "uuid": "6b15b55a-0f6e-4bd6-b581-c4bbc2337f63", "value": 1280000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810888, "uuid": "087116a6-cb90-4851-8626-133a8d58adda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810888, "uuid": "c5501292-7f40-4139-b7f1-5092a2cc3251", "value": "04daf75499c786239f5f2c25dd1ee4ad7d15d750518e319b69597a73824676f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80a8c6c8-1951-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772797326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797326, "uuid": "18204d44-1548-4270-b2b7-1646d07fb309", "comment": "Malware payload", "value": "f9e7be7dbb2a400cc58341211c130650", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797326, "uuid": "f31e42ed-9ac6-424a-a85e-4737bd932924", "comment": "Malware payload", "value": "050241b7685e48fc4a1a042a1f45a090ce33abf72ea8ee339d7a66b48e621ef5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797326, "uuid": "d06738d9-46cc-41bf-a8f5-0e1326777004", "comment": "Malware payload", "value": "aab2e321b4d2c22e08147fb1e07a61528402c156", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797326, "uuid": "93dd8736-d2cb-4724-bf8a-73d6745123f7", "comment": "Malware payload", "value": "8033537ee7706d2bc981d850c37265f80395a49182dab6a2b282ec6dddc2fcf78779dee38e883da00719994c9d358b18", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797326, "uuid": "dfb84f41-1ac4-4466-8c99-8ebb0b0df22f", "value": "T15B41D79733FE397A8A9614A7842E9405D6754EA11C065C00BACD0E076C5D6883FBAF38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797326, "uuid": "5bad699a-28b5-4093-9a7a-93fcdcfbe83d", "value": "48:7jOgo7b5jag3L8GbE4+EvPbjrXecbtlaw6QRnpoQp8Owg/Rf6WcCE1+0nL:7jqjHG4PPrXecbuNQFKSRf6n4K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772797326, "uuid": "f481765e-326b-4148-81cc-4e72f3f56e57", "value": 2207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772797326, "uuid": "0de41016-b98b-4789-81cf-5bea21e802ed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797326, "uuid": "0c8a6d59-d700-4f50-b618-13556b54292f", "value": "050241b7685e48fc4a1a042a1f45a090ce33abf72ea8ee339d7a66b48e621ef5.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc439aed-194c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772795386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795386, "uuid": "6af20cba-4e23-4bea-abfc-18a3176cbb1b", "comment": "Malware payload", "value": "70483bc8b0e55c9cf6f27f7049beb728", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795386, "uuid": "f0bdfcf5-6485-4d56-aab1-e5d3c3e0fa13", "comment": "Malware payload", "value": "05cf4074761f8d60963bceb9533ba4c168586d861caf8decacf0fe92f8ac292b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795386, "uuid": "99b81d02-0b1d-4faa-969f-4c994b18f0cf", "comment": "Malware payload", "value": "6c65b363f0f891b73d6fea4e0023dc238b1da9cc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795386, "uuid": "91364b05-d204-495a-b36d-3382c27e4eb6", "comment": "Malware payload", "value": "1ef7eacb9ad3d99888544747731b28aef95d854206973188a0b1c9edab3e434a9e1b8ea4ece677d205c00d9fabba96c6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795386, "uuid": "1c50a584-516d-44aa-83a9-30480e9a93de", "value": "T1A507AE23AAD08174E6D691FD86FA373AC97DA905033881D785C46C945F32AE23B3E717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795386, "uuid": "129be6b5-2ed6-4632-b2c0-0ca7cee35701", "value": "0bf4447fda89303e8c2644bb6df92eb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795386, "uuid": "c882f70f-6b60-498c-80ed-50dd55a8f230", "value": "196608:wQke5A05AXFN3delxDtPAFGfcn+hr7fTmCwmDoYzPpze:wYA0aFsDXcn+B7imDoAPpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772795386, "uuid": "235306af-35d7-4c42-9cb1-ff8fc45cd482", "value": 17988088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772795386, "uuid": "c6f17c6e-2854-487b-aa3d-79c16bf19574", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795386, "uuid": "6b257265-0a90-4f52-ae35-84f66d03568b", "value": "wke.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54c1422c-197f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772817009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772817009, "uuid": "a01bf229-2ebe-4acb-be73-9868025187e8", "comment": "Malware payload", "value": "dfa6b624cbc76b78c0f374d8b324de34", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772817009, "uuid": "bba966df-b6a5-4fd7-8f25-e06d6ea7b0c3", "comment": "Malware payload", "value": "05d6f4e462065f3c5c3710775f15f96d333ff3d35ea7860536c6208ff4c2f294", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772817009, "uuid": "d9df4088-2792-4e4e-8656-bc9a737e974f", "comment": "Malware payload", "value": "803ce49d77f3f94d04d7d2aefd26127644889daa", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772817009, "uuid": "e24e5d1e-4ebf-4767-95e9-72f3934f2cf2", "comment": "Malware payload", "value": "41f812e137befc9d78d8e4a9c5c0aa4a1a663b2b7c8543e2589890d296224775fc2f5c7115cf3bc8531a87351e858580", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772817009, "uuid": "566c9688-ec8b-45c7-8801-a40867be1678", "value": "T14831E02778368210DBE056F89A1D3A61B757834BA701FFC5B3C16197A80B22687F06ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772817009, "uuid": "0d9648f0-dc5d-4c49-b895-525936e6c160", "value": "24:wtOS6O3KfdpBwa2pdu4FOwfjJ396+4ef1jSvJfdA0VCCJlTQfsz8V7PCOwfjJ39z:CefpXY3o2jSv/A0v8Ve3s3UDrH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772817009, "uuid": "ea6d6b60-8003-4d5e-9605-e9fe7d24a4a1", "value": 1824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772817009, "uuid": "3b123131-4c76-4da9-87ad-67e4ca0b49cf", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772817009, "uuid": "3f7f7220-5022-44b5-84b4-246fa250f07c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0f9bbe9-196c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809004, "uuid": "089ebe28-21c2-44c4-9d59-181a1048835d", "comment": "Malware payload", "value": "e270e30c1861ec8b0967fafe03b4a178", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809004, "uuid": "00fe552c-9651-4edb-93d0-51cd44f3bd67", "comment": "Malware payload", "value": "062c3c93ed5729c7965b7dc1bc56a8cbd024efccaaa4ab90bd701311bda6a90e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809004, "uuid": "fffe3b07-67a0-4fe8-8886-9e221d419167", "comment": "Malware payload", "value": "e850168609d26230075da75bf6d967c4174ee682", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809004, "uuid": "f5287c5c-9f03-474f-8813-4a44aadf215a", "comment": "Malware payload", "value": "c69da74057ce4423566d02482bdf86a96de211176db066d98a9d04c48124655b3357439e1403e9dc7b51ef6e720bf444", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809004, "uuid": "d53c8349-c7ad-4c02-87e0-6e54136e2e4e", "value": "T1FE472A87B8924952C5E83A77F8BD81D832720EF98B97525B5D05FE383EBE4D90A35340", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809004, "uuid": "8214a156-3aba-47bb-8ce2-94509776c11b", "value": "196608:xYDbAzQYKByMJj5q0ZYE0h0GW+D06x72FOW8PSnbbqH:Jz7y0h0sxCFOWyH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809004, "uuid": "33033a0b-bedf-4ec2-b3ec-8ae27e618a67", "value": 26149048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809004, "uuid": "3c90f658-9bf0-4fa3-9b6a-539f89e5233c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809004, "uuid": "0ab852d8-7450-45f0-b174-689a8ea58a4c", "value": "apex.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42835569-196f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810107, "uuid": "49a8aa7c-3d42-48c5-a833-c0fa39ff57be", "comment": "Malware payload", "value": "70dbc9a136e8c38a0fe97ab3f010e847", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810107, "uuid": "a2fbe713-6968-4d0a-813d-1b6743e01de2", "comment": "Malware payload", "value": "066b34ad913a5b7fa8c840e9a7b071c88eb0459d5aab6ffaaa5d04f35a2657e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810107, "uuid": "de850466-15f6-4aec-a28d-5be843acbc41", "comment": "Malware payload", "value": "37c8573acdf1068d39b12e0914fdbdbbbb1d6f63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810107, "uuid": "f9799af8-231b-4fdc-996e-ddd5a313133f", "comment": "Malware payload", "value": "16ca2ce2877d796fec0a60e85e9c87d9844e16bca5519cdd7f75561d4e54819da9167a17f939f4cb0dca24fada170b0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810107, "uuid": "02374594-efc5-4b2c-a04a-96fabe33c6be", "value": "T157251255125EEB03D4971FF40AB1E6B147B82ECDA862E31A4EE67CEB743A7C45C40392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810107, "uuid": "937b08ad-3dbe-4ad9-8f02-f2e1a61f2e2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810107, "uuid": "fc3bcdfb-5465-47f9-ab54-ce3e7879897e", "value": "24576:geqcnDI82O9Cm10GEG3w/r2VNCWSHER+TZsSnJ/:geK8tCm10nYw/UYJEgTqSJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810107, "uuid": "704fbcb9-0012-4036-b6f7-9ee58a63677d", "value": 1027584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810107, "uuid": "344c34b3-4b4a-441e-9ed2-bb4933de8bd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810107, "uuid": "c52d8a92-52bb-40d2-91e8-18bd21ce5a87", "value": "066b34ad913a5b7fa8c840e9a7b071c88eb0459d5aab6ffaaa5d04f35a2657e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dcc9e6c-190b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772767096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772767096, "uuid": "9ca97e81-e459-49d8-a039-6a2608b2ee75", "comment": "Malware payload (Mirai)", "value": "09d8de8902ac92200824a0e81a944f2d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772767096, "uuid": "bb0735b8-6b81-4519-9cac-fb5bad0a7182", "comment": "Malware payload (Mirai)", "value": "0675fbff70f3a74eb40e1434e0e9550aa98393d529692946db1bf9b2529fb8ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772767096, "uuid": "47de41f3-666b-47eb-9d23-2d2db54f39f3", "comment": "Malware payload (Mirai)", "value": "7920ddc601059a9c9db2e4a7bc5ae161c58ca2f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772767096, "uuid": "d06ed81d-5002-490d-a086-ac196c9ea007", "comment": "Malware payload (Mirai)", "value": "b5bcd565c3e2b319203335f1280b6f60dada4e21f22ed45a66c1cd04c3de99f19db8e52aab4b0412b27a044e9eb40461", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772767096, "uuid": "e4c95d0c-40e3-4799-9197-417404564ea3", "value": "T13FC36CB3C8666F58D559D1B4B0608F792F53A91182871FBE2977C2B68083D8CFA053F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772767096, "uuid": "a428d386-e0a8-48ee-8189-20293dd75ef2", "value": "1536:75KpJ/jGeQvZzZXn0FyCucKsEYoeTiT6Hk9pAWvuoFPocdOsn:75EJLGe+0Fy3DsHiGUpAW2QP3OG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772767096, "uuid": "542b33bd-4bba-41e3-ba85-0db542e941b8", "value": 121664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772767096, "uuid": "1eaf0823-450d-4d90-ac39-2726594c5c46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772767096, "uuid": "1c55ab29-0c6f-4678-bc55-d50caa7873c9", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cf15744-196d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809373, "uuid": "9d12289d-e9e0-45b4-bcde-3639f3b018d5", "comment": "Malware payload", "value": "8ad0c26953db7253876338b387d547d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809373, "uuid": "bfa0ef11-64c4-4ed1-a92c-7e4e5f610e7d", "comment": "Malware payload", "value": "0678e82774ae268fefe1d4d050453992d8afc816e793f44684530c11f07f9c95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809373, "uuid": "29952486-48b6-4a11-9575-168cbb827dfc", "comment": "Malware payload", "value": "e68b3cfdf6d86cfc0c841dbf59c6dfe47e9c0d78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809373, "uuid": "a07c0638-e9cb-4538-8c95-927e99c263b8", "comment": "Malware payload", "value": "a3f077902caa518071d0160d85a18b6563604846c39f72009696a27088e75d9df2e77ec9399a6d3038bfe13ec94423c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809373, "uuid": "571e7795-62b1-48b1-b035-84cb7fb06986", "value": "T1EE94E416E760B426E89349B02D78A256391D3D3A2581ED0BB78DDF4A3B71983B1F431F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809373, "uuid": "d88fea7f-29e9-4cf8-9694-0f20f8467884", "value": "35dc8f6e4741152373bb10383b865ed5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809373, "uuid": "fc0b5df4-145b-4980-8853-1f7eae263e64", "value": "6144:Qt4+q1NEGP390lLHmmySEBW+rowlr2WHPjKka/Ct2uxVeQ8bz04y9NjjaVPBN6dW:QW+4E+uEBW+rowlr2UrRxVeQ8s5eBWW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809373, "uuid": "7d58c3ee-0403-4e48-999e-30d13d38cb44", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809373, "uuid": "adba46e7-a226-4503-bff6-96defa83f135", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809373, "uuid": "b21a54bb-78d5-4820-9d62-93ec22fbf0f3", "value": "0678e82774ae268fefe1d4d050453992d8afc816e793f44684530c11f07f9c95", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "758e3b09-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819212, "uuid": "6a3e96f9-21a2-41ab-a1c4-b4b04a05bf93", "comment": "Malware payload (Mirai)", "value": "868f1f947820bd3e1e233f030d684dba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819212, "uuid": "412b0c1b-6901-4d34-a145-968561746359", "comment": "Malware payload (Mirai)", "value": "068ad91e7770d17d9222f3cdce5e8136fa506a7a36a1c11ca791d55fe010ee56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819212, "uuid": "a3b77a6c-5837-4615-9975-a5634eda4bf2", "comment": "Malware payload (Mirai)", "value": "00bb24a2c8ed8ec78823f7d242f7b9f18e89b0e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819212, "uuid": "ef2a8545-c3a6-4558-8e65-b7c09ee3e5fa", "comment": "Malware payload (Mirai)", "value": "b4f0c89d9b1449f2ac3f7374f48a64f32fa7960b9a246070b3df302c9128fad59e37c6f545d117648a01b9d09a18bc3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819212, "uuid": "3578faec-ff9e-4e22-a7e9-291674defc08", "value": "T1C3C33902F58584FDC18AC2300B6FB63B9936F1DD4238B2EB6BD4EB127D4AE214E1D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819212, "uuid": "42d063a2-f530-4aaa-bb3e-6489a47a9956", "value": "3072:UXbg5lvpREgWUhWpN1sP6Gf3qllxu7fWJfDDJ+oJvc05su5o5x:l5lvpREgWUhWpNmP6Gf3qllx6GrcyU6U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819212, "uuid": "d044d757-c8ae-4173-8e12-45a120a9deed", "value": 129088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819212, "uuid": "ce295710-b6c5-4080-8c8a-ac5e0bc82bf2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819212, "uuid": "f59feee0-07d1-41c6-a95a-09979447e979", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a308820f-196c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808980, "uuid": "b44c9a40-eb9a-457b-a11b-7892e4b9118f", "comment": "Malware payload", "value": "b30430aa42b1b34e45bc76ae4c1e084b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808980, "uuid": "e2c574db-e45e-411d-bf7c-e466582a93b5", "comment": "Malware payload", "value": "069e4614606ef738a8c4420ad04f78b8dc920f0ed21a917f2190c345eb316db8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808980, "uuid": "735e0c08-555d-4346-a556-635ff019c9da", "comment": "Malware payload", "value": "f1a39123883bf20c98aebcd160c68e86708d7304", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808980, "uuid": "bd463e6d-a2ca-4fb1-939d-fad1ff034d71", "comment": "Malware payload", "value": "a904b66db41570f91a08d6793ba88318bef79062dacecedf0e90a9a7e3523036c95cf19f75ecf8200840a6d6cb028c57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808980, "uuid": "d368a5d5-fe3e-4d57-b567-17431dddf59d", "value": "T12C45DF4627E85A58F5FA9F38297464140BF9BC279939D72D2A4840FD0C72F45EA22F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808980, "uuid": "3ad18e31-1f4d-45f0-b1bf-05b68f6d2d62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808980, "uuid": "15f7bc34-7677-4337-a1b6-490beade2e3a", "value": "12288:tLBYzyKMJ5r4s7GszIMjy1j89CFnLT/N0HPNI0iAxxrKXBxoo1C7D/hPkg+CaHmq:U0ghpLT/4PPH7caoc7DRkWaAJX/Wtv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808980, "uuid": "5a35a2fe-5a40-4c3b-a2ca-6dd8055b80d5", "value": 1188864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808980, "uuid": "07505070-c0a9-48bf-ac68-cba551391236", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808980, "uuid": "d3270d39-cbdd-46da-a94d-8e68b3f591e2", "value": "069e4614606ef738a8c4420ad04f78b8dc920f0ed21a917f2190c345eb316db8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "257c0714-1954-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1772798462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798462, "uuid": "a78ebe5f-c0e5-45b4-953d-20fff0ed65e9", "comment": "Malware payload (QuasarRAT)", "value": "5b8302f4d40bdae9ecc9752c9c0e62c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798462, "uuid": "4128eabd-7dd5-4f03-a55c-086ae9c06ee4", "comment": "Malware payload (QuasarRAT)", "value": "06c3f12b3da7d065ff2a77c888ecbfa7afb1fd0b0b66e3322f52f8001d5317f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798462, "uuid": "00f53e7c-548e-4768-b524-9ab392c8edb8", "comment": "Malware payload (QuasarRAT)", "value": "5000467ccc15b535f9dd594d10cf27c69bfde118", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798462, "uuid": "124389db-3745-485a-bd88-16f64a4a5899", "comment": "Malware payload (QuasarRAT)", "value": "c3bc6062316c99ee3110407aa72695dd1f5f2463c66b1340997844c239db37c23e1a14d338358c423bfdd99d78b8cef9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798462, "uuid": "0e6c6bec-f20e-4de0-bbf5-c3e31a76a312", "value": "T1610639143BE85E22D03B92B295B0D13663F1EC2AB363EB1B51E1AE7B7C537405C416A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798462, "uuid": "21628fe6-9c2c-4694-a44c-3c65f32addc7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798462, "uuid": "bdbd6576-fc0b-44f5-9235-babf16009f1e", "value": "49152:iv+I22SsaNYfdPBldt698dBcjHdarbfkwvJSLoGdGTHHB72eh2NT1:ivz22SsaNYfdPBldt6+dBcjHGkLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772798462, "uuid": "df6b66ce-8cb9-4c62-8d7c-ca792f7e3efc", "value": 3698688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772798462, "uuid": "3a0f3b2f-9c0e-4f35-ad54-8b1cdb87f752", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798462, "uuid": "0105ae8c-fe72-4bf2-a51a-858019f86cfb", "value": "MW19-Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "980991a2-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772809391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809391, "uuid": "93b2342f-68be-44f6-8cc4-a87764602c53", "comment": "Malware payload (AsyncRAT)", "value": "8f66108ec8f997b14f660e576bdca751", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809391, "uuid": "2e03f25b-ee75-4899-9518-bebbb9e1ec7c", "comment": "Malware payload (AsyncRAT)", "value": "06c4acccda31358fd172466d6245f827c2b5075dec6496516286f936f22ef771", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809391, "uuid": "392722eb-d2c2-4d41-b0dd-a0084e90d3d8", "comment": "Malware payload (AsyncRAT)", "value": "800b1bcb91f794af35e5e823c53d6e58150d2395", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809391, "uuid": "d6cb545c-1de1-469f-b136-85c05d274038", "comment": "Malware payload (AsyncRAT)", "value": "721e3ff30bbffb62f38545e8d9a88369db69b6dcd9fd15da1f23d435e0dd0c1d9e7f0d49f9bf7d8f4a9f943fbf317938", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809391, "uuid": "02f9c3de-19e6-478a-a0a5-06987d7739df", "value": "T1E4259E0273D1C062FFAB92734B56F6115BBC79260123A61F13981DBABE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809391, "uuid": "8d9d08a6-bd88-49d3-a7e8-0a671b6f862d", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809391, "uuid": "0fc8d59f-3a3e-41a8-a854-54647544531b", "value": "24576:j5EmXFtKaL4/oFe5T9yyXYfP1ijXda60Xhw:jPVt/LZeJbInQRa6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809391, "uuid": "5cab9fca-b174-40af-a48c-4513889a4b38", "value": 998400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809391, "uuid": "dfe62606-325e-4845-94cf-b0bd16e1d939", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809391, "uuid": "4911e32c-a186-47c6-90ae-224f8e2e102d", "value": "06c4acccda31358fd172466d6245f827c2b5075dec6496516286f936f22ef771", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db954e4a-197e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772816806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772816806, "uuid": "087acfde-d671-47dd-8dae-98d0b7ea7373", "comment": "Malware payload", "value": "171c5de4b007a16a7710f3686d8d0e1f", "object_relation": "md5", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772816806, "uuid": "a961a85b-cc4d-4a63-9cda-79cd302099b9", "comment": "Malware payload", "value": "072e30bbf2bb844cb0b93d460581f1a80fa8fac75fded6d80802a8b0dbbe52f5", "object_relation": "sha256", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772816806, "uuid": "50b03ecd-3c14-409f-b70b-2494ec273d31", "comment": "Malware payload", "value": "ba65710d9611b1311b366e851146f899f8e6d7da", "object_relation": "sha1", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772816806, "uuid": "27e40381-1a83-4c87-8b40-18ca7d973931", "comment": "Malware payload", "value": "5fabda0543b68c447f3fb97897e7a4f42df582aac36f917842a6b3075f998b4b09fea6953331f2820ef686c0a319f4ef", "object_relation": "sha3-384", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772816806, "uuid": "c9534707-8105-4dab-9ef7-59b1c44b37e9", "value": "T1EAC5331B93091612236B73B56826CDB988F3C3BDE8655F3A63003C3C51BAD9D961B1ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772816806, "uuid": "4775457b-644c-43b0-86d1-7f384d221dc3", "value": "49152:YILW9JyukOPMRgoX7JRkJ2zVybF/fRxxVE8RiH+7:09Jj5MRgoXVeugb1fRxxV30H+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772816806, "uuid": "532a167f-a080-4c56-89d9-a373f214b772", "value": 2639708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772816806, "uuid": "8b53952b-900b-43a1-9d4b-f47dd4109f60", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772816806, "uuid": "10b1473a-075f-4bd6-9ef5-485e1e30d883", "value": "Executor_x64.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fd8dadf-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810237, "uuid": "bb03ce75-a93f-4846-ae6b-cee9461a5398", "comment": "Malware payload (GCleaner)", "value": "50434586184936a864747b0a862274fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810237, "uuid": "ace8ed29-bd7a-4f4c-b953-2c8e5c10539d", "comment": "Malware payload (GCleaner)", "value": "0731ebda003d3e01739d55734eaa5dfb08a34537f3cc606f5bcd753be70fcb4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810237, "uuid": "eb592a78-f5c0-4220-a604-ee08c92d9468", "comment": "Malware payload (GCleaner)", "value": "45fe404403fd4a1a2a4f96ab5d2cb2357f4c0701", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810237, "uuid": "f4da8841-070b-44cb-abd3-33f93dba7e68", "comment": "Malware payload (GCleaner)", "value": "93686b00cdf49b974936512fdad45a6990f39624b22ddfdd9c301b17e3c29a57fedad8a92ca7f5edae58728da051257f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810237, "uuid": "f148b5df-189f-469a-91ef-fe3ccb10c67c", "value": "T1C355AE22F2925133C17216389C27E7659D2ABE113EBCA84B2BEF1DCC5F3524179352A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810237, "uuid": "40ef7379-5576-40ad-aec8-50cb60037238", "value": "0eefadf8e9087d6d95cc4aedf30a5018", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810237, "uuid": "bdd43f81-5276-43b2-824e-211f22fc0417", "value": "12288:JVLMD7V2wGymFSmu4eDCQi0628ZhcPaGfEdERlSdpgdICRqi9/Ci5Ig+FZOxny:JVwXV4HSmYq7MPPfEd+epgf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810237, "uuid": "bc19ef9c-d2bc-4d7d-be92-e9b9fbcf06ef", "value": 1396736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810237, "uuid": "d195ee83-eaca-4d71-86ce-7839e5482c85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810237, "uuid": "5b5c3599-f94a-4243-b589-bda9bb9aa474", "value": "0731ebda003d3e01739d55734eaa5dfb08a34537f3cc606f5bcd753be70fcb4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b35c440a-196a-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808149, "uuid": "bc27ed71-cf30-4e47-ab89-8d2845e56cf2", "comment": "Malware payload (GCleaner)", "value": "2272118a24950de23cc894da2ef9aa4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808149, "uuid": "077354f5-5fa1-4a52-8214-e2343e9c33d7", "comment": "Malware payload (GCleaner)", "value": "073279a2543e2ad7247d2ee56236adf1647db762673ab8c0ecd0eceb9381b658", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808149, "uuid": "cc210eb8-b956-484b-b9b4-1d8d481aa532", "comment": "Malware payload (GCleaner)", "value": "2e26b2492283ad5e9ba2067219ef09c0274c0c5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808149, "uuid": "4c9c6681-dc03-4ed7-b88d-34a953d47aeb", "comment": "Malware payload (GCleaner)", "value": "8ffeb3f2cbd80bc3031eba9f088d1afa8ffb22c1b3c06107f4eeec8e13a81ea74a541324f44e2be4f54ca9a56b2d7636", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808149, "uuid": "fd8fa8e3-bf66-4c2b-8bca-3156d992a997", "value": "T15526D023A2E0313DCAAF7E37851698EE90E53C943C9A5FC165C69BC76E19112EDE1133", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808149, "uuid": "291de093-66cf-47fd-8ef3-10bec8eb6217", "value": "e5f32a93ddcf3aa9009cd70911b0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808149, "uuid": "476426eb-9d5e-4192-8238-daf066c38aa4", "value": "98304:w9Cex3hHycui2/YzkJJfyzADRuigrytEtpP:w9hFs/YGiAYiCyt6pP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808149, "uuid": "e09ac336-585d-42fe-9b76-ab2d58007dc4", "value": 4832768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808149, "uuid": "5775a7b4-abbb-40f3-8049-b114d04654f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808149, "uuid": "caddd1e5-02bd-4884-971b-48fb32bc94f6", "value": "073279a2543e2ad7247d2ee56236adf1647db762673ab8c0ecd0eceb9381b658", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6b86a24-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772810704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810704, "uuid": "b57f6f71-fd93-4a79-8b0c-a29ebb079b34", "comment": "Malware payload (PhantomStealer)", "value": "fe5189cab405efadf391dca79793e26c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810704, "uuid": "62bda564-0656-4081-930a-32083df8f2b3", "comment": "Malware payload (PhantomStealer)", "value": "07432c11f1bb3a5f299aab53022620ece4ca677dc81f18cb1f5ce9c41b6b4553", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810704, "uuid": "b539e2c4-f61e-44b0-b42c-e87bb5516469", "comment": "Malware payload (PhantomStealer)", "value": "28250dc9e37274e0a13c337927ac8074ede60414", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810704, "uuid": "81d4822f-4b53-45bd-9d84-3d9d69024561", "comment": "Malware payload (PhantomStealer)", "value": "54018d02731de10fc1fa846481ea701ec68b33c5d5487aec0ae7d529219d7b008bf6b3c92d42d64fa43f1a2b81737db4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810704, "uuid": "d2697e5a-1e3f-4122-a4a3-d0bc223f9918", "value": "T1236523A92202CD07E59B2B755AB2F5B0177D2DDFA401E30B5FD9BDFBB4A2B510C50282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810704, "uuid": "b2a8a5d2-dc3e-4a1d-a278-b159e71b78f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810704, "uuid": "25d77447-6484-4a8b-b97d-26e0a50c1fa2", "value": "24576:/EJDPPeromyoaakFeha7ExsmCWEo1z08y8qDiZLzeWCj:/EZPPeomyoaaE4+ExyWEKALaLCWCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810704, "uuid": "8cd1ac80-7ed2-4ee2-bcda-9040d7109748", "value": 1536512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810704, "uuid": "a3d7c66c-1892-4373-82df-190da8b0e483", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810704, "uuid": "c4f39ec9-b91f-4146-a384-b19ff4520453", "value": "07432c11f1bb3a5f299aab53022620ece4ca677dc81f18cb1f5ce9c41b6b4553", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7647f8c0-1996-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772826944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826944, "uuid": "d122c8d5-92b8-4251-8b75-03d1fac2a444", "comment": "Malware payload", "value": "97d67632afe554ff42c5fdbb1c6de176", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826944, "uuid": "662de5ca-9a04-495a-8cec-e38f2bf57988", "comment": "Malware payload", "value": "0782c2520a476fb98e6a0bd01937df57a0c730b113c8ec149e2c6be534aa91a3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826944, "uuid": "cfe48367-4421-43d9-8a93-c98fcea286a8", "comment": "Malware payload", "value": "635997eee32bf2ffe4e25e53d206e9c540430b63", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826944, "uuid": "cb3b5335-8d79-4678-9805-c9f7762b3834", "comment": "Malware payload", "value": "dd2387d597cfaa61a0652df911aae35885c35b047dcc6bb1948adf28bf06c6ff250eecbf9b7ed545e2e6e3d97082cd4d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772826944, "uuid": "45be324c-7b58-488d-868a-6bf0a28570d0", "value": "T18581CAC9715207E52F2CEA3267BFC50C5785D1CFE4C11F99FADA6AA44D8CDC82C841A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772826944, "uuid": "71936943-4523-4901-b29a-54f96f3da555", "value": "48:v8UrUQxlUoUOEUYUvUpUCUdUuUCU5UtUPn:v8UrUGUoUOEUYUvUpUCUdUuUCU5UtUPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772826944, "uuid": "cdc8787c-f949-42aa-85c4-0f0a1fc0b6e8", "value": 4050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772826944, "uuid": "a5ae548a-c0cb-4009-88fd-a584fd154299", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772826944, "uuid": "27f07c3c-560f-488f-8fdc-4f0f7e867b1e", "value": "cache", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa6540fb-197a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772815140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815140, "uuid": "1ef296f2-4338-46be-826b-ea89a2211bb8", "comment": "Malware payload (Mirai)", "value": "32ca4e76ab8c3f9f0096b40d3bbbe6e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815140, "uuid": "09afeb7f-e368-4aba-8cf9-8c4a91d24a58", "comment": "Malware payload (Mirai)", "value": "078cf00268c2def420f07a3625d1f191f7a97f57b68af6fa590ef12f78365b53", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815140, "uuid": "22632994-46b3-496f-9d96-7ba2fa1a19f3", "comment": "Malware payload (Mirai)", "value": "f741535fe18aeb3053728eb11dae831c2133413b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815140, "uuid": "0ff2ce48-756b-429b-bb97-fea04191a4ed", "comment": "Malware payload (Mirai)", "value": "2a4021833782d0fd647a72011fe6992c2a7c8ca14118f5b0a41e024e0bac430328cd01e90971495998dd7aebf52ee742", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815140, "uuid": "1dc4c662-3661-44ff-9ef2-654bd82f82f4", "value": "T1B5D30945F8404B27CAD612BBFB5E428D7B2A17E8D3EF720399216F20378795B0E36546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815140, "uuid": "4e522f78-ecb8-45fb-8b19-ad8d2455510d", "value": "1536:zNLAVG5wSCgkC8lgBm7XWeA0Zm4VEdTJTMj04WO3Iv4crxqRd+R2lD6wywHRP1D0:zNUyeC0TzWew4kJ804WqIrFmogzJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772815140, "uuid": "607b7ccf-76a9-4556-9e50-435abbf5a14c", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772815140, "uuid": "7bd7ed1f-b8ba-4efb-b2f8-a03da5e875a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815140, "uuid": "e9cc8ed7-583a-415d-a1e6-54ca5991ac01", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e68d435-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808543, "uuid": "bb6ddb5d-44d2-45fd-be93-16ad89bf433e", "comment": "Malware payload (GCleaner)", "value": "b5047ade94c913e3e456feea0f23d2b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808543, "uuid": "4dd1137d-55fe-41d9-a88b-4c5be7ca4656", "comment": "Malware payload (GCleaner)", "value": "07c8536646a1c50ae39d64a8c8a5bfcecf8b37b6ddacf5fdf068194eaea6ebc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808543, "uuid": "1fd7c2bb-5589-4fe5-81f8-c414f7523dfd", "comment": "Malware payload (GCleaner)", "value": "0c1913ec3628abc62faa6b88df1d343046a3e27a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808543, "uuid": "d6565aba-d718-4205-8ae3-4e4875ab918e", "comment": "Malware payload (GCleaner)", "value": "67375c725fd76c53b9aec3e693d9f25b1d4e40bc050244d9a703d99a35f0bc1210a8da4eb32e8a6ecf4c5eb902472976", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808543, "uuid": "d8639c29-5cac-42b4-807c-29c347e7ca23", "value": "T15646D03AA0E35FBBE690447D4F956B0E273E5A1B5424F6C6BEC8CDCC092B7C104A5792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808543, "uuid": "d23b2bca-a7a5-43e2-a100-8595edfe0a43", "value": "c243d5a6283f8eb7bff20dd0797e21c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808543, "uuid": "77fc705c-e141-48b3-a9a0-1b365c489982", "value": "98304:TH5uRhLyf1ZYnrUDFdblE3yNnBnFmCgzo05:TkDLeyr+ECR2L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808543, "uuid": "e38277d9-d20f-41a4-84b7-bfdd1b5cceae", "value": 5641216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808543, "uuid": "ac468417-8226-4c6e-af47-ad05760d1d77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808543, "uuid": "ac6b3d14-bd21-4880-8b65-b144842e987c", "value": "07c8536646a1c50ae39d64a8c8a5bfcecf8b37b6ddacf5fdf068194eaea6ebc0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "707c4e62-1969-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807607, "uuid": "b784a513-176d-4f80-a1a9-93ba7df7d8a0", "comment": "Malware payload", "value": "399bd408df8d4c649668e4376fcb3580", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807607, "uuid": "75be7b6c-350a-4e1e-94be-3d9a5a5c8f68", "comment": "Malware payload", "value": "083ec9b49d1fda4e4485781203013d8552a71eb8f2b464acaab9cbd97b4ac3d6", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807607, "uuid": "21bef3b0-dc18-4ee1-8672-aae127db1fef", "comment": "Malware payload", "value": "b1fb42e369fc969c6fdbcf6045953f11c782e199", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807607, "uuid": "62cf497d-05a3-46c4-8efe-4bb9dd1ca050", "comment": "Malware payload", "value": "8de0c3c746f76b8cdb55f887734bfbd49218dcc9d0aa94a989cd5307653519847eac0904bd24f638e31c729b4a93d728", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807607, "uuid": "fb789da8-a267-47ad-84fe-9fd8305511d4", "value": "T15894238F1337C2ADF5B795F11CA5705EBB247441A62E6BEA08971E8EEF58403C84806F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807607, "uuid": "9847b3b9-4ec7-4a66-9023-5a5585277d3c", "value": "50c828126d9fa81b292ecb6b956cb2cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807607, "uuid": "5e265b01-a22e-4d70-b91a-6368a67469a1", "value": "12288:0Sa25F2xSEWxV+4Spb3BHxFoKhLNrhTnlLtc:o25Fxe4axHxGSbnl2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807607, "uuid": "c6e3fab1-c725-419c-a119-998a11203df2", "value": 436736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807607, "uuid": "ac5d7c46-13f3-4b7c-96ac-c31fffc08b62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807607, "uuid": "03acaf80-1db1-4e62-bad2-82846b0951ba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2994ddad-199e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772830251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772830251, "uuid": "1721af07-ea3a-4d62-b1f6-9a188578064c", "comment": "Malware payload (Mirai)", "value": "06838c1091298310b8f7d2f4d59203c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772830251, "uuid": "7e6d4dcf-ff3b-41c5-825b-0a9e91a484be", "comment": "Malware payload (Mirai)", "value": "094e9d6ee057d38f40c35f018488e35ab6ccd006ed261b17322e78fd5ea2c0cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772830251, "uuid": "dbfbdd29-98a3-4da3-8e4c-091685bc779e", "comment": "Malware payload (Mirai)", "value": "e5e99c4fe76c083335519db7247b929adb3bf634", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772830251, "uuid": "1fa18cd3-39c4-4979-913d-9649c3912d45", "comment": "Malware payload (Mirai)", "value": "157946b5723ca1dfad891b5752740fcf2145f0dd575e169d345323c71a4bb9cfd0710ae5d099fe9d6b4f27ceaa266d30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772830251, "uuid": "5e0dfc04-d518-47b5-a521-9a76634597da", "value": "T1F1B30737A691CA3AC04752F12AEBD9729C13BCBF0732214A33D47D656F368C61D99B06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772830251, "uuid": "caeb32a5-81bf-42bc-847b-80cb28d486e1", "value": "3072:jir5l8kbD6FHemRUOx9mgWRKHDXvJ3QEP7GzjHVmaFHJp28fpm7FnVqJwXFWnNb:CbD6FHemRUOx9mgWREbJj7oZ9hm7FnV4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772830251, "uuid": "91338ce0-c9eb-457b-84ec-8ded31fa9138", "value": 117649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772830251, "uuid": "037cf70c-3792-42ed-8048-e8dfe4e39c42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772830251, "uuid": "e66a3b49-1a4e-4b34-b76a-17a7990dc1ea", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a027d7d-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1772810200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810200, "uuid": "ab3f6aa4-2dbb-48da-82a6-8c973134e73d", "comment": "Malware payload (SantaStealer)", "value": "7927d172f15046a323b400856b881b22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810200, "uuid": "ad340eef-d8f5-4287-87f8-b38429e27031", "comment": "Malware payload (SantaStealer)", "value": "09843e14f9dbf432eba3ef9530dc295b48280a14dec0d49507c54206d5fb173f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810200, "uuid": "23fe89a9-ca70-4e19-a5e6-f94917c4f2cd", "comment": "Malware payload (SantaStealer)", "value": "394b232cbab734c0a9c0dd23357bd678c2551453", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810200, "uuid": "6d98079c-fd4c-4f3d-9949-2968ca31a728", "comment": "Malware payload (SantaStealer)", "value": "e0d62985f5ebd8e82f90c7bf1d567d87194531ee2cf86ad4a67f1e6a7c8144172449a828c01fe653db6b055ef1e864a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810200, "uuid": "9edba32d-b45e-42c1-8e3c-e18fbd846d62", "value": "T1829623BD228933D8C41AC8346037F945A1F7561F46E8C6D971EFB9C03F6B8219A52F4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810200, "uuid": "a1121675-4579-47cc-9793-b1c977165f34", "value": "b4436fe2ccd1a0108c1cda48be61b0bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810200, "uuid": "03be4515-7810-4952-88bb-64e2c85b4ef9", "value": "196608:cDnehlKe1+9uOYfC9Ak1Mw8RU1fz1ZpCN:un2OuJ0DEq3Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810200, "uuid": "368e571b-63a3-43be-8f06-450f360918f9", "value": 9326080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810200, "uuid": "9383e77a-d3a3-4c48-9ce5-408da6f0ce1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810200, "uuid": "ff641d69-ed9a-45bd-a937-263332f3ec93", "value": "09843e14f9dbf432eba3ef9530dc295b48280a14dec0d49507c54206d5fb173f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faaa9277-193d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772788941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788941, "uuid": "aaa975fd-96cc-4580-8474-457fb3ce998a", "comment": "Malware payload (Mirai)", "value": "8f14584ef4f55894ef95c17419276888", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788941, "uuid": "377439e9-e003-4616-a024-38c1c8f8b545", "comment": "Malware payload (Mirai)", "value": "09d8b4a98a67b5df0e0a82488ec4cb305862d0054dfd43a2fd229f4d1a413d2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788941, "uuid": "1505d2b8-23f1-4703-a7c8-b633d589085c", "comment": "Malware payload (Mirai)", "value": "6795d573b2ac058802a48f04b774f265b78075ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788941, "uuid": "4ef3edfb-0750-42b6-8c6c-fb6783501243", "comment": "Malware payload (Mirai)", "value": "9b0226887e09204aae681f96d34a9a5f4e9cc41ef17a1343e583baf60ba1c492fa76de785c321e6ace12e0fee5efe908", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788941, "uuid": "87776bd5-2f46-4651-aa0b-1c822db1048e", "value": "T168B2D02062AA84B1DB614176F97447F742BE5AF8E3EE72305BA4064828C66CDB3BC4C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788941, "uuid": "3eec3003-cfde-4ed1-8339-0e8c014c247d", "value": "384:v979FDQ06u6LeuIYhdZJ+k7qPHZLlxxUyFJ/oSfpb9iV9+INJhymdGUop5hSK:C063eEh4tPH1lxFFJ/XBb9iaIns3Uozn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772788941, "uuid": "d4c3ee3d-2ec1-4d67-8f62-87c37163fbff", "value": 23572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772788941, "uuid": "2dc2ecde-3c51-4255-94b0-cbd98823622f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788941, "uuid": "2b6caa95-605a-450d-93f9-1550aa557ec3", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3662fce2-1969-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807509, "uuid": "5691fd7d-5157-4e80-8376-e2b15b11b2de", "comment": "Malware payload", "value": "c04c87243c1adc87a2d919d63abd4cfc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807509, "uuid": "03731190-5270-41b3-a09a-27935ef5d8d9", "comment": "Malware payload", "value": "0a2a9d9e37b867ac0305afeea3c098cc5138c6bcb840ab0bb795b17bff93e345", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807509, "uuid": "6527bcfd-f9f7-4932-9c7b-c33b3b275b05", "comment": "Malware payload", "value": "14ef2931dcf0a686653e36c0665826a84ef1d6e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807509, "uuid": "2c639abe-eaee-42dc-aad4-8f42c24817f8", "comment": "Malware payload", "value": "4e95beef8a2ae8052cd956f56522623bdfbca0d3b5c31bd94b9ab0ce6a8d49674a0371cb72193cc8da3d1e0ce26fb493", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807509, "uuid": "8ea6a5f7-d295-4731-91b4-714164c0197e", "value": "T1F0E423AD95A1C81FC0B25631B9349297FFFE9C21102AA62F72527FEE2878347644E354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807509, "uuid": "8f0fb7a8-1fd1-4014-9646-45dcff8da1b1", "value": "24f4223e271413c25abad52fd456a9bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807509, "uuid": "6edd60c0-c5d4-4bab-b48e-4553cf072037", "value": "12288:5DW2vV3MEBS8t0ZfmOJHbq4X86d8zI0EBI59sxfuZSVRY+qsYI1zKdS:5DrvxL091bqv59sxGZ67j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807509, "uuid": "0fd95afa-192a-4aca-8b3b-375c58ead57d", "value": 713056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807509, "uuid": "165b1e0b-6249-4105-8117-3930bfef9712", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807509, "uuid": "5ff80139-e6c4-4353-abb4-400836b08984", "value": "0a2a9d9e37b867ac0305afeea3c098cc5138c6bcb840ab0bb795b17bff93e345", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7d2cb46-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811243, "uuid": "7a227d54-bffe-4aac-98ad-27744c39c4a9", "comment": "Malware payload", "value": "f93e57b671358e509e6089b04cf34f00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811243, "uuid": "f3c0b881-b303-4671-92ef-22733b8f40fb", "comment": "Malware payload", "value": "0a3e6422f7cd32f9d2eedde1ab4e6b56ba4cfe4833d2ea90512e9646fe42ace4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811243, "uuid": "c5f233bb-1390-4228-8ce0-e26a1ee54d69", "comment": "Malware payload", "value": "540e580803030da4c37c04f39a1572cdb2b9ba16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811243, "uuid": "7a1b9b94-d053-48c9-b98a-10769a35e78b", "comment": "Malware payload", "value": "302c4c159ab3ed82d9ba6483c31ba0866ff9209e68441e7cdef84833922f03b919a1763c6f884e19922a31c4200a10d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811243, "uuid": "f81fdfc2-cd10-416e-88aa-556189b3fb10", "value": "T115E4AFE5F2E08437DC325A3BDD0B56A958257E8069385B062AD81FBC5F3C3913825E9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811243, "uuid": "c70fc3a5-40fa-4167-9fba-bc66c5c110e4", "value": "ce7a1d07b14b49824555865592c3af45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811243, "uuid": "c2d856e7-ff18-433e-a4ed-3ac3bc17bc57", "value": "12288:dkAJdZJGY+5K/Lo9r7WTB+rP3tRO7b1W5Zcnb9OAXepxSnRN:PXZJeK0Z0ktRO7b1W5OTXepxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811243, "uuid": "252bc377-eb5c-4449-ac76-a9e7a72c5425", "value": 677376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811243, "uuid": "ebef3baa-ac20-4baa-8004-0918d7632ead", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811243, "uuid": "e0810996-5c21-4c45-8bc9-764522df2074", "value": "0a3e6422f7cd32f9d2eedde1ab4e6b56ba4cfe4833d2ea90512e9646fe42ace4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76da1f18-1980-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1772817496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772817496, "uuid": "b0e1cc4f-b615-4237-a949-d6dd47943241", "comment": "Malware payload (LummaStealer)", "value": "4f65de1121eb545f116270b2129c4864", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772817496, "uuid": "88ecd5f1-3584-425b-b57e-162d5dc1f3f2", "comment": "Malware payload (LummaStealer)", "value": "0a3f28a6a00303569b639c450319916ca31339ac4a4e9d6535a7104925d83ff4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772817496, "uuid": "547b5ac4-9964-497b-957b-73347c910af7", "comment": "Malware payload (LummaStealer)", "value": "746cbb3b13269461cd48b9ae41a98928b55b8ee4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772817496, "uuid": "e42a2876-0742-4e2e-b08c-3a4a9d09590e", "comment": "Malware payload (LummaStealer)", "value": "3ae0640789587990c8136a9ef548fb1cb2e4e03479c35bc8c611dccea410b3771fb8de9daf43b50d10b7e28553825447", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772817496, "uuid": "8afe6fdb-ab2d-419f-90b0-155fe274183a", "value": "T155E53B72BA09A1DFD88E1774D827CEA7D95D03B94B1049C7EC5CA47A7E63CC111BAC28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772817496, "uuid": "134119fe-0fff-4ffb-9bb5-5af2f1e04ec2", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772817496, "uuid": "5e3f777d-7021-468f-9705-4783cfc43aad", "value": "49152:oBwGC1ylfDfQf8NSCGLjFuJw/glWvVvz5wV6j58hm1q:oWkfDfQf8NSCGLhBglW3wV6mb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772817496, "uuid": "5f8dcd0c-e696-445e-9831-4d53d08b0982", "value": 3173888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772817496, "uuid": "7223c885-fb73-4b71-9987-889b457d817d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772817496, "uuid": "10396c08-ed62-4f96-aabd-3dc6e5e83d75", "value": "0a3f28a6a00303569b639c450319916ca31339ac4a4e9d6535a7104925d83ff4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "099c06c0-1964-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772805287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805287, "uuid": "3a36b76f-e7d6-4a6e-902d-88fb2ff5dae2", "comment": "Malware payload (PhantomStealer)", "value": "b188ba0d4e60e871608368c4478b807a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805287, "uuid": "53a3690c-fb91-4e2f-820c-bf34247ea347", "comment": "Malware payload (PhantomStealer)", "value": "0a9b209c687285dfe10f2c07e6055336b550a601b521030dd1f3b6dbe672f43b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805287, "uuid": "15075459-5781-43a4-ae30-0b3e5809eef7", "comment": "Malware payload (PhantomStealer)", "value": "1078288f42170994c300d7cb81f5cc28f0547664", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805287, "uuid": "873967d3-394f-48fc-84ce-1309d8e27161", "comment": "Malware payload (PhantomStealer)", "value": "10092c594bac3b2d6982f4f0e7f467c4a7858530e3440b8dfcc9b87692f53220308827bb7b87f0ef6c9cbab482aa37de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805287, "uuid": "8cb2eda7-e5c1-4093-b4d3-d0257bba4b06", "value": "T19D75E00273D1C062FFAB92734B5AF6115BBC69260123E62F13981DB9BD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805287, "uuid": "66df54a9-6e4a-451b-84d0-0f5838ae708a", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805287, "uuid": "b7173398-3b23-4908-aa30-1dc6cdc988ba", "value": "49152:kPVt/LZeJbInQRaYCEcSqHi+GBkodqLW4x:aTYbInQGi+GZJ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772805287, "uuid": "d315e7f1-54a7-4802-8e0b-1764e3346812", "value": 1671680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772805287, "uuid": "e928c873-ec8f-40b5-9ad5-29eae934d276", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805287, "uuid": "6f069532-bc2e-4746-92f7-a251ab839346", "value": "0a9b209c687285dfe10f2c07e6055336b550a601b521030dd1f3b6dbe672f43b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "869e6384-196a-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808074, "uuid": "5d7f40bf-6b87-45e5-8909-44a53ac51fac", "comment": "Malware payload (GCleaner)", "value": "101738a3e76d545d5036c6b5edd59675", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808074, "uuid": "25c7334f-e206-4ea5-b03d-2813e2d8c251", "comment": "Malware payload (GCleaner)", "value": "0aed66abbbd5e5544f59fca6a5673ba3c3d3a18eadda161fdf6b50442a0f49f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808074, "uuid": "baef6793-deeb-4472-92bd-e1da30a7b398", "comment": "Malware payload (GCleaner)", "value": "526d7a46e25ecfe43edbef17503ac7f924125d7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808074, "uuid": "1668f09c-38ba-4084-bc32-0abf4010f14b", "comment": "Malware payload (GCleaner)", "value": "86b5905aa7d2796ac9d580c537428135cafdee30ba8ee583662d1ea88aabc74f1919b40a06780c4bbbb63ffe3c38818e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808074, "uuid": "b260947b-10be-4272-937a-c69ec84e7393", "value": "T11516E00E78B36CF9E55D88756C1476D8490D2B2CBE3460C7EDC408CEB71A99C66A8FD2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808074, "uuid": "e906183e-c78f-48a7-965e-df6535896d66", "value": "e5f32a93ddcf3aa9009cd70911b0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808074, "uuid": "c2755df8-a799-4ac9-abd9-9468a17bde08", "value": "49152:19CiLxQzzocBhmbcEqRZoBFBJh0RtLRv8D8bj3DS/yGZ+hY4jLeiq9+uCw:19CexQzpEPBFBJh0h0gveqq9N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808074, "uuid": "9624877b-2e7a-43dd-9231-a4639ffd921a", "value": 4086272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808074, "uuid": "391c9603-6f23-4cfd-80a9-0ccb37f20ae8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808074, "uuid": "f4d1e190-454d-4358-bdba-21bd0896ecee", "value": "0aed66abbbd5e5544f59fca6a5673ba3c3d3a18eadda161fdf6b50442a0f49f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b84be162-1969-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772807727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807727, "uuid": "c1da9b01-9963-41ad-9637-b7aa11872d1f", "comment": "Malware payload (GCleaner)", "value": "4597a15ed3cab5b5aee5fc44e86e5ac4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807727, "uuid": "0d42c755-31c0-42f5-82b7-f18f73788fcd", "comment": "Malware payload (GCleaner)", "value": "0b21ac09096daa1da20319807a2ff2dcdca87b3d3e42007bb1f4961d0ad24b34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807727, "uuid": "bda77a79-c012-4c4f-8332-e38f923e6d32", "comment": "Malware payload (GCleaner)", "value": "b63e9c63ed7021f1c0f0d67663449968f7477ec7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807727, "uuid": "8c6abc1d-4cf6-4bbc-85b3-28bf98df52fc", "comment": "Malware payload (GCleaner)", "value": "d847a2b014d38443721b8cc2941f69e26d9e57c9b350d8255a7d2c557b952a923ea7b1babbb77f2efeaf6ddeb6dc01db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807727, "uuid": "32f12405-e44e-4a1a-a2d8-b6dfb515f805", "value": "T19E16D032CA505AFFC52926FA4C1254DEE9F27928ACE71507BF98DCC5A31BB0D74211E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807727, "uuid": "2a077eba-2b94-4d9c-84a8-1e7c4900d8ea", "value": "e5f32a93ddcf3aa9009cd70911b0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807727, "uuid": "f3ec4149-3e9b-4940-9c54-5c38b9cfc4b3", "value": "98304:h9CexG1tgZFyOeJUP/dhZI2daUhLxc9U:hGtg7wUPNIybLxf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807727, "uuid": "0d43cb4b-5702-4a5b-9a2e-87e2f6f3abfa", "value": 4096512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807727, "uuid": "4fb4c0aa-e31e-4928-8a3b-cebb0adb1aa7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807727, "uuid": "cc49093c-cc60-4c19-ade3-8072eb4508c3", "value": "0b21ac09096daa1da20319807a2ff2dcdca87b3d3e42007bb1f4961d0ad24b34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bb51c6e-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819195, "uuid": "95b3499d-8cbd-46fa-a1a6-2052afca5230", "comment": "Malware payload (Mirai)", "value": "88b3cdc3efc403c8f105995f669db0b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819195, "uuid": "bc7647cd-0490-4366-806a-83a83b4d7de9", "comment": "Malware payload (Mirai)", "value": "0b3ff46c98980133f02a8a4d3c1d675451f308e03a665b866bb4968e000275ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819195, "uuid": "59b293ba-6fd6-4f59-9f96-1d0e24e0ca8a", "comment": "Malware payload (Mirai)", "value": "7db2e54e54f93998d3d39f66a3fb4ec97e512f9e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819195, "uuid": "8e13ede0-66a0-4b35-92d2-b4607f9a0514", "comment": "Malware payload (Mirai)", "value": "1aecb8b802d57f2d87cc1d4f9c0a0b458c93393439c91a327a928579059ddf20193f5e62f5a255ab671bca2b7216509c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819195, "uuid": "f68d3949-9ef0-469c-bdd1-81af729a1390", "value": "T135C31859F882AB12D4C625BAFF4E419933131B6CE3EA7212DE204B3533CAA5B0F77515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819195, "uuid": "d7c8f2c3-93b5-40f6-8a6a-f996c6a1b23f", "value": "1536:eEnSyBSVGcCk/b2Po7XxYaTfaIQOpN3ygB0ylDRi/N8KmW+3ZZqvfki9CWe7PT:4rCkx7XxvTfa3OpN74N8KmW+3Zgv8es", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819195, "uuid": "06d7f48e-95ea-4d6c-a4d6-ecc47dafcb7f", "value": 118348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819195, "uuid": "ef7d9a2e-0eb1-4654-aa99-24a80f8756fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819195, "uuid": "6f9c3c50-c920-4275-8983-d845564bfff7", "value": "violetarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6f65c2d-1983-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772818999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818999, "uuid": "c3cd2263-0e72-4510-9eef-026d68984b27", "comment": "Malware payload (Mirai)", "value": "37d2682a93c7e6f1cfaa6b5444d6c45e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818999, "uuid": "2054458a-933b-4e64-8ed5-9cd9cab39a19", "comment": "Malware payload (Mirai)", "value": "0b75728c66d2254a5622017ab375525b0e8e085e5c8cc2b2dc8ca8a09f57c7a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818999, "uuid": "469e5d07-a2aa-48c9-ae7e-18366776c5df", "comment": "Malware payload (Mirai)", "value": "d9ef578f3e7692477e9fc4da6b8452f605bb842c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818999, "uuid": "15a90de1-60fc-4f83-8a6c-57a6ac26bee4", "comment": "Malware payload (Mirai)", "value": "473b012a80ae3232160f04ed9550c71c504629e2ea25292082fa49ce2ee013ec06ef096615bd60d4aad4c636d19f8d05", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818999, "uuid": "a195103c-92cb-438f-aa6a-4a1e6372a319", "value": "T198933A52FD818622C6C116B7FB2E428E376613A8E2EE7203DD255F2137C795B0E7B542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818999, "uuid": "16b6f4f5-0cd7-49a2-ae0d-0b45239c5f64", "value": "1536:xFju64oZnUCIK86kGHL2XrHH9FjmlHa/ZJd1KyjqdvXLB:xFi64odUCnKbHHDSlH0Hwl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772818999, "uuid": "8b53e392-0be0-495b-8a1b-b35329455835", "value": 93452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772818999, "uuid": "c33cd1ad-3a2f-43ae-bf02-528c1b4f50a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818999, "uuid": "c78c5e6a-f2f5-40b5-b937-659df3c41ed5", "value": "jawirbot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a28adfe-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (NovaShadowStealer)", "timestamp": 1772809234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809234, "uuid": "aa2309eb-54c7-4d7d-9639-8050c734f9e7", "comment": "Malware payload (NovaShadowStealer)", "value": "0709df027271605a5cf0a620b6739e56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NovaShadow", "colour": "#69E761", "exportable": true, "hide_tag": false }, { "name": "NovaShadowStealer", "colour": "#D793B8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809234, "uuid": "3a4babc2-d8df-4db6-83d1-3a3b2889d5d8", "comment": "Malware payload (NovaShadowStealer)", "value": "0ba60875de190dc353c4972053b326634cb23ec8fddc0b7de3d8d67fca11436b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NovaShadow", "colour": "#69E761", "exportable": true, "hide_tag": false }, { "name": "NovaShadowStealer", "colour": "#D793B8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809234, "uuid": "680823c2-0560-4b79-bb30-de48a30521fb", "comment": "Malware payload (NovaShadowStealer)", "value": "461623fe88ad2acc23577f29c84a7e9120ec002c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NovaShadow", "colour": "#69E761", "exportable": true, "hide_tag": false }, { "name": "NovaShadowStealer", "colour": "#D793B8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809234, "uuid": "dae68da2-7b44-4182-918b-4f2fcd5c4292", "comment": "Malware payload (NovaShadowStealer)", "value": "023b2f8f9a9fab6f4a8c36e31a195751a11edc6a30c5221f4ffd8405a3906b18f50d15e9f9e4103f4613aad7d0a057de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NovaShadow", "colour": "#69E761", "exportable": true, "hide_tag": false }, { "name": "NovaShadowStealer", "colour": "#D793B8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809234, "uuid": "693585e2-32c5-4cc5-9d91-d3b4ce1d9baf", "value": "T12808337723CCB486EF4183F039AD723779421951E7E9AD0A7DD351EE2435E22660CBA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809234, "uuid": "f69c7a6b-8cce-4ae5-9b92-d4034f9e6f83", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809234, "uuid": "aeed8d51-d89a-49c5-8876-5c7c1f604460", "value": "1572864:C4gPXMoao5ur+FKXoTkdH57eTJHuzcbKPb0te8QMnnb/7:C4AcWuIKXoTkN572Az6GyiEnb/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809234, "uuid": "69ecd1bd-0932-4053-800b-6f53abf2d874", "value": 83073786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809234, "uuid": "951ab896-e0ed-4fb8-b005-28814f31b984", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809234, "uuid": "c7a3fb79-ac4d-4c3a-b876-6b0a994889a1", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48d663f6-1969-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807540, "uuid": "2d63c60b-f8b2-40dc-b1ea-90ef502617a9", "comment": "Malware payload", "value": "5030f31933144b5b43f6dfc63870d198", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807540, "uuid": "7fa17a9c-e0ce-4de3-a48a-fc3fdafe0ae2", "comment": "Malware payload", "value": "0bde8358b4c836488dbf078dda0539636dc04921b1402a7118334dabe225300d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807540, "uuid": "209673bd-63ca-45f6-9feb-96cfd933990b", "comment": "Malware payload", "value": "9a03cbdaa879611e3322e12c242a5e20b789bc8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807540, "uuid": "7da4016a-b7f3-40c2-bb78-2676e12c5600", "comment": "Malware payload", "value": "4049d3d34ac92da4d245fe5bceffb5ac01a317f6e916fd57bec873a7a47eab109a6b8f8b346f1a45f586d2b4d5442f46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807540, "uuid": "a013c238-2e5e-498f-84fa-6be6aaaf9644", "value": "T13FA4E816E6A0B92AF95345713D78B25A2A2C3C392641EC0BF7C99F5A3A7158370F071F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807540, "uuid": "3aa2662f-22ae-42bf-b807-4d15db2b8e85", "value": "9dea662b6d9f21fcd24ed155c275fc33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807540, "uuid": "5a53e893-5262-40eb-a15a-24e6bac367b1", "value": "12288:Y35SA/LCbpXjuAm8FDEdcfp2h7s7x0c0Ls4477Xues:Y3PIXUo3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807540, "uuid": "b3cbe696-0111-4563-b616-ade1602ad9ab", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807540, "uuid": "d91e1792-855b-4e41-9d67-77f836214792", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807540, "uuid": "32ae2b2b-d095-4a43-b58f-5df340239dfa", "value": "0bde8358b4c836488dbf078dda0539636dc04921b1402a7118334dabe225300d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "544b029e-196b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808419, "uuid": "a186e25b-276c-4a52-aa47-d8544dd7186c", "comment": "Malware payload", "value": "daaa9e40e51717861fe7788b27665204", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808419, "uuid": "7844c04f-cd75-4f23-b72e-d7f61d72f2ed", "comment": "Malware payload", "value": "0c150020cbb47d68b1414b0c93834cdc90ca2d8064354964893b3aba9e553676", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808419, "uuid": "0c83ac3b-b9ad-4ef5-af43-c4c7da206ce4", "comment": "Malware payload", "value": "8ca168b99e3371df4bbd43e1316134401fa4464a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808419, "uuid": "4a87e842-a362-463f-bb66-7666d9ac43f5", "comment": "Malware payload", "value": "280c338d974dc6191ff35565ff28893b1d035da3853d23aeb4b5c73bcaa42138d2e37a3336ea4cb70a060efb6a6836db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808419, "uuid": "903db88c-d461-4aff-9861-5f4b5ba56193", "value": "T19D0512600B51649FE4134871ACF27376F798AE2A377DC3827680B598BE3B2454F693C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808419, "uuid": "6721ede3-f1cd-4a80-a0d4-635ba57e7f05", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808419, "uuid": "ea1d0385-2db0-42d9-b05d-ff0ed77a6f23", "value": "24576:tHO/MdQJNoqtlmfmjcYtEXBWdBz6kqd43jbz1HVkMIwSqLbBYNG0:tHO/u079tEXBWdBGzKb0wSqp90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808419, "uuid": "e6d3736d-52f1-494c-91f5-6ac0fd38e14c", "value": 861496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808419, "uuid": "6369e988-25e2-4383-b04f-ae723cbb1eba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808419, "uuid": "6bdd0ddb-6c53-4c2b-8ce8-9a131b0190f6", "value": "0c150020cbb47d68b1414b0c93834cdc90ca2d8064354964893b3aba9e553676", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72a79eda-196f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810188, "uuid": "08bcb979-ab02-4af8-ab79-2871114b4de9", "comment": "Malware payload", "value": "1b9513f22556276d29188efcb7ae1533", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810188, "uuid": "baa94e2f-4827-432a-ab24-6f5c7f316b47", "comment": "Malware payload", "value": "0c189c41e94658eea3482f30109656d3c911f683698ce5ad531e396d64596542", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810188, "uuid": "b50034cc-e38e-4938-b5b0-6fa2c1030949", "comment": "Malware payload", "value": "b5b31bb3ce499eef41f6ec98389994ffc6733ff5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810188, "uuid": "b8e36653-f4e4-4e2d-a805-111eb35aeba8", "comment": "Malware payload", "value": "c4ae491a23f9705d10e8a8f05e31c9873b61258081b7af9f5b1ca9ad266a03828d7825c2b52b1e4e689b218ef5fd1adc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810188, "uuid": "15939ccb-e6e2-4fe8-9bf7-66fe5663ac47", "value": "T194D55C52BE809478D0ABE335E8F11251AA607C5D07303BE32F5A7AFA1D36BD40E36759", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810188, "uuid": "c82de64b-19b4-4d19-8b00-377f80ec9c4c", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810188, "uuid": "a51005b6-ab34-442d-bdb8-4d28c70f3c18", "value": "49152:ijVfkU14zjM47jAt7JhoNoqHWSgnzuK1/:emzh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810188, "uuid": "55eee997-37d8-4f92-8780-d308eca217d2", "value": 2814464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810188, "uuid": "8277ea35-0643-4844-b30d-ce3b40a9d96d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810188, "uuid": "a6172435-a253-47ac-8566-9ffb84dcd51f", "value": "0c189c41e94658eea3482f30109656d3c911f683698ce5ad531e396d64596542", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fe94aff-1974-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772812223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812223, "uuid": "1adbb113-f36e-4bb1-83d5-d3bbee17e940", "comment": "Malware payload (Mirai)", "value": "56f11a020dc69bae62fbc327987ec57e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812223, "uuid": "8bf1f823-deab-43ae-b96c-ebb04b253bbb", "comment": "Malware payload (Mirai)", "value": "0c1dc0c5ab0a63a964a8114860c58d7a9d4922990e13414abdee19cff4044c28", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812223, "uuid": "798a4ecf-b271-4516-8eec-04f2b84aea44", "comment": "Malware payload (Mirai)", "value": "acf0d59211c900233eceb11d4a1b1109a09f44b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812223, "uuid": "fb9fc9c0-9603-4d68-8377-db702951d7a0", "comment": "Malware payload (Mirai)", "value": "27f2a84859e5416de2f31ba0623e816121890b2f42626c5c8989ce7f0ef70fb3bb0f8e8d53a772610d549e11a8d4c21c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812223, "uuid": "0f81bcd1-724b-4901-927f-64d2c55c0459", "value": "T10114E81AAF511FBBD86FDD3742D8071135CCA54722A93B3A3178D928F54A50B4AE3CB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812223, "uuid": "6b1cce20-d98d-45b7-a77c-7aca36d009f7", "value": "3072:tTPVDCa7E+0nf5khQ6ecSWvkKL8+jSzFB:tTPVmqc8aWvtL8+jSzF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772812223, "uuid": "07d67f7c-7d12-46ae-b723-da394cce9cbc", "value": 197636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772812223, "uuid": "d7d0672a-78c2-4f98-88b1-f331fc30eb48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812223, "uuid": "9e57cb7c-df07-4d9c-903a-68ddb74b0c13", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16fe0cdd-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1772808745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808745, "uuid": "75caeae2-52cb-4117-ac3e-cfe5490df6fc", "comment": "Malware payload (GuLoader)", "value": "54ec0c8ebcdc101887fb8904ef992b46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808745, "uuid": "3a77459a-ab58-4990-9b8f-c5e8a4496b47", "comment": "Malware payload (GuLoader)", "value": "0c9e0b19e3596d6b2cd821435316d85141b41aaeeae15f3a9777804b01515eea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808745, "uuid": "902494dd-91e3-4b6d-bdc9-b01001dbfd41", "comment": "Malware payload (GuLoader)", "value": "6dcfd76e92982e437bc56411691059f254744fe1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808745, "uuid": "232d8c26-a379-498a-b6cc-2e6e53003e9f", "comment": "Malware payload (GuLoader)", "value": "5479bc6750bc2622d4ef3bc2c20a5b27ab558f71faff9fd0137756fe58a6f24437fa5a42fee842acdf970d579fdd1146", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808745, "uuid": "b8896538-443b-496b-965f-347ae5471408", "value": "T177341226B2A0D56BE67527320EBBAF3BFFF6790110948F032354AB6E7D72581901F416", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808745, "uuid": "cca4ab04-2fa8-4214-9f23-e2731a179782", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808745, "uuid": "1c54f1ec-27b1-44ba-b7c4-51104eed3e89", "value": "3072:5WIWYHxfvyH+cd459DsvhLyNB0r2eyaR4TeEofbfM61ATiLk+7hJuGkY32CNjJBy:kcBvWb0IvG/RaIeEoeMk+pNzvowq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808745, "uuid": "b267e44b-797b-471f-b280-87ba79b3516f", "value": 240743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808745, "uuid": "c62f4f84-dd4d-406d-9074-f9d7b2f1317c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808745, "uuid": "6954ffc5-aac0-4c7c-9f9a-3edde9cf27d4", "value": "0c9e0b19e3596d6b2cd821435316d85141b41aaeeae15f3a9777804b01515eea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88bdc46d-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819244, "uuid": "93a5d9bd-c9b9-4eaf-aa40-304bcf65610b", "comment": "Malware payload (Mirai)", "value": "394e9d485bb9ea3367028b7e1b39afba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819244, "uuid": "d71dabc0-7182-4c44-ae64-44ee12ab49fd", "comment": "Malware payload (Mirai)", "value": "0ca850adf73b299f9d3cf3edb41ceb83dc50c352f5788ae1cf7e2813ad56186d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819244, "uuid": "439e258c-cb58-41c2-ad52-b53d850c90fc", "comment": "Malware payload (Mirai)", "value": "7c4d8490ba57bd56d06c16232070b281485c6037", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819244, "uuid": "ed7fb3b9-fb22-4675-8dde-c8e2a1ab60ce", "comment": "Malware payload (Mirai)", "value": "30df22d2da7699d43ab83546f3a0daec3649cc5dbad5400d422604971018f324529e87409ecaf48bc65654229a0eaebd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819244, "uuid": "c71ee03a-4416-4a80-ab4d-1b53ee1c780d", "value": "T136C3FA5E6F329F6DF12CC33147B78E21975813D223E1D685E2ACD6055E6038E981FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819244, "uuid": "a4ddef00-c6ef-4abe-b7a6-b577e79af9a5", "value": "1536:iWQ5Ri8+v/t5rm4RfWuQNC8RLipYJPRUx3nfylJZ74uk97H9NefxTLRo1xWe7HA/:qrNiN9fuLipKQukpH96o1zi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819244, "uuid": "63ad3939-87ad-4bd3-a6f9-dc261436c6dd", "value": 118724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819244, "uuid": "4f9242fa-25b2-454d-987d-b82f01474271", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819244, "uuid": "1e045b70-4386-4ab3-b277-38f463dd5c0a", "value": "violetmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "558b3cd2-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772808850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808850, "uuid": "b59bd56d-7a7f-455b-8c8f-fe2cad2ec3ba", "comment": "Malware payload (Formbook)", "value": "65831a6209060d39487c945ce916a33e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808850, "uuid": "318a9db6-f8cb-45ac-9016-9a4bcf16584c", "comment": "Malware payload (Formbook)", "value": "0cd839c7cabceabe9324f0a440d99669a6e4f4c7975e2a19170d7289b5408ef1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808850, "uuid": "9040696a-9117-4ee3-9f02-a5bee8c1811e", "comment": "Malware payload (Formbook)", "value": "7fa5eb306d8cbbfc593c605cb3ce53342258a5f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808850, "uuid": "c646eb89-7692-4407-89df-d75778b73d2c", "comment": "Malware payload (Formbook)", "value": "a1ff0f7213e8743b6aee44499985e8b5e0177ce100aaf002c3c1f1a40328678f3e1430c3f688a74729c59532257c20cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808850, "uuid": "3c35353a-861b-4ad7-840b-e3b6b577638a", "value": "T1A4F49F2DB4E2A0D1ED2198F30F5E97E04E1B731367A61C5723B802448B954FF1E6EA67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808850, "uuid": "844542ce-451f-4e31-b342-76ce1b28fd2c", "value": "96944a9beff3e19cb1f487616a09413c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808850, "uuid": "56c2abcd-3c37-47b8-8357-016bc5b50ba5", "value": "12288:PDeS37qWkCQ/y2iARBRnjQzyBtthtaxriaCoCM7Bmt1/uVgr6Yla+ck7BrH7FGhj:LLEfypAnRjbBPhtHdp6Bmv/uVsZg+Z7S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808850, "uuid": "1285213d-dc61-4951-8a2e-c63e7080e295", "value": 783360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808850, "uuid": "5cb7ee78-22ce-4ea8-a9b5-297528cb9250", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808850, "uuid": "5776cd1b-c951-4671-a0a2-029da3afd25a", "value": "0cd839c7cabceabe9324f0a440d99669a6e4f4c7975e2a19170d7289b5408ef1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ad19a60-193b-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1772787680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772787680, "uuid": "991911f6-ab07-41b4-935b-59bcd5785295", "comment": "Malware payload (Efimer)", "value": "273c3e6fdeba4b856584f808038319a0", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772787680, "uuid": "42b7ac09-8008-4129-866c-e95040c8197c", "comment": "Malware payload (Efimer)", "value": "0ce51c33748070cc56b345617ea0ca6ff289db196dc2db802e1004ed66c11bdd", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772787680, "uuid": "ea364b08-08f3-41df-a16e-990b337bb0cf", "comment": "Malware payload (Efimer)", "value": "2654b7bf3a71de51b8e737b491d1b5a157134e03", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772787680, "uuid": "3a989d69-c26c-43fb-ad94-ca195e356c87", "comment": "Malware payload (Efimer)", "value": "6f2121111459f98062c2f1514f53046f6e780fd801998a05e5862dd49e13141d21b7c5a006e626892fc94bdce42fc528", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772787680, "uuid": "09668eeb-d5ab-4a93-b85f-34f8e43172f4", "value": "T162D633187BD006EAFA73803DABD14165F979B4B54374C2EB2B6C8B615F271E04D3A263", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772787680, "uuid": "b20338d2-24f6-49f0-abf8-62c99a2545ab", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772787680, "uuid": "54f4b800-cc80-4c82-959a-574312e27462", "value": "393216:BN+37QU0aRjzGJft/ncIQc4vvkJxdEyXMCHWUjXBcuI3/PGTAI:BM3MU5Axnccqi3rXMb8XWH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772787680, "uuid": "0d448a11-77b6-48e2-8605-97efa8cd2566", "value": 12749761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772787680, "uuid": "77b75bf9-5183-4652-9d18-1cee8ca6933c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772787680, "uuid": "d95cde13-2dde-4217-ad80-1035e5fe2b74", "value": "0ce51c33748070cc56b345617ea0ca6ff289db196dc2db802e1004ed66c11bdd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df5f383f-1928-11f1-a769-42010a9c0008", "comment": "Malware payload (Heodo)", "timestamp": 1772779876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772779876, "uuid": "380b6aac-ddc6-44ec-9e71-045331cbde67", "comment": "Malware payload (Heodo)", "value": "58b4d0e400c76005d3d5060c38aaf324", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772779876, "uuid": "508f6d50-af31-42b1-80b3-1fcecb2fc2c4", "comment": "Malware payload (Heodo)", "value": "0d06b42a2f780cd8e9be998b25a5187b1479521d39417c0f815b84e1fa822070", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772779876, "uuid": "d787d96d-594b-42bc-8972-a18a5660d3a6", "comment": "Malware payload (Heodo)", "value": "6fd985c1909251cbc4660a376cccbed33d3635d3", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772779876, "uuid": "2769fbfa-8dfe-4d3c-a202-83b75b96ae44", "comment": "Malware payload (Heodo)", "value": "7fe4265977989ff19e47bd24486873b90d29c4b62fc16bd13325af0272f540a411c65277ca045b9afc855e440d320c19", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772779876, "uuid": "5d9ff9a8-f496-48e0-8fb7-a80db1f00184", "value": "T1EFA63332C32AF955D95372B939BBC61A942FD6883343A5CF17B819DCACC19D05B2E309", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772779876, "uuid": "1d917ade-4329-4c61-8ed6-ea6e31914584", "value": "196608:o6gGLdq/Q3Y0iNSrb1Gf0suSMMl0bu6Z7EfxrA+O7i:ZI/Q3nJb1GfeSM+0buiIxrA+O7i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772779876, "uuid": "e3dc0847-d68b-4530-9798-25cae6fd3552", "value": 9563667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772779876, "uuid": "abf8300e-715d-4a1d-998b-54dff88e2fd4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772779876, "uuid": "fe3df6fc-bd76-4c15-b1be-acaee5bb262f", "value": "0d06b42a2f780cd8e9be998b25a5187b1479521d39417c0f815b84e1fa822070.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bf99ab5-1970-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810499, "uuid": "697def54-2ccf-4d00-a6b1-d618609fbc0d", "comment": "Malware payload", "value": "1f3db92afe323ae80d5f24bd5691d09e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810499, "uuid": "78c4fbd5-ce45-4c2c-80c5-123a2f3aed18", "comment": "Malware payload", "value": "0d26f7dbf57f5046777613ba4b28856e2375a31971a9d5ff789d9d265d88eb9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810499, "uuid": "3bc8bb3e-8ea9-4473-b8c6-10cc5d40133b", "comment": "Malware payload", "value": "b658a98dad7fad3bdf174b3fa34994dedef37bad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810499, "uuid": "8de7d20c-b660-48a0-a5a8-d9d5244b15e8", "comment": "Malware payload", "value": "ce2b3237179fd9ba3f442076ab16bf94c5ce454079b48382e61e461ca10e063dd466e3b852ce7324c572f7a0a9948e54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810499, "uuid": "44be97e3-9fea-4066-9287-ff6c1df7bb42", "value": "T10425230822CA89FAC5E96F32E1E583648F46DC39139817CFA388FE98F115BD15E1F651", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810499, "uuid": "0f84a68e-5d0f-44ee-a538-edf4db4b0274", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810499, "uuid": "64619b93-b638-4f6f-86ba-98ac6dac464d", "value": "24576:pyHHVMpu34YdcFfDYs/MhKCrzVpMRKBQRKrXWi:8HHupqir5MhKCnQkLXWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810499, "uuid": "06e6f4e1-78ae-449f-8278-0df72557491f", "value": 1055616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810499, "uuid": "650f2477-b867-4c65-bd26-0918a02c6cc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810499, "uuid": "923dad5f-be91-4d7c-aa56-38bf3802d5dd", "value": "0d26f7dbf57f5046777613ba4b28856e2375a31971a9d5ff789d9d265d88eb9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "012adc54-196e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809568, "uuid": "01b150c3-8abd-4b8f-a053-5d2d94f16fa3", "comment": "Malware payload", "value": "8d1239e20b67d593e731a873755b65b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809568, "uuid": "f477e0af-a431-4498-9317-3e82f647f4de", "comment": "Malware payload", "value": "0d29b2a99c1b1b49458edf202feb084c020a1abfe8d6b5ea6ef609ce615c4624", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809568, "uuid": "c615568e-1f2d-4e66-a673-386a16af91b8", "comment": "Malware payload", "value": "8e5db74778f74eea45a3693c8c0718fc7ed45a8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809568, "uuid": "a6828113-e604-479e-8e69-b1faf32308de", "comment": "Malware payload", "value": "f5735a5868f98237565d99516a1e77305e9a2e4c98f0870b05f4944b899aad93bba7bf583ef06e654bfe12996efbb537", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809568, "uuid": "18f4d605-64bd-47e2-a344-397454db41f0", "value": "T191C4AF91F711DAEBE5A60ABA4CBBC43135676C6E8AD2111E316DB22825F331111DFE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809568, "uuid": "05b29fd3-3c28-40c6-b343-398034fd5c8a", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809568, "uuid": "f0034a20-92f5-46bb-9cab-b0d94fc2d29a", "value": "6144:fwq3NpQ3wDIywUF5ykHERIe6McaazxpwErQMlWUYMuhlhGzcOV1U4f73IH6aq:fzcae63aIQwWRbGzxTx73qo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809568, "uuid": "d76951bf-19be-4f54-a6b2-b2a409cc4407", "value": 553120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809568, "uuid": "63865f95-ec1b-4e71-95b0-180caf8ff47d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809568, "uuid": "d4d5a684-9ed7-4cba-afd0-c02953dd9727", "value": "0d29b2a99c1b1b49458edf202feb084c020a1abfe8d6b5ea6ef609ce615c4624", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "960b0c00-196a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808099, "uuid": "88268f9a-64e1-431d-9f32-a78d56f5d0a8", "comment": "Malware payload", "value": "c991d4c044e445a00c885a4faedc2529", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808099, "uuid": "649e161d-1beb-4fe8-9414-034a9fb67646", "comment": "Malware payload", "value": "0d414e464e17678b9aaa10d953677a5f7bb0680ff4df2d21d33a47eaaaa5f900", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808099, "uuid": "c021d6af-dfa0-4cf4-8de9-52f54f0bf053", "comment": "Malware payload", "value": "14f9e5bbf686b1075643cacdf282765964f503c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808099, "uuid": "ce5085b0-f0e9-4033-b02d-15276395de76", "comment": "Malware payload", "value": "3a689ec421554c3aac156a0bd60b6274881ed5bac7b27e5af30f6a4a452436a54a682a4adbf0dc6d1673c2c3f81eddc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808099, "uuid": "d1ee46eb-537a-497f-867b-63ec1e59dd4f", "value": "T19D05AF4DE5E160D1ED2288B30F9E97D1891B7313A7A5189723B802044B974FF6F6EB27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808099, "uuid": "25acd02a-c3a0-4460-ada4-57e50a4fe2f0", "value": "79b51b0b8fa06ebea3a256fd7f7ce2c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808099, "uuid": "1f765efc-a326-4b61-8091-3bae12d106be", "value": "24576:CayxlixTtcRIa6ctfnQL35Lx49dTcP9g+fS:CadbEdnQ75C9dk9g+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808099, "uuid": "ed5cdd54-8e53-4796-8323-63fca7c00094", "value": 862720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808099, "uuid": "91b47816-778b-450f-894b-a6d61a116a50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808099, "uuid": "677134e0-677a-4ecd-af08-57d8d223b3c9", "value": "0d414e464e17678b9aaa10d953677a5f7bb0680ff4df2d21d33a47eaaaa5f900", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbfdfc09-1928-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772779843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772779843, "uuid": "ef392a99-aedb-4d8a-acf9-7722916622b0", "comment": "Malware payload", "value": "550a48c47e4be4adb5bd13b2c893e57d", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772779843, "uuid": "1214977d-89fa-4f22-a12e-579d17642872", "comment": "Malware payload", "value": "0d5de95ffecdad96465389a555f9132fef20557430ee7e4b15a372608c3019bd", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772779843, "uuid": "6454910a-388b-4684-b883-dfd4d6309600", "comment": "Malware payload", "value": "18e30d147205c4a5ff0728befcec00ef514c5d95", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772779843, "uuid": "ab2eb237-0c05-46e5-9c88-d85b0dd1c0a3", "comment": "Malware payload", "value": "bda5e93d16973154c333d64cab6bbb9d2123dcecdf3b1ffe01d399f982e62a1dcf7c61935e4b57bcb9ee89cad8158782", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772779843, "uuid": "90e682aa-c6a8-48b4-8a9e-ff2d3d62fc0e", "value": "T1C9E523849EF26701F6D682CAB16BE5C4FD2E1C223418CAC8BA7FD4D464D1D25FE4864B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772779843, "uuid": "9ec7919b-b47f-476e-8463-cc3f7dad0627", "value": "6144:QsmnUs7QjOvfAMsmnUs7QjOvfA7eNxnzV7Iplm0lGALblU54:DmnUHOnAnmnUHOnA7CzV7Iplm0ll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772779843, "uuid": "1c5d2c6c-e32c-4c32-8100-02c33ccc5773", "value": 3068079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772779843, "uuid": "178f7d48-49e0-484f-b686-84fa9fe1d240", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772779843, "uuid": "83c0a688-ffd5-4070-9c26-3fc1dc1e8c40", "value": "flow.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24f1ed5f-195b-11f1-a769-42010a9c0008", "comment": "Malware payload (NirCmd)", "timestamp": 1772801467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801467, "uuid": "9a7211dc-9071-427d-bcb1-213dc270bf0c", "comment": "Malware payload (NirCmd)", "value": "09cf561dcf3b0f81fa241bcb170b3c2a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801467, "uuid": "af140e30-e2a5-44a1-aa85-e9d142e17da5", "comment": "Malware payload (NirCmd)", "value": "0d6f9701bbe0142a18e081bdd354895d9e3d678bbacd0a84c4080ea3eaeed5eb", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801467, "uuid": "b7aa879f-0221-4ad5-8865-459d6a922fbb", "comment": "Malware payload (NirCmd)", "value": "95be34ed1052be2f0ef91709a6651d60637aef81", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801467, "uuid": "b05b8039-5425-4871-9879-221c871d6378", "comment": "Malware payload (NirCmd)", "value": "4a87af0728bbe431d560b05ca19f700340658525666da2d43bab2b68f528704cb367af26189ae81df144473321953de4", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801467, "uuid": "27c5a8cf-a5eb-4ff7-83ae-9e9a9971e6f2", "value": "T10FA52342F8C485F3C4511C331B65A7616A7DBE202F268EDBB3856B1DE9614D0EB31AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801467, "uuid": "6603ee02-c85e-404e-8fb4-ed47d6d9ecab", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801467, "uuid": "084c438e-949a-4caf-92e1-8a93241c590e", "value": "49152:ABROTpc8iYM5pF9UBB6jdLXsuuX4/cqZIiQx6lSONx:a8TFM5pXUBB6BLXTuoEXx6lSONx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772801467, "uuid": "9ac90cb8-9a10-4392-9ed7-94c18608751f", "value": 2110512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772801467, "uuid": "8290d513-d686-43ee-8473-151f5ccf1728", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801467, "uuid": "07ade4d8-12e3-4b71-a8b3-2cff3ca3eeb9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e41e796-1900-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772762426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772762426, "uuid": "2e8a45f6-26b9-4771-92df-f51dc8e63b02", "comment": "Malware payload (Mirai)", "value": "e5eb776367d69089c847972b9b22b852", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772762426, "uuid": "d185ec02-e394-4455-9523-8b582dd77f5a", "comment": "Malware payload (Mirai)", "value": "0d8132bdedb562bf7dc10a1d7e81607ecb4d090ed96bf1a118da4e1084504845", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772762426, "uuid": "ca844814-6a1e-4b2f-9b6d-d5c5dfec36dd", "comment": "Malware payload (Mirai)", "value": "cffa8c21a594fd3c653310ae7b3b5a909e1657f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772762426, "uuid": "e8cec07a-8897-45c6-88e2-3d05e986cc94", "comment": "Malware payload (Mirai)", "value": "01af5aac2f343027b9b9150dbdae811a5e7836d13564d2a7aba6635f8b19d68ec6e9b2e0ecac7dfc4f2658c1b71d4dcd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772762426, "uuid": "132a9455-36d9-44fb-9d9d-b48eeaae141d", "value": "T198E44A55F8C09F62CAD56576F65E82683313477DC2D7F30689188B383BA78AE0B3B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772762426, "uuid": "26fb860f-12e3-4653-a2e9-00fe8118902e", "value": "12288:glwOAUlS0XpX3WW/dMSD8dbyqzQr4+f5qevQXfW6pZTbkvVFAOEHh52:gphjmdbyqY4+f5qek0VFAOqh5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772762426, "uuid": "e06e0e43-d0f5-440a-bfa7-b7ae45d2c13a", "value": 717168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772762426, "uuid": "3d3aef1e-1e52-48c2-b705-3da3a9854ab0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772762426, "uuid": "9eb1ed1a-9308-4b95-97af-3f67fc1a376f", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41a160dc-196b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808387, "uuid": "338c22e5-0738-4df5-84fd-3b7a58008963", "comment": "Malware payload", "value": "5ecfe80edd641cbb651548b8b614d7ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808387, "uuid": "43d4470f-ab46-4217-85e5-f689836b85a4", "comment": "Malware payload", "value": "0d8e84be1e43c2a884bd80f7fbdfd1e82c26cd9a58d700599ad4b16d162d1610", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808387, "uuid": "b177e8a6-b7ba-4df6-a006-440316536d2f", "comment": "Malware payload", "value": "5e3e6e61daa6aa2ce58f89ff3d986c2d9aaeb91b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808387, "uuid": "0444461b-4bb3-4a46-a181-8a808e37497d", "comment": "Malware payload", "value": "804c642dcd45fbc937e2fa1bdd32b964e1fcd6e34ebba4cf0faeada1bab29ef61136b10421078dfe6174654569c9eb28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808387, "uuid": "b5f898ef-81f6-408a-a3a3-1de395cd6779", "value": "T1A155CF0273D1C062FFAB92334B5AF6115BBC79260123A61F13981DBABD705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808387, "uuid": "38f2706a-5488-487d-915f-ded388501808", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808387, "uuid": "ba713e59-bce9-4894-8ff9-801e8ca706aa", "value": "24576:v5EmXFtKaL4/oFe5T9yyXYfP1ijXda+ftXj1lHeftVrB:vPVt/LZeJbInQRa+ftXjbHK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808387, "uuid": "43de89ec-6d15-44ac-a858-4d65e8005eb0", "value": 1282560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808387, "uuid": "6803b0e8-f885-4331-9fef-be975c55cb65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808387, "uuid": "d88b7bc6-46dc-490f-a55d-759fafe91567", "value": "0d8e84be1e43c2a884bd80f7fbdfd1e82c26cd9a58d700599ad4b16d162d1610", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff12d068-193c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772788519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788519, "uuid": "b5523560-751d-43f0-8a4c-2e8fd3eff66e", "comment": "Malware payload", "value": "b6d22b744358b322a7d79c9756356092", "object_relation": "md5", "Tag": [ { "name": "157-20-182-49", "colour": "#B32581", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788519, "uuid": "21b0216b-622e-4044-b491-69e2d11d7ae4", "comment": "Malware payload", "value": "0db367ed84c2722c3d05642c46b7b584dfc42dd622249954b9e143c9388dd1a7", "object_relation": "sha256", "Tag": [ { "name": "157-20-182-49", "colour": "#B32581", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788519, "uuid": "4acead9d-b9f8-4f5e-a9d7-3dde0443279a", "comment": "Malware payload", "value": "d7818918dd500cece588e8e25991489774555ca5", "object_relation": "sha1", "Tag": [ { "name": "157-20-182-49", "colour": "#B32581", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788519, "uuid": "1718406c-f584-426e-86fa-41a0d83e7f54", "comment": "Malware payload", "value": "02872693db04ffdcfdf11f4da8b011b8aa60f5eeb7a50254ec96bd678fb2ecede4e20abc76e586fb9db1278624f9a8a5", "object_relation": "sha3-384", "Tag": [ { "name": "157-20-182-49", "colour": "#B32581", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788519, "uuid": "95c5c86b-efce-4c54-839a-58927f2d4846", "value": "T1E4878D87E8A045E4C5A9C534C6659163BBB1BC894B3467C7BB9DFB242F327D0B97A300", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788519, "uuid": "3e37ab67-2868-4252-aa8e-435c32644c1d", "value": "196608:TnNHg0pnB1bLFs4TyDarXvTrAqdvyijU2bo8jJgp/xVfqzF6IOQq2U/e:VDnPbLFs4TyD8vAqnU2bLJgprfY61r/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772788519, "uuid": "c1ce1dbd-e7ca-48ee-af8b-6087bf13de6a", "value": 38533120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772788519, "uuid": "02ac5dde-7494-4b1d-811a-ca548e624f92", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788519, "uuid": "c8de9e5a-14a1-498b-9dbb-3c6aae01f838", "value": "0db367ed84c2722c3d05642c46b7b584dfc42dd622249954b9e143c9388dd1a7.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ae3d6c2-196b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808322, "uuid": "b68de386-6d80-4514-a5f5-e5c3fb42f5fa", "comment": "Malware payload", "value": "37ec20a39c4f0fafcd4135f4b8b75f63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808322, "uuid": "f74a987e-4bbf-452a-87d5-d6881df271e5", "comment": "Malware payload", "value": "0e1d94083848098aea2d7134176935f801ce8113f1ddf504fb7df027461597de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808322, "uuid": "4f635292-3cde-4bff-b17a-c8ff7b32a027", "comment": "Malware payload", "value": "b5b151c16414248acfcb0a6f441368f95bb4d028", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808322, "uuid": "a46e1ecd-b6e6-41ea-96a3-42d3657704a5", "comment": "Malware payload", "value": "1cfd8f8744fc817aba9aac023015fa62d89f9dd284c309f71fe8d06e2b033c90f66323959c870da093de0c86ad132abc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808322, "uuid": "110cdf62-5491-4705-b59e-adf5c0a34d0a", "value": "T12B94F612D650716AF89749B02D79A256782D3D3A2E80EC0BB78D9F5A3771683B0F431F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808322, "uuid": "d66c49ca-28d2-4dba-8360-bbd647bcbd20", "value": "61faa009f32abd23d86bdfa12f5e8077", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808322, "uuid": "8e696f00-77e1-481d-8aef-f5021c9d2e6c", "value": "12288:SjSFdgE7Opncn++J6zGTN3rod9RfAHoVKaK:1i+gzQGwq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808322, "uuid": "f33b6833-a00a-45e4-aa35-05bc0bf99cab", "value": 417792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808322, "uuid": "6cf45dd9-7e07-46b8-99c1-a1482c1f2869", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808322, "uuid": "211241e6-36b7-430d-8e5c-8ea205190856", "value": "0e1d94083848098aea2d7134176935f801ce8113f1ddf504fb7df027461597de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6d70160-196b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808611, "uuid": "2c53d0f6-0db0-4af0-bc40-ce45335e49ca", "comment": "Malware payload", "value": "bc9f6b481ceee95985c423d5d9fe7795", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808611, "uuid": "39d0e79b-0194-4d35-9ded-4180832c4bd4", "comment": "Malware payload", "value": "0e2ab7d1f3695a9aa5ebf1c294c8782fad5673eff65b7e0cea5b33e136f46e8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808611, "uuid": "6d1cc282-9bed-417e-9c3b-2efc924ba42c", "comment": "Malware payload", "value": "4546f57f723e6fe89896285ac4803f65b2fe0b65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808611, "uuid": "4f3406df-bc66-4e0f-9d8a-1148d9b7817e", "comment": "Malware payload", "value": "c4b5793e742f86251773e2c99865ae1e206eded72e0f966b210a8ee9cf2cbeacc5453fa0e2304793dc82c9072ee830de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808611, "uuid": "b37a4d89-4c77-4653-8e25-403488c66b0b", "value": "T1D205F158271ADE02D4B20FF04E71E7F54BB85E99A411E3438FF6BDDBB92A7006D41292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808611, "uuid": "8ece18ac-a5db-4b4b-8ba4-21e974823b68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808611, "uuid": "af8baf6f-c2fe-4feb-85a1-27b599150ab9", "value": "24576:tqu2VhG6TLiIfq4U1w/qyky6SIMCF1EA:teVhGwzU1QdVIXEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808611, "uuid": "c0f18d02-bb0b-4d32-b3fc-858b4c26c227", "value": 821248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808611, "uuid": "1ec0ebf7-e484-45a0-b86b-b803681ee8d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808611, "uuid": "04eef963-3318-4013-886e-15131aeb5b6a", "value": "0e2ab7d1f3695a9aa5ebf1c294c8782fad5673eff65b7e0cea5b33e136f46e8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b0d64e6-1995-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772826576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826576, "uuid": "a1f41995-a736-48ca-a67e-7d60e2175e88", "comment": "Malware payload", "value": "a019e10f2b09e29be244f3c9e430a34a", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826576, "uuid": "1c6fb5e1-6bb4-4f1b-b001-5ea74989b82a", "comment": "Malware payload", "value": "0e331a3e7fd3d6ba920d13beddb1cf4145fa3d76adae5c95c95878f4fcac1932", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826576, "uuid": "e09605f0-d62d-4699-a2b3-9a571d6657a8", "comment": "Malware payload", "value": "86516e7564d0e0362989c9336f1960d18ce498aa", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826576, "uuid": "859c5b54-cb24-4855-bf65-e648b361fd93", "comment": "Malware payload", "value": "57df87232c07ae67c556393caea7901580f234be98537b4c65b175d0b92fb69ef8b01d7f5fbfd31c543923d0592e9390", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772826576, "uuid": "15829079-f6b1-47ab-98cb-a88694897c7d", "value": "T1B8052214C3A4B5F9F504A236716454CA68A04923E109F65E59E7382F8E63FF4AEF9C3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772826576, "uuid": "29a5e7c5-78dd-47aa-ac43-8a4de4111898", "value": "12288:7uGtl1z3aUMxanB0fgUlZOHmbGNECrdRN+snRBolgkaas32A3fF2AYiEZxbY2zGB:PX3Eytw2mKtdHR9dPMAYiEjbNzGYoIw1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772826576, "uuid": "678f79b1-860f-4a55-8863-b5a69f2f9527", "value": 827690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772826576, "uuid": "e6df11d3-c63f-428b-acc6-3dc4bbaf0b61", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772826576, "uuid": "f0014eab-59cd-4271-84f1-aa703ebe6a62", "value": "SecuriteInfo.com.Trojan.GenericKD.79643133.1427.4763", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db3e0d26-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772809504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809504, "uuid": "39655b3d-3e89-4df6-ac20-6b51543f75af", "comment": "Malware payload (GCleaner)", "value": "fa9671e4ea5aca22253c8f8e0b6248d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809504, "uuid": "3f3ab7f1-8016-47e3-a81f-52b1fe818781", "comment": "Malware payload (GCleaner)", "value": "0e4038c71e12dee0e050106c1a6fc5070dadcf25f23828333ba830936ce656ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809504, "uuid": "20896e79-dde5-4161-811e-06811db24640", "comment": "Malware payload (GCleaner)", "value": "5c39e7f64297810cd2a056f0130d86f47fce72c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809504, "uuid": "23ca6090-9eb2-4bd9-97b5-5b475c10d569", "comment": "Malware payload (GCleaner)", "value": "0ab55ad642d6e3034a5b5265047b926de37ad77dd96d876e49b9a7f9a0972526ca98bf8087200eec66c9149dcd17ee73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809504, "uuid": "c38303b3-3712-4d33-a469-72299b8e6b2b", "value": "T10316E027DD4F6229D4282C375C2967EF96DC7F02289E45C84E690DCA4E7FA9B38CC581", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809504, "uuid": "24cc0621-1c33-4986-a5fe-d5171dbfad1d", "value": "345624d13ffc2b7f296b9d2972b1c0a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809504, "uuid": "3ee1895b-b276-4483-aa4b-0cbd87aee601", "value": "98304:siZnokHrT5QfmusRenOZEuuREgkcPoYfYF8p0AlY//:sY9LlNusReYEuOEgk7Yf68BO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809504, "uuid": "38c2315e-1a39-4fa9-9755-8f210c1fd4b8", "value": 4290048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809504, "uuid": "3617c9d2-daff-454a-90fe-0bfbba4d5099", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809504, "uuid": "a0d560a1-2be9-4dc0-b2bc-083c40f5a678", "value": "0e4038c71e12dee0e050106c1a6fc5070dadcf25f23828333ba830936ce656ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "386fb569-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808801, "uuid": "64738fac-e2da-4d6f-b83d-66ccb43942f8", "comment": "Malware payload (GCleaner)", "value": "c9edf7efdd7a472b29129c42066ef1a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808801, "uuid": "7384f7f5-b1de-46ff-b2df-0a70fea60585", "comment": "Malware payload (GCleaner)", "value": "0eb657033b8d77480d42e76f90271d731f5bd8ef2c1f56276834afa4eb01aa18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808801, "uuid": "5a3ec638-08c5-4fb5-888e-73ff1102ccbe", "comment": "Malware payload (GCleaner)", "value": "498961a998b18e8fc36a0acc47dea958aa5a35f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808801, "uuid": "622d9354-2f16-4d78-ac8f-73a68133fdc3", "comment": "Malware payload (GCleaner)", "value": "e9fc83de01cd38e1c43a87e6527b3402c51e2936345ee31c1195bc2394bd9ce35695033cc91680ea76a0164f573b6ce7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808801, "uuid": "c59fd8f4-6d50-4fdc-b21c-b64756b6a245", "value": "T1F316E022E3025C56CDB9B3B1F55D9EDD0A442CF63E058B8F25DC88FB4A37641692A1E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808801, "uuid": "68b7555f-7677-4110-941c-cad38cf61cb8", "value": "234372fce9eaa047bc4c39047910954c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808801, "uuid": "16e39e64-3ade-4cdb-a59f-56d3856c0342", "value": "98304:mBJMPoNA3knp/0kn8wW8yDzBx0dkg/NeD0p2mPqZ4jG8wvVfX:mooiknpV9W8yDz8pB2mfK8wvVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808801, "uuid": "3bf19f1e-65fe-4323-a7cf-9539d6ff6c20", "value": 4165632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808801, "uuid": "cb55a253-739a-4173-9d5b-dd513740e569", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808801, "uuid": "652139ec-2395-4cb1-a809-39bc2966010d", "value": "0eb657033b8d77480d42e76f90271d731f5bd8ef2c1f56276834afa4eb01aa18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "993d6d61-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772811541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811541, "uuid": "fefa6efb-01c8-47bb-8d7c-47ae0edc5ea5", "comment": "Malware payload (Formbook)", "value": "d82353d8067a923392593b8df7ec13e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811541, "uuid": "f685f360-c9e1-4a8d-9d78-07488b7b0825", "comment": "Malware payload (Formbook)", "value": "0eb78aae5ca026250c363e0ff5432ef65f6e5beb31e3f309d93e851ce2dd7be8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811541, "uuid": "1c73595a-3ddb-442f-93a8-4c71b300ba97", "comment": "Malware payload (Formbook)", "value": "bb62fe560bced33eaddf9f10d2bf805b97932082", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811541, "uuid": "15a1d0a3-97ec-4c96-89fc-0f453e2e9ac7", "comment": "Malware payload (Formbook)", "value": "58d50ff3bf15205132332fe307efe97b4625747a5ac26944b67920ecab7e186d9914de25a3bfb4bb6b340818a5911341", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811541, "uuid": "bf3f45cf-e113-4b6d-9d2f-1c833908def8", "value": "T15C45BF0273C1C062FFAB92334F5AF6115ABC79660123A62F13981D7ABD705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811541, "uuid": "4d6449f7-158d-4297-b2b1-965c3a49fbc0", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811541, "uuid": "ee48ccc2-da35-48a7-8e4a-6cdf91200bdf", "value": "24576:E5EmXFtKaL4/oFe5T9yyXYfP1ijXdatSwDKBIYF5ek2iGo9bNUDiBu:EPVt/LZeJbInQRatX+5eN8Xc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811541, "uuid": "84a422bf-838b-49a6-880a-105ca5b5f18e", "value": 1271808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811541, "uuid": "9c58509d-ce76-4eb3-9c86-32d99175e651", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811541, "uuid": "e16928f4-448d-4920-b380-63a3dda4ed13", "value": "0eb78aae5ca026250c363e0ff5432ef65f6e5beb31e3f309d93e851ce2dd7be8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b9ad60e-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819249, "uuid": "dcecbd40-0c26-4cfd-a12e-bcbd032b0f4c", "comment": "Malware payload (Mirai)", "value": "37f0da2a0ebfd71464168b6bf677c344", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819249, "uuid": "92a9bd61-19f9-4929-b301-3afd9d4b9dad", "comment": "Malware payload (Mirai)", "value": "0efc7793506a58ac8f6e14771e7f333f27bf4ba910369d828c378cdae6cce201", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819249, "uuid": "a5b57d41-2dcc-40f3-ba35-b8a9303a47e6", "comment": "Malware payload (Mirai)", "value": "a0e53090edc5bb55eeb97ebbe093e716f05e0313", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819249, "uuid": "15f94f7c-e9a2-40ce-9a12-fe387788200a", "comment": "Malware payload (Mirai)", "value": "ad43da909cd40da2399cfd39fcd2a3d4354bcebee1518a3daaf61d1816a5ef721d9b11de1287d7a0d32efc51dc9ab0ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819249, "uuid": "492e29ce-7cc0-491e-a6c5-adcef258d853", "value": "T116C31A09AFA21EE7D46FCD3702AD0B0634DC5B4612B9BB3A7274C928F55958B0BD3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819249, "uuid": "2125f537-72da-4c07-9cc1-8c246adc6539", "value": "1536:m6cc1JkfWV4+FwmW/7emzjRx1EUEuZm5xHaCZDptatlZP8YUVJT2gWe7g:pVIfWhamW/TRfExuKpsPUC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819249, "uuid": "c6565a88-4e24-4c2f-80cf-24ace30e82d3", "value": 118884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819249, "uuid": "5f82252b-661e-4579-b1d6-04d0c09dc8c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819249, "uuid": "b8affd52-0c51-435b-a9b5-1329d0e21b57", "value": "violetmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65f445f2-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819186, "uuid": "ab1bc519-fa50-446a-8674-f36130bce492", "comment": "Malware payload (Mirai)", "value": "a21c19a56f1a995a76401a49ff043e16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819186, "uuid": "40ca931f-5d39-4c0e-9dff-62e3ef440f34", "comment": "Malware payload (Mirai)", "value": "0efcd580a3ddfce60fcd5ccc25cf815572f80cfb84fef7f939efe6bdadfc109e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819186, "uuid": "86e4a9e0-7951-40cf-ae32-156c873dfee0", "comment": "Malware payload (Mirai)", "value": "20ff99cb99ea80a3df85ac06dbfea5808bbf7fa7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819186, "uuid": "a25a33d5-0b8a-4912-b35e-79a705c4d73c", "comment": "Malware payload (Mirai)", "value": "fbe7a80fe062dcb6ffb053e9577006bfa899d42bacb8fdbc8982fa03a9ff749a830b8d7ee517996dcca368a9309b6c6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819186, "uuid": "2fa80edb-1894-4333-b3b8-bd19e86e6a7a", "value": "T1A9932A51F9829613C9C556B3FB5E429937160368D3EB3203AD288F65338E9AB0F3BD45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819186, "uuid": "c5bf5a82-613a-4fdb-99a8-e8a4a10650d4", "value": "1536:KezHkSpNayqhbAku0Vgn8X7NlByi2ueFzVUDfI+3nSjXteOtcWe7lX:bkhbDu0Vgn8JDyiowwq2e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819186, "uuid": "9e7b8922-5dce-4d79-bff3-f20f67b99d84", "value": 93404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819186, "uuid": "ddc5b104-fcad-42f3-9f7f-47400a930aac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819186, "uuid": "f6dfa8be-e8e8-47e2-a60c-164632b37f22", "value": "violetarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b86d6d91-1985-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1772819754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819754, "uuid": "c652c65d-fc03-463b-9236-534042c33b40", "comment": "Malware payload (Stealc)", "value": "eedbade9b236357a82284694e51ce1bc", "object_relation": "md5", "Tag": [ { "name": "80-97-160-190", "colour": "#FFCA15", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819754, "uuid": "7f41aa5b-e863-451d-abc5-8c0b85771746", "comment": "Malware payload (Stealc)", "value": "0f033735da6f1724e690a790dc9e53c399a1b64e67bcc892e1ad59d12ed7e40a", "object_relation": "sha256", "Tag": [ { "name": "80-97-160-190", "colour": "#FFCA15", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819754, "uuid": "540f0231-98be-4473-8f61-6d16b0c46f33", "comment": "Malware payload (Stealc)", "value": "2fca034b1e89a7c49107dc4f9f02bbf6cb399f69", "object_relation": "sha1", "Tag": [ { "name": "80-97-160-190", "colour": "#FFCA15", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819754, "uuid": "e05a6aa0-9b3e-4d60-83a2-1e3fe63e4ad5", "comment": "Malware payload (Stealc)", "value": "373c8612e8220c8eb31f135db4c2102d8f221749f80f19a64d23da57b677294a5be2cbef42b4f0ad97a41e27e75671fd", "object_relation": "sha3-384", "Tag": [ { "name": "80-97-160-190", "colour": "#FFCA15", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819754, "uuid": "fe9ba374-434c-481a-80fa-ee2b53196b7e", "value": "T1B0A6BE06BAD840B5D4BB923589BB9362E770BC150730A7CB2654BB7D2F73BD04A39352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819754, "uuid": "fda8ce2e-2965-40ab-8d3a-848ab0c9a23f", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819754, "uuid": "eac87a2b-21ca-48e6-8ae0-1e63a525a1ff", "value": "98304:dEpjltk3KPxUxIVzAnIaQ8Lazhs9Ftx5ueE:MlC3KZUx0zV8Ladgtx5bE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819754, "uuid": "ee0039a7-281d-49d2-bd2b-d795bc5da547", "value": 9768448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819754, "uuid": "5c981721-3fa9-4f0a-a872-ed117b6129d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819754, "uuid": "9c35bcc7-db2c-496b-ac48-67cd06ca3b00", "value": "downloadsetup_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0be4b919-19a2-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1772831920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772831920, "uuid": "c563828c-8c91-479c-8fbc-41812c02fa7f", "comment": "Malware payload (Gafgyt)", "value": "b1bc44a58f0e4342538bc7d09976fe3f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772831920, "uuid": "da52abb4-2ba4-4981-9744-6c5fca3a89d6", "comment": "Malware payload (Gafgyt)", "value": "0f3b6cea0bf1a53f233565ef14577676c69bf5fee82ceca029e1287670fe4ff7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772831920, "uuid": "83d01302-e2eb-4e8b-89c4-b9e31cd0d07f", "comment": "Malware payload (Gafgyt)", "value": "47f5005e3c30216a7c25c133dfbe819355462121", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772831920, "uuid": "c0ce8eee-81df-4a14-9fbb-5251afebee74", "comment": "Malware payload (Gafgyt)", "value": "6d183b6d2e1cfb1cbed69cff36cce5544c189819385e3e60213ea83f50df8a4f60e9d83a0dd869dcd88b980461d1ee45", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772831920, "uuid": "737c0ef2-eefb-427b-830a-b56833eb4135", "value": "T135C30871E8044B1BC2D223FAA79A429E3F355E9757E733115B38B9B02FF27891D29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772831920, "uuid": "99d92e7e-2286-46e9-be29-cea4b9a89b6c", "value": "3072:xHySRuf1WxlT+XMnzUPmI+OfYicm7/L7QsRPGfImNb:7ReWxcXMzUPmwOm7/L7QsRPGfImNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772831920, "uuid": "07159a80-b23d-4b6f-9abe-51339b265339", "value": 125138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772831920, "uuid": "2ab942b7-3d21-4c91-a6c6-d88c1793ff7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772831920, "uuid": "7341ce69-825a-44fc-9d3c-b74925b93b16", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69fb8c07-1949-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772793852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772793852, "uuid": "880f030e-0ecf-41d4-9709-93667f0a3124", "comment": "Malware payload (Vidar)", "value": "3ef8789b65ac65590fdaa8d06c3cf377", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-OpenClaw", "colour": "#525D1F", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772793852, "uuid": "503702a1-19eb-4f72-a4e8-c5bf970fb3a0", "comment": "Malware payload (Vidar)", "value": "0f69513905b9aeca9ad2659ae16f4363ac03a359abeac9ac05cab70a50f17b65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-OpenClaw", "colour": "#525D1F", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772793852, "uuid": "d4b99415-d482-4921-b174-c0fa429b494e", "comment": "Malware payload (Vidar)", "value": "89f04bbe88c83882827a5164ade78fd4db24b667", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-OpenClaw", "colour": "#525D1F", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772793852, "uuid": "0156b60c-fd55-48a4-b05d-4de25e40d451", "comment": "Malware payload (Vidar)", "value": "a534fbea39070d1f83cadbeaceed97365021d1dee68135afacb8f2eb6fd1890b60fafa9f5593dd8fcde4ddea74539d67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-OpenClaw", "colour": "#525D1F", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772793852, "uuid": "e0c8d2ac-1ce2-45ab-b1fa-e19af2f121e0", "value": "T1F5282302BA8B1964C05EC8B4D2474A934F3130DB163BA5BF50E942683FAB7B49B3F755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772793852, "uuid": "108df67f-052b-40ec-8d8e-5cc2eb0f8d3e", "value": "e61251d70770a939fcd72f2941900a06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772793852, "uuid": "bb8d758b-76b5-416e-b01e-765b1d887f5c", "value": "1572864:AiEyfxBpoYRS4XSJB4Gn0fXt8wr2PX7hhNExO5pSs97tFfBJtUe9LAs7B9k:ANyfxBiGS4XOl0fXtMPd5pJ95FfdF3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772793852, "uuid": "cd79acb0-0ea4-4106-b35d-c84d8cb2342e", "value": 99634176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772793852, "uuid": "7caebbfa-35d1-418e-b1ea-1a905053fd1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772793852, "uuid": "f056721a-0591-48ba-a3ef-361aa9cbd5cb", "value": "0f69513905b9aeca9ad2659ae16f4363ac03a359abeac9ac05cab70a50f17b65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fd9b1cb-1951-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772797271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797271, "uuid": "d2e17395-51c9-4e30-91b4-afbefd5a260b", "comment": "Malware payload", "value": "8d8aa0be8f82d22deab96f96d9af34b8", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797271, "uuid": "6b3d4749-27b4-4900-8f03-69e2108063e5", "comment": "Malware payload", "value": "0f9cf1cf8d641562053ce533aaa413754db88e60404cab6bbaa11f2b2491d542", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797271, "uuid": "ad659ca6-0fb6-4e25-8424-eb8e8ee30d94", "comment": "Malware payload", "value": "42111d2ebcd42fa1fa7069560401db736c483776", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797271, "uuid": "0ce8a626-5dd7-47b6-a3f8-4f21fc25e856", "comment": "Malware payload", "value": "a8174cae513b8fc6db126f976e7313faa5ca879fc42ec1ed98b7f369d31fbbe4cc359f1fd1fc74cf079cd713b38b4606", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797271, "uuid": "20fb1d1b-6309-493a-bed7-901352f72e9f", "value": "T188352314FCA42B2FC60F1F72190BEA513FED6C41DFB150639718B25D6A362B179D20AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797271, "uuid": "78793bf3-50ba-4de2-ab73-4ee24da169e9", "value": "24576:mNOmTRC/KmPbeqL+FnXvO9+f1KUw+T/s/N:mOmVv+bD+1X29WKwE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772797271, "uuid": "8ec440aa-664a-44f9-8075-f0c4f6fbf6a8", "value": 1080832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772797271, "uuid": "e20cca30-ab4e-42ab-883d-f83f44810875", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797271, "uuid": "acabe9ef-f204-4bc8-af7e-a775774b3380", "value": "0f9cf1cf8d641562053ce533aaa413754db88e60404cab6bbaa11f2b2491d542.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ef1d89c-196a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808034, "uuid": "ef81c044-f62b-4ffd-aeac-d9a48e850a39", "comment": "Malware payload", "value": "fe9eec34e12f32f7e436ea2641fc41fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808034, "uuid": "fbbd2273-ea0c-4f99-a1f0-6cfa05fcdf07", "comment": "Malware payload", "value": "0ffadcf982cb2a10d0a6cb05aef628c5796465f37bcbd7f3f41237df9e72a479", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808034, "uuid": "f3a10cf7-4080-4809-9222-6313464cfa21", "comment": "Malware payload", "value": "bb75cfd3eea4f8d689f2eb85a03a86e1c0069bb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808034, "uuid": "a2fb07c1-7668-41de-9f85-24a93c72afb0", "comment": "Malware payload", "value": "1393b608525fef6918952301859e409b14e6af8183a4c08c654e420637bbb40316652cbc9424544b80756cbf65bea4e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808034, "uuid": "098d491e-3dab-4a01-b7ec-9c3f52c79b9d", "value": "T18CE4BF0723D44A68E5BD977A8466409147FFFB42AB32EB1DAD0A51EB0C27B41DE41F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808034, "uuid": "6a04ce9f-42a7-4810-a992-850fa26ec725", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808034, "uuid": "396ce176-adc8-4a63-b143-a77ae561acb0", "value": "12288:GbzCiB3nlPAg0C6+6w6ZD5Ww702NUAHKbNCX0WT0D88NoV0NW+LOw0+Kr5D6q:q/h6fZNC8ZHKJCX0fI8mVS7p0Fr4q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808034, "uuid": "80fd5ea3-31f3-426e-a17c-ca8e7c933439", "value": 718336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808034, "uuid": "494780f1-0e3c-4acc-a3f2-ad67d7c7e38c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808034, "uuid": "a0d39a61-7df8-4009-ad89-c02543553ac1", "value": "0ffadcf982cb2a10d0a6cb05aef628c5796465f37bcbd7f3f41237df9e72a479", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60bfdb0e-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772809299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809299, "uuid": "b8354b05-c57a-424e-92df-f693fd4fc272", "comment": "Malware payload (RemcosRAT)", "value": "6acfc5427d17033b4dac50e601d20c0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809299, "uuid": "13720503-a22f-491b-881e-38d6c75f844a", "comment": "Malware payload (RemcosRAT)", "value": "106e554628c27e84b06b88652149c5468bca392b0de55322d6c96735e21235c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809299, "uuid": "cd03b9f5-af29-42a5-9c41-7eacdf8111ba", "comment": "Malware payload (RemcosRAT)", "value": "8bf1ea4c705f35b3460f18d04dce67cd2cae9780", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809299, "uuid": "40e3b409-b10b-4a74-a26f-ccea82679f19", "comment": "Malware payload (RemcosRAT)", "value": "0252e947cdca7bf08b91538725a0699c5b6c51af96c52a3c702fcd79fba826e3bf7da0c8365d127d9772ce4190c35984", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809299, "uuid": "e234257f-0890-4da0-bb75-bf3494ed3dd0", "value": "T11C6512082729DC03E4B65BF056B1D3B41BF89E8AB611D353CFEAADD7B5363501889392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809299, "uuid": "ced11cf9-42a0-4760-8022-691f7fe9ef2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809299, "uuid": "76cebff0-ac0e-4684-870a-7dbebae5d892", "value": "24576:Pqu2VWl7OPVaMNxtWJnS50YYheNApknRCkJVtr3lYPcDZWV9Rr3PNJn+OP:PeVkyyS50YAeepaRCkJVnIq2Hr3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809299, "uuid": "926a34f7-e459-4ca0-9cb4-084ce0744d5c", "value": 1545216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809299, "uuid": "cb578fb3-4e6b-44ca-bbb4-f0cc4960f4a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809299, "uuid": "30a6adc0-4064-46c9-99cb-cfb3b75753b6", "value": "106e554628c27e84b06b88652149c5468bca392b0de55322d6c96735e21235c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b2bf4a5-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772809692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809692, "uuid": "458c872a-f389-4dc8-9781-71943735003d", "comment": "Malware payload (Formbook)", "value": "de3f098df40cb413dee6d1627c3cf153", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809692, "uuid": "25e57203-bcd7-4418-b2fb-62111ce0e1fa", "comment": "Malware payload (Formbook)", "value": "1084633d1e01346d5971b8ede307bf25f2d05ad354563ee3dd5540c79b1d97b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809692, "uuid": "cbfd96a3-c0bf-4ddf-97a3-b1b60d8dcabe", "comment": "Malware payload (Formbook)", "value": "c9b00637595849949b66edb95772e8433b96f42d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809692, "uuid": "1b8c2301-cd47-4803-8bcc-2ec4f3aaeb92", "comment": "Malware payload (Formbook)", "value": "ca6f6acb41ba7be1251a81949efc7836487e154f9e3d24c6fab4061bb217433c9a422550ba1dd3d5286932baf434a4dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809692, "uuid": "607f9b62-6af0-4e83-9fb8-24d8dcee727e", "value": "T137F49F2DF4E66091ED21C8F31F5E97E10D1A73136BAA189723B807044B954FF1F6AB26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809692, "uuid": "cde9fd04-09ea-4c76-955a-eba45ae7928a", "value": "c2356eaefac76ce13634b53b65aeb72c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809692, "uuid": "e982dbd5-0b3b-4dc8-980e-ecbaf551bd01", "value": "24576:Oo5NHfYYn5XCNT3dt6yX8uL7QkhWnYySG4:BJfYy5SNTtt6yX8uL7eYySG4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809692, "uuid": "cc143606-99a8-454e-a65c-f9f06e628928", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809692, "uuid": "adf17f04-86d7-4427-9d7e-c81c642523ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809692, "uuid": "547fd6ec-eea3-42b4-b5c2-20d20f8919b7", "value": "1084633d1e01346d5971b8ede307bf25f2d05ad354563ee3dd5540c79b1d97b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39ffecb2-1946-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772792483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772792483, "uuid": "9a5dc0a6-156e-411c-84fe-92609ea2a811", "comment": "Malware payload", "value": "1a987f3421e052323760e9889721a0a3", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772792483, "uuid": "129b5959-0000-40ce-b7ad-65518900989d", "comment": "Malware payload", "value": "1097080886d6c93d1cd3ec877d9640f84e765edfd813953729f934a243a04a03", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772792483, "uuid": "2993f1ee-ff40-4268-86ae-68181536714b", "comment": "Malware payload", "value": "cd1cbc546b4f01c8022152474d89b36e629a4543", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772792483, "uuid": "c30f6c05-811e-4705-aafe-9250c4cbc004", "comment": "Malware payload", "value": "14a7e774e3c2d844f139ad12d8c2db39dc8d56e6c982b15f42312a169f6bc1c021ea2ea21422a3b09a7579668f4116cd", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772792483, "uuid": "c1f88373-cbb8-4c01-8741-dc351882ba16", "value": "T16A534D2B19F8EB2D0A5B28207038B7142E6957BF864C6F5993B150F3729E2FA135E534", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772792483, "uuid": "18010b05-ec51-4ad0-8571-93ad104271ea", "value": "1536:jvoQWYuuuuuuuuIIIIIIIIIIIIIIIIIRAWmmmmmmmmmmmmmmmmmmmmmmmmmmmr:jxzxxxxIIIIIIIIIIIIIIIIIRAWmmmm6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772792483, "uuid": "d7e606d9-94fd-4455-b06d-d441b6fa0e97", "value": 61081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772792483, "uuid": "1102a94a-9566-44d8-8703-0bad6710466d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772792483, "uuid": "baf50343-f410-4a21-98e2-9b5566f23d4a", "value": "2_13_2_1903_25.02.2026.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c0527d3-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819223, "uuid": "6e33d1f2-31c2-4839-9346-e4e8bce59c59", "comment": "Malware payload (Mirai)", "value": "6ea16d15963ec1727ef55c44d0a2ea9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819223, "uuid": "1d2923e9-aeed-47e0-9f9a-9fcfbdffbed9", "comment": "Malware payload (Mirai)", "value": "10d09e5c9a15ff0a87b5f1e6824637943624b239d84b4df927ed06a95a720161", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819223, "uuid": "cb81f518-e9e2-4ed1-903f-eb8953eb68d2", "comment": "Malware payload (Mirai)", "value": "1c3bd11e8c298fce23a1547bd0fcd052311da4d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819223, "uuid": "55456788-8b7e-45ea-80bd-9b4cf58f9ec9", "comment": "Malware payload (Mirai)", "value": "84bb842c8405df4021e72c2300905d00eef5c7a4634f126478ac81678e5e27d6d887a17533531843fcae778e91528feb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819223, "uuid": "0b0dd479-0db8-4484-9836-f4c820a3de40", "value": "T10CD35B0673180E17D5A34AB02A3E17F083FED5C121F4BA89691F9B6A4676E371582FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819223, "uuid": "223aa842-cd47-446a-b5bb-7539b969e482", "value": "3072:NCboo0CJacgjLPeD2OacUC32UtyMJ9qlRCn1:NslzqLtOacUC3vtyMJ0lR41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819223, "uuid": "0644fbb1-699a-4170-a378-aae0fab23477", "value": 138800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819223, "uuid": "329b9bb2-77db-487a-a4ed-29c159b1bc44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819223, "uuid": "939e563a-25e6-4656-829b-a378749ce259", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d95b480f-1950-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772797045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797045, "uuid": "3c3fb184-682d-4b33-b28c-75cf1bc71055", "comment": "Malware payload (Vidar)", "value": "52353db06ea4bb4f76273af1a2b2654d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797045, "uuid": "22fd895a-8653-4713-98ea-ca20962acb64", "comment": "Malware payload (Vidar)", "value": "1107b0f7d0c91d82cf71ed1c8c0d1708f0668b5067cf79d7a6d10ab0e31882f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797045, "uuid": "8769b27b-1452-4df6-a3d0-fe0482322fc5", "comment": "Malware payload (Vidar)", "value": "7aada1c46e8144594542d8c8b78b1b74e2e3e94b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797045, "uuid": "01486353-a3fa-4295-b217-e308c8b5aa2a", "comment": "Malware payload (Vidar)", "value": "46044e97cef6ec8c97157cfd9f8c3e6942c254cadb31c976bc32e053c46649ae0609e1472073671ecd64454dd79a4562", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797045, "uuid": "9ee4c530-96fa-45c6-9420-5a60aedd69da", "value": "T155959C47BCC060B9D5A9D2328AB151A17B30F85A0B3137C32E55B7B92EBB7D41E39394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797045, "uuid": "441b9700-cd81-4c47-83e2-00870cbc8152", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797045, "uuid": "97c02f9e-98e9-438b-939c-a58c652cf3dd", "value": "24576:UH1GGd3Djzqp0SQSYGWAowudrLICJjT/otdTg3IsbJ/BnOcsYgts1sxK1ub:UVGGd3D3qR3mrkEmdT6I6TnMYgtdxK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772797045, "uuid": "bf4098d3-78f1-4e69-8ad3-7e3b20243177", "value": 2014208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772797045, "uuid": "4717d8f0-1d80-4839-8039-efe1205f7ec5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797045, "uuid": "a94b11ed-cf26-4280-b580-f004b009a7d2", "value": "52353db06ea4bb4f76273af1a2b2654d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f42bf4d9-197a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772815129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815129, "uuid": "a946df62-601c-4110-b85a-fd3bd7d71808", "comment": "Malware payload (Mirai)", "value": "95d4d703a16259ce649d81ab8e1927ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815129, "uuid": "69f8cb3d-d4e5-4ebb-a1da-84d3866bd9e5", "comment": "Malware payload (Mirai)", "value": "113aeed282f4fa932881f140e0569e6795f5a42409e2ae90d865d2008cd9d2d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815129, "uuid": "490571bb-8cd0-481e-9193-fdfa68ff64ad", "comment": "Malware payload (Mirai)", "value": "5281afed679aaf2279fcb4cf6e93427491aa1458", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815129, "uuid": "881e712f-dacb-4c74-98e9-032f9b91bbbb", "comment": "Malware payload (Mirai)", "value": "952831e9cd69c4d4d5860d64e6eec34fab3de8033bf808455a4506d2b2916d8fbc704c7ca640851a5d56a5fc7b88f70c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815129, "uuid": "6f0523c1-62ad-4bf6-abc5-37626d87ba40", "value": "T10C935C02B70C0E43D1675DF02A3F27D1D3EEA5E021F4FA88691F9A8591B2E325586FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815129, "uuid": "a3eaa648-eace-4fc7-8605-9f42d4053f1f", "value": "1536:pcBZli/TwLrLnyUiQI0tdpDjnPqGD0M39+7BAnKEAilKmMGXyCPTEA2lfBUB:2Li/T+xPbTMAn66MNCNlB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772815129, "uuid": "803d00af-e0a7-464b-9950-ea096f2ab055", "value": 92048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772815129, "uuid": "b138a3f1-c39b-4b0f-824a-5b176957d418", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815129, "uuid": "bb245950-c485-4fa5-8e60-c2f1f3ad8bf2", "value": "titanjr.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5da8bc8-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772811589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811589, "uuid": "4d65e84c-07b8-4a2c-a08b-5ef751c1a479", "comment": "Malware payload (RemcosRAT)", "value": "3964a61d0e5673c967ddf25fef239f3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811589, "uuid": "e3454127-e037-44de-a233-6a28b8564ae6", "comment": "Malware payload (RemcosRAT)", "value": "1148fa91ce87cc06cbd373b0bd40eb1de0ede6e438262dda0ca8bea60b9239f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811589, "uuid": "6f2c607e-bf2c-4328-b550-fd98b3a356a9", "comment": "Malware payload (RemcosRAT)", "value": "1c6c710568566d0c52de1d224f551bef36d66a32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811589, "uuid": "65482171-2d59-47a5-82e6-5a2455a873e3", "comment": "Malware payload (RemcosRAT)", "value": "a1a6e8e3c39c7f635c9623375ec9f029ab385943ec9aaac68347bcd7b02f96f9d40ab5a80c5692d22720fd7993fe25b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811589, "uuid": "6f465ab4-0fce-4902-bbac-0a897b0be703", "value": "T1FB65CF0273D1C062FFAB96334F56F6215ABC79260123A61F13981D7ABE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811589, "uuid": "a6a0d8a8-1c7f-4b73-9752-b18e0b7a29d7", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811589, "uuid": "3bf352cf-0994-42be-a054-4d51669f50f6", "value": "24576:B5EmXFtKaL4/oFe5T9yyXYfP1ijXda1dSbU4BX/ei+fLAZRX0Qx8YrPNTQb8VH:BPVt/LZeJbInQRa1dKeffLayUTQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811589, "uuid": "5553d2f1-1ae4-4047-b732-aa79a78c93cd", "value": 1414144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811589, "uuid": "9d53b003-0970-4e6a-953f-37cd4f4df363", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811589, "uuid": "313ebe99-7ab8-41db-b207-27e574201fe8", "value": "1148fa91ce87cc06cbd373b0bd40eb1de0ede6e438262dda0ca8bea60b9239f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cd05a96-1982-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772818392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818392, "uuid": "72b425f3-1968-4f9f-b4bc-2586e2c3b9a4", "comment": "Malware payload (Mirai)", "value": "610c75187fba6ebc5ebba2d722d198e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818392, "uuid": "062a8b06-1796-4c21-8a4a-8caf56fea8fd", "comment": "Malware payload (Mirai)", "value": "1165640c96fd44b4ec275c6e800d0101133aa62b4c6427a37505ddae034b8529", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818392, "uuid": "ef3184be-62b1-452e-a840-a8584b33a96a", "comment": "Malware payload (Mirai)", "value": "63a136bce2e96dc20f523524fe77947acf3fccef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818392, "uuid": "33f226cc-8cbf-4139-9480-bc112aad359a", "comment": "Malware payload (Mirai)", "value": "42fa69f0a1090add2067a262ed46524b755c34112a9587701e54dcde35ce0de2b64e1f1408af14af40699aa4a855fabd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818392, "uuid": "821fe0e0-8773-4a90-8475-64ccba4e5f64", "value": "T115C3AE73D42A7EC4D1554030B8B5FEB51B61A5C041935EBB26E9C87A00CBEA4FA0AFF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818392, "uuid": "29f6f6f7-749c-4528-b843-5325560c4964", "value": "3072:hfpZykqkt436I+9eIHfmNOkSMPXeC4GnH8:hRZ0F3BcONOkvZhnH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772818392, "uuid": "7f53886f-1aed-4f50-8dbf-487f27ade4df", "value": 120332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772818392, "uuid": "e1dcd465-142b-417e-a2aa-9ab7cdd2381e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818392, "uuid": "f777ae6c-e0f5-4211-9bbc-97068794798b", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d17dbc0e-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810347, "uuid": "30ead51d-401e-4247-bb61-834b5f6e005a", "comment": "Malware payload (GCleaner)", "value": "29854fb0956cefe10b174959907853b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810347, "uuid": "aa6d5303-6026-476e-9058-c196bfb22acc", "comment": "Malware payload (GCleaner)", "value": "118415042c798f71eef0254dc60b0b66e237fd908c96d62a030fc4771f2be77f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810347, "uuid": "fa086952-f7c9-4e10-b221-1adeebc2adcc", "comment": "Malware payload (GCleaner)", "value": "8c41eb5eb79e7201dd6e7b8d50929ff1e4bb8003", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810347, "uuid": "63bd1366-5596-4bbf-b0b4-1dfded8febd7", "comment": "Malware payload (GCleaner)", "value": "3050c917302208c82a1f09a694aba3b868f3a961c7eb3405c7b240b4cc6a79fa730eddacf4dd119474738d7288494d5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810347, "uuid": "4f7880d0-8c11-4529-a510-ea74c10f8a8f", "value": "T10725AD26A2F27837C1673A38AC1B569DA839FF3029285C462BD41ECC4F35F95F4651A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810347, "uuid": "6cbfdd38-1cae-46e9-b159-a89353bbadfd", "value": "fe4280c06246cc873fe89746dadec91e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810347, "uuid": "786788db-4301-4b37-9c81-a30fc2cae7a4", "value": "12288:oNnqG7tucDD94ypPY2VKHF7O4Cy4MOjE9taCb6mI9/wgQHqak0ABvoC71:olluEBpPj6o4CPbE9taCbdIWgsFGvoC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810347, "uuid": "944daf42-6231-46bd-8064-c650e29d0156", "value": 987136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810347, "uuid": "0d23f8c8-379d-4d30-b52a-7b8fb7789747", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810347, "uuid": "69eb0f63-0fbd-4f9a-b6f3-d1ad0342767b", "value": "118415042c798f71eef0254dc60b0b66e237fd908c96d62a030fc4771f2be77f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ae4542e-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1772810175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810175, "uuid": "63512f92-45c2-4398-afeb-99f04bf09945", "comment": "Malware payload (CoinMiner)", "value": "53d461c92c187fc8b7eec8548a69e34d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810175, "uuid": "6708f1f8-206a-406f-ac54-9930ddc77e8b", "comment": "Malware payload (CoinMiner)", "value": "11dafc9f077ea507a88277b30dc8b1868e73c0e93d8fd80bf5530b4888f22434", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810175, "uuid": "ff4d343f-d95f-44ba-9418-1e01707ef3b8", "comment": "Malware payload (CoinMiner)", "value": "dfb515394c29c67f9fb393e17ae0840fe181e4f7", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810175, "uuid": "d383d57d-566e-4071-a8b5-3e94e5f300be", "comment": "Malware payload (CoinMiner)", "value": "c76461a9da95053872a4efa98c61d719877c5f7f1f8567c8e6f47a62ee006ab28aa6ef1652bfd481ae3f394ba293659d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810175, "uuid": "849ef055-1276-4ec7-9d14-bd2bf0af2f0a", "value": "T11E3633127F83E470D165063194B69B964AB9EFA00760D6E7DBB83923BC313C279376C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810175, "uuid": "c2267a53-b601-4f95-96c9-91d2d4589e6e", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810175, "uuid": "f746db71-d30e-47dd-9a08-fea73a27d9ab", "value": "98304:vu5WqOQQvCiWP1IPxkwYACcHxvxLLnNb48TfSlJRuJUJuq7/8IBrjA4T:vu4qR+8dIZkwYA/vNPOlN9/rjAC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810175, "uuid": "025f3af4-a0f2-4947-955a-bc826ab176c3", "value": 4877312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810175, "uuid": "1bc87393-8fac-47e3-b8be-54197932b3de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810175, "uuid": "336107d3-3934-4807-a247-1006a4e17691", "value": "11dafc9f077ea507a88277b30dc8b1868e73c0e93d8fd80bf5530b4888f22434", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a989f86-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819220, "uuid": "d2b2bb7b-cfc7-4e19-8a9f-ebb92e88ca31", "comment": "Malware payload (Mirai)", "value": "a20fd71a5513d3d483ac6774279ce45d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819220, "uuid": "8507aa3e-0c4e-498f-8961-9726ed0a4bc5", "comment": "Malware payload (Mirai)", "value": "121bf02f4fc60863bfb6dc9134de7a136c661db132d1500459ad9c63f50d988e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819220, "uuid": "8778994b-9c44-4cd5-bd8e-4455e6b87e92", "comment": "Malware payload (Mirai)", "value": "10ece6a2c5af74d22528d8f67561f655eed6b225", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819220, "uuid": "5c2dfd5e-236b-42f6-9f0d-94c6c103c797", "comment": "Malware payload (Mirai)", "value": "e454d15b36fa8aa2109ea8060637aba664b0affac92a6126dc98ec78305b6af7d89ad6b160c4826d3258240ca3c4d12c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819220, "uuid": "7759ffdb-3038-4d39-b1a9-60b4e2bdeab3", "value": "T132558E5AB2B370BDC057C030939BDB62A835F47505322E7B65C4DA352EA2EB01B19F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819220, "uuid": "cccce1cd-3bb1-4c26-b468-0029674fb6b0", "value": "24576:XNvo4+Av5Th+VKhWxVZuXacdW0vY3+D/WcBlF8KWA8kMX:XZo4rv5Th+whWPZuKcdBYubVWKWTX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819220, "uuid": "a4a517b0-b8c1-4d00-bb45-4b79901b7bd6", "value": 1343888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819220, "uuid": "b6e990cb-f85b-4303-809e-5f3fdec3c63c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819220, "uuid": "23edef8e-902f-4bee-ac04-d80ee453b6f5", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f307ae6d-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772809114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809114, "uuid": "c56d5957-dcd7-4b30-b35a-c8a51860f248", "comment": "Malware payload (Formbook)", "value": "87dae6aec3e6fdfb7086af69d8f6ba65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809114, "uuid": "795b748a-5d67-466e-91d9-0dc2e107ede0", "comment": "Malware payload (Formbook)", "value": "12312f4f00b04ee1bbbced370335dba32914f75a5aed504f473d425939dd975e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809114, "uuid": "7051fb2b-e531-46ae-b93a-ebd1145441bb", "comment": "Malware payload (Formbook)", "value": "d7b909e5e55e52802b52fe8080cee0f1b944133d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809114, "uuid": "f0874419-815f-40c0-b881-51249de817ce", "comment": "Malware payload (Formbook)", "value": "f575f2a0de08d82f484bf2f0826404eec96d101cc663eabd95530b08af6001cadd87f670faedc880703adf73315c7b47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809114, "uuid": "093a3dda-d502-4b82-8baa-c1ec023e0460", "value": "T1DCF4AF2DB8E2A0D1ED2188F30F5E97E04E1A731367A91C5723B806444B954FF2F5EB66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809114, "uuid": "7cefe589-dbec-4059-b169-f0aaa3550b97", "value": "96944a9beff3e19cb1f487616a09413c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809114, "uuid": "886d8a47-7185-4d77-8b40-61b92c51f824", "value": "12288:mDeS37qWk7hQxuE8yh6lK1W+esq1CcFPGEhWF1MUXCA2KRIqo23UBuIyGBeC:eLE7h+uE8y4lK1W+eRCgNWbMUSsECUEL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809114, "uuid": "eda45c65-f95e-4b8a-a08c-2f8f1d59ee2b", "value": 783360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809114, "uuid": "df4eaddd-24f8-4ac2-bc23-c273cc22245a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809114, "uuid": "d36b9929-9e98-477c-a2af-fb7c11f6e640", "value": "12312f4f00b04ee1bbbced370335dba32914f75a5aed504f473d425939dd975e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5e29129-193f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772789765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789765, "uuid": "ccf24eec-b893-4e8a-950a-5b00b06bd652", "comment": "Malware payload", "value": "392cb269f4f219a3b14007ccdfcd21b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789765, "uuid": "9d587bd0-e723-46cb-bdef-2a175ef84f76", "comment": "Malware payload", "value": "1251d54fbeddcda6d0fe88bab0932e34bf2ae53406f1781f85615a7c5c39a83d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789765, "uuid": "cc8fe652-0035-4fb3-806c-dd26d72a3f06", "comment": "Malware payload", "value": "ddf941e05b090767fd30e4982a41b49caa86fee7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789765, "uuid": "50f5b8a2-23cb-49a2-9a78-82787853b293", "comment": "Malware payload", "value": "f27838cf46584c4c004569998fa7f41447f9813f21f54e8bb3f507990989e794ad8033f67e6b3c0a1b723bff6324f24f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789765, "uuid": "1d81ea08-58f1-445c-bca3-7f3761455f6d", "value": "T18B087C42A3EA05D5F9F79A3489E65213D673BC063B3082DF325C172A1F736E08976B61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789765, "uuid": "65da3675-3353-4521-97cb-44028a0de602", "value": "8062a445f5cd940b5daefb09f80bc2a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789765, "uuid": "bbd0ac76-6244-4166-a6cf-ecb0f804e9f2", "value": "393216:r9UZyW0PYsIUmgB9S7QJrojJgVXIXT9fN3aoIKF1H5XMutmnnY4nZFUT7HihCLJ+:rJX3mcLmSh81vxOtxth", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772789765, "uuid": "edea4cca-3f19-4356-ac6c-62aa31e91f89", "value": 82256896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772789765, "uuid": "e0362a22-d103-4766-84e0-0f56361ede58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789765, "uuid": "a2c101e6-6acb-4a7f-ae95-f7f5aa972549", "value": "CrimsonLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5547f232-1981-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772817869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772817869, "uuid": "4839d1cc-3233-404a-a901-0c4da42762cd", "comment": "Malware payload (Smoke Loader)", "value": "af72d60b4fbcbcf9109490bfeddf9263", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772817869, "uuid": "83f4bc66-0f7d-4245-b815-1fb5363a4286", "comment": "Malware payload (Smoke Loader)", "value": "1260de45ed2115518b558d266e32b733cbf8db8e464cb3a0e070e4c0149ec554", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772817869, "uuid": "8a5e4d27-5a4f-432a-9e76-4b5bed61c419", "comment": "Malware payload (Smoke Loader)", "value": "e9722ecb10c28e64ee1904040d290d5327b1dd3c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772817869, "uuid": "811429ea-5619-4cd1-b99f-25c8e4c76692", "comment": "Malware payload (Smoke Loader)", "value": "8b53085acd91d123d74bf0f3536b6226476ce53c5a9642bc749d2356bf6c21f05a002ea87232eb00fe4ed6e3becb7b14", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772817869, "uuid": "41d194d7-6d8a-4e8d-a9ab-efd5e57b1891", "value": "T193243A2BC25330FCE552C07892A66232B772BA3D47358EE70293D3359D61AC05FBA965", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772817869, "uuid": "0eaee4b5-26d1-4c5c-ad03-602aeb14aa16", "value": "c81db0a320cdad5ab41c9a291ea9b6e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772817869, "uuid": "d275d628-69cf-4e47-b8e0-1a85b2a5572f", "value": "3072:Ry+NC+3FGCgIuXHbTZvQJoUaCSC0CwMQv7PfyeLZlwABcJw3r:dDPgIuXHnZQyUSC/5ubfhce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772817869, "uuid": "888ecb94-af20-4324-850a-1092c76e9c80", "value": 223744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772817869, "uuid": "73886ba3-43a3-4f74-a24b-fd08021464f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772817869, "uuid": "d0a9ee07-fa6e-42b4-927a-e7173904b55a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91416806-190b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772767289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772767289, "uuid": "9e34cb31-3d50-412b-b7f2-d19c7fa822b0", "comment": "Malware payload (Mirai)", "value": "bb73c96692a3b2becc1d8f9a14d8f35e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772767289, "uuid": "9c9bedff-b0c9-4bfd-9437-040c4b0a8765", "comment": "Malware payload (Mirai)", "value": "126bb7fe59f613f236a4e007a19b4952241162b3af3f8a41e1b2faefd6746f67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772767289, "uuid": "406baacf-1e24-4f15-bc92-aa6aa06a0295", "comment": "Malware payload (Mirai)", "value": "96eb61793ea44ded12aae9a79e9559f208491b4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772767289, "uuid": "2cf6e0e4-3ee8-4d27-8783-c5cd17393b9d", "comment": "Malware payload (Mirai)", "value": "341df31514ce865f918fb2a7b258b3494bb7a233b9453ce0d9e75da1e15d8f07f6415f447bbf31cfadaf47e34fc3c742", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772767289, "uuid": "85ecbd8c-5235-48f4-88ca-a629ae28bd39", "value": "T10EE34D8AF802DE7EFC0BE57E44670D15FA30A7613243172D529BFDA3AC321A65D16E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772767289, "uuid": "796869cb-e4f7-42de-9978-565bae346074", "value": "3072:luWypdcGShA/TtPq6ND6ZJ243nxl9XzrTmduH:gCGShArdDPAxl9TmduH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772767289, "uuid": "98ef7a6b-bc0e-4d4c-a681-c2aa0e1b7e8d", "value": 146888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772767289, "uuid": "e15fb750-18bb-44bb-883f-88111056995f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772767289, "uuid": "aa836946-75ef-4fff-9d90-e0b82741334f", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fecbbd66-1983-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819013, "uuid": "2702f9af-f559-4a1e-a96a-360f34dd7ff4", "comment": "Malware payload (Mirai)", "value": "30f6640ce9b6dd238d66ca71c17ac09c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819013, "uuid": "05732bee-bf35-453c-b131-a4b4629aee21", "comment": "Malware payload (Mirai)", "value": "12cdb69e5d5798f8b5db55d59e36623ffd516e4f49c0e01885f7571a520ca765", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819013, "uuid": "044b9a3a-c3c0-4b4f-a525-05e11a5084ab", "comment": "Malware payload (Mirai)", "value": "6d3b6e4f627c233266dc216e97506dfaa2abb869", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819013, "uuid": "9083bef3-e84c-4601-bfc3-263c012bfe75", "comment": "Malware payload (Mirai)", "value": "dee5411ac0bc54e71d03e7664d253bc61a8d06c9f3209d3a551f5845b07e67f9e594118d53010e878ea9218cdc2156a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819013, "uuid": "900c888f-c502-458d-a35d-ec4666a91630", "value": "T172934992FD818662C6C116B7FB6E428D376653A8E2EE73039D256F2133C781B0E7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819013, "uuid": "05333e58-da7a-4e06-9969-b232e64b2360", "value": "1536:F0XpWNg043co/sTgvlwSBeMLs9jT9PSCp7Mn3qK+BQz0OckKM21:F0ZWNg0qvTe4mjTp3p76qKI+0Ozi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819013, "uuid": "b53b62f5-7daa-4475-bd17-44b9c382e8ff", "value": 89940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819013, "uuid": "f09b6cba-a4af-44b6-85d9-53097004aca9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819013, "uuid": "56db81db-69da-4d71-bd7a-a20288fd140c", "value": "jawirbot.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9a3b654-1969-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772807810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807810, "uuid": "24d31dbf-64bc-4bd0-891d-3de99bec220d", "comment": "Malware payload (GCleaner)", "value": "947dfcf02dcdef7dccccd944f7bde97c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807810, "uuid": "94812c0e-6c69-499f-8c95-c8a15d6d01c5", "comment": "Malware payload (GCleaner)", "value": "12d7d0612d9bde569dec9314e881817420d2f2b73cc4d1579889c5b5725aa9fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807810, "uuid": "9a3a13b2-5a5e-4d99-bc95-6edecbee75e9", "comment": "Malware payload (GCleaner)", "value": "8f65e5c5de4f909165dde1d1d928e5d10620b081", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807810, "uuid": "37c00b87-2c7e-4230-bdc6-c5bf3ea0b529", "comment": "Malware payload (GCleaner)", "value": "70e03815d4c7965ee462ac13d879db8a9174724e51a1e0f3cee50723bcf7ffd90e7840848e2f8833cb1056ef16cbef1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807810, "uuid": "a760170a-269a-4739-9053-e95828a0659f", "value": "T11C16BD2D73B04821C9ED1A399C29605E092BDD27D4ECC08CB1977EC7BDD6E159E6FA02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807810, "uuid": "9de33219-68c2-4835-af15-45254cc66548", "value": "85f3ca0400d93842304463da19f2baf9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807810, "uuid": "924c8c24-3f2c-4593-9a37-dcdd8420bc87", "value": "98304:AEz3SzGBDRqDtxjX6bcnY+oms2WKVAu4ACTWaQdw0dCE:AOfUtECYXmshKVAuXsWacwy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807810, "uuid": "b4b235b5-b6e8-4612-abae-001ddfd4f6dc", "value": 4393472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807810, "uuid": "3adbefd2-1ad0-4acf-a847-5f0a392308cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807810, "uuid": "44a67225-762d-40bd-ac18-d3d9bc7ca78a", "value": "12d7d0612d9bde569dec9314e881817420d2f2b73cc4d1579889c5b5725aa9fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b8a88e2-1948-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772793452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772793452, "uuid": "4e5cd068-6322-4178-88aa-c11abf4a3bbc", "comment": "Malware payload", "value": "af3b6fab01487c008bb87b2c49f3092e", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772793452, "uuid": "85f372ed-a6e2-4638-a685-c65fb03104b6", "comment": "Malware payload", "value": "12de518efad8c0ff2cf65c1e446dac209cb0bd6852bb3258bcdb81bd33568245", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772793452, "uuid": "abcc3a8c-b668-4016-b032-b90b33eb6b3f", "comment": "Malware payload", "value": "ca920d51ce070888dd3494ffa646a8a72b93b5bf", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772793452, "uuid": "5119b72f-1d32-4892-9496-42a0572f377a", "comment": "Malware payload", "value": "c3bad2d98f74129938f28b3c947b2445ab298322ddefbf88fc241171f33258540e3997eb2568e743741f44d977a30110", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772793452, "uuid": "e77b853e-6b7c-46ed-bb0b-f68fc593b590", "value": "T1AB67E086F20CC82BD9FAB07C9D8E07E378156C555B10C28B2915B60DBFB37D49A52BE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772793452, "uuid": "81c69c35-dc20-4420-b564-1c48a1eb5fd0", "value": "786432:XdJy7ONLv5wZ9D4pOBKAnV68xodcFv4wp:XdJQILK4pOYA9xrW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772793452, "uuid": "cabea03c-3628-42c4-a608-6780ebc891d7", "value": 32291163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772793452, "uuid": "c73a9e20-6779-4725-9b80-1fda2e4b0ca2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772793452, "uuid": "165209a3-7f81-4fc8-8fd9-844d85ee7365", "value": "com.message.inbox.sms.text_1.0.6.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5ec6227-197a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772815132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815132, "uuid": "f5673e04-1596-4816-9f46-4e70a9364c0d", "comment": "Malware payload (Mirai)", "value": "a8abb2cc82beb06cf95bfc6b4428036a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815132, "uuid": "68f5ddb4-f4f9-421f-98e4-f45c09a6b2f0", "comment": "Malware payload (Mirai)", "value": "13695088746965f1c31bfedc38d49e150e0cf20755fb1934aaff189e21657430", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815132, "uuid": "486391f6-c255-4af2-8bd5-0c4b2d306c14", "comment": "Malware payload (Mirai)", "value": "713dbadf1e592bd0144ff6603fdd408a7f340e5b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815132, "uuid": "334f735a-8ec4-4d1d-95e7-167b7517b6b6", "comment": "Malware payload (Mirai)", "value": "ea26d7fc321ea4a59763a2549137a5e6b8f35f22bbc82e8962a8bec9fb671bcb02a73371a5472255f2cfb1b97b6b209d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815132, "uuid": "98594203-9d94-4bb8-a801-8e3a442a1b90", "value": "T13FC35BB7D865AFA8C555C074B0708FB52F53A9A082871FBE19B7C2754083D8EF605BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815132, "uuid": "fc1cda9a-3d1a-4d0b-a8a8-567fb64fb188", "value": "1536:3QA/pBwTNoF5ZoJTOdgC6LKymJR8tOxarDvWQdQYO/SMCWql:3/7wTNdSdgjuyBOxuvW+QYXVJl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772815132, "uuid": "8190748f-4e21-4c7c-8a36-e5193dbe7ee6", "value": 121664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772815132, "uuid": "e971db2a-805b-4fae-a9e9-364fea0c6b28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815132, "uuid": "07a45c12-b408-4e96-9fda-501c09cf7df5", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4edbb1b6-1969-11f1-a769-42010a9c0008", "comment": "Malware payload (zgRAT)", "timestamp": 1772807551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807551, "uuid": "1f8c40fc-a3e5-4f8f-9f17-0565e39107dc", "comment": "Malware payload (zgRAT)", "value": "b3d8a3d3b59bfe7ff75919be2a0b9a05", "object_relation": "md5", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807551, "uuid": "b400e175-4931-44a4-b1d1-882756fd6a0c", "comment": "Malware payload (zgRAT)", "value": "137326ac5fc9563532826dccf4442886bef1ec94a41654b9cbb6c963d78a35d2", "object_relation": "sha256", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807551, "uuid": "3e02fabb-ab2e-45a9-acfc-2808f4b932c0", "comment": "Malware payload (zgRAT)", "value": "6c908e921ecb2f9e23ae89efbb35275aaa4e46b4", "object_relation": "sha1", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807551, "uuid": "a67c5041-a4ad-48bf-9c91-a7f0c4569fd2", "comment": "Malware payload (zgRAT)", "value": "a0fbf84e9f6786f33714a75b8d78af0c4fae1c67894352b9663c91900d6ae4f2362dc78fa5a01e4a915dcd5952cf240e", "object_relation": "sha3-384", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807551, "uuid": "ed4b7f48-c325-45dc-abec-f197610a0c74", "value": "T17DB66DD29D508A66D6EFF239ECB252427330B840433125E76B9526654D7BBC8133FB2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807551, "uuid": "1fd1d785-b444-45bd-a5f0-98f33da6732f", "value": "0951d9f67c9a9e1b6ea746ed01bccc26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807551, "uuid": "850d2724-e33c-4c1b-89fa-d7569c688de8", "value": "49152:4kNQ/uEj2EU8rFjH1K/gM2dMhFlbGxtHbjtxHAExkCjtNfGdxt6a+b2F9sAFX7lT:4Cmkt65b2Fdtl9ZqkKvI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807551, "uuid": "cba06423-b4ef-4aa7-9ae3-a1632b01f37a", "value": 11175320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807551, "uuid": "f8d6f4ad-c1c6-4ceb-9880-9bd52b49a3c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807551, "uuid": "ad476f45-ca27-4806-b570-c517fda06478", "value": "137326ac5fc9563532826dccf4442886bef1ec94a41654b9cbb6c963d78a35d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58179fcc-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808425, "uuid": "b9390a68-b331-4cac-aa5f-fbb0e7ac5ce6", "comment": "Malware payload (GCleaner)", "value": "4c721cc715437629645434db155928f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808425, "uuid": "52fea78d-aa61-4e4b-8d6f-72f34ff23afb", "comment": "Malware payload (GCleaner)", "value": "142f30da346b8ce1aa75cccb1dd12d61beae9fc42d71224ff8d24a394c9011cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808425, "uuid": "048fb121-309b-4d29-ac45-a91b4761af67", "comment": "Malware payload (GCleaner)", "value": "c92e837af93212b59ad4e2871c28a15357cbcc92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808425, "uuid": "1a54c888-e0cb-490d-b5db-abbeb3c19cfa", "comment": "Malware payload (GCleaner)", "value": "e56a8617e0fd74e22be54d97e6077951730ff430776551deea880ea6fe8e75c03ede73e01e5980ce0d3973040a275591", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808425, "uuid": "1895b028-5259-474a-b8d7-fa6ed2687d71", "value": "T10046E1C6DD7840B2FB5D1278EB17C4BD982C3B202A07700593CD8BDE5A7C74569A93AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808425, "uuid": "3b07e720-f373-4eca-b1b3-97e9941a4e10", "value": "336c69b6e8562d1c5231f219b62d7473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808425, "uuid": "93c0b538-29ba-451f-b73b-9d8adff0c656", "value": "49152:X9t9uLanwZBpIQaJd30HojjJX7oLGPOcPm15Gx6vip+iLmB2gTc:X9zuLVrt830iF80SGmj19", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808425, "uuid": "90e4dd15-b006-4c17-a154-9819042a4816", "value": 5670400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808425, "uuid": "581ef9f9-e83d-419a-83d0-29e13eb582ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808425, "uuid": "9a4f7e4e-1a86-41f7-ade3-6befb66ae285", "value": "142f30da346b8ce1aa75cccb1dd12d61beae9fc42d71224ff8d24a394c9011cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d903e54e-1948-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772793609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772793609, "uuid": "1145dbfd-8dc1-4949-b702-e28732f902a3", "comment": "Malware payload (RemcosRAT)", "value": "3087bac328df158ab2fd255c51102df1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772793609, "uuid": "0b2a449e-9592-44fd-9676-58b6f04cdca8", "comment": "Malware payload (RemcosRAT)", "value": "14432e750fb9b4c22c3ea6c2c4dda9d5338eebac5c86451d51c77358eabfda51", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772793609, "uuid": "1f9658ca-e689-4504-9c0d-f3dc3e705e51", "comment": "Malware payload (RemcosRAT)", "value": "aa44a1419a98ef24939cb09deca325774977406d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772793609, "uuid": "d5f950f7-d790-4b00-bf9d-76dc10f4aa8f", "comment": "Malware payload (RemcosRAT)", "value": "7f6844629eba01e5e9eda11c3d947166156155b76ab9c2877d97c3a78078728600a9929f25ed85b0d0d29f1fc92d3f73", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772793609, "uuid": "a404da03-5b04-4de6-81b4-94cdc691487a", "value": "T1D6E5B0AED9846F0ACB938B1D80FD8E5052976457716FB22B4633BD75D2F365E82004F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772793609, "uuid": "c37bc5bb-1e9c-469f-81f4-27e99dd36a64", "value": "24576:oETf0WKwQvB0zc7QJdX7tqD+JydLNhpFZ43u+hzpVQxPlcP6QZACYGfKqfuSfOWi:odUcUZppiqiqfuS/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772793609, "uuid": "f4c2ffd9-d94e-4ef7-a6e2-e743db0a697a", "value": 3249016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772793609, "uuid": "8b41ac99-4c78-4cb7-8639-1eb704eaf925", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772793609, "uuid": "ff608daf-2d0e-48a5-bc97-d6b34565d490", "value": "INB98767890.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe0c765f-1983-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819011, "uuid": "63b29e7b-3c1a-416d-aef6-7a8a83a1a308", "comment": "Malware payload (Mirai)", "value": "3375344b13f03922c1a29ee3899aa17f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819011, "uuid": "bb56975d-5e9a-45a5-b803-892f7c026db8", "comment": "Malware payload (Mirai)", "value": "14779a841ccb985767f66367ecd3644d826f23c921f52100eda9eefe9189fce9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819011, "uuid": "5454cc41-1efe-49a7-89c2-c094d577698b", "comment": "Malware payload (Mirai)", "value": "5cdb90738e726a1a885c8078ae7323533ec4846e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819011, "uuid": "cd886705-0019-4edc-87a7-f825fbeb4688", "comment": "Malware payload (Mirai)", "value": "5e01d9aa464f922e8000295e4708bf1adf4c48bd5313026dc2d2a80ff81735f3f9e4e49cffa848a78f5ecdd02e8987ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819011, "uuid": "fd0e6a87-41cf-4b89-a8dd-3027ab39b8fe", "value": "T163B34CC9F7ABE0F0F9060AB02063B72A9A34D9365111ED26F3D57D73AD35602916BB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819011, "uuid": "dc78b584-ec11-4088-b61c-4375ebf99929", "value": "1536:SiJpvf8XJwwBNV47YFx9K2ukqK8HtvPU6318aqoPMWwyPtJyinnn/iu4Bhr:xvf8Xvn4yBuVKe1+e7D7nqu4BV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819011, "uuid": "8c47f54a-4e64-476b-9a7e-4cf3620df7ed", "value": 112140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819011, "uuid": "325ade47-5acb-4033-8229-bdefa5507115", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819011, "uuid": "01dff885-725f-415e-b5c1-6917af0e53e6", "value": "debug.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "193092f6-196f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810037, "uuid": "188f3509-7079-46e1-8a0e-8e8a7841e990", "comment": "Malware payload", "value": "ffd12c48e8bc75f70e16ec70e7d102b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810037, "uuid": "eda3a1db-e709-48be-9a3b-0793bf324a63", "comment": "Malware payload", "value": "148d31f13b22a874b92def2ed334c0fbe72ea15494a7bdde9de752b3adac3453", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810037, "uuid": "e1e45677-6b3c-4b19-abee-74a5d80c4af8", "comment": "Malware payload", "value": "207682720482f8d91a053e9f7f118bd4fb19d043", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810037, "uuid": "cac02e95-4cc7-46c8-9dfc-f7b67ea11fe5", "comment": "Malware payload", "value": "2959b2b8c5d831e783991554adb6edf7cbad3e736b93621952c02f79cba6692835b5d56dd560039e3131e5ee23b46f0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810037, "uuid": "acff12ec-777b-4921-8ca0-d51ba3145fef", "value": "T16694E412EB107465F89349703E38A256782D3D352681ED4BB78D9F8A36B1A83B0F571F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810037, "uuid": "6c100875-e092-4e82-a128-7f24d88c847f", "value": "efdf248bdbf4a7ee72e7aa7964ad015f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810037, "uuid": "47341d67-fba2-4cd0-9cef-6b0f2ee95c18", "value": "12288:ZRm08V30cYwRinUZ2YMomSfc9DUPbpST80txvAQYt:vmNLmS09RTrA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810037, "uuid": "db82ea6f-68c1-42a4-a521-9fa75cae9510", "value": 417792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810037, "uuid": "c5297751-ae12-45ce-a55b-ebea208389a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810037, "uuid": "a0647184-b712-42f5-bd61-22985c08ee69", "value": "148d31f13b22a874b92def2ed334c0fbe72ea15494a7bdde9de752b3adac3453", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d963d79-1985-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819628, "uuid": "9d4d6b45-84a8-49dc-9435-08ee3a3e2e75", "comment": "Malware payload (Mirai)", "value": "4756faed68b604d469d52738eb35359c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819628, "uuid": "046bce8a-b8d2-4ee1-96ed-01ab718fe728", "comment": "Malware payload (Mirai)", "value": "14aa037691e7e19eb4d8c7857578e3fad0966c136fe803f6c1f108f1a63491b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819628, "uuid": "71c722bd-b921-4f3e-a95f-f6ce1ce29424", "comment": "Malware payload (Mirai)", "value": "975eec92ab1d8a5a2251aa75fdf5a9646379d0a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819628, "uuid": "98778d01-fcd2-4b79-a6e8-91d3bc669e5e", "comment": "Malware payload (Mirai)", "value": "d34e3902cdb7cf26a8f2cde7224653f92fc505cb5f0e081a1027781c8c87ab9e981d96c1da586b9fafa2e0498b6f1b2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819628, "uuid": "468ac983-6d15-4ab2-9cf3-17d4cf2dabf5", "value": "T1681633CDE97834A907F9C0AD375A92149F3E3683445B7EB87FF9709BC50865A2402CE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819628, "uuid": "ff4d8c2f-7de9-49f6-a6cb-d5ab0b3b6ca3", "value": "98304:ellxtvA8fr3veVvExF3JSBpW7zxVkTlV7vOvyqRKLjcK:ejXY8fr3veCxxJSBpW3xVmlwrgUK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819628, "uuid": "034f9522-1fa5-4f46-8829-0c8b396812d7", "value": 4170428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819628, "uuid": "65ae3dab-79d9-409e-b85c-b0df3ab530eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819628, "uuid": "7aa7e4b0-dd88-49d4-b401-80668e483619", "value": "bot_mipsle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7291d95c-198d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772823072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772823072, "uuid": "1f1ed497-4135-4495-8073-d56c57253fec", "comment": "Malware payload", "value": "3b5af92975900e4ef13e49ac899b64b2", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772823072, "uuid": "73160d44-0cc4-425e-8093-a107b3568fc4", "comment": "Malware payload", "value": "14cfadb8c0154dc1174b0b9af74765f769fad524d17eb2ec494ce02c9a221c8d", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772823072, "uuid": "0b8cd91b-c4a0-40b1-b4aa-e3ec19456214", "comment": "Malware payload", "value": "f0211a02144d6193191c1387cbbe6a983d226f18", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772823072, "uuid": "7e913380-252e-4b39-be9e-cff19658cade", "comment": "Malware payload", "value": "eb2b652249e9830580faa98e5be5fa991537874b118bf1bba87b8dd61a97fd3810db63636a03e023c4fe9157dfad5527", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772823072, "uuid": "4b5dc30c-14c8-4672-baa8-07f95f7f6f77", "value": "T1DB427A1037F44348F0B26F399A7B73658815BB16DF22DBCC0220800D1972321D869F2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772823072, "uuid": "0b327614-feae-4cf6-9f08-82f5211bff70", "value": "12:8d/2dSm3Sm3Os0oK9JuqVUKmQU4SK9Jo6jqs8XKYLXjtgBniQKXmZrYDeXqlhM6D:8d/2dRR4b1fWshiv2KDe6rglJtyFsnP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772823072, "uuid": "f54a5bfd-ff1f-458c-a52e-12dc1e0bec22", "value": 12385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772823072, "uuid": "3ca9518f-fba8-4efc-a68b-7142ebea8a62", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772823072, "uuid": "a366f863-d7c4-46d6-b772-e33b4aaba733", "value": "Dopovid_maino_09.01.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "232293ae-1974-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772812202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812202, "uuid": "da9f7843-6515-48dc-b4c8-a311b6a6d5c7", "comment": "Malware payload (Mirai)", "value": "37f6e92be6dad249c5fb6af45abb9f9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812202, "uuid": "3b457dbc-72fc-4f3a-afb3-7cc7983f8dad", "comment": "Malware payload (Mirai)", "value": "14f5f0adadc31567b70d1fd453afbebf68c7f7a469fa83cb4a670afa870688b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812202, "uuid": "b79db595-9beb-4aac-81f2-ba47d9ee0b41", "comment": "Malware payload (Mirai)", "value": "3d6a0be3fbcb499e95d5441de587edb38626f526", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812202, "uuid": "b9c789cd-5be1-4b8c-9b08-0e344a2d5018", "comment": "Malware payload (Mirai)", "value": "142fdf74f9f52dae2d84baced882fe88a4acb014d287f2b6f385c791fdcaaff6472ec3aac7516ab8c20d3893ce3f1366", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812202, "uuid": "9210d049-69dc-43ee-b3a3-6abb636181bd", "value": "T16D03D691BC824A26C5E4137AF67E17CF332063E9E2CBB217D9115B647AC690F0D22F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812202, "uuid": "adf1268d-d92c-4d4a-a598-7e3bf6701899", "value": "768:QnAj8PFqTSzrCk3mjqlm70FqlKwsXrl9RORY3Cg0S1sTPhPQQpv4ta+EbfwWSY:QnAj8PTCk7PE+nKYl0S1apQQp2fWS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772812202, "uuid": "dc284e71-c962-4aea-94af-f6b87df92310", "value": 39028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772812202, "uuid": "2830beb1-2af2-4c50-a90d-925f1aabf10c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812202, "uuid": "2f634a6a-7903-42b9-b2ee-829ad8b8152c", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "719e9009-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819205, "uuid": "dcbc318b-6221-4b6e-acc2-c666a57e8746", "comment": "Malware payload (Mirai)", "value": "15b35751a3a11cbfb52810ec324a62d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819205, "uuid": "84d40fe0-e3b9-41e6-9983-eaac2b84d46b", "comment": "Malware payload (Mirai)", "value": "14fde8e693ba9186c0202676aa997979a20dbd9a2a0dc26e06964e5d601fbe11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819205, "uuid": "a82a37e3-c9ef-4911-8d76-f55dc17e0ef7", "comment": "Malware payload (Mirai)", "value": "657f242072b88e0faea3b55349ae38ade5e36221", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819205, "uuid": "568ce3df-3c63-4112-a23b-ddd0f1ad7f5f", "comment": "Malware payload (Mirai)", "value": "2f1ae2fc9f6ed5f8436c0cb12b4c45e4e1a9395f5707e2e5ee35fd2a084585b2790fe3a9fbd2f7205f6db718535d246f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819205, "uuid": "611619ad-03a5-49b0-bf8c-948a2f5a6e5a", "value": "T18A831B46B9818B12C5D212BAFA6E518D33137FBCD3EE7212DD20AF5067864EB0D77612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819205, "uuid": "d30015e8-bd94-4d7a-9940-a4f6f1aeb4a9", "value": "1536:BDnwYvQWU/mL6hjlpLvFauPIFAQZbMNiFiEghBfZ7gL5hGYUs/gWty:L4W5CzLvFauMpiEghBfZELDG9ey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819205, "uuid": "a7619053-e25b-4d55-9ec2-f801ebd1b80e", "value": 83888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819205, "uuid": "cc634709-6fff-441a-a402-5c0c5eb82dbf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819205, "uuid": "44477799-38e6-4b26-b62c-2fa24c060b60", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cdb612a-1942-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772790877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772790877, "uuid": "1ea394cb-4271-4e11-9b78-3de2bdc8779b", "comment": "Malware payload", "value": "370ec4e513dc8ee94f5163f3ac09c592", "object_relation": "md5", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xrpnode-app", "colour": "#D7A51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772790877, "uuid": "d5c1e79f-c1b1-4155-8320-37ff31cd7b0e", "comment": "Malware payload", "value": "15015b739b901b6eb4849a504341068993de5ce324f619dc3f9d1230d3fa5759", "object_relation": "sha256", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xrpnode-app", "colour": "#D7A51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772790877, "uuid": "962ff597-72c2-41fd-81b6-8892cf43b368", "comment": "Malware payload", "value": "3cc13b6eb47d0f288ba651f0990098af7d9eb0a3", "object_relation": "sha1", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xrpnode-app", "colour": "#D7A51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772790877, "uuid": "5d8ef546-6fbb-43f2-b107-8b322d30a47c", "comment": "Malware payload", "value": "5cb00edc9fa5f90e662a2bab8fc9abc270413a21c81a75ee321c53bf92c9d28f72b36488523dc6b37de5089cc3dde44a", "object_relation": "sha3-384", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xrpnode-app", "colour": "#D7A51B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772790877, "uuid": "4dd2fe21-f9b3-435c-a1e6-abb260320a13", "value": "T17F31127789403C7EDF8645CE2C823911A587456B424F3D9CF69C48892BE7B7C947C06B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772790877, "uuid": "c3173775-eef8-47f1-bd04-3b51f9e1da98", "value": "24:1y2A4s9+NdgPWZP70da2A4Ax2Ag0qGaQH6xvu2AQ2AuRYzcz2Zfsz8eSO0Ga+8uA:1lI1Wh0bA6JQcCWcHF0r+zIepNhFO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772790877, "uuid": "dd8199a7-1174-4572-bc52-addfd82d7d69", "value": 1520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772790877, "uuid": "9ea7be71-d7f6-416c-8998-f6d97a18aa3e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772790877, "uuid": "04fd4687-3c6d-4251-88ca-d2ba672d9463", "value": "15015b739b901b6eb4849a504341068993de5ce324f619dc3f9d1230d3fa5759.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e80222e-192e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772782129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782129, "uuid": "5f151b8b-61e5-4611-a9f3-44e0be12d9c7", "comment": "Malware payload", "value": "fc94566e4fd0235624863475cc2892bd", "object_relation": "md5", "Tag": [ { "name": "api-devx-help", "colour": "#8AD189", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782129, "uuid": "51aed722-b3e4-45a3-9244-56270a319869", "comment": "Malware payload", "value": "150e2b307d306d8730f611a2c0c2613c9b3ad5ab3887a174b926a0a2a61c35e8", "object_relation": "sha256", "Tag": [ { "name": "api-devx-help", "colour": "#8AD189", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782129, "uuid": "2f7a9652-79e9-4d85-a0bd-3c96dfc76c60", "comment": "Malware payload", "value": "750b5aa9854293d6c5e9d772b4888142636347fc", "object_relation": "sha1", "Tag": [ { "name": "api-devx-help", "colour": "#8AD189", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782129, "uuid": "b6cd7131-f4a8-4888-9252-0cb3f638dbb1", "comment": "Malware payload", "value": "68c71912c1013743ec773437365d0052b2bb87cb9e176ea392c347c03107735b74a89bc8335fdf83fbf3dabcf2a0fc63", "object_relation": "sha3-384", "Tag": [ { "name": "api-devx-help", "colour": "#8AD189", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782129, "uuid": "86aef0ef-5b0f-4c4a-bf99-4c58b8294860", "value": "T1A0F733AE62C46F231DCA831E4976BB9CA121C325E1E4A4796DF82F4356E0B075F3D16C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782129, "uuid": "2cff5309-09ca-47a2-b536-1958e9a651ef", "value": "1572864:hBh+bST8j1cEiWoYFzZholtSEmxnkG2Su8nR9ZwLlAMu/Ya8B:hMr1cfFYFtholtSNb5nlMu/1y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772782129, "uuid": "75cc41c1-f14a-453c-8462-8480f9555f3e", "value": 73297640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772782129, "uuid": "2a6ca1fe-56ed-400a-9b2d-1d5245591f1b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782129, "uuid": "89022c9d-8f88-46db-9dcf-6a3349557c5a", "value": "53e0f3e2999b6f7963865a478ae53f86c3812aa27f36089f38e2d2e1e5de2b6b.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d559be85-19b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772839129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772839129, "uuid": "bcc8e868-2ef4-42f1-b4ea-453df0a332db", "comment": "Malware payload (Mirai)", "value": "353dc61374e69ba74192778525db70f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772839129, "uuid": "fdfa4405-014c-4567-9cdb-b5755be65147", "comment": "Malware payload (Mirai)", "value": "154e1a90d2a10c17d62ddc5933a45f2ea1aeeb13f8d93f450c70c423e8910f60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772839129, "uuid": "a149da4b-eb0b-4ace-b3b4-527fa04f14da", "comment": "Malware payload (Mirai)", "value": "067fe9bf640c58eaa7271f39ccce1dd7a63b9eae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772839129, "uuid": "70c99c0a-fd18-417c-a98a-0e6f4b2fed96", "comment": "Malware payload (Mirai)", "value": "a52ba955a85afbeba676f255ae2ee070ded0878e6aac8020a5520e27dfb325d028aac8809ecf9bcb59046700bb7eaf04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772839129, "uuid": "9ea61a4f-7b6a-4076-9442-cb63f0dc77fa", "value": "T1EAF3853E7A11AFBEE168827107F29F70CF9529D326A19381E26CF6185E7128D0C9F754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772839129, "uuid": "1d0119cc-5d6d-4165-a913-0fc8109548bc", "value": "3072:G103/L7OBjwobENT7nfIvT7JmrThPaL2IvP7Nb:s0JfQvxmrThPaL2IvP7Nb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772839129, "uuid": "0f732562-9ac3-4ee4-abf2-f7377aeec9eb", "value": 159678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772839129, "uuid": "3c46132c-4ca3-452a-b08c-27bd8b99f634", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772839129, "uuid": "1c8b091d-0e7e-4d30-96bd-fdde5eb1f1a7", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ec6893-1995-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772826574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826574, "uuid": "33a33cbc-e807-43f7-9588-a80b818b58f7", "comment": "Malware payload", "value": "ffac95db063dc00e53e14bfc7cb30c17", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826574, "uuid": "c82b1457-34ff-454e-a912-ddca7f52c147", "comment": "Malware payload", "value": "15779f5361fe4224a7333fe4402e8cc4ba6c1fc748907f0fd5b61446e5b0820c", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826574, "uuid": "869af2c5-5621-40bf-8972-25699f4e3bec", "comment": "Malware payload", "value": "745f2e25cf2aaf78b81ffc12e0b04872739b6216", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826574, "uuid": "d05e5abd-827f-41f9-8e0e-ead085b1709c", "comment": "Malware payload", "value": "f80f682f14e1497936bb33585958f2464f17e2ac2b82f35fbb3e398a87b325fb10d9ed9eb9343577149a8a89f0f2aa0b", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772826574, "uuid": "6689fa20-ab5c-47e0-9ef3-40b56a61eb31", "value": "T1C4252303B9D1FA5FD0075F7669D2A216600DED582B1C85977FCA732D6CB623392E3288", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772826574, "uuid": "7bd4c7ac-489d-4124-8a6e-427a9cb2e507", "value": "24576:JOaY0CJR8lffiwyceg8U6Y98FVkJfIaqiTKt6mh:JOjPGiwyceHE98kDW5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772826574, "uuid": "1abdef66-3819-4a86-a08f-bad8de517fe2", "value": 1057792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772826574, "uuid": "e6d97d97-bf02-4fb7-9740-71e5db96bc1b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772826574, "uuid": "7f913893-d4d7-47e5-94e6-5b0098f5593c", "value": "SecuriteInfo.com.X97M.DownLoader.2343.19025.22015", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "055721d0-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819024, "uuid": "0dc17875-c3bd-44b5-b04c-852fac2759e6", "comment": "Malware payload (Mirai)", "value": "608fb905a8f4a2d5a7311aeb85369878", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819024, "uuid": "a12c3038-8b5f-4e1c-87a7-bda45249fde7", "comment": "Malware payload (Mirai)", "value": "15833b64e5b5a08d9875c88c901c2687130618f4c283de2a6e699c66288a1657", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819024, "uuid": "2cad9c07-553e-4444-8a42-2bfab8cd5e37", "comment": "Malware payload (Mirai)", "value": "de3d85a75ef27f84bef38a8ec5babbb6b4c9d57d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819024, "uuid": "da015c32-fe2f-4765-94c1-ce30d07ee059", "comment": "Malware payload (Mirai)", "value": "ac2571f35f25c2955bb0362e3e153ada0871d088811539b80d5ba98238a292ca08b7936dcca640e8550b5c4d3762ace2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819024, "uuid": "12e70eab-4efa-4b18-b185-f6d425b5314d", "value": "T1F3839C23C9361DB4D45845B0B0A1CF355763E52681976EF698AACA3ED083ECCF94A3F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819024, "uuid": "6ede17cb-cb5e-4be4-b7ea-31f2f3bfe35e", "value": "1536:8OmkxPUOUubAF848Z+E7KEvnzho93CeXPF9lyD:8XkxtL1+E+Edo93tNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819024, "uuid": "4efa5323-4b4c-416e-babb-13a78c1d7a47", "value": 83812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819024, "uuid": "eac81c7c-730e-4bd8-b3d9-293344123321", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819024, "uuid": "e4c059aa-7521-4529-8e41-701f817dd280", "value": "jawirbot.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4bc5833-1929-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772780207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772780207, "uuid": "c6da4bc5-0277-49e1-9bd3-cc1e4c2cac2c", "comment": "Malware payload", "value": "19d73c6daa5183d7ca5713ce9e4b3c10", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772780207, "uuid": "8f8b4e83-5218-478f-9548-3a9b1e56b242", "comment": "Malware payload", "value": "15c58b3173cb547fd4ef4a109a50d5d7907c57d7f578f3bdc5e0b67afdc6049e", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772780207, "uuid": "72db4591-d4fd-4160-83d9-a890d0b2a741", "comment": "Malware payload", "value": "a4c1c1cd523b5ad6dac0cfc3e4e0da0e4265908f", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772780207, "uuid": "3d94b37c-af55-411e-a7b4-26c61c043deb", "comment": "Malware payload", "value": "9827adc3a0e97e38ea3a5c108abf48336b62403903b4f6c20f0b77a48c86ea0c862f66fdc036c4c6499f70be0ce1d598", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772780207, "uuid": "3fb73a07-9bda-41ba-9283-3086c26960b3", "value": "T12E249E021C76AA510774894AEF6C8750CB9B7606C41A3D1B746F58F02FBBB648B31FDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772780207, "uuid": "e257a714-896d-4eb8-9eca-f3f0e9ac2ec7", "value": "3072:kvuvxGvyPTPFynlfPEvT+BkMWo5xXThTKKkBRnJYEX6J8/tcBTP0:0uv9ylfPs+ia5xXU5nLoieBTP0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772780207, "uuid": "973fee64-bbfc-498d-8f94-325bb0451a9d", "value": 221535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772780207, "uuid": "cd5bc40e-1307-4b31-b27d-d2675b5aa107", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772780207, "uuid": "d7e7e936-23c2-43d1-bd4c-cc8a9ec788da", "value": "Protected (3).py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9193eb75-1984-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772819259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819259, "uuid": "79b73994-a3ba-42b7-8e88-eb7175458fd1", "comment": "Malware payload", "value": "2bc899ad2c68594b7d068d4af185db5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819259, "uuid": "e1b65607-31dd-4356-b229-1469a89483f4", "comment": "Malware payload", "value": "15e982a32165a377160260aceaac808131ac01be9f6588fe0f60038fefd64b90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819259, "uuid": "d23efea0-e123-4c85-a073-c23896092d7a", "comment": "Malware payload", "value": "37d7e531266a82775595d82ae5970a62d575081d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819259, "uuid": "ce20036f-32ad-42cf-a7e8-f141fd31f7e0", "comment": "Malware payload", "value": "f781e4e327646ffc83e3905f845fd4d2874ec359c0800c3d70eef8a77d64669bbb18e7397112b065a3f9503f6dbe4d9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819259, "uuid": "15d150cd-a59a-4edd-9cf8-a77e8f9475ce", "value": "T121231745F9819F15D4D525BAFF4F21897353472CE3FE7202DE210BA9278EA6B0B7A801", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819259, "uuid": "10f53c9d-6428-4d8a-a12a-5694b82708d5", "value": "768:BFnxZD2Dbxyyh1vnVZYLECjzEQZIIdzKRKluJiIdRYZv6v0RtTHgGAMe9:BFnxIxyyhtnV2xjzEGIIARKlMi6OEWAJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819259, "uuid": "37d657bf-f05b-4f08-b730-f324f7a7f3e4", "value": 49096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819259, "uuid": "22144acd-d8ba-4ad6-bdd0-e392dc835e38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819259, "uuid": "6da29746-8ab9-4615-8da9-f799726b8c33", "value": "violetarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28c86713-1974-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772812211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812211, "uuid": "733ecdd3-f459-4128-a15b-cd8c014cb9bc", "comment": "Malware payload (Mirai)", "value": "568500e2dca4941489be01a8cfd63f12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812211, "uuid": "28f89ce2-f47f-4e39-8fb1-0d7286878d2a", "comment": "Malware payload (Mirai)", "value": "1679d43b3c45312369aa2050559f3dae7e7213f43ae023163e263cf78a63fd68", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812211, "uuid": "cef25184-ef3c-4127-854d-e3bcf5511ceb", "comment": "Malware payload (Mirai)", "value": "8cf7d3c4c674e402e5b65d01210a47e7acd06ebf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812211, "uuid": "0bc29472-a21d-4a0f-be1f-367008f166ac", "comment": "Malware payload (Mirai)", "value": "5db05f4db18cf1f0ef1954f17e245442e11bb83210498115ade2ee52c79bf8ad2948b8dd331a6bcb43b0332c3939b042", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812211, "uuid": "68d6a55e-4a3b-48e1-9dc6-4d00ab39c469", "value": "T1ABE32A46EA418B13C0D61775B6DF42453323ABA4A3DB730699287FF43F8679E4E23A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812211, "uuid": "56ade3f4-8f83-4df0-a491-db018e1f864b", "value": "3072:03DeG9+AYBhQeqHaPAn0DG5OCYzUUtBfxn0DYM/9q2KzC:03DeJBaDHaPAn0DGzYvBfxn00M/9qFzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772812211, "uuid": "7b88c715-7ea1-497f-8551-d9ba39c9ad09", "value": 153730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772812211, "uuid": "75e2fc36-9ef4-4dad-b40d-b11a2f00ac9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812211, "uuid": "3fe6c339-d5f9-4d4f-8dcc-61b6d61cc12a", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "423f7915-1982-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772818267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818267, "uuid": "be13cc5e-2007-4c35-817d-8cd837e8a33d", "comment": "Malware payload (Mirai)", "value": "085efcef06ea995885d7879fd3af2be9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818267, "uuid": "96b1db29-f005-4468-bd4e-119fa4830e8c", "comment": "Malware payload (Mirai)", "value": "167a6cb4c56ddca68283a29cfee5a1f41799022cc4adbc873b71dc6d3f9759e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818267, "uuid": "41271b25-0970-48a5-b225-f0982dcdb78b", "comment": "Malware payload (Mirai)", "value": "f856a9cd772a954e8c308bff0da8a1ff520e82d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818267, "uuid": "a3f3434a-a792-4905-8c8d-89a95ec3b22f", "comment": "Malware payload (Mirai)", "value": "a0c7c582e34746292fa17268ca1cc12aa5de617eb16499ca8296cc55f04f25fbac5308bc9c7d4c2112e859655e0c9fb1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818267, "uuid": "c05a662f-e137-41c2-85c0-8902668be87e", "value": "T15F04B50E6E198F7CF79987345BB79E31925833872AE1C582E1ACD7105E6024F641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818267, "uuid": "cb6d1e7b-0cc3-435a-aec0-b8d8040fbc0b", "value": "3072:1OATXjpCgqDJHDexBJKfjPV4kuMu8hJBQX/uw9EfszRpSP/QBrj4jTv3TcJ2tD2i:1OATXjpCgqDJHDexBJKfjPV4kuMu8hJH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772818267, "uuid": "77aa45b2-877b-446b-82b5-7a9cb5e5d8c4", "value": 175820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772818267, "uuid": "a7020f7f-f70b-4118-a4ab-33f385ea89ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818267, "uuid": "3b950711-6c1b-4c13-aed0-d097b9b57ba9", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aa19331-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819032, "uuid": "b9642cb2-eb1c-4eef-b1f8-70788ee3427e", "comment": "Malware payload (Mirai)", "value": "8b562c98e8bb6f9b46620d0f74e0acfd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819032, "uuid": "7abba02d-c530-48df-bfd1-cd28ee41b28d", "comment": "Malware payload (Mirai)", "value": "16d4fd7dbc82af3f972fa860f39cbd08410a3f8b20bc1af3ed299dea44dc2222", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819032, "uuid": "866ee8cd-f8fe-4627-b712-731443ce80e3", "comment": "Malware payload (Mirai)", "value": "cdb7b9ac3a0008e62eee249070bfafae2e049e31", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819032, "uuid": "2a6732af-9c1f-4f6f-b15d-1a8498141d76", "comment": "Malware payload (Mirai)", "value": "115a0e302efb8fb2cea0ed8b95dcd1993bcba69eab255d69670d422685ce2dab7bba69788566f3d9d8f9806612559e8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819032, "uuid": "56bd313b-edbf-405e-aedd-d6ac8d781fe5", "value": "T10A83B786F8513B39D7E1FAFEE748139D723A0398A3D7B211CD38556263C8B58AD34624", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819032, "uuid": "ca99119f-3f84-4438-9c84-6cda827f64a5", "value": "1536:zknaZu4XoZuILp2TYouOnNTUGCHdbG70WM4DTrG5uVB:zknsuNuWp2TYouOnNfC9bG70WM4DfMuD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819032, "uuid": "b80bf13f-8a09-45b0-b9b0-7aca644f34cd", "value": 84664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819032, "uuid": "faca661f-5f64-4205-baad-2f81c0f5a655", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819032, "uuid": "34912034-1d91-4f9e-a05d-1be9b26200aa", "value": "debug.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ee2755d-1962-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772804598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772804598, "uuid": "74bd107f-4ffe-48d1-bb97-48d7ac7898f0", "comment": "Malware payload", "value": "66f4e04c4e25c98a8641f102b1aaeaad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772804598, "uuid": "1ce26c63-949e-4256-bca8-98662e49a994", "comment": "Malware payload", "value": "1700b3653df1f1b83115f46481dd086c8547a6e5b0691d402a89350dfb401a21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772804598, "uuid": "6601756e-f4c2-40e3-bde5-db4548c6a3e4", "comment": "Malware payload", "value": "ec1a11a9361d43fb3201700379dcfb142854a524", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772804598, "uuid": "dea69f2f-f096-4053-a63c-7963288b1ab6", "comment": "Malware payload", "value": "e61e25adf3db8369b23948f29cafe75e70524838f0a3aa2ba894592375d489395be46d200cb24c1ffd433eca0e522bf6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772804598, "uuid": "19a96aae-bf76-4049-9d5b-ce8d0287af52", "value": "T1B294C416EA1074A5F89345B03D79A246292D3C3A2680EC0FB78E9F563B71A8770F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772804598, "uuid": "82e8418c-e4b2-430f-8a1c-33d1fd84aaa0", "value": "6f5fa4bc892e6fc08316936b9720ff9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772804598, "uuid": "82b532d7-ad5d-49a8-8bbf-97823813e4de", "value": "6144:s8sUJ6pfFrWhVBfejGbubJX1ug9NX6z0Mil70irB5trZaIaCnVAyW6lL7D6B5FsV:NsUJ3fejGbubJX1ugqgTrZaIaCFug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772804598, "uuid": "46e8f502-74af-4fcc-82f5-e4c9d973b33d", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772804598, "uuid": "0f89b238-01fc-4551-b96d-76c82cbf07fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772804598, "uuid": "ecff90f9-8130-4f98-99b2-20308173aab4", "value": "1700b3653df1f1b83115f46481dd086c8547a6e5b0691d402a89350dfb401a21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41959ced-1970-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810535, "uuid": "76d9b36a-3448-4bfe-b359-87b6421beed4", "comment": "Malware payload", "value": "75833364a3dca6238dc94b5199227135", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810535, "uuid": "7757adc8-0b01-4f0f-9158-495b09ac248e", "comment": "Malware payload", "value": "1709f214312d94851629b41aa95b073ed9c9dd205853f0822285d1c50581d5ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810535, "uuid": "6cc2a0c2-ee30-442a-9b78-c9270e77ceb6", "comment": "Malware payload", "value": "02d8325c38a244f29abd9a71630983d6b6417e61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810535, "uuid": "29c4dc2e-97c4-4499-84ec-c07d8e48f990", "comment": "Malware payload", "value": "5db97ec0fe2b9386863382deb339a0847c7e60fdf573b413589e5914ec41642f9a13ae2d2ef04e591e9ec59a2a34315a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810535, "uuid": "a87bfca2-705d-4356-b563-9be3de379441", "value": "T143845B23E620A12EF1A3C9F1B9A5A25728263D3A5698EC47F3415F5834715E3ACF131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810535, "uuid": "1b2e5214-778c-4c8a-bb38-1b71571b12cc", "value": "252c027bda7298291893ceb108f11214", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810535, "uuid": "ae1058c0-0ded-4eaf-bee1-f50dfe15022d", "value": "6144:y8d1/w5KA81IJ8GpF6nuTmOOUWTUxcBfbbNcknSrnGRyZXPFnUY:hjYKkJj6GmZUWQCbcSRyZXt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810535, "uuid": "572c580c-5734-4aa1-9933-d3c24a0e9945", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810535, "uuid": "d1632f32-7ed1-41fc-a1ff-03f0bcb61d15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810535, "uuid": "071d4ca1-e3f1-4bb6-a7b2-b4957cb069f7", "value": "1709f214312d94851629b41aa95b073ed9c9dd205853f0822285d1c50581d5ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a05ff04-196b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808375, "uuid": "fc516402-08c7-4215-b658-811bf73b9be9", "comment": "Malware payload", "value": "fa1e01a7b0e427c055eeeed76d4dfc16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808375, "uuid": "e37c9075-a95d-47d8-a4e5-b5a10225367f", "comment": "Malware payload", "value": "17134855fb6c5c7d5357c6a3b87a3bff86c43501e3d6cdfc963204559b1e8d21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808375, "uuid": "1e32b58a-f38f-4317-93fa-bd21ed232c70", "comment": "Malware payload", "value": "76bfcd75eb207903bc01937892f86abe41e6a2e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808375, "uuid": "3de74d74-da7a-4a52-9537-9b1be7914344", "comment": "Malware payload", "value": "5980f03e62ea287194d7e6718efeac45ebffc31ed2e2474c521c78c1d46e5b5ee2b9e5ef682c97704e374a45e905a059", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808375, "uuid": "db5b45dd-8d87-4cc9-900d-f68571860f9d", "value": "T13455121162AFDD22C6A9177350E2E63403B09E5AE013D72B1DEE2FE7BA567D61D84303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808375, "uuid": "5f7fd1db-2931-42b8-903d-fd3fc1948dce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808375, "uuid": "a68453a3-8aea-4b8a-8730-4ee63a9bc7e4", "value": "24576:5SDGxm5ElNTuyRyYTdhfcyLF/s5WYt+RbAj/AJusucy1xqN9CaguQlVict:5SDGxXlNT95NcyLS5WdAj/A+fosuWQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808375, "uuid": "76a51118-11ef-49ee-ba76-98b7cbf207e0", "value": 1331712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808375, "uuid": "fdc01126-324e-4d40-a986-3c142ade8e11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808375, "uuid": "cdbd3771-2a70-4f3e-8f15-a02e5c6cd553", "value": "17134855fb6c5c7d5357c6a3b87a3bff86c43501e3d6cdfc963204559b1e8d21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f470b9a-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1772811470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811470, "uuid": "50810c34-1eee-408d-a2c1-454be8dc7c43", "comment": "Malware payload (a310Logger)", "value": "2f7e5639db38d71eccb29a0a88ece1a9", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811470, "uuid": "211bbf27-f94a-4be3-81b2-c0feb2f6f480", "comment": "Malware payload (a310Logger)", "value": "174cd71ba0adc35fb65689bc77b349fad38811d170053b087c4bf02a0a122ef8", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811470, "uuid": "4f0595da-c5d8-488c-8b3c-8f0fc2602ca3", "comment": "Malware payload (a310Logger)", "value": "25aff71b84da30a7475b7b5015271ae316829583", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811470, "uuid": "89337129-fab2-4eef-ae1c-df0d49d668c8", "comment": "Malware payload (a310Logger)", "value": "4f64d3b9aa4a0747af887484d94de208fc7dbcbb3ec66708a1a0b44b57d6dd55eac7eab47235909e2c05708ea5042a68", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811470, "uuid": "ba130b8d-01b7-4b61-af65-009409c2c549", "value": "T19B845A23EA50A12EF1A3C9F1B9A5A25728263D395688EC5BF3415F5834711E3ACF131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811470, "uuid": "4646cc10-abc1-4435-a54b-d6eb368836ec", "value": "252c027bda7298291893ceb108f11214", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811470, "uuid": "c10470f7-3007-44e0-9c9c-4f4ebee9d82e", "value": "6144:P8d1/w5KA81IJ8GpF6nuTmOOUWTPQCNE4EnvFEsvyF6GCyHxxBT7k:EjYKkJj6GmZUWDCv0nCyHxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811470, "uuid": "23f9f08e-da71-4114-ba42-8d958c5e7c9f", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811470, "uuid": "15d263b4-f3b5-43f4-bd11-80dd18c3c7a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811470, "uuid": "2a47db89-5a4d-4207-8a57-0f25c26194d3", "value": "174cd71ba0adc35fb65689bc77b349fad38811d170053b087c4bf02a0a122ef8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8205073-196b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808640, "uuid": "afe68a57-fa08-4f13-8fcf-8347a5d53f5c", "comment": "Malware payload", "value": "ed54dbfaa5010fbfb7725609ab39c35b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808640, "uuid": "069425c8-f2db-4b87-beaa-972f9379b04a", "comment": "Malware payload", "value": "175d125a3639d38212758b595a4bb8f476794bd92ddabd9069380ff33ffb307b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808640, "uuid": "b32b9a4d-76f6-440b-b68f-0191536174b8", "comment": "Malware payload", "value": "ac025005097b7f8a804d7e9fc0837760283a7a2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808640, "uuid": "a7cab7c0-21d0-4356-827d-2f74cb10fa67", "comment": "Malware payload", "value": "273a414633ed31326a8807353a74cdc7e0eec41fc2f7c77cbc2c84386fbfc2b2d1faac85a3235873a8acd93076857a52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808640, "uuid": "ff7cc3f5-dba9-4c85-8b83-18b167c575c3", "value": "T1FD0523203980D983DA535B35A536AB735AFFEE231BAC421F1761BE4C3C72646AD0B714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808640, "uuid": "67030cf4-69b6-4f32-844d-5fd2d43549d1", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808640, "uuid": "ed510ded-2dcb-4274-9fa9-4d0fec1116de", "value": "24576:gN8b+Puqn7vjSxiYBGkFL1bbxJDQVuoqjyFa/nJNGrkU:A1Wqn79Ih5VonKUahQrkU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808640, "uuid": "e7776e2b-ca95-42d1-84f6-87df6815def0", "value": 850760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808640, "uuid": "05260f32-c6ad-41b1-8b18-8462b16b924f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808640, "uuid": "55dc7ff6-5ad0-4f5b-9746-cb87bc521155", "value": "175d125a3639d38212758b595a4bb8f476794bd92ddabd9069380ff33ffb307b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74b231f5-1970-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810621, "uuid": "f84e0000-988c-433f-a473-056cf75218c3", "comment": "Malware payload", "value": "46f23ea9f80d13f89436c742eec63f57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810621, "uuid": "2c9acdd6-f212-438c-bbf6-85324483583b", "comment": "Malware payload", "value": "177c845c9a901583824521abbb5f9a97cb786b5a157b711668c1c196247065ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810621, "uuid": "6c6d6d62-f6e8-4115-aaeb-09a861dc6b14", "comment": "Malware payload", "value": "727dee4a05caf1fbd38519558268ac82d3eaf74b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810621, "uuid": "f5fe7ccd-57e5-4d59-ae67-177bed01947c", "comment": "Malware payload", "value": "0e73de13154f6df675ef782a6f4d0b5cb8739a14b3077ea35ec7507bafdbc257776b751f8c63e633439ed2ba30390cc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810621, "uuid": "be14d7d8-3916-4d23-b0e0-13ca2c214aa7", "value": "T18A4533403770691BE663307ADD79D99E2F7280A209F0730B77A035367A5A4CBE51EA1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810621, "uuid": "f07b74e8-0ba9-4d1c-81ca-54dcee693dd6", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810621, "uuid": "71884768-208c-4b57-801d-539ac585cb53", "value": "24576:R3WrDmoFFY2aZVfGmPVti6/KXvezY6HuxfCIeTmYAs9oLN7BwCArAWA4+uMU:RWeoFlwGmNM6/We0quxfW6wonwCAE3cV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810621, "uuid": "3e237741-c428-4326-928f-8189afebc3a6", "value": 1252328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810621, "uuid": "93107e87-df10-41b9-9f59-c31f233d677c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810621, "uuid": "74ace287-0b3f-4dff-a71d-fa2c620d9207", "value": "177c845c9a901583824521abbb5f9a97cb786b5a157b711668c1c196247065ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb80491c-1968-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807411, "uuid": "0cb81685-0263-44ac-ba46-dd3dcd4771fc", "comment": "Malware payload", "value": "1a3c1751280e8f154bf5e916b37ccacd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807411, "uuid": "bec677b5-b38d-494f-abc8-1571c1d6fe09", "comment": "Malware payload", "value": "1782f3db2231d7b7ab877c21fc550b44469e22126b17117e188d3317eed7d5ef", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807411, "uuid": "e2ad7928-4b53-46dd-8dea-41980229c0f3", "comment": "Malware payload", "value": "33287f3f8bc5c2e04f0b5ca638ad4f0d9ec2ed9d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807411, "uuid": "52804745-56af-479d-b999-064369a95662", "comment": "Malware payload", "value": "77e68a111c23c825302ed20a506cf9479d3c25e464e8ca1befa77ac70ede0ee2b696132a0b166099158240c0c80c0243", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807411, "uuid": "3f6ce38c-9c93-4903-a7d0-d380136fee5c", "value": "T1EE153AD176EAEFB9BA4B1F7BE627732F039546850B42C994D1623C43996364200FC8DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807411, "uuid": "d98ebf3b-80f9-408c-957d-826d3d5d8e67", "value": "154514cb767b5afbf381ac853ede8b45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807411, "uuid": "2f03283f-52dc-44ee-b54d-d9e83489de4f", "value": "12288:Om8NSyLJO6JAO9r5oB+XenrvM5Ewo3Wd8VFoEL5XV:Om8wBO9riM4vwk9V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807411, "uuid": "f226fd6d-489a-408d-8333-1548a0c996c5", "value": 928256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807411, "uuid": "3dad575f-0299-4c9e-9e1d-0a5272d29c9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807411, "uuid": "b2117a6c-4289-4624-a0ec-e00ffcb7d7fd", "value": "SecuriteInfo.com.Win32.MalwareX-gen.77937273", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0def71c5-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810019, "uuid": "b5fb187f-6912-4f47-a9a8-1a96ae3ea3d4", "comment": "Malware payload (GCleaner)", "value": "9c17b3f2f05ac2499bb9c2eb30b19f7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810019, "uuid": "e0a33f8a-f532-4a8b-8976-e29900fb4c80", "comment": "Malware payload (GCleaner)", "value": "179d2412844a501d0a1409d43d127c365d2e14d4956c291c2e1115b33bacf5df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810019, "uuid": "1443df28-53d7-4cec-973e-194c52092e97", "comment": "Malware payload (GCleaner)", "value": "0b4df0a7a9efd9de9ec0346c857dfb92b4bff0d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810019, "uuid": "5a7cdf8f-e4d3-497d-a17a-576fc0bc3f5d", "comment": "Malware payload (GCleaner)", "value": "42bc6b78589c9227dd53fef87ea1a28178f6d4740f12f691f21fa90bad9d993c2f349ae1506c167d487955e284b5195c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810019, "uuid": "083d72c5-96bb-4f2b-8113-db6bc144d766", "value": "T17BE49F36F6D04432D1226D78CC5F96A598297E803D287C4A2BD81DCD9F38382BD65E9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810019, "uuid": "2cd0c60b-a119-4b6c-b745-0c73a648353a", "value": "c475b6e242f56325f64c2b76233f720b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810019, "uuid": "70a32e64-cc88-4366-bfc6-5ec5f7647d0f", "value": "12288:tQ8mJu5T0Ns+MD77lUjVMXokTZ90/xfQFWl9On:uJFNhu7lK4okNG6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810019, "uuid": "0752a36a-e055-4f9e-b2a6-07b803280819", "value": 698368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810019, "uuid": "4b989cf6-eaaa-4708-ba6e-a9a02b39c0e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810019, "uuid": "f74f13ae-1d72-42aa-a91e-2eb683609062", "value": "179d2412844a501d0a1409d43d127c365d2e14d4956c291c2e1115b33bacf5df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f1a1e10-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772808329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808329, "uuid": "2c1e0352-8deb-4c9f-8ba8-653e27f1232b", "comment": "Malware payload (Formbook)", "value": "ab4d1bafed32cf699755bb58537c5baf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808329, "uuid": "0baf3d5f-a626-4e6d-a333-07df2f86ce41", "comment": "Malware payload (Formbook)", "value": "179f5d450a755a78da421044688b0be6375f0baa76ed4e9006ae87d363a4daae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808329, "uuid": "9db37b72-b8f9-40ef-ae0e-e2542987fe5f", "comment": "Malware payload (Formbook)", "value": "2b987068f0450440e55b4c5fff4a5ebfa875fb0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808329, "uuid": "b4147107-76a2-4a45-8c0d-61aac710eeeb", "comment": "Malware payload (Formbook)", "value": "718122a31d6ff5fd7aa766e52d4db2cba5904c0cf3364d983a9afbccd7c9bea3453385ed86f20b8a744634fa3a45c899", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808329, "uuid": "ae4a70d0-a92f-45fb-9c75-df61460b33af", "value": "T1CA05A01DF5E260E1ED2184B20F5D97E18E1B731767A5189723B802040F974FB6FAEB26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808329, "uuid": "188d4e44-f009-4a59-b6c0-be5909377962", "value": "79b51b0b8fa06ebea3a256fd7f7ce2c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808329, "uuid": "7a6f09f0-09d6-4a59-9656-65cdaa4591f2", "value": "24576:Aayxliu5lNiq5bJcdw9IgvJQLACYOlXnfqlHcz19vZb:Aau5lpFYw9PQLABOdSVcz/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808329, "uuid": "69d4c806-373a-4688-a31d-40b308d5650a", "value": 862720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808329, "uuid": "c453fcce-af4e-4d84-b6c6-f342166f647c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808329, "uuid": "4bc6647e-62b1-4364-9a10-b6180b1e1878", "value": "179f5d450a755a78da421044688b0be6375f0baa76ed4e9006ae87d363a4daae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11b04cf0-196f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810025, "uuid": "409bca42-8953-45e1-8c0e-bba8f637059b", "comment": "Malware payload", "value": "c9bda1799a28542f811447f957f78277", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810025, "uuid": "e5bab509-1146-4bab-a256-02cc07713c68", "comment": "Malware payload", "value": "17ab03a6e6ed47d50135268b0b7d59492ac02809edd49ac96efb0faded3aaa47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810025, "uuid": "a729bb65-6d3e-4c79-9053-804ab7c6f589", "comment": "Malware payload", "value": "73eb8be059360e26813abff33add2dd0b88bff2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810025, "uuid": "e86fd153-acf7-4c76-9164-2bffbdc369d5", "comment": "Malware payload", "value": "b84c90a38eb8ce08e333935a99d5b5afbe66520bb10253d537e36ee760d66cda163c0d81974e89e994df571d129781cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810025, "uuid": "09af08c4-5147-4183-9665-c2109c900563", "value": "T166E4CF1513E88E68F9BE973944F4341487F5F8369722EB2E2A1840ED2DF6F41DA52723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810025, "uuid": "b10d1e89-87f3-480b-a04d-1d0709c76954", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810025, "uuid": "df1fdd3d-306a-497c-8d67-e417a00b72b6", "value": "12288:5hTSFUOgQiS6izzSd+h5abG4XHBvQOmh5kHN:fO9zSoyNXBQJo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810025, "uuid": "16c09ad1-410e-45db-82c7-a90d0a6a14f7", "value": 689152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810025, "uuid": "3716726c-1675-49fb-9a7e-eb8516f136ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810025, "uuid": "60c6f8d6-4036-4ee7-9cd2-a29e870392e9", "value": "17ab03a6e6ed47d50135268b0b7d59492ac02809edd49ac96efb0faded3aaa47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5b86354-1969-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807804, "uuid": "ddf71c2a-9755-429b-97d6-4bf91c226f41", "comment": "Malware payload", "value": "9defd8133adf6aa2826598cd949241a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807804, "uuid": "543416d4-4f69-4a59-9be8-8340cdf86ef2", "comment": "Malware payload", "value": "17be5e78667db09c03cd2ab82009f31ff0c9032d22a9b149a81e8cd555e1078d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807804, "uuid": "3b55f8e0-3a96-49cd-855d-0e71eaca3692", "comment": "Malware payload", "value": "2a7df62a4d88d376a9311b497256c51136d2fdcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807804, "uuid": "53c4926b-7256-41b2-a752-fd346fcce6b4", "comment": "Malware payload", "value": "bba69cf1bf6fcb7ca63776380852f67f0031df4f89f0a05557612c486fa240f2a16e317409ba9f0236714424593115c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807804, "uuid": "488c1eff-7100-4c15-bb11-2372dd53d3cf", "value": "T18B35121D7AA5DA57C22C0B7B8403601C61F7852BF9B6F2AA1ED90DF10F5ABD0C44DAC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807804, "uuid": "33228c12-f96a-4fe8-af60-48397fc85aec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807804, "uuid": "69fc18dc-c86b-4edf-bc0b-fe89e5f6e9a1", "value": "24576:H7cUNONasp2D+zWUkQnmjg2vF1ZaDvo24TmaQWrNgEc7:HIUsNFpG+iUkQqr3ZUf4TmaQWR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807804, "uuid": "2a13537d-1169-406a-9015-31db15cc9283", "value": 1121792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807804, "uuid": "5c08bed6-4fb6-49e5-8124-3efdf928c75c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807804, "uuid": "7140f636-6843-4386-af8a-5308c717b03e", "value": "17be5e78667db09c03cd2ab82009f31ff0c9032d22a9b149a81e8cd555e1078d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a45c9543-192d-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1772781924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781924, "uuid": "933166e7-9d1d-4bce-b0ff-1025da4c9b2b", "comment": "Malware payload (ConnectWise)", "value": "bd54f1818c5ec9ec7cc9bbad19d671ee", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781924, "uuid": "03e89c2d-2d40-481d-aeb8-55023c91d8a4", "comment": "Malware payload (ConnectWise)", "value": "17d3da1d20564a5dfbe7c59eb6b0d3ba992c7acea3e5ae8887e53cb3408525da", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781924, "uuid": "83fd35d9-c928-4dfb-bf20-5f399baf629c", "comment": "Malware payload (ConnectWise)", "value": "08cc4fb6ee487691345d76fe559c2aab5b674021", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781924, "uuid": "0151a513-e45d-411f-866e-636d32ba0878", "comment": "Malware payload (ConnectWise)", "value": "5565153ae053cb69413a077ac84774782b14b4bed7d76abf1b638d3128626fce31cf088c10517bb6f563e69d9fd814b7", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772781924, "uuid": "0c33776f-cec9-46e7-a603-a7fab1852f99", "value": "T16ED623116BF89678F0F26A35E876A0B1A53B7D115E23D12E2224791E2C75EC0C9B3773", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772781924, "uuid": "a86d78d4-d62f-4b17-a26d-9dcc5db864a7", "value": "196608:nHxcp9ym3nltDUJVtHxcp9ym3EHxcp9ym3VHxcp9ym3THxcp9ym3UHxcp9ym30Hz:RGplp2GpiGpHGp9GpyGpSGp8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772781924, "uuid": "1d713ad9-2128-4e73-9840-8ed8268b5cce", "value": 13504512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772781924, "uuid": "d1b4d9cc-8e7b-47bb-a6d6-bafe3596ca39", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772781924, "uuid": "b90cd3a9-29c4-4f7b-931a-3b6a91097a5b", "value": "ScreenConnect.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6e99015-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772809980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809980, "uuid": "f95095f8-62ca-4a2a-be33-6b436f925221", "comment": "Malware payload (Formbook)", "value": "f9b4b74fe930b25eb59c3c435f0e23ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809980, "uuid": "690a4738-29e4-408e-8ae6-4eeadad230e2", "comment": "Malware payload (Formbook)", "value": "183c39bdd27dab318f776a71b1650db0b7e16b66933cafe70318386d955f924e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809980, "uuid": "646f64db-67d4-4e09-add9-792dc2b96e05", "comment": "Malware payload (Formbook)", "value": "bb25494848534b158249129876a311ab87660e3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809980, "uuid": "ab3bf62c-c0fa-49f8-80c6-d3684e80acfa", "comment": "Malware payload (Formbook)", "value": "5481af9b050bc62ac948961da1e376d4bfbd83cf693c4ba18ec6effd33d22fc9e3c5b98289479cb90d17cfcd6718a0eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809980, "uuid": "e5224b84-0b2a-47e2-b8a0-fb47697a7ec5", "value": "T1BD35AE0273D1C062FFAB92334B5AF6115BBC7A260123A62F13981D79BD705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809980, "uuid": "ab0a345c-a991-414c-ace1-6673dd6bb569", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809980, "uuid": "a36d0cf9-f7c3-4330-bbc5-258a1d1996d6", "value": "24576:+5EmXFtKaL4/oFe5T9yyXYfP1ijXdaXlJ3q2ZVgIDzzygVE:+PVt/LZeJbInQRaXLJZ3Dzzyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809980, "uuid": "cbb359b7-f3e4-4b9c-87ba-610ed975f1cc", "value": 1154560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809980, "uuid": "1f8e5b91-a892-4daf-8ae5-ee66bbcc61a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809980, "uuid": "c5e29d04-d7e4-4daf-bae8-95c47fca4306", "value": "183c39bdd27dab318f776a71b1650db0b7e16b66933cafe70318386d955f924e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e02284a7-18f5-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772757973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772757973, "uuid": "fead1c54-2c51-41cb-a531-a7bf3240d190", "comment": "Malware payload (Vidar)", "value": "c64a7c2570ec12be8ddb0b862454d5b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772757973, "uuid": "1c64644c-d195-4142-87c9-f8de1b7865a4", "comment": "Malware payload (Vidar)", "value": "185464ac8a19e981984af6cbdc091cb10dc0766b896155f13d85b1cb4d597779", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772757973, "uuid": "8884d304-2d74-4496-a4a1-bd0122642af0", "comment": "Malware payload (Vidar)", "value": "411fe0922273ab1ba75e2e1febe9834141527168", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772757973, "uuid": "08267a42-1f80-4e64-ae17-294fd2a4e69e", "comment": "Malware payload (Vidar)", "value": "70d5dea9dc361a22c0e3bde339b06dbc76b2468733c0c5a21c3e30e0a22275ce5a53b6a489e35c916a85dfc62e85dec7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772757973, "uuid": "3e1b9f34-1c1f-4bf9-bea8-3aed4a7c1c8a", "value": "T101D607EB67714DE8C1DE813AC0A6BF05A4F370B90F3EC6E7839007685A595F44E7A624", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772757973, "uuid": "9320f047-0ca2-4b0f-a6d2-a31a978a83bb", "value": "b11456eacd71c49a08181553a6a92704", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772757973, "uuid": "4ee44772-4f1e-4388-8085-2232b8eced41", "value": "49152:ttD+DUHAh4UxrzPrjzAj0tr5nS+mBrAo6d/V0nPMnIrLEp/2pPLmwJSDH/A/VDUP:exGLEUp9VDFtXdOTA4l8ndyUUVdQIv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772757973, "uuid": "837639e1-52ec-40bd-b323-ea81d3a35344", "value": 13872128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772757973, "uuid": "9f27c703-f80e-476f-b89f-bae1f9484878", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772757973, "uuid": "7ee9cb7b-41d4-465d-b966-2bb339ec3bfb", "value": "SecuriteInfo.com.Win64.Evo-gen.69568323", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ae91e56-193e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772789022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789022, "uuid": "fdf985d6-49a6-4f19-be59-16fe056d28f4", "comment": "Malware payload (Mirai)", "value": "422d1ea33b6f37b38d3a513724ea3aa4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789022, "uuid": "05e4fc63-7c11-4538-b0ec-7b33fd35cd45", "comment": "Malware payload (Mirai)", "value": "18aac30f5064d6c1d154d2ab32000b32a0bbef2e29d1ff8e3fe723f7aeaf6164", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789022, "uuid": "8a587966-8054-4594-86f0-ea8c56276867", "comment": "Malware payload (Mirai)", "value": "7cd21ac10ddee6d2d83ca4390a28c31f0532c4e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789022, "uuid": "bdaa52c7-8e08-436a-b0fc-6a15b40400e8", "comment": "Malware payload (Mirai)", "value": "5303b776234429ac07120f4b104e088c171a4773c1cca6e6fcbf299c56d3aa37496ae55b8fe018aec666314d5796367c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789022, "uuid": "0c6ce53e-788d-4070-82ef-4d95ede8625d", "value": "T140736BD2AA43C0F1EC9605322177F7724AB7E23E1058DA42D36ADD76FD12602E26739D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789022, "uuid": "fddd678c-cf60-4afb-9b4c-40348c9d5b69", "value": "1536:E8L860RVGLkahA27Jl3JT4qfRiwyIbgc7/7rBtL5:d0RekyxJl3V4mkJa/HBtL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772789022, "uuid": "77f493ae-d868-4df3-80c6-49e9b18842e8", "value": 75312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772789022, "uuid": "c0eb0f28-677e-4119-9156-4df0779ed185", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789022, "uuid": "6286bdbb-be09-4064-b38e-69fa2918f643", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f334364b-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772809974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809974, "uuid": "33072f55-8914-4af5-83d6-0c5c60c3b1fd", "comment": "Malware payload (Formbook)", "value": "86a40567abe8518d052c14e78d0a67dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809974, "uuid": "e7053e48-9050-4d6e-bb03-eda9af9bbd7e", "comment": "Malware payload (Formbook)", "value": "18b0513b837a7541044b9d63826485bdd9e3440109fcb3727142cd5cf332d6d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809974, "uuid": "e5aa0116-c0a3-4a71-9bf5-4455f63c3f27", "comment": "Malware payload (Formbook)", "value": "c4065a2b6364ac13e51d2cfb916a1e7025a3ded0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809974, "uuid": "24f739c5-f938-42f7-8a8c-52a62e21db81", "comment": "Malware payload (Formbook)", "value": "1163a469c9ceaed960f9bb266192423e9dd199c9679f9516edb702e08c15dcb9e77e75dbb2219c9bf3e01b2fc308b705", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809974, "uuid": "b0469fdf-b5e4-4d58-9cda-11f17ab70ed0", "value": "T1C745CF0273D1D062FFAB91334B5AF6215BBC79260123AA1F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809974, "uuid": "ba0cfda6-9909-47b2-8708-59fc54fa1a17", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809974, "uuid": "a8923da2-cc3f-48f7-b81b-4d5987be9ba6", "value": "24576:65EmXFtKaL4/oFe5T9yyXYfP1ijXdal7BTbziON133B1fYo:6PVt/LZeJbInQRalZpn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809974, "uuid": "7708e5ac-5647-4c58-9acf-da0e52a85184", "value": 1257472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809974, "uuid": "57b6c5d0-3ff5-4383-82ae-855fceae531f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809974, "uuid": "dcf0bc6e-f549-44b4-b227-cb2f2e4d438d", "value": "18b0513b837a7541044b9d63826485bdd9e3440109fcb3727142cd5cf332d6d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "942521dc-1995-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772826565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826565, "uuid": "11923adb-7bec-4783-a903-e1788771167b", "comment": "Malware payload", "value": "615c3a8748fb23cf56e48ab3d504082c", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826565, "uuid": "0268136b-4f73-4b0e-9bed-3eade56d5cfd", "comment": "Malware payload", "value": "1905914f4343f1e6daed07eb74ccedc386798ad7f61e264014d3939c24e8a219", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826565, "uuid": "41337d99-bdb1-4895-8274-20da69b7da9b", "comment": "Malware payload", "value": "4c6d0fe1323e06dc5ac19d8a73f758e625dc3882", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826565, "uuid": "9586fca1-f28e-4910-85c0-e6ae5a2c5cd9", "comment": "Malware payload", "value": "160f02faa36f073dec0ed6567a1abf40e504632698cff609d05a6e2cf09dadb6a8977a4ca074952ecf8c6f2999bb658d", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772826565, "uuid": "ed47fb9b-1f4d-4cb6-aebf-cef7d67cf4cd", "value": "T1E0D4230389A1BCDFE5035F77B8A43111601A902D835CA1A7AAC6B5745CF71BBE3FB198", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772826565, "uuid": "438642f7-2d2b-4e78-b8f9-3b13d97c2e5d", "value": "12288:ZiAOaYozIthC3GhdxFFvvR8lmoL6K6ZmidSy2tSPgZG2:POaY0CJR8lffiwyceg7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772826565, "uuid": "d49af627-1197-49a0-be06-30525f1b5c10", "value": 628409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772826565, "uuid": "58bc5c83-82a6-4ad4-8638-fa5ea3b2a9ac", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772826565, "uuid": "3d49c4e0-dac2-4dd3-8a15-631f26b5b262", "value": "SecuriteInfo.com.Trojan.GenericKD.79633335.16998.31984", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e165649-196d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809348, "uuid": "d501a4ce-4bd7-4664-ac0b-686ea7e02fd9", "comment": "Malware payload", "value": "94ca032414219144fda6ff5d6c3ad68e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809348, "uuid": "7769f269-7ba9-42c8-8bd2-8c98433f9fca", "comment": "Malware payload", "value": "1907f5aabf118dd685f88db5564e4accc4c0934725909196d79704f2ffa0f192", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809348, "uuid": "a03e578e-ea69-49e5-b4be-200478a13697", "comment": "Malware payload", "value": "7498a43038b8d510a0026ea9dd04f5716fa0bbc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809348, "uuid": "be153410-2d52-41bd-a40b-cbdb59675d47", "comment": "Malware payload", "value": "68fa847c234bfab419da81c8fc548b5c7a43bb6b24e498c4f1051385cedfd4e62777e85b30d6168128cbed6bfb81d8a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809348, "uuid": "c6288164-5e57-4416-8d13-6424ac7245e5", "value": "T12B2512281118DE03C4AB1BB85AA1F37853B80FDDB592D2578FD8FDD7742A7A414893CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809348, "uuid": "16aee09b-95d2-4480-b15b-7619526d73aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809348, "uuid": "1ca2de03-e060-4deb-a318-6f7adf97d603", "value": "24576:9Eni/4sYoQPvHuUAPz8BgM5ciOhPGuyyn1jffgCNsJgW5Jg9rSz:9Eni/sPnuUkz4ONIy1jgCuJgW5mZSz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809348, "uuid": "6623412b-4df6-4b93-b166-6b64dc24ab65", "value": 1006080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809348, "uuid": "97ce1407-7010-4b4a-8fd2-9eb91eb71534", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809348, "uuid": "988710c5-7f3e-4f6e-90fc-27123b04964e", "value": "1907f5aabf118dd685f88db5564e4accc4c0934725909196d79704f2ffa0f192", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b928b201-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1772809447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809447, "uuid": "46a92cea-8f02-4ee3-91f1-90a85ce6735e", "comment": "Malware payload (GuLoader)", "value": "0fb22642c0c3cb88ec40a1f387d35b4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809447, "uuid": "16be27da-71e1-4643-a798-78a01980fba2", "comment": "Malware payload (GuLoader)", "value": "195bc09ff1b365c0dd470aeaa1bc86f989c09e424fffbdfdeb0bcb2331385b28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809447, "uuid": "612d6971-29bc-42de-a613-f3867c652946", "comment": "Malware payload (GuLoader)", "value": "2d8b55e21c75731dbf5269976e915b041674eb66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809447, "uuid": "c85f9ea4-2c01-407a-a0a1-d0c520de08cd", "comment": "Malware payload (GuLoader)", "value": "bda23f23de033aa46e5be342a0ce3f4591cd641edc185993dfb90faa5e50a269bbfe683ace6b7d3fe862465f6f883169", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809447, "uuid": "f9961c63-e901-4e69-a58a-754849685c05", "value": "T135C4BFA0F611D9EBD5A709BA8CBBC4302167AD1E86D1111F32ADB62825B335211DFF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809447, "uuid": "364eb8d3-547e-4c6a-8e57-7c9acc0b3f62", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809447, "uuid": "bd708c9e-d9e4-4553-be0d-9dbebeed2e41", "value": "6144:/wq3NpQ3wDIywUF5ykHERIe6MyhdVgWfMnfYyumOk6mgcbpiOgizVaSuQ2/z/fw:/zcae65hmnumOkrDpupQ2bo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809447, "uuid": "e7e6e323-b78a-40c6-981e-79ace7a19d0f", "value": 582112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809447, "uuid": "44407f0b-bc75-4fdd-9a99-984d6bad2738", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809447, "uuid": "a323590a-9c6b-4890-9b9e-d647c0be5e45", "value": "195bc09ff1b365c0dd470aeaa1bc86f989c09e424fffbdfdeb0bcb2331385b28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ab7817e-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808752, "uuid": "2559a287-10ef-431d-a7da-461bdd509d4e", "comment": "Malware payload (GCleaner)", "value": "d676a1f481c90239477df8ef3fc2c1ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808752, "uuid": "d7090043-3dfd-435a-80c4-5accf51be1a9", "comment": "Malware payload (GCleaner)", "value": "19ad39d7fed91d68dbf10682baf88efa757d13d490b621e6f50b4a08c0291ab1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808752, "uuid": "3d499bdf-3fd5-45aa-b6f2-2e204062002b", "comment": "Malware payload (GCleaner)", "value": "9407b2471d27a5c3ce0c5c1b364e4055bbe9c720", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808752, "uuid": "5f1df92d-4261-4294-a313-861feeeb1a86", "comment": "Malware payload (GCleaner)", "value": "eceb2bf6e2b58c5df7705704ab7842842cc9b1220bf585d86e0c39e41b100e515dfb963d11030ef9985f99b41f18357c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808752, "uuid": "4ddd934c-0cd4-499a-ad0a-b7985573e8a3", "value": "T14306E0950FA5CA3EF41F0DF584574769603225EF0D27CAA31EA82498C9ED2D867F348E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808752, "uuid": "f4b53b46-2162-4ff7-bc3b-d073377b4411", "value": "234372fce9eaa047bc4c39047910954c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808752, "uuid": "e8fe7a65-466b-46b3-8d2c-828c7d680008", "value": "49152:yGQJMWwJGp9Y2euxLjg6t2SufjY+XwsfvIpF8Ot3+FtmHThshZ9LqQv59wija5:yBJMD8P2udU6x6jYB8+7MtmzaZseOij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808752, "uuid": "dd1a9fb2-7273-469a-ae24-fbd982cde0d5", "value": 3815936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808752, "uuid": "a022e1c2-b050-4416-b285-ebb25390048c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808752, "uuid": "6b72a6b2-be9a-432b-8f25-a0dcf5fedc09", "value": "19ad39d7fed91d68dbf10682baf88efa757d13d490b621e6f50b4a08c0291ab1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1ba20e2-199f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772831017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772831017, "uuid": "089e4da5-1c35-43bd-81e8-0a8cec0c2033", "comment": "Malware payload (Mirai)", "value": "f7e7436bd9112599b1d2e21266b188d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772831017, "uuid": "95f9d6db-6b05-4671-9d20-6b4e8aefb702", "comment": "Malware payload (Mirai)", "value": "19d872e13e242f6d0ac4a41916dc1138efdad28a2ce4f51c15fe1ca0c362cb62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772831017, "uuid": "6f2b05b3-f469-413b-92ca-30dad2543a8c", "comment": "Malware payload (Mirai)", "value": "8372aa0004c1028fcc20aecb29dedf823eab5fbc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772831017, "uuid": "464d9e32-4400-4f41-80f6-5ec89742351a", "comment": "Malware payload (Mirai)", "value": "89a4a89e4162e65a2549d0a939fba32fc5de85da3107fd18d6440b73fbd007b010cce70340b45c6f1471ffbfa87fef3a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772831017, "uuid": "64c577f4-382a-4983-8b3d-c72eae3d1392", "value": "T1E2B30877A4604FB6C041A5F125BA9D310F12AD931F5F1A94723CBAB04A3B5CEB84EF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772831017, "uuid": "ced13a0a-2785-4740-a980-f7302f6ab19f", "value": "3072:N8osRyHt6h0XhCENFbPrLxT3FPmH1cuOvvni2N/:N8ocyHt6KrPrLxTxmH1cuOvvni2N/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772831017, "uuid": "a37a1cad-a269-4498-9fa5-f1bd09e48a44", "value": 112751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772831017, "uuid": "e1767678-a33c-4b2c-a45c-706fdfee71f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772831017, "uuid": "008f6a4e-1ed0-4bcb-82cc-c608e571354a", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "091dc04d-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808722, "uuid": "588cbb2a-e4de-43bd-ace1-70c33b6563f3", "comment": "Malware payload (GCleaner)", "value": "3801804e3dfb99e23769c62685ee01cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808722, "uuid": "8d8c1804-d4f2-4b45-bb88-5356839f5d3d", "comment": "Malware payload (GCleaner)", "value": "1a07aae4ef7c8505392aeac8266dae98eed45c6c1023350b8050c9a0eebd387c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808722, "uuid": "ab45e698-6896-4a08-9836-bb5e7eb56479", "comment": "Malware payload (GCleaner)", "value": "9cfd798656bbe2a2514428a7e9de0be6dfa49040", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808722, "uuid": "3d179c45-be5d-4f55-89a3-9f8f8de7c4d8", "comment": "Malware payload (GCleaner)", "value": "a7dc06abe4a1f642081166d4e1eac243dfa5088c5bad5c7349b263e5555eefd46d0e49c5644201e59e96917a93c1e118", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808722, "uuid": "f43b027b-9a2d-418f-99ae-b4f3e59d4e2f", "value": "T19206DFFBA0BA4172E0899D3CA9E99D7FEC35EA301E2CA814DA9C194D7D64F11D0D016F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808722, "uuid": "96831ff9-9cce-4223-b0d9-203f4649246e", "value": "099b2b7fa2a0044e2ca25418be2f8a70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808722, "uuid": "fc0f2579-425e-43e5-b85c-9032cf10ceec", "value": "98304:ZtemcBn5wkKQlr5jdeozv9vnZhDMdMLQ8BCyz2Bh:ZHYxzDhzv9vJQry", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808722, "uuid": "98eee019-59b1-4fe8-a128-25f926f816ad", "value": 3982336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808722, "uuid": "3ae396ea-28b2-4cf5-a3d4-3877dbd79e53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808722, "uuid": "e7105343-03a1-41ea-9007-68a41488571c", "value": "1a07aae4ef7c8505392aeac8266dae98eed45c6c1023350b8050c9a0eebd387c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c46246c-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1772809801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809801, "uuid": "061b1943-a503-4dca-bb3e-e0bcf0026611", "comment": "Malware payload (SnakeKeylogger)", "value": "0b199d912cbbd4f44ec668ea8d121a70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809801, "uuid": "8994a832-3741-4a16-93b9-452d47231da6", "comment": "Malware payload (SnakeKeylogger)", "value": "1a4c5aa8c94861065bfafc94bd7650110e13b362aae14630971e96ab9914c187", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809801, "uuid": "39e08b7d-67c8-4c03-b937-d3e0f62621b5", "comment": "Malware payload (SnakeKeylogger)", "value": "4b08ace307a2ae4418f0de83a6944392a5e84669", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809801, "uuid": "8c96c40d-dc50-4157-8b00-1e00c1bffd6a", "comment": "Malware payload (SnakeKeylogger)", "value": "b96135b34b6a8c8e754d3d9b8db30a41b141deaf5c3035ed20245c279155df1299bced7f5b57e4eddb58858c1d093c37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809801, "uuid": "60585a9b-1012-49a6-a2cc-88ab8a2e72cc", "value": "T10D35AE027381C066FFAB92734F5AF6115BBC79260123A62F13981D7ABD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809801, "uuid": "cd991112-2799-40c3-b9b8-266786c2916b", "value": "c1ce208b1192bfcf652c179f34f034d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809801, "uuid": "3f14ac52-b9cc-42da-9f59-cdd2956f6227", "value": "24576:J5EmXFtKaL4/oFe5T9yyXYfP1MAXDz0mQ2+EZe:JPVt/LZeJbInGiz0mZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809801, "uuid": "94e6e09b-0189-4d1f-92f5-b37ebe852845", "value": 1104384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809801, "uuid": "d3be6e56-e7a4-42f8-b7e1-f7e3a7d84d6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809801, "uuid": "6c29a138-d4e5-41be-9a13-f5892af97c44", "value": "8c7214863d5cb9c77ec74b55c27062828cee382fb207a1aac8c6ec1f95808f4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29f1a632-1971-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810925, "uuid": "20f648da-cbb3-4018-bfdd-3bdaeb7ed27a", "comment": "Malware payload (GCleaner)", "value": "4a826ff61f26ef1c3c354833d1add48c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810925, "uuid": "aad29ad2-9549-462b-89fd-dee56b8979a8", "comment": "Malware payload (GCleaner)", "value": "1a5d385dfe06a4ea35d5516db579e7ae609eb5c3f67acac079e41537481a0531", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810925, "uuid": "24acd620-4aa7-4c16-885a-bf577618c9d9", "comment": "Malware payload (GCleaner)", "value": "c05427a0aa4f6df72f5918d8b5de6c39bc286fcd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810925, "uuid": "5d09eac8-76a6-4039-a872-a7d58ab05a55", "comment": "Malware payload (GCleaner)", "value": "81a049818cabfaad76d5358a9ba708980012cf2e4be0f5e719bf6ae02fb12dd147e84781e14a01ea9daa5336d956fc3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810925, "uuid": "67718047-6fd2-4d5a-96fa-01e0a5a14687", "value": "T1D0F49E21F2B08537D0327D39DD5B62949835BDC029E968463AE8DFCFBF297813425A87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810925, "uuid": "760b482f-4de2-423d-993d-2887e6be988c", "value": "ce7a1d07b14b49824555865592c3af45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810925, "uuid": "7f990210-5532-489a-b73d-0d57ba5dd2b1", "value": "12288:UkAJdZJGY+5K/Lo9r7WTB+rPc9jNQrGhkfwpKxvpa/fy:OXZJeK0Z0rTQySf8KK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810925, "uuid": "cd5143e4-7110-4565-86b8-edd2fcdf3b98", "value": 790528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810925, "uuid": "a8824d7b-d0ed-4caa-b42d-6de7ca379ecd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810925, "uuid": "41ae6bea-c3ff-48e5-af2a-c5bfd2af26f4", "value": "1a5d385dfe06a4ea35d5516db579e7ae609eb5c3f67acac079e41537481a0531", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afa24a1e-1985-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819739, "uuid": "e8dd76f5-38e8-4083-9cea-91d503ab7d8d", "comment": "Malware payload (Mirai)", "value": "0cf1db2ce8aa7caab50f3cdf256fbdd9", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819739, "uuid": "14758907-b754-4160-ad5b-d541c32949c1", "comment": "Malware payload (Mirai)", "value": "1aa2df01d4a6d619f2f42eb0adfc2b158ccb58bd4d8b96d2a629afee8ceec75e", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819739, "uuid": "af958bfb-c871-4cec-982e-4ad1e5ba1c4f", "comment": "Malware payload (Mirai)", "value": "65b5253ac30436ee695dff096dbee89e4a210b0f", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819739, "uuid": "4e94971a-37c9-41a5-a38f-bd8eb7975ad8", "comment": "Malware payload (Mirai)", "value": "686cda0fc2908515ee70cdd5af1b12c2fb62e72454fef543a9961f301351baa726b8f15ba941a747fdda5820eee23fc2", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819739, "uuid": "7691db59-6122-45d5-b7f6-fb7dbcacde92", "value": "T188A67B01FECB55FAEA430D3148ABA23F23315C018B69DF97EB447B28F97B5950836199", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819739, "uuid": "70b43a8a-b417-40dc-b8dc-6e28da32bcc7", "value": "98304:sANQOhK+mOuylkdqmIkfErDs+MxPGR6qTjMFx4dkGi2Uz:sRs3IqbrDOx+r/rdn+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819739, "uuid": "34ab1877-ba52-4ba7-b3b0-ebd61e329fa4", "value": 9494848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819739, "uuid": "3f1753e2-8bd2-40b9-8cea-1b1325d9cde4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819739, "uuid": "6d02e4cb-b5ff-4910-b4a9-21c9a194b9b0", "value": "bot_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "891f54b9-1956-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772799488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772799488, "uuid": "cdd05ac7-3cbd-4e58-8fe8-5e69c8cb3229", "comment": "Malware payload", "value": "d1b423712051d5687b073ff367e67c70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772799488, "uuid": "3d3302af-ba2f-413d-909d-319d76b5904d", "comment": "Malware payload", "value": "1ab39bc014f6b6124fbd72d6f6390af9dbb0b67b50112e911c508b81318a3c8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772799488, "uuid": "6307e2f1-a51d-4dd2-ac2b-bbdae41a8192", "comment": "Malware payload", "value": "07f251eee4b7c62d7c6d6ce313b4d8e71f46f231", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772799488, "uuid": "799f329c-d8c6-40b2-8ddc-2b9431046f71", "comment": "Malware payload", "value": "f281017ffec3770a991e9eec1c049a7fc7d5554676375017ad0b5a177a069c7185ddcc12c14b7769d3fecedae78e9a95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772799488, "uuid": "a767a366-4089-4a25-ae50-c8051011d631", "value": "T126B47BC0BD4260BBC4965C350524A77B7EB80F615329DCEFC11728E0E6B5EBB9272927", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772799488, "uuid": "6d87f033-20d5-43d4-b992-4a1bbe196a46", "value": "6313a99fffecb8759e5b2f8e8aff2a59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772799488, "uuid": "b26f3f55-b2f1-4d55-8fb8-ed766271faba", "value": "12288:GLmv6J3O1b3pwFRNkdgUkFnl3jURuRe5n4GZ91Rd6qIXzsQAXnuoMC0Y:Qmv66b32F7wQr7e5BnT6qkzsxMz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772799488, "uuid": "3dfe9788-4cfd-4890-9e5f-14f0106f2c8c", "value": 513024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772799488, "uuid": "2b87d183-9b9f-4069-9f2a-15e1452dffd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772799488, "uuid": "5b8ca949-a614-4e18-9c37-753bb3916a67", "value": "1ab39bc014f6b6124fbd72d6f6390af9dbb0b67b50112e911c508b81318a3c8d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15d4d109-196a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807884, "uuid": "3b782e02-9405-478b-8ac3-4336e1871081", "comment": "Malware payload", "value": "301403997d498247474ccb2f23082d26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807884, "uuid": "a6326248-0572-4edc-9a74-a6f5a3478f70", "comment": "Malware payload", "value": "1ac633410501eedd299e77f6f42aa8a3bbe78d470ed7487e1fb446e954359923", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807884, "uuid": "509f862e-8ac7-4fb8-8d8f-0df24fcc7031", "comment": "Malware payload", "value": "cf76975d9ebf88066fde2668e793eaa6f340b415", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807884, "uuid": "a8151fb9-eaa4-43a4-9b03-8b309c46731e", "comment": "Malware payload", "value": "37d5dcce7dfd29e2d5126fa52fc1dcf4af34b19cedc44ba08007ef7215ddd57151e26ea488983682bd82705a4aaba23d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807884, "uuid": "3597833a-efa3-42a1-a048-cd2673e0bf2f", "value": "T1C6351220529CCD26C8DA1BF92475D33463B2CD6EA422D396CEDE7CE778AA3D14D44263", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807884, "uuid": "e446561f-6bb2-4fdf-bf77-b7816b006cbb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807884, "uuid": "d41254b7-69a9-433a-842a-2d66a76b06d4", "value": "24576:VzHYguQvjcVGKHZVAURdnoHTOcQyx0XlQ7/zzN0CQd/ZeYVictuw:VzH9u3PHLAURdWvz40za7NZeYQc7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807884, "uuid": "4b723ac0-6ac9-4ece-baea-5c49baff3ff5", "value": 1100800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807884, "uuid": "32706db0-0650-45d1-b8a7-6e7942bdb462", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807884, "uuid": "eeee7448-9fa5-4eba-b832-1702e0c15a74", "value": "1ac633410501eedd299e77f6f42aa8a3bbe78d470ed7487e1fb446e954359923", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2613cd20-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808771, "uuid": "24da8efb-39dd-4d25-86ce-c246323f8bad", "comment": "Malware payload (GCleaner)", "value": "72adf6876abec6b043b36e19bbdb7e66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808771, "uuid": "377b6caa-2a17-42a3-8b66-26d28536968b", "comment": "Malware payload (GCleaner)", "value": "1ad43241e56f0a1d43316268a35f05b0c6d76d06817f06d3d3d49c4516f7f7fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808771, "uuid": "6c022afd-df2b-407f-872f-93889d6e42cd", "comment": "Malware payload (GCleaner)", "value": "e0a549e9d514ddeed74dc2ff92e6eeb927226024", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808771, "uuid": "44f1803a-b3ac-4a68-be4b-39e76723a43c", "comment": "Malware payload (GCleaner)", "value": "2ca6582e1d0c152086420dfb6597d8dcd5d31ecf7cfaa0f1361e56b1fbac3f4d073854f1abae73ef1aacd80ce06b2df4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808771, "uuid": "7aab54b3-132a-4a54-8b43-ccfe5d8f9807", "value": "T16A16E0F5C7D73772C5E6117849FD61F0283BA9E260A189C52A98AFDA820F6C7134DCE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808771, "uuid": "a562e6fc-e1d4-431d-bd98-cc9e3f8d943d", "value": "099b2b7fa2a0044e2ca25418be2f8a70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808771, "uuid": "16e7f2be-4a10-4ffe-9f69-874edea7a6cf", "value": "49152:Kto5haSDuQPEKU3U5DZSvRfGc7wJheKAURL9xMaU6Bhk9s7/vqgF:KteBDDPEfk5DKfvKAqL9xJhUszq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808771, "uuid": "4e831ff1-87f6-4ccb-975f-249a8cd511ec", "value": 4345856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808771, "uuid": "cd4dd5f8-b1fb-44a1-a4d0-4a79a1d2ba9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808771, "uuid": "532c60fc-6e16-4854-a755-124b9a007162", "value": "1ad43241e56f0a1d43316268a35f05b0c6d76d06817f06d3d3d49c4516f7f7fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d7686b4-196a-11f1-a769-42010a9c0008", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1772808005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808005, "uuid": "1c1f79b3-4203-4aa8-9d4b-618bafdb7881", "comment": "Malware payload (ScarfaceStealer)", "value": "763a0e62154d09fd8d3c9e7a71ac7f03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808005, "uuid": "45786543-4920-488a-8b6b-9b50233fb7c2", "comment": "Malware payload (ScarfaceStealer)", "value": "1b274a393634e2aaf1ab3d2d96e232b292ba74539420c74769fa2ad3ab9eafc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808005, "uuid": "1cc58b36-0a47-47e7-86b3-1a680a53af59", "comment": "Malware payload (ScarfaceStealer)", "value": "7ed8d121dbe676dd89c6a83d609cd988929b634e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808005, "uuid": "b72e412c-42dd-4611-9450-1d6af89af9f9", "comment": "Malware payload (ScarfaceStealer)", "value": "2994936539e8d91f3ade9cc15e70bd49e98fb10a92bc0bd0ce157f32dfdca4c8691e0e9fe16537f15b41455563434c0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808005, "uuid": "ba472d6f-ad16-4886-8173-846e00ae2d9f", "value": "T140E623EA949913F4C8D30A80764E13CE31D1A59E46ED6C2C7ADB1C41AF26DEF550EE23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808005, "uuid": "72eed150-b67d-480a-8def-d1bd9b026129", "value": "8739de86cd836ae1476705562c069cc0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808005, "uuid": "a6f1a4cc-1e91-41b4-99ed-73c356f0abcc", "value": "196608:6pncU/ZoVG6A5xdQKqF9m9mmCLh8CDjD3bGKgBl89GcRM95y2QJuhEXqkw:5uEG6AvOzFl58wDrGxy4/jy2mX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808005, "uuid": "26be76b3-04e1-4397-ab27-1812f9a41dc7", "value": 13877248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808005, "uuid": "b77a2c33-8cbe-41e5-a3c7-c28d33ce99aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808005, "uuid": "02c76986-b60c-499b-8ca3-cb5e211d3cc3", "value": "1b274a393634e2aaf1ab3d2d96e232b292ba74539420c74769fa2ad3ab9eafc9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32911ca6-1971-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkCloud)", "timestamp": 1772810939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810939, "uuid": "2deb8eab-4583-4e1b-872f-385fbc4844ba", "comment": "Malware payload (DarkCloud)", "value": "817bcef39bd9b16ee7005ab82f5d43d9", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810939, "uuid": "3c5450d2-b408-45cd-8a09-d4a1645f6f77", "comment": "Malware payload (DarkCloud)", "value": "1b820d25eb575ddb78cf2c0dba54ea33b000d106f1d10760047e2ff760cf0b07", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810939, "uuid": "6b0b6597-3fe1-4efe-9929-a715f9a3afe0", "comment": "Malware payload (DarkCloud)", "value": "8ce97e68a317a9a3152f49a3a91fb7561c3886da", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810939, "uuid": "c6fac9e7-2842-46c2-b3ef-26ca3c5aef5e", "comment": "Malware payload (DarkCloud)", "value": "c61372e5b1f0ceda71c51a3be245913a1884cb55cb420eafd20f26cf27fd13f2f829ff1df22ddf5807eb3d879b637ee5", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810939, "uuid": "29d7c41e-6a42-4073-acad-c78ac5efd38e", "value": "T1BD05234BB8D19961C2817730C436CC654A797931AD40676E837EE5EBBCB0383DA63A0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810939, "uuid": "596e2ff4-aaac-4674-8391-4f2873e8835c", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810939, "uuid": "7d32254b-36db-461b-aada-3d834c155f2d", "value": "12288:2z7hU5I5yuNHIgzSFKxWltRohBfSTso93ULYDEzDzkr0ybaMjgeZcLvxTFzsw04V:2f+iN57Gtene39Ez/knbkdLv3zi4Bf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810939, "uuid": "09b75edd-29f7-4ec1-a972-3bf4c50a7849", "value": 802816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810939, "uuid": "b10daccf-fafa-48e7-a465-9dfa2936a860", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810939, "uuid": "1dd7a427-5e26-4687-a71f-a8975fd1aa83", "value": "1b820d25eb575ddb78cf2c0dba54ea33b000d106f1d10760047e2ff760cf0b07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f53fddb8-197a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772815131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815131, "uuid": "383dc710-2114-4d8e-ad48-e784d02d4550", "comment": "Malware payload (Mirai)", "value": "9af3b8bbc46cd72743ee499ef20e348b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815131, "uuid": "1ddeb8fb-71ae-40b9-8c53-35424be9b9df", "comment": "Malware payload (Mirai)", "value": "1bcea661a5636b818c2eb6a8ab8fe85a0cf449f85d850b1019695abad595c390", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815131, "uuid": "c9eca89d-0b07-49bc-b547-5421f33198a6", "comment": "Malware payload (Mirai)", "value": "1cd98f3c16270abe3d7b16baee42133bfd1a6e99", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815131, "uuid": "898e2382-1c14-40c4-930c-9055d1e5cf92", "comment": "Malware payload (Mirai)", "value": "319436fdf09bbeb6d65f71cb879fb7fa591cf77f614ecaad92e917e0090e4834c82fbad95d9f861a82ad85a508a94408", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815131, "uuid": "466b71e9-5795-46b8-aaed-0e731ac2d19f", "value": "T122332912997C1A2BC4D4A77710A38363F2F62B954194EA4FBD710D4FEE983501ABB6F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815131, "uuid": "60c11d7a-35f0-440f-b040-a0f7334b6487", "value": "1536:4b34LHJRwGYtJLx1TBH4EmgSXUwdyq2NS:4LaQqUy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772815131, "uuid": "a8f8b7b1-73fc-41be-99f9-86bd2184a145", "value": 53812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772815131, "uuid": "4c0cac35-4bdf-4338-93b7-637d219f293f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815131, "uuid": "afb58d69-aa07-4ea7-8032-0a1c8e1dfbcb", "value": "titanjr.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff85d4ff-193d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772788949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788949, "uuid": "8d4f5471-f984-4cda-a001-54baf238f487", "comment": "Malware payload (Mirai)", "value": "3de12a4ae378a138edc32557d004f1c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788949, "uuid": "cb574d59-3906-440e-a49c-494e9e6cf02b", "comment": "Malware payload (Mirai)", "value": "1c0d10315f2c1577a89c29f948fbc77b020283cbc7701758cd5acb662a5bc4e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788949, "uuid": "c51c1ca0-13ee-4920-8383-03399ea75535", "comment": "Malware payload (Mirai)", "value": "d322599a8a1dd5e58be5d2230837d756b203705e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788949, "uuid": "a104334b-ff51-444a-8ce4-6d78573719f7", "comment": "Malware payload (Mirai)", "value": "8b229edb82383fc1f056b383f380a14bb340b1b4b8203c03208368e49abafb856d125c8ee25ff7f9ac7982eea2329c06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788949, "uuid": "5546b281-2551-4d35-9863-0d43674322b8", "value": "T141739D63C8362D68D14841F071B08F395763A92285871EF758AACA79D087EFDF2163F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788949, "uuid": "83ea2d56-f2b0-491e-ba2c-01211a5e58d9", "value": "1536:4t49SA5nI7L4KOL4d+eGU8C+AI6I9oKA:4tSjnIP/OleGU82I9I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772788949, "uuid": "a4741351-4fb4-4377-9449-a65171c7d852", "value": 75528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772788949, "uuid": "60a9acba-ae86-489e-8a5c-837ea0a97dff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788949, "uuid": "3deffa30-f4b4-4274-ad2a-b8bf2c4845bd", "value": "morte.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21d87fc8-1954-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772798456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798456, "uuid": "34ad131d-7470-42ad-aad2-b965e7fdf223", "comment": "Malware payload", "value": "411a3840b936261298a9907a3f4d42e5", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798456, "uuid": "c036ee21-a60d-4c80-9bcf-bf6bb109e3fd", "comment": "Malware payload", "value": "1c63dd5c645b215c7dc0e0e4ef509e9394da2669564f79eb4caae43ad59fe0d6", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798456, "uuid": "c662e0d7-e375-460c-b507-ff8014af308e", "comment": "Malware payload", "value": "a7235131432fd890072a0ab88e25333394630020", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798456, "uuid": "585306cf-2f3b-4b9a-a7b6-422933da250c", "comment": "Malware payload", "value": "3aa2d03077abe224833ff63213ec7f6e369e1581a81c0d0f42c86b1782499613c1e178b3d7a9a2e3858ae43307c6e8d3", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798456, "uuid": "a797c06d-4390-4caa-bfe1-49289dbca7ba", "value": "T1519423EA118DC0BCC9A925BA452234AD762E215CFF67DF220D2AFE7F158884C36547C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798456, "uuid": "a8faaca8-4e8d-49d9-9af0-3f4a6169b37f", "value": "6702f1bd13a4e9743588bf4e6892ab6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798456, "uuid": "c8f8900b-dc13-4564-badd-495c08207061", "value": "6144:0TzDNAjPol0E0Y4NiCVaU06dNsOz4zaQwOo62NoNgVzJ7BRHJCP/2a9TYrJCfA/H:szK0leo+SO99X6EoNgr7BRHJma/UnNA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772798456, "uuid": "c5121fef-f188-4c65-826b-789cc68a3fe9", "value": 443904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772798456, "uuid": "eb728caf-41a6-48cf-ad83-74df532428bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798456, "uuid": "8bcc9add-beea-4f4c-b54e-ecdaa2316d64", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20532a11-196d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809190, "uuid": "7ba32d1a-690a-4e54-8bd7-d0f99be50e48", "comment": "Malware payload", "value": "37687c1ec7df8b465b1b0f7c73257336", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809190, "uuid": "d11de9c4-6fb0-415a-b387-3c4d64ee9391", "comment": "Malware payload", "value": "1cd85d2a12b11b71598543c00607e74e3a48c66d2508dfd0676e42d204c39e8b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809190, "uuid": "3ee64fb3-fe5e-491e-97ea-85a963522f87", "comment": "Malware payload", "value": "2137b496ca5b09af12232be9465158ca1e6536aa", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809190, "uuid": "b776ecb8-8d47-4ff2-9a71-f2c142695b82", "comment": "Malware payload", "value": "bb1b83f16aac32772c07344122a827d4dbc304d2e95e63848621ff1ab4c32051c6d349d70b89046d4dab0045cc4b4a1e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809190, "uuid": "7fdeed6b-0468-488c-b80a-76db82ec12a2", "value": "T1D5068C93A693E9E9C31BCCF9C551673EA7D3BC29231DB2530A69F34DAA33D246604704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809190, "uuid": "9b722684-dedb-495c-b915-2b6facb0dce0", "value": "c05eafbf2c8c8448f56fb1998451e045", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809190, "uuid": "6d3b913e-8694-4032-a385-510cc6f1f7bf", "value": "49152:HoJesTo/llvt+4hzsifepH7ZBkwIO/yXgoGIAb9VFd5gI1hJYOfCo:9lVoWztmpH7ZBkwIoyTGIIb5LnJYOfC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809190, "uuid": "06892311-831c-4f6e-8698-dc4b0eef88e1", "value": 3850240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809190, "uuid": "651b3661-0ea0-4754-a11c-b29bd9f7b234", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809190, "uuid": "ce83b527-51f0-4c4c-9cfc-67f4dd030b98", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72cb4255-1924-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772777976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772777976, "uuid": "3eb6e0b2-0237-4754-88cb-007f73874deb", "comment": "Malware payload", "value": "b595afb8ab2c4ab2ee7dc4bf1b256002", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772777976, "uuid": "0b8662d4-b6d4-417e-bb06-1cd3e72ce386", "comment": "Malware payload", "value": "1d501c439b40ffcf1239a6d575b04ce0fc5dea2bf399f01b9957293ba4293e18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772777976, "uuid": "9f2f64c9-59bf-4fb2-9af7-590f011a48bd", "comment": "Malware payload", "value": "9eca05f1200c3e97cc6a18a49feafcebcd8777f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772777976, "uuid": "2a822a82-7ceb-4a56-bab5-d72a14e54dd4", "comment": "Malware payload", "value": "b284ae9b3a0ccf54e9e86e817522ca898148ab27c6242ec865da2581a186a2b73f6224364669a8b4b74178d4c7c77ffe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772777976, "uuid": "a48969ad-327e-4346-98a1-cd5a7b082e29", "value": "T13644C6077B919EB7C89BCD3306FA860110CEE45726A56B2B7774DA1CBA0B90F49D3C94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772777976, "uuid": "5fb5ae6d-56f2-44a5-b491-75f940b0e2f7", "value": "6144:n/dXObJcq26/6dFOzvXaLXJmAOWGhoYSf3U6LwIMr:nFCJL6dxJmAOWGhoYSf3U6LwIMr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772777976, "uuid": "b5855684-c2a1-4b32-ae1d-3ed4d90ba1d4", "value": 260802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772777976, "uuid": "2c61ac24-a9db-4b88-8fa1-52be43ca98e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772777976, "uuid": "aa30db60-2651-4ad2-9cd6-3adfe47f7c06", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "279d612f-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772808344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808344, "uuid": "df1d5711-abea-4215-b52a-73b907da5e19", "comment": "Malware payload (Formbook)", "value": "56a87ba94df8d4b8fcd952d9dced2aff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808344, "uuid": "8cbacfef-3b8e-4161-88c5-4eea83c7413d", "comment": "Malware payload (Formbook)", "value": "1d940966ac64ef594b93203b056ec7b8554c0f6ec93f03cf48bd63a3eb1f3a49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808344, "uuid": "11623c63-4b7c-48d6-a0e7-b9aaace4b444", "comment": "Malware payload (Formbook)", "value": "2808ea8406e7a40da6b9328a54880797240d513a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808344, "uuid": "ccb93c18-afce-41fb-a2bc-be99b75bb0fe", "comment": "Malware payload (Formbook)", "value": "ab2385447f946eb13f58cf9329e2715552e842ac19cecf55e1670b7453f46e8fd5ac7ddc55a4e41ee767bae94d1c44ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808344, "uuid": "61a7427f-8e60-48e9-be84-8be120723036", "value": "T1C7350221739FCE22C2945B7B80D2D67413B4CE49A413D26B6EDD6DDB3A66BD70A80343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808344, "uuid": "fa825ffd-f44b-4a03-9e45-d00e8e1f9b13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808344, "uuid": "2700cd18-0a7b-487c-94c1-5c58c201b69d", "value": "24576:Sn4yFdYSIHlJFA4QIQY59081mafaZ8PzgguQlVict:kVdYPQIR59081m8cOuWQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808344, "uuid": "09c89414-0fb5-4183-b92a-1673dad2e2eb", "value": 1112064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808344, "uuid": "11470c03-dca2-45fa-ae6d-079180d098ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808344, "uuid": "43553283-b6fe-4e3c-8a84-683a4478cb55", "value": "1d940966ac64ef594b93203b056ec7b8554c0f6ec93f03cf48bd63a3eb1f3a49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bc47e5d-1951-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772797291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797291, "uuid": "9089eecc-a6be-406f-88c8-e2c3a9931ffc", "comment": "Malware payload", "value": "41c19fc6c8a8687988f28fc487048bf3", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797291, "uuid": "af8c11f9-fffb-47c5-8a98-1cab5baa4077", "comment": "Malware payload", "value": "1d984d4b2b508b56a77c9a567fb7a50c858e672d56e8cf7677a1fca5c98c95d1", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797291, "uuid": "f1881397-5099-488e-b8b2-4ad475da7e2a", "comment": "Malware payload", "value": "3de597e3237d5c7e7cc66ecb58b9ea2af149afa1", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797291, "uuid": "22f72b1d-a826-4a66-be81-8e8829831429", "comment": "Malware payload", "value": "1348eb7c86c46137669fa82558d06bde4581f99c2cf73983436c6d95b4a7f8d6c61e45d7cb36330c5b58f73be8d54bef", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797291, "uuid": "2526e0bc-4965-4d73-91ee-8a9c38b2f8f2", "value": "T1BAA2E847B740D332C8814B314A1FD7E49F75AC589F77211636AAB35C2E72AE016BB9E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797291, "uuid": "c0795c42-5cc8-428d-a985-90b99c0de5e4", "value": "384:zY6bsWacfMey3M5UC0qEXddGSo78p+vV5F5gd/aj:zAxcUeWMmCgFzd/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772797291, "uuid": "8dac71bc-d0b7-4dae-85b2-d3cd5d89323d", "value": 22528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772797291, "uuid": "5bc9bd52-c8ec-461f-b4d0-03618904bb50", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797291, "uuid": "8db44506-bedb-4dcf-a771-4817812fff6f", "value": "1d984d4b2b508b56a77c9a567fb7a50c858e672d56e8cf7677a1fca5c98c95d1.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2f87e56-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810322, "uuid": "babfd802-7a61-4edf-84c7-b9a9f1a3de15", "comment": "Malware payload (GCleaner)", "value": "ad1883952b362fa4434c75d83d7d4081", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810322, "uuid": "4d4e6daa-d779-4719-a044-a22326035f59", "comment": "Malware payload (GCleaner)", "value": "1db55be06c39f251ebf8c94aeeb43e40afe176154ec71e9c303801c87cbabb4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810322, "uuid": "afcf8f32-4a5d-4776-89a1-0190e5e5ecf1", "comment": "Malware payload (GCleaner)", "value": "344aa52c19c30b7d4238473d8619de179996dcd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810322, "uuid": "a06adbdf-355b-4504-b3d6-476b7876a3ec", "comment": "Malware payload (GCleaner)", "value": "2f30d8d4b0c4ebd0290a72037f90530a04f55dbe71f4b33c181327ed0b5f4ec4a321094ee12ba56a74f44631e131e8ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810322, "uuid": "529dad6d-6444-4156-9a0d-b4b4f107c021", "value": "T192059E22A2F185F7C1EB2A7CAC5F669C9839FE313928588B6BD51DC84F3774534211A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810322, "uuid": "1eac2605-6706-4ec0-af04-9ef7e9a09acd", "value": "fe4280c06246cc873fe89746dadec91e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810322, "uuid": "b24951e2-f042-48c1-bcac-a29c4709cc2c", "value": "24576:HlluEBpPj6o4CPbE9taCbGIWZ+7uBTvvDb:Hlwa1Vu/uBrvDb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810322, "uuid": "d0544776-1888-4800-8ac6-b50021780252", "value": 847360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810322, "uuid": "0995f3eb-68ad-4e23-8778-33a39f0262ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810322, "uuid": "39a3c5a2-d927-420a-9a2f-5562e61ee350", "value": "1db55be06c39f251ebf8c94aeeb43e40afe176154ec71e9c303801c87cbabb4e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9ff1c51-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1772810844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810844, "uuid": "2dd76b2f-f5dd-4765-a565-794199470abc", "comment": "Malware payload (njrat)", "value": "a2ba09e44d7c9d1e79bb0afcfa70cc51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810844, "uuid": "1b3a1969-851d-489e-97fa-ae355f1500fe", "comment": "Malware payload (njrat)", "value": "1dc8912eb645787109698f975846095ff31f9d5078f5ddfc9483cf44aa312520", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810844, "uuid": "c2640d5d-e1a3-46a6-91f5-e1a1bea67795", "comment": "Malware payload (njrat)", "value": "d3944a0946e8c2b56bf72c3a539dd1a95e55ffc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810844, "uuid": "d1080efc-ea0e-4211-9e06-ebaa99870b03", "comment": "Malware payload (njrat)", "value": "b906223a1f1ed8f528aa176766c104811eed2c1b9739cb4a81ec3910cdad58ad37eb6b78b3ca45b6758d956686df84ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810844, "uuid": "02131145-b740-483d-86fd-9d3e32b9c57a", "value": "T17324086DAED7F641C1454936B87353804A7D5E7AA0CFB6568EE33FED5AB3C9420030A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810844, "uuid": "d9b64f63-51b7-4bc9-95a5-b929946c55df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810844, "uuid": "260c673c-e033-4fd8-b5ce-81cfc3d75a10", "value": "3072:fg84KxhkTcGNKd0VQoXcINbHm+aa4NpVq8BxFRzaqF+o2GQJ7/JzqVfGvc:8gVGRLsUbHaagVqwlL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810844, "uuid": "0d8a7349-42d0-4bc4-a6e0-aa2a4fa0b2aa", "value": 221184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810844, "uuid": "190bd4d2-e45a-4aaa-b3b7-555baeefad97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810844, "uuid": "3f2057bb-dbfe-4a55-b9c6-041fc698e431", "value": "1dc8912eb645787109698f975846095ff31f9d5078f5ddfc9483cf44aa312520", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a157ce0-1972-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811381, "uuid": "be866de4-8071-4a1a-817b-b83c12131dda", "comment": "Malware payload", "value": "8561d43ac49e66be78afd688f68d0048", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811381, "uuid": "743b4162-edb0-46d7-b12c-ffd1aa8c376d", "comment": "Malware payload", "value": "1dcab56a0998fc7228c2ec8ef6a4e9721522a9fa94a2665ed12d63d721db5b23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811381, "uuid": "ade1e183-7da9-44d5-96cd-75b088f0c021", "comment": "Malware payload", "value": "4c6a30b5cc364794adfc784ccace3b3554aaf0b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811381, "uuid": "825fd352-cd30-45a8-8cab-4dca2ffa2f37", "comment": "Malware payload", "value": "442b1eb4ecc27ac590e3aa4274fa7325264fa5071b33a48101ead1475413f5cca3fe021be15b16c83901e30fcdb00427", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811381, "uuid": "2f1471f5-4f67-483a-a27a-5bb5b2b943f3", "value": "T17A8412027AC2C047CA9609B00CB1FB73E6A97D5C69568743B792BF0CF672655A84D3B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811381, "uuid": "5fc36743-ccc5-4054-badc-2aedf0d8f88a", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811381, "uuid": "e80d58a1-38d3-4463-a684-3e7b7665abd4", "value": "6144:nwq3NpGrARcVC0Fw5NQqVkCrpgF2d33IxSLoMn36/3ACxtcEmb:nzSicVXoNSCrp0OxsGyx98", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811381, "uuid": "67eed766-35de-4d49-96ac-a3bc604ee597", "value": 404685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811381, "uuid": "84a695a9-ac4b-4dee-ba11-8f68412eee1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811381, "uuid": "08bba1a3-eb1c-42e2-8e0c-68cb43e3fb9e", "value": "1dcab56a0998fc7228c2ec8ef6a4e9721522a9fa94a2665ed12d63d721db5b23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "734fa074-196a-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772808041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808041, "uuid": "459e6349-dfcb-4ac8-ae59-ab2725de1095", "comment": "Malware payload (PhantomStealer)", "value": "3a629ddbd1c0e0ece98be283937871d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808041, "uuid": "87fc08d4-0b70-4495-809c-703be8e49628", "comment": "Malware payload (PhantomStealer)", "value": "1dd2b1c2480081818d532883b7710b654aa652aee0d6d4d8d4486d8430410572", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808041, "uuid": "38ed7659-debb-4fcd-8aa1-bf8bec5e8b9f", "comment": "Malware payload (PhantomStealer)", "value": "fa02e68d4876814ec1e70848d027e481f4725456", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808041, "uuid": "a4516171-40d0-42c5-a650-eccc7a8a2dc4", "comment": "Malware payload (PhantomStealer)", "value": "559c185a80ec86462a1cbda1a7f8e8a058dc89c59418720978d5f1fac3e932584ef6bac090d819446a8a95ac52fd0b69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808041, "uuid": "9ce79956-6fe7-4282-a5f7-474b168aeff3", "value": "T189752220136DCE63C9AA1BF94931C33547F18D9EA622E3668EDE7CE77D967C14C44282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808041, "uuid": "7783d4e9-cfe3-4600-b032-c48b13f41f0a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808041, "uuid": "d3eb8cfb-1c14-4fb3-975e-d7549dd5f7bb", "value": "49152:gzHvu7i0IYONZ99s9ivnlqHJaHC5BLLckYYhCBQc32:hVENZX0gnyGgBLwkJc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808041, "uuid": "2a1536e1-141a-40cd-ad9a-1db794b9d37c", "value": 1622528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808041, "uuid": "4a095d6a-801b-4b18-83b6-e50674206999", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808041, "uuid": "fa373aa1-afd7-4195-9877-1eae6cb79d1e", "value": "1dd2b1c2480081818d532883b7710b654aa652aee0d6d4d8d4486d8430410572", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f11b9d2-1974-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772812222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812222, "uuid": "0bdcfd4a-31dd-4b81-a7ca-4bd991ccc50d", "comment": "Malware payload (Mirai)", "value": "5f14ddc6cc66c69ebaa6561afb03b439", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812222, "uuid": "b37acd26-8726-4797-9648-85d8dc24b808", "comment": "Malware payload (Mirai)", "value": "1dee67789e64a36c32b8f3e7f45d899aef5b9f71214e08954759887658177674", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812222, "uuid": "addb801f-9548-440f-89db-52133c9b3bef", "comment": "Malware payload (Mirai)", "value": "0b3dca65c1989c28e47b1cb532fa46202f973fd9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812222, "uuid": "2e21804e-610b-4d20-8584-6aca39f90614", "comment": "Malware payload (Mirai)", "value": "d3375323723cf7f6262e00435c3ce8d31c0a645d5198ac4ed21eb1b6a4b9f40ed1a6d6e2f0875a25852eceeff7a7f756", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812222, "uuid": "1b65a20f-0ddb-47f7-b7bf-84b8204130d0", "value": "T12EA37DC9B283E8F3E81704B0603AE7779B72D46A2219EA86C378DD31FCD1541D527A9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812222, "uuid": "413b5233-d54b-4a0a-b422-bbbceca2d61d", "value": "3072:fix33tTBcahQfaQsPZptxfyZZ00WYIFpvAclU:fS33t1cahQfaQQZp/fbHpvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772812222, "uuid": "23fa564b-f3b9-4fd1-811d-92396e2acf6a", "value": 104552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772812222, "uuid": "4e9f9e8c-453f-4e28-a410-4df1e50a6c4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812222, "uuid": "e074da24-4712-48c2-9520-64fcd9f098d4", "value": "debug.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8903ff37-192e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772782308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782308, "uuid": "c8df8639-54ad-4ccd-9a62-10596a8b5cd8", "comment": "Malware payload", "value": "85d6ff388254ac0066d2d3742b1ecd6f", "object_relation": "md5", "Tag": [ { "name": "api-devx-help", "colour": "#8AD189", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782308, "uuid": "01fd98de-975b-4d86-9434-fec9cfe177d8", "comment": "Malware payload", "value": "1e12f9db9842a221dc8ccbc885190cb5553e3e4ddaea16721f00da4264052896", "object_relation": "sha256", "Tag": [ { "name": "api-devx-help", "colour": "#8AD189", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782308, "uuid": "91b8fbb1-9ace-445d-9ffa-ec66bf3204e5", "comment": "Malware payload", "value": "80859e31d7da425b8a7367568e7dfc9141dc60d7", "object_relation": "sha1", "Tag": [ { "name": "api-devx-help", "colour": "#8AD189", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782308, "uuid": "06fcf353-4f8b-4412-82de-f9769f5380fa", "comment": "Malware payload", "value": "8af0a21ca2b372f3aaa293f2c5c82a6486fe8c97da26f524ee9920f17dae27002075a726d910b2fc23f137ee518a610e", "object_relation": "sha3-384", "Tag": [ { "name": "api-devx-help", "colour": "#8AD189", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782308, "uuid": "fcdc0ff8-b7c9-4e67-8ed6-8528f435acb7", "value": "T1D0F733AE62C46F231DCA831E4976BB9CA121C325E1E4A4796DF82F4356E0B075F3D16C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782308, "uuid": "a854056c-e066-4117-8a35-c2e9d9a7f11e", "value": "1572864:XBh+bST8j1cEiWoYFzZholtSEmxnkG2Su8nR9ZwLlAMu/Ya8Q:XMr1cfFYFtholtSNb5nlMu/1b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772782308, "uuid": "543509ba-e63e-4dfe-9cb7-fd0ea3b651e5", "value": 73297630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772782308, "uuid": "2b9e8263-fa65-448f-b52b-54360f60e54a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782308, "uuid": "5cb3e897-ab04-451e-8212-33da3dbb0313", "value": "3ff24b2ac0669ad9869b4fb323d97cef51a60fb969871c221986f43b27006324.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "218dd76c-196b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808334, "uuid": "cf254917-1ea2-4393-b13b-015f2535b2b0", "comment": "Malware payload", "value": "05502d2ef09218b7a20a951958a608ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808334, "uuid": "50fae7d2-455e-4c02-8ad1-8496c4f72cfa", "comment": "Malware payload", "value": "1e4c6ae2e0191791ae885f6b4a2042cb27b6da479600abcefd4226c2ba953582", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808334, "uuid": "e53b69aa-c1e9-44d9-b1b8-e8a0ff898d36", "comment": "Malware payload", "value": "b3c14f30d36c7276d1d2649719f17f71cac5958f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808334, "uuid": "2484c9bc-9c8c-47c8-8945-25fd1a0c4e25", "comment": "Malware payload", "value": "e73975d1bb2641f5526afe139332807ce879e949b21661cc34a17a76dec644df154b24aa39d4ca4c50daef54895b6630", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808334, "uuid": "b93b7acf-9ad9-4b7d-bd39-db3a455610ee", "value": "T1C9756B476F9480ACE4B6D1F1C852564FE5773C22D732CE9F89987A4E0E731A08E6D6B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808334, "uuid": "b4ec4ead-0bb6-47d3-afe4-d8628f6cb2af", "value": "6a1932979a704343d32e1c7a0f9a3b50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808334, "uuid": "e83537cc-5676-4222-a8e7-7f0e8b947a97", "value": "24576:PVcM4QCxv79ivZedIzVli/IJKEHNGmJe+CuVSt+ap8kEB8dc:d1oBYxeOJUtuVSM48kEi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808334, "uuid": "3379e3ed-138e-40d0-a581-2f59d52bf4e9", "value": 1662720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808334, "uuid": "a65405b0-d74c-4687-8748-28b938eba9b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808334, "uuid": "f8b0dffd-0c76-496f-a193-8f7da5ee46aa", "value": "WallpaperSites.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9c2855e-1983-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819004, "uuid": "a8a7c066-9f5c-4066-8dab-c5a4ea3aac50", "comment": "Malware payload (Mirai)", "value": "c033c862455890cb8a3891b1897e96f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819004, "uuid": "dd89b82c-4d15-4289-b4b0-f8f918a9e50e", "comment": "Malware payload (Mirai)", "value": "1e5cb8fa383faf84647bf000896ab497c7f4026d7fb7a1c1310345997a30fef9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819004, "uuid": "1996c60c-67c0-46de-bd85-e314f552739f", "comment": "Malware payload (Mirai)", "value": "61c280adae89a669e43504fad623bcaab1498caa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819004, "uuid": "3af9a287-a4c0-4221-83fa-54b67f7ce757", "comment": "Malware payload (Mirai)", "value": "28a420451a9d3bd4e3b302c1af4c8d2d2001926d1fd56d1078a9825f60dc60cf4d8a1b5eb68fbe7f654b67581270b32f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819004, "uuid": "3cccd8c7-48ad-47af-83b7-8c7db2745f65", "value": "T1248328C1BA4BC4F5D90748304067F33FCB31E6398061D25EEFAA9E65DD73642662628D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819004, "uuid": "6e19446c-2047-4a52-aa9f-f73744991c00", "value": "1536:N+O3W1dz9BCSKJYHUeWAcaHWSQCYjxCAoN5F+hN9:N+J1d9JKjeWHL/jxC9XI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819004, "uuid": "0bff594a-92d9-425e-bf87-112d9477169c", "value": 87696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819004, "uuid": "859ea0b8-44c8-44d3-aa9a-3029c5746cdd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819004, "uuid": "a018d019-b011-4d0c-8451-b68f44c6b8cf", "value": "jawirbot.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bae738b2-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (DDoSAgent)", "timestamp": 1772809020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809020, "uuid": "e4544947-9398-4d55-bcfc-f61db48c613c", "comment": "Malware payload (DDoSAgent)", "value": "4704a1f07bad932369a0b7f191512085", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809020, "uuid": "8189f094-6805-44e2-b808-2d31f1dde795", "comment": "Malware payload (DDoSAgent)", "value": "1e7d362fdc84b221b948355dcc09464b3de670011190029aab249d458a17c0c0", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809020, "uuid": "488ae7c5-369e-4a68-8037-a28f8cbad825", "comment": "Malware payload (DDoSAgent)", "value": "99c55d37c7985cb99c312363c891c210fb1fb829", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809020, "uuid": "f8c394c8-a5b3-4f33-8d94-c9db7ca3e444", "comment": "Malware payload (DDoSAgent)", "value": "62887121b2cc995203e4d9236fb5bb6527d6aa8ace848fc81cf4de016209c0246d5e8bb3546f91fde060803e9bd148b7", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809020, "uuid": "2062ce5e-281d-47ee-9f32-1fb8519762d7", "value": "T154573953BA19EB1EDA28223448B1CAA463791C9580D6A507B741F319F9F307E4E6FCF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809020, "uuid": "ab86c0a3-1a3a-47d9-ba3c-94731f90a82b", "value": "98304:+aqgWz38FqcZ+SjEjrsHxxrv6BZYyD2qDSK6kODox61dhxwk+gdOgxtpu+pTwDjD:+aq738ZZ+2SK06xrGCRYrj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809020, "uuid": "3947f6db-3d4b-4eae-92c3-1f71dff84fbd", "value": 29425879, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809020, "uuid": "a9d0474f-37ad-4bca-b84f-4471134de36e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809020, "uuid": "c727bf75-3567-4b35-8b91-b2edd4d16c3a", "value": "apex.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90eff89a-1969-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807661, "uuid": "2cf100a6-bf51-4ab0-8c8f-8b54bea0e1df", "comment": "Malware payload", "value": "90012d963d10db12cbedcf81133ac47c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807661, "uuid": "ea4dce86-e68e-478b-be44-d533e4642155", "comment": "Malware payload", "value": "1e8902ebdbdc158b751d2c6b3925267ff59b279a1b3ea1d9d44c1540cfa2e948", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807661, "uuid": "26bb8576-a19e-471d-98f5-22caec8ce0c8", "comment": "Malware payload", "value": "461646fe9ec00c441adf1f542e1bdb9b1f4516d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807661, "uuid": "89256665-a40d-4528-850e-683eed9220a0", "comment": "Malware payload", "value": "76302efcea9aa02dbe8ddacc6627108cfd8321514898a912c05e7fe335abd9456d094394a5a5532cce60c7ef7a21a544", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807661, "uuid": "dbb7bb04-ad07-450e-a949-771385ada519", "value": "T1D8F34B03F6D644F8D467D1B4A69BA733B5B1F854537429AF0B90CA362E0DA30B22DF46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807661, "uuid": "464b5109-26fc-48c6-b6ab-41c05de413e2", "value": "c411c22bbc58519d23851b4202b63f4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807661, "uuid": "f93deeb8-6ff9-4ca9-b00a-974107393ea6", "value": "3072:85iAt+/UB9uIjXAiDbLiqlnDTM4hbAGL3jX:pAt+/UBQLuLk8bAGLj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807661, "uuid": "3ec56c83-ddf9-4d46-a171-b9911f73d716", "value": 159744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807661, "uuid": "8ce79985-194a-4bcb-97e4-7ab34adbec78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807661, "uuid": "91a23256-f40a-4a87-9f37-e7cdad9fbf4c", "value": "1e8902ebdbdc158b751d2c6b3925267ff59b279a1b3ea1d9d44c1540cfa2e948", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "778cd067-1969-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807619, "uuid": "9537a3c1-db90-476e-8ea6-aef127b3952f", "comment": "Malware payload", "value": "50c10e7aa56aab840f743fe4df11c49b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807619, "uuid": "5b745fc5-74c9-472c-8012-a08a8cada47b", "comment": "Malware payload", "value": "1e8a28346b249d0090153a21f0097475be7c106d6f7fe01bf00af05335563640", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807619, "uuid": "c5e1c96f-a2a3-4660-b3eb-58edc6726638", "comment": "Malware payload", "value": "b15900948f01764967842abf89b67b5404b63bba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807619, "uuid": "cc218148-49f9-420b-8980-f8a853a57d83", "comment": "Malware payload", "value": "ef29649c521b27780f0328bd8d170f8fed9d35faf5aa390382b7699f7e1ae28894e51910c85a8639e960d84081a41ba5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807619, "uuid": "54cf3118-3397-4da6-afe8-1c5eb2068ca6", "value": "T1ADD6338C2AE011EEEDB3903CEED16264E59C78761336CEDB97E447565C632904D3AB23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807619, "uuid": "7032a982-367b-4a29-a213-76bc8c3ff0bc", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807619, "uuid": "2669d000-f09a-470a-82fd-be9d7844925f", "value": "393216:UpUHoFcExzM0Ex3BIxmXMCHWUj5cuI3/PkuUSq:UpUIFtMBqxmXMb8OH/sCq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807619, "uuid": "90a342f3-f9f0-4a2c-9132-53263143dff1", "value": 12758548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807619, "uuid": "11b98f91-3f92-44a8-b253-f09cb6c6f7e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807619, "uuid": "7943d1a0-85bd-4e32-b794-aeaa17e13a16", "value": "1e8a28346b249d0090153a21f0097475be7c106d6f7fe01bf00af05335563640", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "671c642e-196b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808450, "uuid": "9c9a0490-bf2c-4774-bdcb-b644a3dad7bc", "comment": "Malware payload", "value": "1a68d3114aa78cb45623104bfaf197e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808450, "uuid": "77ea76fb-4679-4e8f-bf9e-20010699c8f1", "comment": "Malware payload", "value": "1eab549aeec3b69b8244fcc4719cebc68285958b798db1cdf8c8f7e08102a9a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808450, "uuid": "03487f73-6e4b-4b83-ad1b-d495a8a3eb04", "comment": "Malware payload", "value": "47535f3d04a61dacc8c176dcd72363c44a52f4bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808450, "uuid": "60e80bcc-93c4-4a74-8595-965015f769a4", "comment": "Malware payload", "value": "cc1e75747f08fc4f675837c08bc7577b2cec85a6d6b587299e004e244d14ffbaa15bf0a9685f250913c79687761ad568", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808450, "uuid": "513ff85e-c5ed-422c-9a91-231bcaa9f567", "value": "T13F25D00523E95B68F0BE9B799574246087F2F907E732DA9E7C8C41DE1A32B81C652733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808450, "uuid": "44badc61-bd09-4bdb-9ce9-4059e45ac4f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808450, "uuid": "cbecf833-ae69-4f46-9518-26cba112b087", "value": "12288:sOmK9o2tVX5rVBo83tUsm+u6cgJxPLX4DA1K0XGeglq7ehF4r8V5F7AJzYmLgI:OK9oarVBo6tgNExj4DAXng07ehQzQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808450, "uuid": "4fa8d64f-f44a-4cbb-b0fc-f95c62878c55", "value": 1049088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808450, "uuid": "74499a37-beb3-40d5-9d12-2eedd27d92f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808450, "uuid": "08a8763b-46aa-4c80-974d-ef497e886cee", "value": "1eab549aeec3b69b8244fcc4719cebc68285958b798db1cdf8c8f7e08102a9a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99e67f9a-1952-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772797798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797798, "uuid": "69f35efe-524b-4077-8cc1-753b07e8d324", "comment": "Malware payload (AgentTesla)", "value": "82632742363f974d4e733bc5b0602fd5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797798, "uuid": "149729a9-5234-432d-ba7b-650dc3464a05", "comment": "Malware payload (AgentTesla)", "value": "1ecc3c1fb0c32c448deb5d4b5f6058d9a24b985770c0584e8afa56c44e57e7a0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797798, "uuid": "6506e836-85a8-42c3-86e6-3f6804bfd67e", "comment": "Malware payload (AgentTesla)", "value": "01035ccb0400847e939c1338133ee34ff826cf67", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797798, "uuid": "fe0bcaa8-c964-4bd0-b3ee-9923254fa868", "comment": "Malware payload (AgentTesla)", "value": "6f5646f89b3f4ba8294b0542eb5947a8fdf3d3dad3af1260567868be44569044b4d0bd07f565775ac432f14ce59bceb2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797798, "uuid": "337e966e-8021-4b60-b89a-b2b660484d6b", "value": "T156657E906EF4A9C018180F38C2F3D10B35B18DD8CE8F5ECC4A49BA96B5AB759D39549F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797798, "uuid": "2aadbd45-9323-4de8-beac-bbb1079cc720", "value": "12288:mPpX8fnUhRLdYJJ/Jx9NDaaLdnzhRTwRrollbP+usm2gu80CTdreK+Qs/yzDLaqa:uGk81Jx3DGsllb2INTdrYmsriDYRXeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772797798, "uuid": "f960b2a5-e213-4cbe-aa5c-bce21f6c410a", "value": 1413932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772797798, "uuid": "b10d79a7-9b21-4227-acf8-f5759e5d1c80", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797798, "uuid": "4925cdb1-6049-4996-8fd3-3e8cd88d2dcc", "value": "82632742363f974d4e733bc5b0602fd5.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1ff21c9-1969-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1772807771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807771, "uuid": "be47dc66-9118-4487-b267-b8046ed6acb1", "comment": "Malware payload (SnakeKeylogger)", "value": "69ec9d3a64e78cff10ed60f70c8bc4b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807771, "uuid": "01e8321c-4cda-4143-a1cc-a24608a06b17", "comment": "Malware payload (SnakeKeylogger)", "value": "1ef4b8f572edbd8872dfc7df6bbf8bb44118369740c7d3da57a653eb729afbce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807771, "uuid": "c9199c18-7589-4e65-8e05-068ca072239e", "comment": "Malware payload (SnakeKeylogger)", "value": "9d8189af5efb3c611284eb045bddc27f38a09f87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807771, "uuid": "c39dcf51-8e04-4caf-aaaf-e9cf5baf4f47", "comment": "Malware payload (SnakeKeylogger)", "value": "1f42973d7768571ceb924c227e1100cc682cd594ae303b0bd706e5d1c3920432e462fad745b6d331eea96bce2eee61ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807771, "uuid": "ec241d17-d7a9-4cd3-a9bb-2bf8907b5e8e", "value": "T1FDF31364F958F6FAE143ADB75E89DCBEDEE6D05693101F0B04410B6814803E5A9BCF3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807771, "uuid": "1a9b2392-22dd-4727-aa1b-5c9a616e4b21", "value": "60559adcf3698c3eb3c69577ebf28413", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807771, "uuid": "e3f4195a-f110-4a41-a87e-575d6cc0205f", "value": "3072:nrY0FLg5SmNberoWXeSlAXZaQYMX4+R0+KBVqVm8qSIeDqQUWYbPGK:rY0KwMTWIcQYMXjR0+gV0IeDdYb+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807771, "uuid": "d54b5d2a-ea0a-45df-ab3a-38bdb66588bf", "value": 169984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807771, "uuid": "7bb88185-239b-474e-9d7b-5bf4eec5c620", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807771, "uuid": "853a01de-d24c-4329-b94b-a282fdb8e90a", "value": "1ef4b8f572edbd8872dfc7df6bbf8bb44118369740c7d3da57a653eb729afbce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4da4e6f5-1929-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772780061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772780061, "uuid": "12e0664b-deed-4974-be2a-b8bb08470f80", "comment": "Malware payload", "value": "8f2df797bdc62956e53d3b6ce7222dc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772780061, "uuid": "69f5739d-0166-44c3-8afe-d8879322c0f8", "comment": "Malware payload", "value": "1f009b2b05fb231e8b864ac5a588d955438c28a8191fd1cae87a0c4bd0b49c9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772780061, "uuid": "06602ec6-b72a-4a10-8b66-ea04bb873407", "comment": "Malware payload", "value": "3423ec146ac6f1edc807230d242eb1cc31841d19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772780061, "uuid": "dbeabdb3-1098-4d8c-8b67-3a421ace02ee", "comment": "Malware payload", "value": "099a8ba4d1ccf5a74e0ed4962df0dd78591c4f958fbc9c0d703d79d19fb3a7d1a6e07c2f2cf3ecae5db7974d13c5473a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772780061, "uuid": "4b1ad0cc-3ba9-485e-ac45-e02d479df63d", "value": "T117051C7E59A2916AEA4A40FC35454B6249B1B33B03B41FF701A691302717DB2EEC73F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772780061, "uuid": "a20e38c3-2076-409e-9505-72023f53d23a", "value": "12288:tXC3lQZAJPAFLnpr4Xf8Y5MSpHUKHY2ybk/O29D+CU0sD1PcUWs2nFUNSh1Wmv3:etJPARpr4Xf8Y5MSpHNTYj0NnFsu3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772780061, "uuid": "88f88f8c-8fff-44b0-b4cb-a6401c0c8ebc", "value": 808996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772780061, "uuid": "3c0d78d5-7472-458d-afe2-863971229deb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772780061, "uuid": "676e6b61-c1f3-4a81-9468-caaa60c53a8f", "value": "1f009b2b05fb231e8b864ac5a588d955438c28a8191fd1cae87a0c4bd0b49c9e.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7dd9da5-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808586, "uuid": "9cf0193c-0930-4019-b0c0-faebac267289", "comment": "Malware payload (GCleaner)", "value": "15ea8f2b6514a30046848eabea8f486f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808586, "uuid": "d10f77fd-dd88-4e3c-bf88-50dedbea1f79", "comment": "Malware payload (GCleaner)", "value": "1f5a276f36a9793da0e84b9e18891fbd6f050069c906b1368dc4f810990286f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808586, "uuid": "b4ff8e07-8e8c-4d39-8216-a37dbeb65527", "comment": "Malware payload (GCleaner)", "value": "9df18cb968632bd9851985788e64ce4b9e91bf6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808586, "uuid": "83dc1650-4d7b-4915-bd5e-50ac2f3b557d", "comment": "Malware payload (GCleaner)", "value": "3030eaa85f25d507689338ae41f6b0260a6b8bf0fc37615b74dd663c3df9c4edddc3cc65d36b8bb7eabe482f17cfb6c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808586, "uuid": "f1c4b395-8241-49b8-9d3d-e20291a4480a", "value": "T1FE26E0E762C10CA1D43BCAB49A6695EC573DAD8422154F4D2EECDBD804B8393EB3F152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808586, "uuid": "5cf3b571-ddfb-409e-acf6-7231cd111f2a", "value": "099b2b7fa2a0044e2ca25418be2f8a70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808586, "uuid": "32ed66e4-0219-4485-986c-0c351aeba5da", "value": "49152:tto5h7kxgk1aU+gT4kjHzyrXzs81GLf9ArX2ZUE6KKv11w8MGh/RBh1iZ1BqROW6:tteyaU5TFSsmgaXE6KvYXRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808586, "uuid": "ecc8c2d9-a433-4a35-8883-5e0c272c7ca3", "value": 4682240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808586, "uuid": "24d54139-b5c9-45fe-b188-ba5b3be8e674", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808586, "uuid": "7c9601ac-6c7f-482d-b92b-0a455f28bc41", "value": "1f5a276f36a9793da0e84b9e18891fbd6f050069c906b1368dc4f810990286f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc341ab3-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811277, "uuid": "45558685-ea1f-45f9-881e-ea826308b810", "comment": "Malware payload", "value": "ea1d4b7cae665a0f58ad1c00eeb0ab11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811277, "uuid": "6f806288-5d9f-4499-bb9a-8397ebd1a3b2", "comment": "Malware payload", "value": "1f865dbcdbcadc63d6991c1534342a0c639c67894e545c9e31092faedd2ae1c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811277, "uuid": "4abdabc5-ea90-48fb-8d41-664fb97f8637", "comment": "Malware payload", "value": "7797f5c47496ccab5c6e5f6babb3b8de98ee0681", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811277, "uuid": "bfe38a3e-137a-4f18-b84a-100e06228b9d", "comment": "Malware payload", "value": "1a00e4543b074eb513c760732d93f199853ab02aedbbb94a7430703a26e5bea5b3856499332d70f304c89c2bf50633ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811277, "uuid": "9fafb20f-cefb-4152-8d02-dd480f471364", "value": "T108258D66B6F09037C2761E389D7B669CB8267E013D74B8496BD42DCC4B39641FC2D2A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811277, "uuid": "95428788-1b90-4b0d-9b53-796a1dee1236", "value": "1b5561a94cb01af2569d6f2ff45e087c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811277, "uuid": "6ec60680-0f0e-492a-b19c-fb682ad0024e", "value": "12288:xXXYiviV8rqIPazxvzRNRhBydf6o2uzIrOG5ka+7l/A3IqkDHHT16a9T0RC0:tFTPaZNNIN6ndr+7iKB6a9TsC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811277, "uuid": "68fc8db9-ae7d-4c0a-977e-8d8f9eb42cb0", "value": 976896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811277, "uuid": "374ef5d0-497c-4ae4-b589-e3acb60a2b15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811277, "uuid": "59c746b7-8936-419e-9d2b-a0006c32e430", "value": "1f865dbcdbcadc63d6991c1534342a0c639c67894e545c9e31092faedd2ae1c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6dfb374-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772809121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809121, "uuid": "8253483b-5a68-4e75-bd85-b9bc42ee2ac2", "comment": "Malware payload (GCleaner)", "value": "f25a83cc3ba315ad6bde1ba927da294c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809121, "uuid": "ad2ddbde-bc2f-42e9-b4b2-516d96107822", "comment": "Malware payload (GCleaner)", "value": "1f8cf92ffe3efbc84194d939bb82c45c046db62b8bc6fca24ad696b247f59db5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809121, "uuid": "68b74001-77c6-4232-8525-73c423640e4d", "comment": "Malware payload (GCleaner)", "value": "24737e66179f8868ddf0025f89ec2fa24e7f0a1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809121, "uuid": "e1a58daf-312e-4722-99aa-40d2f2627d6b", "comment": "Malware payload (GCleaner)", "value": "6360ac79e3dc9cbab4b13cac83389a146ace1d219aaffd50247b0911048d769600678a04d2b2c59e591272661b31be4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809121, "uuid": "14d616ad-4455-4218-98fd-05b4fae9dae4", "value": "T13F46E082E78119AFCE10A7FA9D5537D768837F88A0D190CC75C899C8493D7477C28EAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809121, "uuid": "ceafa4d4-46dc-46f4-ab64-34021dbb94f5", "value": "345624d13ffc2b7f296b9d2972b1c0a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809121, "uuid": "8bd1a6ef-2b49-4b6a-94cd-3792effe7003", "value": "49152:SiZHBokSHkPu/HV2C3WdiLZKTXxDnN9MhVL3AME6Gq81o8APu7HD6:SiZhokA/12OKTXxDf0LF781o8iqD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809121, "uuid": "8c2d91cd-0636-413c-9130-ee23023db60d", "value": 5388288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809121, "uuid": "3ea0b8e9-4281-48e8-ad4e-7a1c9f7e2cdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809121, "uuid": "bafe2ebf-aae5-4057-a447-911890dfa168", "value": "1f8cf92ffe3efbc84194d939bb82c45c046db62b8bc6fca24ad696b247f59db5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93e5ce31-1942-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772790916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772790916, "uuid": "af997055-1d2c-4279-9d2d-93efac8303eb", "comment": "Malware payload", "value": "0f46a3a157dff5d5ee9de24938d67a4d", "object_relation": "md5", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "jasjdpoekkqwda-com", "colour": "#F78A49", "exportable": true, "hide_tag": false }, { "name": "modeactivate-dev", "colour": "#EB9FC8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772790916, "uuid": "7aebf23e-837e-4968-98c4-aca018aa6e57", "comment": "Malware payload", "value": "1f9316491eb729a1362f5f02d88ec1a2ca5877c1ac496d517ff602c6ae350a5b", "object_relation": "sha256", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "jasjdpoekkqwda-com", "colour": "#F78A49", "exportable": true, "hide_tag": false }, { "name": "modeactivate-dev", "colour": "#EB9FC8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772790916, "uuid": "8e7df2bd-09bf-4c73-8167-68659b5e54b6", "comment": "Malware payload", "value": "5906166916129a74a8f327a7d6464cfb989a5ac7", "object_relation": "sha1", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "jasjdpoekkqwda-com", "colour": "#F78A49", "exportable": true, "hide_tag": false }, { "name": "modeactivate-dev", "colour": "#EB9FC8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772790916, "uuid": "04796a76-2215-4089-a735-ba02e5721cad", "comment": "Malware payload", "value": "1d0381f77f4b95cc198d579f92dc61c9dbc0e595e6022c395d603170e98557150084c3dabe10f3955a32bb1a7e43bc61", "object_relation": "sha3-384", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "jasjdpoekkqwda-com", "colour": "#F78A49", "exportable": true, "hide_tag": false }, { "name": "modeactivate-dev", "colour": "#EB9FC8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772790916, "uuid": "c870d034-2d09-47e7-b725-3b8aa51ce933", "value": "T16F413018E2659879504A178EC8B61C48954F4CAF4B015F44B64C78E93F36D3DC7AF39E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772790916, "uuid": "d06eef5f-3885-4a1b-9127-9d95f1c84122", "value": "48:UjSfV4tGOiBGqQq04KPAKKeoMKbFiKyEMEQgOEyCPP:UjSf8GO/bcLFiK1ziEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772790916, "uuid": "fa67ede0-465c-4352-838c-a84a23318c21", "value": 2269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772790916, "uuid": "7150a31d-73b3-4f6a-a9cb-fa463494df6f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772790916, "uuid": "9b1b25ef-db3b-4e69-a357-7ac8e2411e65", "value": "1f9316491eb729a1362f5f02d88ec1a2ca5877c1ac496d517ff602c6ae350a5b.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8257309-197a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772815136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815136, "uuid": "bd92f6c9-3040-40c8-a745-5337695013b7", "comment": "Malware payload (Mirai)", "value": "57571ccece550d7208d5792d8adef874", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815136, "uuid": "7156b405-5e9d-44cc-a509-581ca6f24f73", "comment": "Malware payload (Mirai)", "value": "1fc349afacada277ac57b86a84a0cf3f9abab538bb3d7094bc7b6322530fdedc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815136, "uuid": "54b80e2f-28f7-449c-916c-13a26cad906d", "comment": "Malware payload (Mirai)", "value": "2fff6d1a9ebf7a30e7c18a2ee7ffe397331af31a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815136, "uuid": "11db291c-5e11-492a-9ae7-a06d6ebaf260", "comment": "Malware payload (Mirai)", "value": "acc95803cbeb54dfefccdc0a558f9a9529a184be20f95ef48d4bfe9c2a950b86094045c3373c4b8c3d6bd1b279704be4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815136, "uuid": "8a70bb8b-700e-4fdc-80a2-d93bf02307eb", "value": "T105116DA86320C31278A2463964E12BC993CA6FF7A484CEC8B131CF15C14559C3EE5BE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815136, "uuid": "735ea58a-a9ad-4cf3-9e40-3e169553d30f", "value": "24:+HwhHw0e7HTHGRB7HmHtq7HvHaX7HBjHBWBTJ17HwcHUV5:+HwhHw0EHTHGvHmHtwHvHaLHBjHBWBFM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772815136, "uuid": "258ad92f-b819-4377-9e0e-ca92af9bda41", "value": 1026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772815136, "uuid": "5173ad5e-bcc3-49ce-84f0-6f7b3c4b543a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815136, "uuid": "e7ef1edc-8ab3-45a6-9402-336750f805c6", "value": "realtek", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c85eef03-195b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772801741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801741, "uuid": "2b33be44-1685-49ea-acc4-a12dba3fc4d5", "comment": "Malware payload", "value": "842b54c83a4e16dda0e76b9af5b6e762", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FrostStealer", "colour": "#039E85", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801741, "uuid": "1210d884-989f-4c3c-86a5-1788add2c760", "comment": "Malware payload", "value": "1fe016374f7213b8e982ef7cc67c5b770d7aa22f1b01d0397a72317752dfaf6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FrostStealer", "colour": "#039E85", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801741, "uuid": "7e76c244-0b6f-4ff4-900b-9b98eb8bdc8c", "comment": "Malware payload", "value": "a54d81c3fb29be2a46b1e0e66b75f2ca4cc09c22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FrostStealer", "colour": "#039E85", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801741, "uuid": "51720b33-7bbd-4c6b-908f-449c963dcb8e", "comment": "Malware payload", "value": "fd9e3ea02ce1903a5b94bc3a67ea38a9a032e7729be5c44a0b820d89c181eecbc37b77975ba86804a822451947d6e922", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FrostStealer", "colour": "#039E85", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801741, "uuid": "38a0f08c-868e-4b23-a5d2-55eb7c587e09", "value": "T19628E01663E112A6D577D138C79BA203EB72B40723309BDF729C03652F63AE45E7A760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801741, "uuid": "2ae3333f-97a3-41af-a011-96a1eefb3447", "value": "9eba512b03d8cac8a6c4424e25e9f06e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801741, "uuid": "2df30d1e-b130-439b-a6c2-f9d892d096ae", "value": "1572864:lVDG5MiP2aVxUXfQfOInRaVJc3ge1S5GDudIaexVj:lVDG5NVybuQc3ge1SvdOXj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772801741, "uuid": "410fac99-bf20-4bbf-aea0-9cd55d550189", "value": 95887279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772801741, "uuid": "a85478e3-d327-4b0a-9a56-46c967be57a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801741, "uuid": "af1bcfdf-8a64-45a9-b06a-02339ca1b450", "value": "GunslolView.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f3992f8-196e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809618, "uuid": "d17c1d79-6c15-4709-90f2-a8c874f59703", "comment": "Malware payload", "value": "ffd3eaa04dedcad1e084e919ef9a7123", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809618, "uuid": "c79e173e-2ce6-4c34-bbbd-86f7046de6d2", "comment": "Malware payload", "value": "1fed3f893d7a3cab80cda40da9f6f403708419d2ac2059ac5ee6a50424c2a3ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809618, "uuid": "02b25ea3-8f51-4bac-8404-f00973e05b18", "comment": "Malware payload", "value": "da12b152f16e6552182769bd010278ad0984e2f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809618, "uuid": "7df9c596-d51e-4bfa-88fe-42b4f9a20779", "comment": "Malware payload", "value": "f6ef378cbba3e3ece451284c0994ae0fd23088b43a19cb085fd6c6d896bee4d0173f613d655a5af4e6e85c0778af7b4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809618, "uuid": "cfe12213-d334-428f-9a69-2a2eafc85140", "value": "T125152310F5E0D037E16A17325C8B53B20EE5ED6AC6D2B25B8389789C7DBA7005B67B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809618, "uuid": "f6a87f20-98c2-47c5-adf2-a67bb063e3ed", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809618, "uuid": "84b34bba-3387-4aa3-9bb2-8ef8fa775860", "value": "24576:13dIYP+p/x7pViylCTsiJlsOSpMYWzAb76VAtuuWSgH7t:13mKwTB5iJNzAc0WSgbt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809618, "uuid": "d70a8138-4c6c-4bab-aba4-0e2c5a0ae983", "value": 879232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809618, "uuid": "425c9f45-4a28-4b3e-94d8-5ef21564834e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809618, "uuid": "3e6aa5d2-8d00-4784-9600-645ffb9e9750", "value": "1fed3f893d7a3cab80cda40da9f6f403708419d2ac2059ac5ee6a50424c2a3ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ed3b8bd-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811094, "uuid": "9dbe3f63-7b53-4135-98bb-c3e2c1c80b65", "comment": "Malware payload", "value": "7665cd19edad518808d09054e87afd2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811094, "uuid": "cecfb4d4-5105-4fcf-9ca6-9984a6b3f1b4", "comment": "Malware payload", "value": "20319983f849f6cf7be8fae73950649dbb6593cca2282d005091eeaf8b13cc27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811094, "uuid": "c68e1daa-120e-4ff6-9755-921a6b3a2296", "comment": "Malware payload", "value": "e7649262e9261f8688e5552fa55d41022bb0cfc2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811094, "uuid": "85572d31-a9a8-41b0-858d-5a6dd137a676", "comment": "Malware payload", "value": "b77c9c33eb66349deec1324a48b710f8c093a4a3a2f600e64227b403602fed4788425313c488004b24e63e862f2909ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811094, "uuid": "6457d7fe-b269-4984-8b77-69c8e9307be2", "value": "T10F7522982B56CA16C9664BB55A31F2702BBE3EDFB900D3079FC8ADDFB566B015D00342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811094, "uuid": "22f378ae-e38b-4eff-ac3e-1a2193002e19", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811094, "uuid": "87daf671-ab22-4064-8260-30008a2f548e", "value": "24576:vbCkk+oNQbYSwcdOiyaiPqptwxhRIOwmPpDSg2IDLikkdQTdIVwNU4KN4j:v+RNZSVdy1NPpTyFwIV9424j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811094, "uuid": "364c6b78-8251-4823-a433-efafed7e19ec", "value": 1555456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811094, "uuid": "ebe720d7-cf7a-4746-afff-98cb71e11f3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811094, "uuid": "41b6a457-8143-409b-9ddc-26b00ab5c263", "value": "20319983f849f6cf7be8fae73950649dbb6593cca2282d005091eeaf8b13cc27", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39f93c51-1971-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1772810951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810951, "uuid": "479f9bbe-2311-4ee7-9783-7aa96e1cc940", "comment": "Malware payload (GuLoader)", "value": "803dd50ad2177c15197031d2ab6d13df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810951, "uuid": "dc2d68c7-5918-4e40-8ed6-a27c1cc8dfeb", "comment": "Malware payload (GuLoader)", "value": "20c650ba6fe0158bf49bf298711fb95f5915dba704169c2443bf921f4852e9fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810951, "uuid": "bdfab632-7064-479f-aaaa-f1a32d76a573", "comment": "Malware payload (GuLoader)", "value": "eb97230b96bb4a332e7e4f3e5f6e0ad66d051eaa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810951, "uuid": "b318392e-24f3-4c7a-a62a-eb81eeaf8ac1", "comment": "Malware payload (GuLoader)", "value": "fe6739080082f72ef8d5987562940d97a70f9411f16e241e71042ac8ba0ccfe3bf3892d29789bcab893da106638e05ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810951, "uuid": "76c02c96-ee33-4b49-93dd-f727f3d12783", "value": "T10AB4231253B88967C88D2EF05ABA049BEA78C25205A4F7174751DFD6BDF37D0890EBD0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810951, "uuid": "5c0816a4-5af5-4cca-aafc-e2ed5f913fa2", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810951, "uuid": "2362ab1f-decd-4b46-af4d-917ff52b8ed5", "value": "12288:G1yDJcBnQPVdN7/WONtPNMxELugStr5LQhj+:G1yDJc4rzqxEetrgj+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810951, "uuid": "fc8c145b-0f9e-4692-b4c5-25dd7cf36be4", "value": 535904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810951, "uuid": "566dd0ed-1426-4ad9-b034-435a3f6107ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810951, "uuid": "03d4e27d-9c93-46ef-9cea-92b4d204e5ea", "value": "20c650ba6fe0158bf49bf298711fb95f5915dba704169c2443bf921f4852e9fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d94c953-1974-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772812192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812192, "uuid": "4c9599ed-878c-4c01-b62c-a5bd0e3565d9", "comment": "Malware payload (Mirai)", "value": "23a183211ce13caec85094b71b2a0b24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812192, "uuid": "deceea88-365f-49ca-9f8c-7b521f079e2f", "comment": "Malware payload (Mirai)", "value": "20fa2340667b07792ea3820c15f42212030b15e2f27b504ff7503cea863a8391", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812192, "uuid": "d4dc7591-dbf6-4eeb-822a-1d0abef728ed", "comment": "Malware payload (Mirai)", "value": "c6e522fef1c2aaaab2b24fa3a177337e72e7c5fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812192, "uuid": "fb23325d-077f-4698-9e95-b28a3be756b2", "comment": "Malware payload (Mirai)", "value": "707c80607527ea0206b357c581317192f96a8e548607fb13d4014023821eb6cf4bae10d2be5bf4fc8201899194258a8d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812192, "uuid": "63ce7261-d6b7-4fe6-a7b7-4e4312902d3f", "value": "T1A3A36AC5F683C4F6EC1311B5143BB3339772E539503ADA93D3A9EA33AC922519A5A31C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812192, "uuid": "7f78b750-2345-49ae-8a93-295b36f89bad", "value": "1536:qWouPd9qZlyR5hHxiNdVTqUl8KdcZE+vxSzkr:OuPrqZ4ZxCjqxIcPYK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772812192, "uuid": "652c10fb-b4c7-48da-b7d6-9b9804cc6084", "value": 101548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772812192, "uuid": "fefb24c9-0f63-4e2c-b1f0-24ad484fc4f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812192, "uuid": "8a5a93f2-efaa-4b87-8385-3dfb5f6821aa", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68dca96b-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819191, "uuid": "87e72226-9341-446e-aa8c-c556d65f10de", "comment": "Malware payload (Mirai)", "value": "aec05b622998c8b4c59f7892e46b34ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819191, "uuid": "a274a4f4-51ad-4b81-a242-af866d18ae82", "comment": "Malware payload (Mirai)", "value": "21418433d4c93a8eeefa2479a2fde7706b7a85dd21bce3f855767909d9dba632", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819191, "uuid": "039e38db-f27e-4622-8e53-eb2b19358683", "comment": "Malware payload (Mirai)", "value": "9b2a50eb48e1689265c797dac77e86eb75882cee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819191, "uuid": "de99d095-16de-4934-8f8c-b2cf8c6987a1", "comment": "Malware payload (Mirai)", "value": "4e37a4fdba8f4eb7daf3e26757805f77da725af6d8a6c8832ab49c0fc3f05f1e288d1731ab5182226714b796e42c0d15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819191, "uuid": "0c9a60b4-ef2c-4f0b-a2f7-4f05098841f5", "value": "T1E2B2D740B942C91BC4C55172BB8F51EDBB16532CE3FB3302DE265FC926AFAA64779840", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819191, "uuid": "b254321c-06bc-4815-9e6a-49983a9aaec7", "value": "384:9hd0HGG+AKZRVJeFUBh21bVPBDvdKxIEcxZY6oc6BEiOWDUiGdFx4e0Tb:9hqHGG+TZfJeFy21bVP22BJoRbOWRFv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819191, "uuid": "d0a0e8c0-19f2-4cfd-af92-c3ab855e53f5", "value": 23536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819191, "uuid": "ec1d6ff1-d71c-43d2-92ff-f179a11f8428", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819191, "uuid": "3c9e78d6-e2e5-4163-a13f-bd04ac4d553f", "value": "violetarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3213c57b-1946-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772792470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772792470, "uuid": "f12ab43e-2663-4b06-ac19-f126339e6ad4", "comment": "Malware payload (Smoke Loader)", "value": "ad627456a723f79d77ec50e3ddffd133", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772792470, "uuid": "bfe7f1f1-573e-45ce-bba8-911f73b9357b", "comment": "Malware payload (Smoke Loader)", "value": "215e8de734ec872836c1b451178b7f54e4f3c366bd5b48e9e9cea3a9d1b9c16a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772792470, "uuid": "03de73e7-08fe-4e27-8093-e0ed44da1787", "comment": "Malware payload (Smoke Loader)", "value": "47e88a207a05a83bec17bafdcfae71eb1e5391d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772792470, "uuid": "35012c11-3120-4e7a-a832-d49f62446630", "comment": "Malware payload (Smoke Loader)", "value": "df7ae9275616cb49ed7074241f18d0cd03ec7368e889e3c3cbd5026057b3cab27eb5087a8511ff06e80bd3e4f900f683", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772792470, "uuid": "6d57634e-906b-45c7-9fd8-56096c295f99", "value": "T13BC529537E91C9A8E19EE339A9A22182BA74BC4C0B3137D71F412B751E773C0593A72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772792470, "uuid": "e2134d81-5ee7-4935-b46b-c1962bf8f1e7", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772792470, "uuid": "72bff37c-8322-4a4a-95b7-fb3643d88875", "value": "24576:rtZzem/y+4BCYe+B85HYA+1+/XkmPSSSaqhelet29m9cQXWrb:rtRem6+JY3B89YA4+/XkSnaq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772792470, "uuid": "bfa592d3-e331-4f9d-b975-28a3311f9628", "value": 2707968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772792470, "uuid": "36893bcc-0a31-4fad-9358-b58473517f2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772792470, "uuid": "2d969ed2-dd22-4a57-9487-2d9225d3f6bf", "value": "215e8de734ec872836c1b451178b7f54e4f3c366bd5b48e9e9cea3a9d1b9c16a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13966449-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772811317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811317, "uuid": "47d70fa1-7783-430d-977e-090bee9ce4b2", "comment": "Malware payload (Formbook)", "value": "2aa41e684b747969da47764890d4a1ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811317, "uuid": "e34cfa6c-5189-4d7f-b708-5522e153de7b", "comment": "Malware payload (Formbook)", "value": "2175b1210756dfc0ba7e02003350de625bb832e4b7bc1e6d1ae945d87593ffa8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811317, "uuid": "7cf9cc93-fb0c-41a3-980f-d60bdc39d7f9", "comment": "Malware payload (Formbook)", "value": "faf8115c06900d21262a9e644eb574cd66f233e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811317, "uuid": "4a82562a-fb43-4b8f-a06f-08c758943691", "comment": "Malware payload (Formbook)", "value": "3451232fbe82298e81d8d7fd24e5b550acd6df3869e1c4f6acb9efe98f963ee20d98946a90dffa0a59963cb4dce3a3c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811317, "uuid": "1dd33551-99d9-4a4a-808c-9b104d43c1bd", "value": "T1698412216264DC97DAE205300577AAFFEAAB4DE89061A3471F443FA73C31AB6540F793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811317, "uuid": "e00cc31f-724f-4eea-8a53-37450a5d2c6b", "value": "9a16e282eba7cc710070c0586c947693", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811317, "uuid": "4a02024e-102b-4068-bcd3-18c788eb6756", "value": "6144:1fYBQgD3HSlhoMfJvL4AScFzwXlYsWbrz3kNpX6gbFC+0WW0h8V6DxzP+XNF/Z1h:aQkSlLJecaVtWWjFrJg6BmZqs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811317, "uuid": "b04c5303-a5b7-45dc-9bba-8c96da369fff", "value": 388400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811317, "uuid": "51294e16-c99c-427b-8e28-88ef4ebde21d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811317, "uuid": "54b0bf8d-85d1-4dc5-bd71-4666822cbabf", "value": "2175b1210756dfc0ba7e02003350de625bb832e4b7bc1e6d1ae945d87593ffa8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05615a14-1946-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1772792395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772792395, "uuid": "1d2cec7a-e1e8-46ed-b3d5-14bf07830950", "comment": "Malware payload (LummaStealer)", "value": "8d3221aaa4e43dec4d25b67adfa48823", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772792395, "uuid": "663cf882-5d6e-4d2b-96c5-1a5f3b842d9c", "comment": "Malware payload (LummaStealer)", "value": "21fd32c7e7fa106466bcd80bfc22263be9b415a583daf4f3f9a698f7d1aa9f46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772792395, "uuid": "430d67f8-f1c5-473a-b463-29d6daa79391", "comment": "Malware payload (LummaStealer)", "value": "afd50825bfaf0cbaf45f4e8dafe0ea8b6de52552", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772792395, "uuid": "0fe3e871-7615-4920-a12a-1f316d2e9eb6", "comment": "Malware payload (LummaStealer)", "value": "2c039560bb9a4151311c8fb006e20ec600916a6b5e818c5093e3b8425787423ece247778cee54268b90bd783c69d8ed9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772792395, "uuid": "93284cfb-ce7d-440d-8401-dfc278ab8a9f", "value": "T18606E171AEEE2123E5CE32B084947741AFB5F8D997C10196F9E83B564C3544A3F3B826", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772792395, "uuid": "8a30aa93-915b-48f2-ab9f-a21d60cd6d1c", "value": "98304:362OQrAiKQGBc3dMZ+1+SDCJB15Sr+uDT1O5O1q1SW8qrp:q2OYGBi+BJB15eDUmSr8qr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772792395, "uuid": "c28270ba-d7aa-4ba3-95c2-981931e51d45", "value": 4017152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772792395, "uuid": "6ddd0058-29fa-409d-a13a-b21fb1a0246e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772792395, "uuid": "5fc3a780-31ef-413c-a4cb-9a6dc7a8a273", "value": "21fd32c7e7fa106466bcd80bfc22263be9b415a583daf4f3f9a698f7d1aa9f46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a76ca2f2-1972-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811565, "uuid": "1d80d4f1-ffc2-43e5-aa21-c82b2062a6f1", "comment": "Malware payload", "value": "0b668c6eb859c11b40ca1e3a2598fdc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811565, "uuid": "e398e068-ff5b-4808-81c2-76be3fcfda58", "comment": "Malware payload", "value": "2208c2e697533a9bc14697830eec988f9c95fd90bd56b03d7ab78e45a15dad8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811565, "uuid": "8e18143b-df72-494a-81d0-1baeecfd6cb0", "comment": "Malware payload", "value": "2a77fe211a43021a00ac7050a634c849b9e53510", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811565, "uuid": "613ef31b-65b5-43ab-a270-4a4b9ba0ae6e", "comment": "Malware payload", "value": "c35ee1d0d4b85ae65341cafa7301903be6e4fc38ce3bc0f14bcfe3da3cfb733a7cf9c1a08e77b604739fd8a1fe17dff5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811565, "uuid": "061eb0ad-838e-4a6c-8a31-ef661de9f38b", "value": "T18194E812E6507426F99749B03D79A256742D2D362A40EC0BF78D9F4A3B71683B0F932F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811565, "uuid": "6f7e5aad-7eb6-41e2-a0ed-87722b998fd8", "value": "ada24baf6095c39810b12ea76fa114d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811565, "uuid": "34ad628a-0490-4c32-b50b-731f92f87c85", "value": "12288:ubqbz+OurJvIxBrW0Et6QKv9+IlkvL6rRmzRyXSy:u8v99+Ih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811565, "uuid": "c756a2b3-9f8a-468f-9eda-9eec05751f4e", "value": 417792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811565, "uuid": "9a72c79c-44f3-4e68-acc5-3e26a4048aa8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811565, "uuid": "4c7ce08d-f95b-4305-8c7e-fb096c8058f5", "value": "2208c2e697533a9bc14697830eec988f9c95fd90bd56b03d7ab78e45a15dad8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1d08dfa-1969-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1772807797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807797, "uuid": "34e380a2-4454-47ae-a6b1-e09051ae7404", "comment": "Malware payload (SnakeKeylogger)", "value": "12c611cbb592ead587a308a2add0f42a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807797, "uuid": "1a19b0a3-fac1-4f8b-bd5a-d46ba7f0bbf9", "comment": "Malware payload (SnakeKeylogger)", "value": "222f7e11de06bf254381e704d4f100646e109cf4b1633acc8c982c39ba58a4d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807797, "uuid": "97cd8265-0bc0-4e67-987c-be9ab45e5430", "comment": "Malware payload (SnakeKeylogger)", "value": "b2bedd8d592b05536b2d398dfaca579dacc1fb40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807797, "uuid": "1a6af3fa-88bb-4f7b-b472-7ec063e74daa", "comment": "Malware payload (SnakeKeylogger)", "value": "5dcb788e817dd5a512ff61f8f00a4aa30886b6ae2fd8d64467b437b59941afcc513f9597f7600510cc1d83f098046f32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807797, "uuid": "02daa11d-3337-45ac-ad1a-16f9fcae58c1", "value": "T1ED35124E7779AEA1CB1C0F77D893654882E5C456C272F34A04D95DF20DAABC8C64FA83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807797, "uuid": "fd3e0dad-dbf4-4a6f-91bf-ff11d0dca7b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807797, "uuid": "b375f67f-8261-41e8-aa07-328503dd10b3", "value": "24576:09dUpFS1u8p/iTnLmrL6QGKqgxbgVxL4hg6DHHX6ey33Varh9CJ4Sh2:2aLS1u4aaLegGPkg6r36ey33YXCth", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807797, "uuid": "37298c8b-c5dd-4ee4-8768-b1d6b553f7d7", "value": 1103872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807797, "uuid": "4c022449-d250-4c5f-8c21-01f215de1de9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807797, "uuid": "7e5c4eeb-885e-4067-8a87-6ca545310c81", "value": "222f7e11de06bf254381e704d4f100646e109cf4b1633acc8c982c39ba58a4d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81b35ce3-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1772808924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808924, "uuid": "bfb3aa7b-4cc3-49c3-bcc2-a08d1e131793", "comment": "Malware payload (GuLoader)", "value": "458a218ed3ea4b86e96b6aff45067cc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808924, "uuid": "1179d959-b637-4bd6-8b05-e8d104c53094", "comment": "Malware payload (GuLoader)", "value": "2252c8e8cbf72fb0185c8ea1dbde6551898307e8fbbefb031f26ceff869c60ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808924, "uuid": "e799445f-efc8-4d48-9527-b0fa82fbdca4", "comment": "Malware payload (GuLoader)", "value": "fcdd4c75fd9fda49d7f4b341a9c2887856ed93ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808924, "uuid": "5de0b431-a4b6-4d5b-90da-6b637ccb3371", "comment": "Malware payload (GuLoader)", "value": "80dd495a833de4b69d13891394f332b06571b761d06b7fb473bdc2c077cf39d66cffadb237b3bae26d4bd2594eddb949", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808924, "uuid": "4a90649f-4c4b-4b6f-b1ce-279d5464aaef", "value": "T112452310B6E0CAF2F5EB0F304AF983E5CEA6ED81555452069F093E5BBC375F1640A647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808924, "uuid": "37f7a303-608f-4bcf-94e8-7fa086411f05", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808924, "uuid": "cc21c771-80f6-45a2-81a9-462adc07ef69", "value": "24576:TPd0EGusLgaADxjugwJ0AohkQasxHLBhBaznGLN05TWa8Qtoqu8qp:phSAa0Y0HL0zGLNeVtFG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808924, "uuid": "b1e4af7f-2d1b-4741-a825-a6eecef2f0a4", "value": 1173224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808924, "uuid": "0916ae97-3760-4513-a7f2-e34cab46522c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808924, "uuid": "971f622a-a7a9-4ebc-a5ad-920c64acec83", "value": "2252c8e8cbf72fb0185c8ea1dbde6551898307e8fbbefb031f26ceff869c60ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e29cdabe-196b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808657, "uuid": "8402127b-8bf8-4a52-9bfd-b47e3b180130", "comment": "Malware payload", "value": "1db57b053ffcf1ee4e918cfd53c4d39c", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808657, "uuid": "2858f1e7-4b6e-454f-ae24-03583f49e3e3", "comment": "Malware payload", "value": "22dc7b5460c050320680cd2164360acfc4f63964978bec1a82f66451dbcd0c82", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808657, "uuid": "864111c2-822e-4483-8b84-9d43b7bfc921", "comment": "Malware payload", "value": "828ba3b0d1d8cfb10820b9a310a3dfe2dfbd158a", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808657, "uuid": "692d3b1d-e5eb-479b-87f4-05eeb6c4b6ad", "comment": "Malware payload", "value": "391cf0c4fcbcd0205b8f78600a45f65b65974900881a29b16f8bcd8892b60a8c0d997bc67e806a630eb7c7775f093225", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808657, "uuid": "146b018b-2cdd-4483-bd9b-574f75ba384f", "value": "T1F8A5338B6994CD03DA23933900624633E055B0AB5D6F7F6F8EE5421FB9F74E23A16748", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808657, "uuid": "089f8c65-0e83-4bbb-bbaf-83e2b4f7b410", "value": "49152:6R/+91nDk36I9wizBREQ/SgzsaUVWfdHnu16lHUY0tggx:n91DXWFAa3fFue0YQ3x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808657, "uuid": "05bcbbd0-f6f6-400e-9a3e-d0851003260e", "value": 2244958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808657, "uuid": "a7efa73c-ef63-43a4-b84a-067a969f484c", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808657, "uuid": "abbb70b1-6d58-409d-89c1-7bafb335be95", "value": "groaxbaba.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a76a7e0a-1929-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772780211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772780211, "uuid": "7c4fdc3e-fbc0-41c2-b42f-1b773205af52", "comment": "Malware payload", "value": "ca8ccf8cacd0afb5a82cacf18df507ad", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772780211, "uuid": "0dbddafd-d2e3-49eb-8a76-1856e24b79b2", "comment": "Malware payload", "value": "235b25b7d9cf6f6a7ef4ab6740404f7a9656b8b7c3242f48d9a4e0076ccb196e", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772780211, "uuid": "e20fe4c8-54dd-4a60-b779-88c8d8eefe06", "comment": "Malware payload", "value": "d111ed2c478c3cae11cd813480e2d496f18e89d8", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772780211, "uuid": "5e03e0dc-2fef-482a-abca-56b1e8a78e28", "comment": "Malware payload", "value": "3dbc0dd13005c28f01e13a4caf1574b485a0062b3d07144716ff63e7f27d91a4fd059ae04be576b02577f87a03fb27e8", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772780211, "uuid": "6d626c74-70b5-46e6-b849-e2d713ec6b76", "value": "T1FC24BE142C05B95847B8445AEDAECA32DBD76613C4217C063A9F34A12FE732897B3DBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772780211, "uuid": "079d2c7e-6050-4918-b57c-aa9de2a0a3f4", "value": "3072:kRvl6/4zpywzjGXbv8bjLk5CJS2h5o++kY10u/vV5qGOcoy2PK:AS4zlOrN8JzT+F10unXqK4y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772780211, "uuid": "d0a49bd7-5b22-48c4-9c72-02d5e0a2ae5b", "value": 218215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772780211, "uuid": "5ed5fb1c-7644-488e-b9f9-bced87486cb6", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772780211, "uuid": "d832976f-0075-491b-b461-71922c7f7b95", "value": "Protected (2).py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8c67fcd-193d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772788938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788938, "uuid": "7c569ce1-d8ed-4d9a-ada2-7ccbd6fa465f", "comment": "Malware payload (Mirai)", "value": "07d58afc18a9c0e054233da4425445c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788938, "uuid": "642219e1-aba9-4682-bc92-f0c0a491144d", "comment": "Malware payload (Mirai)", "value": "239945186e89ccc7255beffce0d329061a3d2e472a2183aa4edeb04be5045cbb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788938, "uuid": "a6d7f669-218f-4f24-8332-ce4511cab93d", "comment": "Malware payload (Mirai)", "value": "b0a9f3e5f76c9196c8e014768c1c82d3f0de130b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788938, "uuid": "c9acd16f-1209-4ab9-ab5e-1a575244bfe0", "comment": "Malware payload (Mirai)", "value": "c7cb86c94802d1f50b945e008e241707b5fca23c22c6fea7721e385bef128adbae07a6b236961969eb3319e886e7bc78", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788938, "uuid": "9f0f524c-cdc5-479f-a2bd-4f6ba47ce1ff", "value": "T1CB6302703719EC3A22A09D72FEFC8656566E09B1E2BB51331D60DAA93445D89248F3A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788938, "uuid": "82928d03-c179-4108-809e-aaadd1961693", "value": "1536:xee5+Hx/E/1RMXspkac4fxCMLOLDzLJsP:xL5+R/O1dkiwMLO/zLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772788938, "uuid": "9e503a6e-7b2b-477e-9584-352a912df401", "value": 67192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772788938, "uuid": "e7f0edc0-53cb-481e-86d4-e13201d5c9e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788938, "uuid": "efdde0d0-1ef3-4653-a232-a354a4e06863", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b47069b-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1772811303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811303, "uuid": "e0eb4021-755b-4d1c-8258-4b5496b0e6e5", "comment": "Malware payload (DarkTortilla)", "value": "a4d4373d575da8723950a3a627253c38", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811303, "uuid": "2f9508cd-37d4-4c72-8a93-27a5caa2c243", "comment": "Malware payload (DarkTortilla)", "value": "23c50a813e364b3dc9a7dd6a496e463fb8e0f3de3d590401305b32cc61741849", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811303, "uuid": "2beb5b53-2b28-4228-8246-800a53d3c1fe", "comment": "Malware payload (DarkTortilla)", "value": "2b24bd164d232df610f29bffa0d6e9e0d339e00e", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811303, "uuid": "3b79cbdc-0ed1-46e3-b468-2890cdda3fde", "comment": "Malware payload (DarkTortilla)", "value": "5d7db8e43cd4ab96916c7f018b3011837749570d18f583f5c30a065e6589a46342ddf138247edce6de4753512726d72a", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811303, "uuid": "18b18492-774a-4639-8881-4ca4c20592e3", "value": "T13E35E11A0DC36A64C1A98F38D27504E863F0C65B5252F3AFAEDD42F4DE57B8ED902493", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811303, "uuid": "252caf84-4022-4f5b-8e87-b5355fe0a382", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811303, "uuid": "b84b5255-c97f-4d97-959a-b6f59692a976", "value": "12288:rn0rM3IrmN0Nw1HBY7sOft8VHrqR4SKGjyYe4xlryvQ3Nn+dJad90zoJlq+:r13saJ1a7bfJRe4xl+vQVbd90z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811303, "uuid": "c9d80d69-1d99-45a6-8b44-751ef4883321", "value": 1133568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811303, "uuid": "3bc8b3b8-ef79-4a30-9556-80e138521dbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811303, "uuid": "93cba949-3971-4399-9e32-c1944a8a5450", "value": "23c50a813e364b3dc9a7dd6a496e463fb8e0f3de3d590401305b32cc61741849", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e7b646e-1969-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772807630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807630, "uuid": "9d03a1da-acd5-4795-b00d-91ac0166fd57", "comment": "Malware payload (Formbook)", "value": "70aa389f7f478d6632d95e7c9fd31a80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807630, "uuid": "1ce69b11-a8a3-4669-9017-2c0969bab07a", "comment": "Malware payload (Formbook)", "value": "242dedca69c062e566588f42ecdc7e7efc9f37d06eb5793af59bb956c53c72b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807630, "uuid": "ff43a936-7838-452c-b0b3-fdafba95580d", "comment": "Malware payload (Formbook)", "value": "a22c38b7797cb3fbf3c7b879328662ebed6307c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807630, "uuid": "a27a3096-f12f-48ce-bc4f-96dd3fc5150e", "comment": "Malware payload (Formbook)", "value": "7ab595ce5baaa26a7e59ec5e4757840654cdcfe40b0828cc3fe253fa7779f718e613e9e236bee08adfe76b90a4365a42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807630, "uuid": "c704d80e-01ee-4403-8e51-c844e57091b9", "value": "T1BC35121DF7786F11C71C4BB7C8136501A2E3C066D633F34A99CAA9E50E36789CA8E953", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807630, "uuid": "256af8a0-c232-44da-9b74-1d01778852dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807630, "uuid": "17beeb2e-b481-48f8-8afb-f5843fc1c573", "value": "24576:eswtVsPzThH6Ne4r5mle99Y8KIymCVnW7pbjQYQMVKS:rsVsQNeXlbvmCVnW7JFbV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807630, "uuid": "cf0fb827-a92e-4e0e-bfb0-876bae3dc6af", "value": 1098240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807630, "uuid": "130ba1cb-3410-45fa-a1fa-9db49164458b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807630, "uuid": "c874af5a-c9c1-4f8e-aafa-900e2459cc2b", "value": "242dedca69c062e566588f42ecdc7e7efc9f37d06eb5793af59bb956c53c72b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49f14c72-196a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807972, "uuid": "627bdc0c-2267-4b8c-8378-b87f242fe358", "comment": "Malware payload", "value": "8f5465c495554e91524240c6de4aea7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807972, "uuid": "84d7d7a4-34cc-48df-9367-396499d7bb3b", "comment": "Malware payload", "value": "244164b09f351a3a6cc61d957423962ccc6d14aeac94068068cb49265c05f918", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807972, "uuid": "c0902d1d-1afb-456d-9a53-169af348fe7a", "comment": "Malware payload", "value": "81b37fcdc3f8f2ad4671fe4f743badbb908f6004", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807972, "uuid": "5649bbc6-b553-4b1b-885e-5be5423d4f24", "comment": "Malware payload", "value": "180f17fa12adcc6d2e2e858372955ba2a9ff5601332a10cb89d7d6e965de060dc1dce7a2ca40986307a2b963bc7a3942", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807972, "uuid": "8d396aec-e74d-4d57-baae-2776748c54c3", "value": "T106151202B350C82FC4A307718976F2696774DD50AE921B4723C9BF6B3D72792D90A36E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807972, "uuid": "a352d215-0cc1-4d7e-9fc5-5fa02cd9fa5d", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807972, "uuid": "7ff33f42-b5af-4e34-8385-bc41b94e2ead", "value": "12288:fRpRwOvZXDEuJWXGEk5G0kf+5u47dm6+CHSy7+8892YTQ/Ue1Txon6dB9mf0+5Cs:fzO4zEsWmG0aauYyQ89PMUmTz1+5V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807972, "uuid": "d1ca94eb-4a7d-47b8-822d-4a9ed3e3726f", "value": 940968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807972, "uuid": "07b39757-4ebb-40a2-abeb-68701eda4f0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807972, "uuid": "8527cade-fae6-403f-9eb2-7e9313f06dc7", "value": "244164b09f351a3a6cc61d957423962ccc6d14aeac94068068cb49265c05f918", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa7a4d31-1983-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819005, "uuid": "a30e9dc6-62e5-46eb-862a-5302ad95fcf0", "comment": "Malware payload (Mirai)", "value": "6e427110113f65ab8aa3cd81bacbee09", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819005, "uuid": "d74d80a0-4177-496e-b8dd-f13f31529873", "comment": "Malware payload (Mirai)", "value": "248474467abab21e8d2bb6421bc36318ed8858dabcea0d89a521d9127f47dd6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819005, "uuid": "a0275344-e13d-4d3b-868c-647a4cac094d", "comment": "Malware payload (Mirai)", "value": "74609c9da104180137a6f40f8b30132cf76d0d43", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819005, "uuid": "3325f159-3d2c-4687-8c9b-aacbeb542ada", "comment": "Malware payload (Mirai)", "value": "0d7af0bc15e4ec99c7d9cd9be272113be2c1dcf466c57283e05e84af158d9f306edeb2309674eeb051bcd8a3e013e71f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819005, "uuid": "6e5f0006-806c-4ae1-87c4-ea47b1bcf8a9", "value": "T196936D02B70C0E43D1675DF02A3F27D1D3EFA6E121F4FA88791E9A8591B2D361586EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819005, "uuid": "fe7ec438-9612-4bda-933a-efb3599c13bf", "value": "1536:J0kTGvVuQTzBrwJi9Ma5xuUugrdCzG6dp4qKLHh/G2MivyC/r5jugk4tJm:J9O5T/fCi+4qKvMxCRjm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819005, "uuid": "db71adc5-96a2-4b90-a697-cfd98550a3a0", "value": 92048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819005, "uuid": "5a3b4dba-415d-4844-9f3e-4f5c80c912bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819005, "uuid": "973d7548-3144-47a7-9621-a2905886da83", "value": "jawirbot.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d85b54d9-1949-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772794037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794037, "uuid": "3c7823df-7021-466e-acd1-614246d78d82", "comment": "Malware payload (Vidar)", "value": "6e17b665c5e7e4ad3bde127b2cdbf54a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-OpenClaw", "colour": "#525D1F", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794037, "uuid": "21f8a6e0-0437-4607-b5ce-19dc01971a62", "comment": "Malware payload (Vidar)", "value": "249058ce8dc6e74cff9fb84d4d32c82e371265b40d02bb70b7955dceea008139", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-OpenClaw", "colour": "#525D1F", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794037, "uuid": "36ce2afa-f02f-445d-b216-e808c4395404", "comment": "Malware payload (Vidar)", "value": "a26b3a264022d2228e39d78b6720f9e80c984265", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-OpenClaw", "colour": "#525D1F", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794037, "uuid": "68a57762-d454-41a3-986c-7974bb8e6c73", "comment": "Malware payload (Vidar)", "value": "1f99199fa88733b15b6e9ff5aac9e24930f86cd5e646ec9755d4a24efe06b6715cf8cfeda73505376fb8d8d02683db14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-OpenClaw", "colour": "#525D1F", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772794037, "uuid": "38aa02ec-5713-48b6-b37f-cf002bb371f0", "value": "T199282202BA5B2968C15EC8B0D2474A934F3130DB123AA5BF50E941743FAF7B49B3E795", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772794037, "uuid": "74a4fd22-d44c-4aa9-9993-1a45f2a58555", "value": "0e25cac53c037625c8c4fabe299d447d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772794037, "uuid": "325f069b-ac30-474f-9ec5-b52a2373218a", "value": "1572864:qFGEyIUeSLAs2d2MhBGUhXRS4XlGn0fXt8wrmjWVhEZWxQOPX745pSs97FtrZFfK:+pyIY32VhEUhBS4XW0fXtwqhN+H5pJ9b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772794037, "uuid": "f4082c19-20aa-4c5f-a8b7-d7b8bb64c716", "value": 94364160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772794037, "uuid": "6488260f-0019-4797-8dd9-771cc2fffad2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772794037, "uuid": "57f77ce7-d346-43fd-82d5-dfc4e4006552", "value": "249058ce8dc6e74cff9fb84d4d32c82e371265b40d02bb70b7955dceea008139(1)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0527aa83-1959-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772800555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772800555, "uuid": "a5123eba-0bd3-45b0-9306-ecbcc63fa73c", "comment": "Malware payload (NetSupport)", "value": "61e605628915d2cdc3e0d35d53efe2b0", "object_relation": "md5", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "PenguinsLocusts-com", "colour": "#8F752A", "exportable": true, "hide_tag": false }, { "name": "redbegonias-com", "colour": "#73EAA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772800555, "uuid": "ebb17578-0184-40d5-8351-be5933a4981b", "comment": "Malware payload (NetSupport)", "value": "24acf01252890d6616f00e222560f2d2f2796aeb8b26c916222b35c071454c8c", "object_relation": "sha256", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "PenguinsLocusts-com", "colour": "#8F752A", "exportable": true, "hide_tag": false }, { "name": "redbegonias-com", "colour": "#73EAA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772800555, "uuid": "fd9b09ec-de61-44cd-8350-29df92f27e90", "comment": "Malware payload (NetSupport)", "value": "80bd31ab49d3111d33eff8a2f2d4c880472c1f58", "object_relation": "sha1", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "PenguinsLocusts-com", "colour": "#8F752A", "exportable": true, "hide_tag": false }, { "name": "redbegonias-com", "colour": "#73EAA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772800555, "uuid": "8f6c9875-d19a-4339-91d2-012bbdd5e0e2", "comment": "Malware payload (NetSupport)", "value": "50224495fe78b978dea2691f539b986cc1e21106df22a3e84877910293e9769f09d3d6df3f00cccde763122df8c2e952", "object_relation": "sha3-384", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "PenguinsLocusts-com", "colour": "#8F752A", "exportable": true, "hide_tag": false }, { "name": "redbegonias-com", "colour": "#73EAA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772800555, "uuid": "adedb051-95bb-4dbd-a0db-f61588f0932a", "value": "T1C7D533F56ADE60B1D81CDE3E2F9D53281ED0FC558DE432EF95E61F49820072DA03629A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772800555, "uuid": "3af818c5-715c-4e0c-a095-f05446cd6a3d", "value": "49152:r0AEWQiHzNTEjKW4ZYnir6iOUj/UP/ErtHEUoN/nNWbvU/wIT9no4N3wrHL2xi6G:r0HWQUZ4WbrG8UHErLohEbc/w69noY3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772800555, "uuid": "b91ac061-c67c-4199-ac69-7030dc211967", "value": 2985970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772800555, "uuid": "d77104e0-44b6-4dcc-b124-1a4042584973", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772800555, "uuid": "abb4e631-6c77-4edb-8d21-f5e5c299160e", "value": "24acf01252890d6616f00e222560f2d2f2796aeb8b26c916222b35c071454c8c.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0516ca0c-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810863, "uuid": "36206442-6c0a-43ab-8020-eaef3d69a792", "comment": "Malware payload", "value": "9d3c4925a3fcead7c74aaf9ed001af94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810863, "uuid": "8e670774-f08c-40f5-9687-6e9f8d935f53", "comment": "Malware payload", "value": "24de848413379c2fdfd7e2b9c54c5529d8cca71b853e1700e5307896e952353e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810863, "uuid": "dffbdbbb-3a75-466d-abdb-94cc1ff330c9", "comment": "Malware payload", "value": "8d2b9e9f16d38bd6823e2d1535313062fa02101d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810863, "uuid": "e96dbcce-2d1e-4f9e-98cb-171d456ce161", "comment": "Malware payload", "value": "c4b86a3159f636e169bda082189044425dfc5ca4e50bcda979824a58008a0ea0048d55935a5ad51fc2c7503fc710b0e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810863, "uuid": "a68fbb95-f0b8-433f-8cd1-b014d3996973", "value": "T1DAC4230857A14423DA130E751D7B592AEFE6EF526428678357008F9C7E237A2E4AC3DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810863, "uuid": "a78e052b-7b59-4357-8254-f61e57dec922", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810863, "uuid": "5935db80-55f5-4db4-8c8b-8ab83962f6c2", "value": "12288:21yDJT9L6c3vydE9Kp9n2ymJd05EWRwFYkZ2ENPha0E:21yDJIc9Af2ZJdWzkZ2EPHE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810863, "uuid": "60244fa3-41f8-4e10-b12f-9dc12a948e94", "value": 583352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810863, "uuid": "6c025583-e0b2-4ab2-987e-d36ee77a274a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810863, "uuid": "1e6891f2-5f74-446a-a5a5-09384ced10d2", "value": "24de848413379c2fdfd7e2b9c54c5529d8cca71b853e1700e5307896e952353e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f625f50-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772808974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808974, "uuid": "840b6fc8-4efc-493a-9ff0-ea352cab0e42", "comment": "Malware payload (RemcosRAT)", "value": "5a6d62ea3a2e2058a66a03ad2dc8ef89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808974, "uuid": "d1f9f485-bd88-40a8-a7de-384ef03b55dd", "comment": "Malware payload (RemcosRAT)", "value": "250c53b26a89388b4d85e6fe3751c900a4def99755b4e4605fa5cbaee1489257", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808974, "uuid": "52289ff0-83b7-4c92-8213-89ed83781c2e", "comment": "Malware payload (RemcosRAT)", "value": "0af2b662e0a317fef201ff8e4d0977ad45c3ef8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808974, "uuid": "6f707279-0d57-4899-83a0-fb57a0e16ed1", "comment": "Malware payload (RemcosRAT)", "value": "542e18a65f2224877fbaf40372dba99636232db371ca21f930fee10f4f3cd1430200fbe3e122911813f881d25947d68f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808974, "uuid": "5471dbae-d4bb-4548-81b9-2d79c570a51d", "value": "T1FF84F24BEB1BA910C2858873C9F149FBEB706D53A495083E3352BF1A8D3568ACD1917F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808974, "uuid": "a0c4fac6-53ec-4a2a-9a7f-1fa1da9869fe", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808974, "uuid": "0c8c26be-5cf9-49f1-bbf0-70fda0ac8a79", "value": "6144:7NDlOLZLClTgENs/+OIWHaMiWeqIf83XdDKMuCJX9nZb:7k8TgENs21DVkZHxJnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808974, "uuid": "4cf99494-9acb-48a1-922d-2ff8b0b73de7", "value": 395872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808974, "uuid": "e7f1e743-d1cd-43f0-aef3-935fa5bab2f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808974, "uuid": "59e9c658-7d26-4e09-9645-2a012ec077b0", "value": "250c53b26a89388b4d85e6fe3751c900a4def99755b4e4605fa5cbaee1489257", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73c528da-1985-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772819638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819638, "uuid": "a70f51fa-2011-4ac4-92d5-60033cacb220", "comment": "Malware payload", "value": "12f8ffd83a1f4be008f640b46f119625", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819638, "uuid": "07c6bfe8-a46b-4ff3-ba26-87b6316a43f6", "comment": "Malware payload", "value": "254d43c932647cea4d9ae0979ee9c20d59361b07f3defdadf4bf9caa9f2f9c69", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819638, "uuid": "535c014a-37de-474d-860c-6f6c6162baf9", "comment": "Malware payload", "value": "e44bc641ef24371b5129750e2c4ef4034f12e988", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819638, "uuid": "85d4f478-a11d-4578-befc-c4ae91983c1f", "comment": "Malware payload", "value": "6ee9fc42921ad136c59f3290174daf8cc3ba3420d52b0c8b71fb9134fbb1c587ee1b77f8160703536837536cca14300b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819638, "uuid": "dbc90484-e3d3-4bea-80e2-0eff3b99b3c2", "value": "T1C80197077123A2B0570F00318B8BB1E0B11A391FA4118E2C3E89A5387F22489BAF66C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819638, "uuid": "07eb8c00-a273-45eb-bb0e-6d65a35e67f6", "value": "12:AzCtih/3HMl2RHj9OEww6smNbBzNRB1fbdDkzlMUm9SksuIq1+jrMyms8Magzq83:AzCtipM+dwDtzbDRkzlM+kNIq1+rms8u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819638, "uuid": "86fe17a3-125b-4b06-96a6-385ebc606c7c", "value": 724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819638, "uuid": "0caed6d2-92f7-42f1-9453-5d4042f14bb2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819638, "uuid": "b9f0d932-2006-4034-8889-f962f6a6440d", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8947c390-196d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809367, "uuid": "1492fbf5-4188-4fb2-b8e4-14ac77fd1f18", "comment": "Malware payload", "value": "6233f318d3c065071db4acf309f4d70d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809367, "uuid": "9a3dc531-045c-403e-9533-2be2ea264220", "comment": "Malware payload", "value": "255e4827ae35c0dd2490699e7d0f9056c6aa35e43f63ed7d9ad9e25f4b7742b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809367, "uuid": "ee180712-a75c-4554-a89e-c107b5acc814", "comment": "Malware payload", "value": "d8679049f57e579508ccf1b96c31b82d9e2b337c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809367, "uuid": "7828c60e-cd0d-4a69-999e-8fe88bf87d0b", "comment": "Malware payload", "value": "9dbce79042ce49045d4e66676a9576284e9d3bd531df66606bb644b6ce623ee5388c0cfb09abdd20fb068d92db21b348", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809367, "uuid": "73de2ee0-fb59-4442-ac3b-b62a42a1762f", "value": "T11045D05527E84A58F4FE9F39257824540BF9BC679A3AD72D2A4840FD0C72F41EA21B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809367, "uuid": "64ed8200-4370-4772-a6a4-f6638493bf6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809367, "uuid": "7a648550-a03f-474f-93cb-86faaf161b16", "value": "12288:SpJyryKMR5ZKGszIMjy1j89CFnLT/N0HPNI0iAxxrKXBxoo1C7z1K0XGeglq7ehr:j+hpLT/4PPH7caoc71Xng07ehTwxZ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809367, "uuid": "199ddcc2-9181-4eea-8fb2-1a8f50ca143d", "value": 1188864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809367, "uuid": "2ef60a43-3543-48e4-b41a-a7fdc2baad41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809367, "uuid": "2154dc0a-2a77-49ed-997d-5e9c6e48e778", "value": "255e4827ae35c0dd2490699e7d0f9056c6aa35e43f63ed7d9ad9e25f4b7742b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9058fc1d-1975-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772812814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812814, "uuid": "b783d1dd-d907-42a0-9e21-48293ca72846", "comment": "Malware payload", "value": "dccb7c68a468d8d314735e82e1400ef2", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812814, "uuid": "cf3f751e-fe05-42d4-ba31-def3390ffac0", "comment": "Malware payload", "value": "257323ac48e09c2300074e6aa19e196705861266e6711a1eabcd5b2e8cefcbce", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812814, "uuid": "143b745b-b3a2-4d01-b7e4-6cfbe0b791c6", "comment": "Malware payload", "value": "5bbb2742040765d7dda813c7b096b491ded01358", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812814, "uuid": "d2d8f3f2-fc3c-4be6-9110-ab128c336f39", "comment": "Malware payload", "value": "3cc8979bb1e86d9f0ede2d2f99ef1afd7123b27192fda9b5007fe1e36bdc7c8b38ec8247e37ee06b0859918daf5f7d86", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812814, "uuid": "0b353f3a-1658-4c9f-9ba3-1cdc189f609d", "value": "T13A464CC4AAC886C4FC136C7576A0E0E4458D56E7BDC9E412E41F6EB5BEB20E1D4327B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812814, "uuid": "e35829c1-3c03-4a7f-be40-fc2397b6001f", "value": "98304:GatwRzzE4M66PCsFidNNImzeVhZvWZqPGKpKoJyiACk+9VkW1D+oLQOKHIiMuATe:Ga+4KNumSVaQPGKpKIyiACkCVk8MOjih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772812814, "uuid": "d88b130c-1454-417f-badd-e794af81a0a8", "value": 5871616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772812814, "uuid": "ef62ea1f-7d62-46e3-9f13-3008e2332b5c", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812814, "uuid": "de9e0d7e-1342-416a-8b38-6a78d6a475da", "value": "nPedido_de_Comp.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5562b244-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772811427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811427, "uuid": "b97b109b-8b4d-4152-8950-2947c6d7a6c6", "comment": "Malware payload (AgentTesla)", "value": "75c00d3d849035817bc0ae90daf2f202", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811427, "uuid": "71f67314-a21f-42c1-92a5-599a0fe69015", "comment": "Malware payload (AgentTesla)", "value": "259c9097a874797d7c06c733a96b81325ec2621a793b08883fb86583c1da4938", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811427, "uuid": "9a9db1d6-9fc6-4a37-8f35-225eb191ce7e", "comment": "Malware payload (AgentTesla)", "value": "0d23f9b04b268c8a6cd438ff1b49255df70c9fb4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811427, "uuid": "fb18957a-3dab-4133-b2f9-e44cfe2fa17e", "comment": "Malware payload (AgentTesla)", "value": "8d8b570c6b451c906982e199db68e10c334d50d4a565dcd5de8f5515fc15d00fbf33851735b23cd14745bccfe053d59f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811427, "uuid": "67212507-d117-4a43-b1d6-669e6a12e4ff", "value": "T19D35AE0273D1C062FFAB92734B56F6115BBC79260123A62F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811427, "uuid": "e9ada7cb-fc47-448f-900e-36f88f261bab", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811427, "uuid": "2883edc8-3b62-4f6b-80fe-45a1ab7b4064", "value": "24576:C5EmXFtKaL4/oFe5T9yyXYfP1ijXdaFU6KG/4h/x:CPVt/LZeJbInQRaF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811427, "uuid": "50a792cf-4ffc-4120-82c0-23eb0e2ed7fd", "value": 1096192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811427, "uuid": "e9be4378-4e2f-48be-9f40-e2453287c15e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811427, "uuid": "31fb5c46-f21e-4723-8f77-8d8a18dc104c", "value": "259c9097a874797d7c06c733a96b81325ec2621a793b08883fb86583c1da4938", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e47870c-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1772810690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810690, "uuid": "53947907-5cc6-4c31-997d-384881f41b2f", "comment": "Malware payload (a310Logger)", "value": "d1287aa8b662b5e863bc66146cc43082", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810690, "uuid": "5bfbc0c5-14c4-4c81-b2fd-6a990e693727", "comment": "Malware payload (a310Logger)", "value": "259e187f28ee2f16b1d7ca85c2d5df072926abcac5f6f6412db64739f75e6a45", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810690, "uuid": "97aea933-f3d8-4d74-bdf0-7843f0911113", "comment": "Malware payload (a310Logger)", "value": "edd49b3405c07c65b0d830e4fadd61dbca264695", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810690, "uuid": "a801654d-8e99-4a4f-b10e-a806df7781f1", "comment": "Malware payload (a310Logger)", "value": "62c9d1844391e33584e3f0197cfd962d8d57486a92aa7bcdb97419bdf6a887825b955fef927c6689d83566e44ff7cc84", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810690, "uuid": "c55e1729-f70c-43d5-a1d3-b4e5deac1efe", "value": "T1C355CF027381C066FFAB91334B5AF6215BBC79660123E62F13981D7ABD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810690, "uuid": "dbe2be7a-c0c6-4b77-88cf-fddeaa81972f", "value": "c1ce208b1192bfcf652c179f34f034d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810690, "uuid": "097d8f14-f971-4986-8bbf-eb59ff770116", "value": "24576:b5EmXFtKaL4/oFe5T9yyXYfP1MAXDzbRk0DmztpXFnfpT21opMT+:bPVt/LZeJbInGizbRFmzXFnfIO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810690, "uuid": "233965be-8af0-4e95-a81f-1bb18bf1c88c", "value": 1360896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810690, "uuid": "28a7efde-9ca8-4665-b89c-b8baae9fa118", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810690, "uuid": "1ee556cb-3793-4f36-8b6b-4af5d6d22c06", "value": "caf1a2035a70c0706188075c8096067059e8fd0d68247f6b0901c3f6299c1c57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c46492e-196e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809667, "uuid": "487cb4b5-8d15-452b-a6d6-dfc3759b40d3", "comment": "Malware payload", "value": "0c86f54e4aeb0b0daa8f5d8b2bc129bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809667, "uuid": "a0c71eb2-8c51-4d4c-ad51-bcd53a02f49b", "comment": "Malware payload", "value": "25a4cad43620bed0d9f072a240efa436a1bde1f2012c7c46cc434afc9bfc562c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809667, "uuid": "ec084790-a34b-4e30-a68a-3bd38207e6e3", "comment": "Malware payload", "value": "84d1692dfef41980df0edec3aef5698d518f2711", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809667, "uuid": "228bbab8-527d-4f25-a469-16dbf53366f4", "comment": "Malware payload", "value": "c34a0b971ed2329ab812f0160df79b30dd7729ccf42e5ebc8263847aa38c490115f75716f37f8687cc738862479acd76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809667, "uuid": "a5754ed3-102d-4a4a-86e5-11d96a259a3b", "value": "T13155125C229DCE03C4EA4BB91A62F13563B42CDEA426C3074EE5BDEB74757F408C169A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809667, "uuid": "145de31c-ee82-4dac-9cb8-532f0b5c6036", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809667, "uuid": "2f0b848a-6000-4494-9387-e72ffe7302e4", "value": "24576:C/lv3Ni9R6Ruyge3iY57+rwat6tSv/eCzIflDyzbCkU5:C/N3OR6EdY5Xat6tSeffdjkU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809667, "uuid": "43c117eb-7803-4ba6-a195-97010bd4ea26", "value": 1288192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809667, "uuid": "2a98b509-7538-48f4-b673-2b91f39ec390", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809667, "uuid": "88fe5d84-3f2b-4a95-8a97-08a71c8fbc3c", "value": "25a4cad43620bed0d9f072a240efa436a1bde1f2012c7c46cc434afc9bfc562c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2352a211-196b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808336, "uuid": "25f8add6-797d-4af0-9139-f068769c194f", "comment": "Malware payload", "value": "49132bd89cb433e2b43642438f06004a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808336, "uuid": "063339b9-55b5-42e9-b0c7-a5bf83fb74af", "comment": "Malware payload", "value": "25a6a285e6daea738af9a9130ef2d83cce8b123fe3836adcec25c7ec663b8122", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808336, "uuid": "af4a6456-8e1c-48a3-a3ba-fd7a2cee4fb6", "comment": "Malware payload", "value": "bbee278408c59b74e7cc75269d7fa7c62a6df116", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808336, "uuid": "7d31bf11-faec-4ab6-bb45-39f67eb84ac7", "comment": "Malware payload", "value": "5c68d388656ce8377c43152b66242dff66d993342dd65a96c6ee524ec6c6e50eb0a378f0b73afd86415023ac27c8c42a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808336, "uuid": "6845d1f0-6ca5-49b5-aedc-2f4f757bfcba", "value": "T1BA25DF1523E95B68F4BEAB799274156087F2F903E732DA9E7C8C41DE0A32B41C652733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808336, "uuid": "4ce7dab2-0368-4fdd-bded-5e8a8739c663", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808336, "uuid": "d790ca8f-e55f-46a8-b479-5540e1ed669d", "value": "24576:VK9oarVBo6tgNExj4DsXng07ehp3xlADcwvI:gccayE2gGehpBlADRI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808336, "uuid": "64d68aba-0d3a-4fee-a955-d367b58f7385", "value": 1049088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808336, "uuid": "f9de3189-3ba9-4b86-9e78-36296e7ad94c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808336, "uuid": "fc5f8540-2126-428d-976f-ea4de516783c", "value": "25a6a285e6daea738af9a9130ef2d83cce8b123fe3836adcec25c7ec663b8122", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e6a2ccb-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811013, "uuid": "5c25640a-3ee1-4c87-9899-8eeb4168c3a4", "comment": "Malware payload", "value": "a1347ffb64867bc36b6e0ff875596610", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811013, "uuid": "54b7933c-5a5c-4552-80ac-81290dbb8921", "comment": "Malware payload", "value": "25aff3a127f8ebeab3836fe96da24f33cdb3cb3c895cbea3457739ec4f0c6c75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811013, "uuid": "ae576209-70de-4973-afeb-8a70410581ad", "comment": "Malware payload", "value": "8e59ef1d14662fd7d8f5ef53e6bfa99dc1fcb612", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811013, "uuid": "94c35bcf-ff46-4a61-8c4f-63886730ea69", "comment": "Malware payload", "value": "4c4e5d4a555c7d8d8ca4c6e209f05cbd69e44cd080b58b2712a80fdfb2d0c9957471678f7ec94fee05f947ed3be693d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811013, "uuid": "f6285f70-8567-4669-8261-749f98430d9d", "value": "T19425E0052D826B05C56D1B38C066D4B863F0ED4B9297D75F7EC82EFBBA73785CA02492", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811013, "uuid": "20a0a161-5d58-4d86-b163-00156cd2bd12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811013, "uuid": "e384050a-52ce-45d2-b321-42883d4a658d", "value": "12288:ku3S2Xpghk3IrmN0Nw1HBY7sOft8VHfF8MY6Im/rW+HM1BBmNWfjfznJKEmkV:tMk3saJ1a7bf/F6IV+sTBmUfrznt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811013, "uuid": "6836a654-9bfc-4c9a-83a5-a4a8aa9c1d70", "value": 1004032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811013, "uuid": "4e163a81-d561-4dd0-9f53-951cafa9261e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811013, "uuid": "4f60729c-a788-4c1d-8e48-286f97904e08", "value": "25aff3a127f8ebeab3836fe96da24f33cdb3cb3c895cbea3457739ec4f0c6c75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "697ca19e-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1772810602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810602, "uuid": "fc3f8e06-fcf8-44b1-b082-6bab36ed17c2", "comment": "Malware payload (SnakeKeylogger)", "value": "a5d1f66fc7f632f3ccf15f45e3af7fae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810602, "uuid": "87918892-d792-4dd1-9144-f51b839553a9", "comment": "Malware payload (SnakeKeylogger)", "value": "25b5d87ca8be1bb9c42f128f46187a14f4a9701c3375d7395ded821d217dc50b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810602, "uuid": "273e36b2-8e1f-434e-b3bd-22be56eae640", "comment": "Malware payload (SnakeKeylogger)", "value": "da6b48b38c85eefed46ed9d283c3c70954bc72f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810602, "uuid": "88655f66-8225-475d-8123-4fa7b58d81ef", "comment": "Malware payload (SnakeKeylogger)", "value": "3cf9241f9ff7a80b2227430d0a73431f2dd80ac6f3b0b3b8ae8922be98c09da37df4f52d232b5144da97c2cce532d348", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810602, "uuid": "33b32327-6dd4-478e-8d5a-d217d79477dc", "value": "T17C2512A42215DE03CD5183B15AB0F6B91B7C2EEEB901D30A9FE97EEBB666F114D04143", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810602, "uuid": "e307fd01-341c-4e7a-9014-dc95432d1e99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810602, "uuid": "ee245b0d-6c4e-4bfb-b7d5-389043d8433f", "value": "12288:g3j2AR6xichB+Q0f6wo/7rF2IZyGPBmoxPVfeSNMCGo0kq9NHizLNZE5GbFbzFYy:Wj2a0BB+Y0G1VrMLNHMNZgInFP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810602, "uuid": "e060f36a-bb87-4667-8763-46f7868f897c", "value": 1020424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810602, "uuid": "7ee4c2e4-edd7-42c5-b714-f53f3a9b7501", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810602, "uuid": "9b70cd3a-92a9-4029-aa7a-985e48c2fa5f", "value": "25b5d87ca8be1bb9c42f128f46187a14f4a9701c3375d7395ded821d217dc50b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80573ac9-1984-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772819230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819230, "uuid": "8dfac892-4aaf-4169-b7ea-59244fb054b6", "comment": "Malware payload", "value": "61cfead1f7edd7c46d22eee50c78e5df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819230, "uuid": "b185355b-c3e6-445e-a00e-3855c1e219d1", "comment": "Malware payload", "value": "25c275bf1f30227120f5de93afa7a4f107151eac8f205c5bfb0228f7aa40aa42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819230, "uuid": "b32aa005-7a11-4bc4-8db3-a8f1678b3c34", "comment": "Malware payload", "value": "595cbcbdd15a91b5c75658beee4680c195d575dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819230, "uuid": "d2f00b9d-6992-44ae-983f-5e1e159091f2", "comment": "Malware payload", "value": "b8fcb930933c802a089f70c303be0688c6b63a0d57b3278bbd08a5a955375dc6345fbed268e1fea921e7f59543674478", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819230, "uuid": "2d468537-8db2-46d4-9134-bf589614164c", "value": "T125C22A74BEB74D6BC485B171B1EB8318B2F6534E28F55E2E3C621ECCEF449142212A79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819230, "uuid": "8ca101aa-df62-4480-b6bb-aeeb6af3a5b7", "value": "384:fVGYJBJ8sJu049kJ1zjpXn8FU+f/NlhyKC4:d9J2049yz9MO+3pyj4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819230, "uuid": "00844f74-88d1-4769-aed2-11cc3a7fe754", "value": 27160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819230, "uuid": "8603698c-4e2e-4066-b568-6731c175e708", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819230, "uuid": "0bfd8889-fef1-4068-b9a6-edb6966b8273", "value": "violetspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8611a233-196b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808502, "uuid": "e6715cd3-ae4b-4203-93d7-33b32638a17b", "comment": "Malware payload", "value": "e7c1f41e6214fd47cff351329d65bec6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808502, "uuid": "d07db936-1820-46fb-b15f-57af9ca412fc", "comment": "Malware payload", "value": "25c83c2808f1b19bee06ed3e25cbc65a054b9916b647d5360c1a969467e4a291", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808502, "uuid": "585d1a4a-ef51-4920-a244-ec5e511a1e6c", "comment": "Malware payload", "value": "1b9ba30e5409daea560df0f5266e1fee233c502f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808502, "uuid": "f00c5aca-7b64-445b-84ba-0623a1eb3993", "comment": "Malware payload", "value": "0ffa3c1f658f8ac4278b24824b2edeb0ee813dac92a0b24e7acdc3b428eabd7b1db39fa340a7ecddbb6937feedc2178d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808502, "uuid": "952757b8-286b-4004-8591-62be47320f3a", "value": "T1D8930749FD406B10D8D635FAFF4F024973934B6CE3FA7201AA245B2523CAA6B0F76516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808502, "uuid": "2f047e08-12c1-437e-9c40-b2857e10913b", "value": "1536:wqnZy8D4zgUdtS0tFbvacgzafVAweBuqKlUI9HiWNRIbT2gZ1Ykn:68NUv5nTacgzafVAwe4BNRIbT2gXb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808502, "uuid": "cb037210-d212-427c-84c8-549c3e9a0e11", "value": 93252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808502, "uuid": "bbc15be4-2ff0-4b03-9183-ca89b3edb268", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808502, "uuid": "34324810-ef30-4412-826c-138c5b50d9e3", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3593a5f-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1772809491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809491, "uuid": "6704d1ed-e160-47e9-8cd2-aa167c4c11e5", "comment": "Malware payload (CoinMiner)", "value": "43ae0fce42dccf0e5fdc4ce1595f0d87", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809491, "uuid": "60d49dbb-135e-4470-911a-401735221513", "comment": "Malware payload (CoinMiner)", "value": "25f27ceda292165749c5ae267f86e42cff40d501635959c3fe8a9d6116b4f3fb", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809491, "uuid": "935a284a-3c4b-4858-b30b-75882527e251", "comment": "Malware payload (CoinMiner)", "value": "4bad73a71a200b5ad1b55144dcc74c3e6dcc57b0", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809491, "uuid": "5b0c0320-6169-492d-a332-a1e2822456a8", "comment": "Malware payload (CoinMiner)", "value": "6379374eaaf171c06a0756f86b298ae5965ebf300e225967910a4cc052b14f3bb342c9a41bab1a5610b8a3a973e46910", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809491, "uuid": "5adde85a-3f68-49a4-b4dc-d004f0026f27", "value": "T155363302B7CA9035D9C11875006A1FFA2AB5DD6A1320F6CB85A0372E5DBA3D55E3C2FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809491, "uuid": "cc1c7e6f-0717-4283-b776-bfc995b8cf66", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809491, "uuid": "432fd200-4d56-4bfe-ba9f-9a5922fc5c7c", "value": "98304:695gK2d/ChcToJIIYzX1mqqWDM+9In3ILDVS7BaQl:69iK2IIoJLyX1mxzYt0Ba6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809491, "uuid": "90ea8bd3-aaee-444d-9798-84e18e7241ab", "value": 4898872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809491, "uuid": "17d6f8dc-dfa2-4303-8efb-d48d0c19fa63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809491, "uuid": "2a50217b-7ccc-48ce-8923-7e752cfa64c8", "value": "25f27ceda292165749c5ae267f86e42cff40d501635959c3fe8a9d6116b4f3fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "363332bd-1968-11f1-a769-42010a9c0008", "comment": "Malware payload (Kaiji)", "timestamp": 1772807080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807080, "uuid": "b824fc59-f68b-435d-88cc-256a09234377", "comment": "Malware payload (Kaiji)", "value": "00547b53069a9584a48d1df44cb6415f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807080, "uuid": "36ce2b2c-a291-40a2-99a1-08fc3cc10a86", "comment": "Malware payload (Kaiji)", "value": "2622c5614943fd702979ba3086e864e2052dbcc5f115d5168e40dad21bd4335d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807080, "uuid": "a7eee0bd-d94d-4779-96d5-e026522a84c0", "comment": "Malware payload (Kaiji)", "value": "a85805ccb8a9be14fe8f971d68011c2f3e3c35dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807080, "uuid": "c83acd6a-6a7c-4218-8e6e-576b0516cd2a", "comment": "Malware payload (Kaiji)", "value": "527832b8863e53b45afa318e3eb408c063a8e72d4186fecbea0ee5203d8626047fda05fb9e95fa58ee23e13a7e224c98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807080, "uuid": "44edecc1-1fc5-4971-a6d1-ff8b1beb10ee", "value": "T166361A57B8D28A42C0E4367AACBDC1C433671EB99B9B12675D04FE3D3ABE1990E35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807080, "uuid": "cdfb3000-9703-4141-a16b-e17ee8d58516", "value": "49152:PJzG9XxZPF773LVPN9GnMbaVZGNJru8cYWPAXq7nLYvVmrzmpxUIU1F1:hzG9Xn53LtN9pbu0Jru8cYWPAXqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807080, "uuid": "ad7f051d-e699-48ec-a6dc-ba127f400586", "value": 5308416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807080, "uuid": "a8954eda-eb91-40a6-aa29-d6bfdbc726b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807080, "uuid": "a3924de7-0951-42ec-b693-8de2326f7f31", "value": "linux_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bba0e36e-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772810740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810740, "uuid": "d6006d58-4c5a-4de6-be18-2dee0b59bc62", "comment": "Malware payload (Formbook)", "value": "048df09a01e5b84fba8503e01d3f8ea0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810740, "uuid": "71e58380-e0b8-48e4-b912-64c70b48c4ac", "comment": "Malware payload (Formbook)", "value": "26a6fed7f63fea5d4873d19b279324ba7b665f394aff4d17d26cfe3532fba486", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810740, "uuid": "f0a1070e-b267-4490-9d35-248c9d076eef", "comment": "Malware payload (Formbook)", "value": "54ca0209ba849d5475ce0ec04ab1ca93b0fccf97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810740, "uuid": "d4d26a9d-b51f-42f5-83f2-6a479baad228", "comment": "Malware payload (Formbook)", "value": "a039d0e85f7f76dbfcf00df9feb6ff486319c67faaf5c0771922b979f761244229829cb5ddcb7be91e49cdae6bce8102", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810740, "uuid": "146bcb84-92ef-4dff-aea6-a90a75f481a5", "value": "T11A2512AC6A1AD817E4A557790671F67407BD6EFBF410D2038FDDECEBB8A2E815C04182", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810740, "uuid": "edd17370-6df7-4074-b86e-8630f0a58cdb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810740, "uuid": "409a3909-92d1-4436-82c6-7e2cdcca27ef", "value": "24576:TLjcPsHVQQW0thpxYPhx4d4AkGOW48Sf2A5xSU:TLjB1LpPahx3JGYJ1b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810740, "uuid": "537ac174-389a-43c6-8c27-b0d43c86812f", "value": 1051136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810740, "uuid": "63ac0f05-6ccf-4b29-b124-cd7bbde13cd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810740, "uuid": "3e7c6524-d27d-4124-8196-f36b4fc7bbb1", "value": "26a6fed7f63fea5d4873d19b279324ba7b665f394aff4d17d26cfe3532fba486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3edb62b6-196a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807953, "uuid": "8e5c40b9-870a-45e7-97c3-c70e9d02fe07", "comment": "Malware payload", "value": "05f501bbbdd2afa139c942daf29360de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807953, "uuid": "2d0f1bf1-d48b-4c52-8660-1adcf455b689", "comment": "Malware payload", "value": "26d3b855732bbab0728b355c12e73ccb7bc66bc8c3671526b84df1be701c71bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807953, "uuid": "67c62936-1f9e-4ee6-b458-3ca4c6316249", "comment": "Malware payload", "value": "60734dc81ec21666d928f045f47a11eeb3cd6755", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807953, "uuid": "dff5cbe9-bcc2-406d-9176-99925e8c9266", "comment": "Malware payload", "value": "776b2d83787fbdcdfbdc238f3657bb2487ee7a0753878432b0e3e10af02da1f6b3b5203a683ec7269674cb2bf4a76db1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807953, "uuid": "b6283443-418b-49b8-9e86-72422e33806e", "value": "T15F1512605746649FE0A30C74A8F27775F694AE16376DC3837AD0B9887D3A3468F243C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807953, "uuid": "e3d74df5-e13a-43a9-b8ad-9e59bcaaad21", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807953, "uuid": "9b7ef6cf-6002-4d8e-aa9e-ddb421a3a8a3", "value": "24576:mHO/MdQRFoPwPkrSsWdBz6kqd43jbz1HVkMIwSqLbBYNGq:mHO/uvwcrSsWdBGzKb0wSqp9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807953, "uuid": "3c460117-0fba-457c-8337-46847482162f", "value": 882624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807953, "uuid": "7aed0ffa-d978-45d7-8f91-6c1b7e653bce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807953, "uuid": "3f6ed383-08c8-4ca3-9dc6-c8640e734d42", "value": "26d3b855732bbab0728b355c12e73ccb7bc66bc8c3671526b84df1be701c71bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bf3fafa-1973-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811814, "uuid": "c2b2af5b-2896-41d5-9a96-c5a156e129ca", "comment": "Malware payload", "value": "27211d001ed7ade204580462c6292cf7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811814, "uuid": "e1de103e-366b-43a7-86fe-a2bf5204d3fe", "comment": "Malware payload", "value": "27786fbbb9dadb182448743dc7e8df4be46bab0ce2911d67ef030905282ab34e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811814, "uuid": "9acecc5d-7b53-465f-9d0a-aab0d5f8c249", "comment": "Malware payload", "value": "e31ace075063b50f33b7b30251b17bd916db2956", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811814, "uuid": "4efe4903-e595-48b3-8ba7-8b0a6c54eea7", "comment": "Malware payload", "value": "2bf022aa77a209dede414b320dd6bc2a009a62e4dc2390cfd53954159380402ec1f1cba942db488231e70bbc30dc490a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811814, "uuid": "90d6ad7b-0c71-439f-9713-51e91b10c14f", "value": "T1B845BF0273C1D062FFAB92334F56F6215BBC79260123A62F13981DB9B9705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811814, "uuid": "6a05c956-c6f4-490d-9dab-4f696c0960fc", "value": "c1ce208b1192bfcf652c179f34f034d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811814, "uuid": "0400addd-229d-49f1-942c-9d890b572126", "value": "24576:W5EmXFtKaL4/oFe5T9yyXYfP1MAXDzlPn54UMVC+Z4fTJ+:WPVt/LZeJbInGizlSUuu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811814, "uuid": "13976926-5f98-49b1-80c5-180b7d1e2d36", "value": 1250304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811814, "uuid": "2941e21f-3bc5-43f4-a718-5957da7e3eb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811814, "uuid": "69155c87-9bc5-4e29-b46f-614ae5f6a8a9", "value": "5cbb8eb4846c4a900a1843a047d4fb07359be8a7d18a668aca2db0dc693d46a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a183f81-1969-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1772807516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807516, "uuid": "bc6b141c-7bdf-41c4-9dca-01459a938911", "comment": "Malware payload (SnakeKeylogger)", "value": "83a3c13a4caa45d4391852a0694bd526", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807516, "uuid": "1335b8cf-3c7d-4efc-b7c5-1e812275814e", "comment": "Malware payload (SnakeKeylogger)", "value": "279606dc53234325b3c63298ab2d8a0d146f8dacd4ea18c6b6166ea0dc08f70f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807516, "uuid": "06367970-b767-40f7-868f-295baf355df3", "comment": "Malware payload (SnakeKeylogger)", "value": "664e8dce0ff42ef87c357fd3d00af692bdec8bf7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807516, "uuid": "aabbb4be-f5fb-4261-898d-e599e2da8b24", "comment": "Malware payload (SnakeKeylogger)", "value": "817f9a58c657e6888c198f35ea2cc3927c0a3fa1c532a7d0b4ca39c0873dffe539812027a0c74339cd5a5d8b6301ceee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807516, "uuid": "306a33eb-7fe4-42fd-9e86-198d2b474702", "value": "T111552380721ECD46D86427FA4A32E37523B4ADBA6501E3968ECFBDEF79527124C04B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807516, "uuid": "587f3f73-b730-4ffc-ab3c-5039c1fa6a14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807516, "uuid": "4944efc5-6a01-4f78-b4ef-a790dac445e5", "value": "24576:WguQsVjgtNWrt8/xbv0l48uaxHuzKzR3qBxMRQjYac49I1r3F7ML6KPVictiK:PuB/rmxkluHAhq8+jY89g57OXPQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807516, "uuid": "07a97996-a15f-4c70-bafb-cc6172fe257a", "value": 1337856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807516, "uuid": "24fc0db2-1ac8-4d36-b157-c7cda73b7e7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807516, "uuid": "9bae9cd2-d3a8-46e0-a348-ef14a2653159", "value": "279606dc53234325b3c63298ab2d8a0d146f8dacd4ea18c6b6166ea0dc08f70f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc379a2e-193d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772788944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788944, "uuid": "f2ae075e-304f-4ff7-887d-2585bfe97c83", "comment": "Malware payload (Mirai)", "value": "7d465735bfe001f436ae0589e5e44424", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788944, "uuid": "fa0edb99-e30b-4eae-8ba2-08c7a9e07460", "comment": "Malware payload (Mirai)", "value": "27da0af2582b5ebc21961f174e6187f587160382c1d596a6a5db9bc424bb4cb2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788944, "uuid": "c0a044db-8063-43c1-8b90-25adc6dfcd3b", "comment": "Malware payload (Mirai)", "value": "6baf533503c242d95f8392ce403d5dd1434c56da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788944, "uuid": "8a761584-9072-4b53-b4eb-f1beb6921732", "comment": "Malware payload (Mirai)", "value": "5ef01fda381f91998869cc380ab597aec2a7321e8d90a0b282d7aea4fd290d3b9ecd8141e10cc982cc72f07adcf5d39f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788944, "uuid": "95067761-b0ec-425c-84c6-33610d5f2837", "value": "T1FB03E1D09497445AA174207A0D26E1045F32F628EA1DD4DDEBD0663BE81FFB17728B4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788944, "uuid": "f65c2685-c255-4c0a-9e93-cb8ec7c2ce63", "value": "768:X/39j9W3iSztmectrFYNKGichO3lOYIbHyQ6PTLDsSTnbcuyD7UHQRjQi:Fj9gzx7ctBYNKncU3IbHyQ63Qsnouy8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772788944, "uuid": "b6fd658d-68a1-4da8-a57b-d13876557633", "value": 39620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772788944, "uuid": "7b318d83-73a3-468d-8eea-fd1718acf6e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788944, "uuid": "25703834-ebbd-4414-81f5-09d6b1304a39", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99bd5929-1971-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772811112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811112, "uuid": "af7794cb-b889-4add-9efd-e585c18971d8", "comment": "Malware payload (GCleaner)", "value": "6a5f039433013dff5e1e21d482ef0247", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811112, "uuid": "c6c2464e-51ab-4fa5-82a2-70ccc55ae6be", "comment": "Malware payload (GCleaner)", "value": "28146bf315c0cb31f792bd5636c53fe70ace7e909aa3f6885a59cf085bd25f18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811112, "uuid": "995d8cfa-a32e-42a0-84cc-f2e9fcbe75cb", "comment": "Malware payload (GCleaner)", "value": "5ef4bcb4c5dcec855747cd2b821bdb462c9840db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811112, "uuid": "fc2129c8-5920-4058-8b33-2356b33d73f3", "comment": "Malware payload (GCleaner)", "value": "68c5d0f92677a98cc779c42ae73360b7276bc74deb3f4ff4c2a960ee2ec730791513ab4bb1778e7ca7d0fa7b1e91ee7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811112, "uuid": "da8121db-7fff-405e-80eb-47278c7c83c6", "value": "T1A2F49E26BEA19433D0631B785D6B9E6F582ABD002D3479CD6BE42DCCDB3D781342A253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811112, "uuid": "a3fb8183-149f-4779-9059-51c10d20644c", "value": "5343399a39928268750ade4858cbd1d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811112, "uuid": "d4775ecb-25f1-40ab-a61e-6e2068cb37ae", "value": "12288:i2d0/V6Chk61Wd0Mv6jE/h/7kiv1nLcl4VORW/GUF5h2:v6N31WB6YJgihocyy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811112, "uuid": "e460e64f-f543-4edd-9c6b-dc9d998db823", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811112, "uuid": "9624573a-08c4-4658-8c25-74f5520287e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811112, "uuid": "78514921-f142-43ac-b296-4d11bacec2f1", "value": "28146bf315c0cb31f792bd5636c53fe70ace7e909aa3f6885a59cf085bd25f18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd5ef44c-197a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772815145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815145, "uuid": "f721eda7-8d3b-4eb0-97a3-21944c5d94de", "comment": "Malware payload (Mirai)", "value": "2d0d0c9dd8f41f42329d525b05c29226", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815145, "uuid": "573f2e04-e81b-40ea-8ae1-a131f8cdc2f2", "comment": "Malware payload (Mirai)", "value": "28768fed528dab06fb800aaf02e62f519a88614004952e170b2de858b0d06e92", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815145, "uuid": "5a678af9-ae7f-4cce-b3e7-cb89667cceba", "comment": "Malware payload (Mirai)", "value": "cb6cef3e89c894becd0a34f8a2f2127e48cf2120", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815145, "uuid": "1753fa7a-6bda-4ec1-95df-2af3c5f4ee1d", "comment": "Malware payload (Mirai)", "value": "5e3e50edb9338029bb579b93688a4ab3a5668404fca3f773f8a06988ca8a65a55f70d92de23770130400c9c81af950ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815145, "uuid": "3af6c76a-77f4-4ebb-8e5f-43f6d6bcb873", "value": "T18DC3ADC3FA8714A1C46206F007C71BAD6F93A221CE5FE4E7AC1DB63B5A7A4DB1516381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815145, "uuid": "b2e53fe9-ead2-4ce3-8ee6-138efe6c0080", "value": "1536:CrMjtT/2h9gC/LjVCnXEglWuoPJEjuAclMkWFcpxs59NgRCEF/LW9:CrWT/i94XEKn+SuAcFWFcMgbq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772815145, "uuid": "5a5cbf01-e85d-44ca-9144-bf8c8fe69e21", "value": 124676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772815145, "uuid": "8a04cf2e-4b53-411a-b84f-7aeaac7833e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815145, "uuid": "cc67a5ce-a379-4532-a408-0a5b55725b93", "value": "titanjr.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d28d7bc-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772809185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809185, "uuid": "63b05cbe-58f7-4a93-be0b-30d767386f4b", "comment": "Malware payload (Mirai)", "value": "239d6caf9385d357295b3db9a4a8ee46", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809185, "uuid": "b60b7a3b-a89f-4aa0-b3b9-476bb739cd20", "comment": "Malware payload (Mirai)", "value": "28aba57aca34aff76d73a19845da3797a7c5ccec474bc3620e53ddbc175a737b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809185, "uuid": "b910ae4c-53e2-4e40-a0e6-b9dba4d1ef76", "comment": "Malware payload (Mirai)", "value": "28b4a4f3c08a38968f7dec419db05cc3a1b299f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809185, "uuid": "7b07eaa4-4243-4f9e-9dc0-39b05f0c60cf", "comment": "Malware payload (Mirai)", "value": "044671369ea6283b345321322c9c2faab6675a1fe12f2efbb2351315521b56f491ea139cd8a4b64347c25bc149ebd223", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809185, "uuid": "0e1ea5ac-2ca4-4b5b-8eb9-edcfea21b47d", "value": "T186B30945FC505B17C6C652BBFB4E428D7B2A1768D3FE720399256F30378B96A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809185, "uuid": "a581cc49-8ada-47b7-bb4e-d31eb52d386f", "value": "1536:jUK9yqnU8vGRz4VA4j6T9y28Ty6O5FtZpqQcZlCtwywXvqcVuafhPeA45Zvn:QixnUHz4Z+5ypkn3E8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809185, "uuid": "1e835007-ff64-4fa6-93b0-c6b4bad1317d", "value": 117280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809185, "uuid": "e22ecba1-9ace-45af-8fe3-10e60a1b1da8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809185, "uuid": "36424385-92dd-4886-9013-6021cadc9a07", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb5a5af3-192d-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1772782043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782043, "uuid": "9c67628d-f82c-4aee-b530-66a7e80edc88", "comment": "Malware payload (Gafgyt)", "value": "348b4e4314a2a25d5f6381905a7e99f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782043, "uuid": "d594ff90-40f5-4ecb-a9d1-6c41b4f1a536", "comment": "Malware payload (Gafgyt)", "value": "28bc04d07c184e0f86b16dc23d1e627d24f3d0a6d1098b819b35d9a0ef4af4ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782043, "uuid": "18ad536e-ad10-4c51-91cd-ab2566cc0502", "comment": "Malware payload (Gafgyt)", "value": "04590b334a98ccf61e6cd54cb491b1d613f3ea9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782043, "uuid": "e9fc631a-7da1-4d6b-826c-e6063832172d", "comment": "Malware payload (Gafgyt)", "value": "16a23d532501479a7b11207ad744ed28a0cff8678ea15a84b444d63eab64f8a7600680abdcd0d1630cf550b0850eff01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782043, "uuid": "4e491fe5-9c0a-4509-8f61-393e7438ed2f", "value": "T15BE31A45FC509B26C6D322BBFB4E438D772A17A8D3EE320399255F21378A95B0E77241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782043, "uuid": "dd38817a-13f0-4a1c-b151-35efa89c22f2", "value": "1536:Ig7d+/+VafoNsiejzw4Ng5jRclHAZpo/AD21ATkdhNVfCOMVPZxqXiHzlB6wyw06:IA+WVafoYjcValHLA0A8hvQYSNksT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772782043, "uuid": "04ce0400-c8ab-4f6d-8e65-9a508f6bf5db", "value": 150208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772782043, "uuid": "23c81b35-3740-48e1-ab9c-565f353fe58d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782043, "uuid": "a5207e9d-01e3-494c-b0a3-a0c76f48a587", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2658e1c5-190c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772767539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772767539, "uuid": "667d21d9-9fa3-492a-811e-0fb5b70777af", "comment": "Malware payload (Mirai)", "value": "917e4ecaf26683cfa36fda7899ce8e67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772767539, "uuid": "9fc69cc8-32a4-4da6-8fae-c2ec19a0259d", "comment": "Malware payload (Mirai)", "value": "2967f78d71dc4c0f29f1a4b8c2dd40cb0a2db03ed09e4fb0c577e7f5ea0299ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772767539, "uuid": "0887c762-a5be-4e4e-b372-ce4cc9b8ea28", "comment": "Malware payload (Mirai)", "value": "60b68a253ba34a293624796f26ddb3cd408855b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772767539, "uuid": "2b195f44-1bd0-4093-acfa-89e973729762", "comment": "Malware payload (Mirai)", "value": "64158b52f42ed76fd0a9f0b19b39169d5f8a711ad48a812491dacdd445c56f9484fba2de86b5ec42f5bfc7da3a8e54a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772767539, "uuid": "c68865f8-76b1-4e7c-8a20-92007079135f", "value": "T192F3B50E6E198F7CF79987344BB79E32965833872AE1C582E16CD7105E6024F641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772767539, "uuid": "0c9ad5f6-1690-480f-be41-43c808c83423", "value": "3072:MOATXjpCgqDJHDexBJKfjPV4kuMu8hJBQX/uw9EfszRpSP/Q4vkTTzTT4BFZDiwZ:MOATXjpCgqDJHDexBJKfjPV4kuMu8hJH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772767539, "uuid": "a84369b2-0760-4603-9ff0-fc62fcfaa4ba", "value": 171724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772767539, "uuid": "f538aff6-de14-44c7-9836-95d982e8f23d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772767539, "uuid": "159c5cb8-7e43-46c3-8f10-e277e143f6a2", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "698b9256-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819192, "uuid": "ec03650b-2666-41e8-a5aa-40b18a15ced2", "comment": "Malware payload (Mirai)", "value": "aee1b68078b601ad580484083d6b6a3c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819192, "uuid": "f85c0be1-f433-4d5c-afc4-91d52c49618a", "comment": "Malware payload (Mirai)", "value": "296f42a79501db9f6a058f51bd851c307be3ed545af3099296e3ebdb853e54ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819192, "uuid": "ee37b754-2ec1-4624-81c3-87f96c10f324", "comment": "Malware payload (Mirai)", "value": "0e4423491d320512c66cf2f71bb3c90e043d0dae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819192, "uuid": "4813e097-8fa6-4260-a488-0a372a133c8f", "comment": "Malware payload (Mirai)", "value": "735c56fbce75cec3ebbcc0e73361c4daf3f4db9cac8ffed1ed78191229f1e95968ac255b435f3155702ded004cb8728e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819192, "uuid": "14140880-f569-4582-8f78-dcf6cd8a7b41", "value": "T1A9B207B2F446DEB8F40FE33E855B4805B272F75102967A31B7332E37987928464B6E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819192, "uuid": "b36ba752-0ca5-4869-9a65-6cb3abdf0913", "value": "384:J4ID1H9pw23lKD1cM3Kvbei9WLjToh0xsp1XIq8HAxQtB:J4I5Dt9vbei9WsixsPXIq8qQB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819192, "uuid": "59304d85-ea90-453a-98b2-4943a8eec146", "value": 23948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819192, "uuid": "5647c1c0-4002-4996-80cc-afc421fe6fa6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819192, "uuid": "07a78087-25e5-4164-b0be-bc5d588b0413", "value": "violetm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36410047-1971-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810945, "uuid": "da28a24a-70d6-4d84-8f09-87897377ab97", "comment": "Malware payload (GCleaner)", "value": "0210dbf6176927da4aba29a7a5d30c09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810945, "uuid": "93b3f7f2-aacf-45df-b436-d8e8075ae458", "comment": "Malware payload (GCleaner)", "value": "29d3d20c025f4ff914307c5c8eb2bced6da2cc74fdbc84d4cd735d6521c8aa3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810945, "uuid": "028a3fcc-9b94-4ae3-bc93-c2c80a2ee014", "comment": "Malware payload (GCleaner)", "value": "029185bf89c04e9f3c23a366e81966201098c821", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810945, "uuid": "a44baa49-96d4-46e3-956e-136b6e15ee3b", "comment": "Malware payload (GCleaner)", "value": "8242bac33fc0360f14778474e6b53328fdb2c7ec838a794eee1f1ae731cc7ab90393c90aac258bbe1d30efe652333ecb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810945, "uuid": "60a82d36-a109-4040-9783-c9fb4180157a", "value": "T1FB059E22B1A14537F1633A7C9D5B925D982AFE312934EC452BD87EC91FF9781383A243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810945, "uuid": "188f54d6-eddb-486d-be51-75899d2aa549", "value": "5343399a39928268750ade4858cbd1d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810945, "uuid": "a2e9af77-a868-4156-894b-e29bd3ed4ac8", "value": "12288:f2d0/V6Chk61Wd0Mv6jE/h/SktBRQXSLGlUEifm9F2I:K6N31WB6YJZtBsveti2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810945, "uuid": "10deda99-37c8-4e86-83fb-7acc898fd174", "value": 814080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810945, "uuid": "dc781551-1ce6-46cb-9c73-ed10241c809a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810945, "uuid": "d5c0bf50-ffa5-4ded-86e8-3698f00fa8cb", "value": "29d3d20c025f4ff914307c5c8eb2bced6da2cc74fdbc84d4cd735d6521c8aa3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d96d5029-1951-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772797475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797475, "uuid": "99af21db-632a-408c-897e-71f0d5ff4f71", "comment": "Malware payload", "value": "c454027b25b92e06d085101fc54cf490", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "moonzonet-com", "colour": "#AC8277", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797475, "uuid": "67bc52bf-2897-4548-be4b-25115a6ad0e3", "comment": "Malware payload", "value": "2a20d78642d3c155f5820606bf5bfd66f0c1f7264b79bf96fa80ee2f13debde2", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "moonzonet-com", "colour": "#AC8277", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797475, "uuid": "1742fa18-9eff-4ce1-b1ab-196c10804f93", "comment": "Malware payload", "value": "1d6b7096cd90b85459a5ca39a2ef56bee13f8c5f", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "moonzonet-com", "colour": "#AC8277", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797475, "uuid": "f2ed5c72-cd7e-4eb1-9da2-664a6076d6da", "comment": "Malware payload", "value": "e8bdba2f07b9dc0e7dcf2cde8a46c4ae51407fb1088a1d16f2a155ec1b35c01073024af0799e02ea3785b168459b86ad", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "moonzonet-com", "colour": "#AC8277", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797475, "uuid": "472bf3e4-78a3-421d-98b7-42ea62167d94", "value": "T13CD0C99BF16A903917450FC5C305B81DC94701DB38C6C586D039CA8B703243A37C6A73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797475, "uuid": "8cd8d0d8-f8e3-4ae1-a341-39142d2fb61e", "value": "6:3JZFSgHYwLqBDudZLFNEuuwLqBDarFTXQEcIIVEwLqBDoPWdpIv:3JZFpY+qwFg+qkFNIS+qMe8v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772797475, "uuid": "365ced70-88f9-4f6a-b7b2-bb8102ba37c0", "value": 213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772797475, "uuid": "a5266744-c321-4b77-997d-eb3ee1607134", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797475, "uuid": "b4a48732-15b8-4db5-828f-d5975b2ec1a8", "value": "2a20d78642d3c155f5820606bf5bfd66f0c1f7264b79bf96fa80ee2f13debde2.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d70b98f6-194f-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772796612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796612, "uuid": "fb7fe364-89a0-4308-83d3-a8b40d5193e2", "comment": "Malware payload (Smoke Loader)", "value": "aaa50ed470ef2f3cabd4d5e78edb5835", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796612, "uuid": "3e2b3311-c4c5-48d3-afec-bfd701559927", "comment": "Malware payload (Smoke Loader)", "value": "2a214c6d9f8cd7caf626cd85ea6b6905eef0a0966019c29838d166122550a6de", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796612, "uuid": "4819ed7f-957a-4bab-8127-bfab4421c871", "comment": "Malware payload (Smoke Loader)", "value": "40b7e555b3cae127d3d3e0f31de57d5aaaae3f0e", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796612, "uuid": "6a204900-11a4-429a-90f9-c2d186d6ce8c", "comment": "Malware payload (Smoke Loader)", "value": "c44985c26b26a20f9c0f67e054584bf667987fdfbc2d828ce97839c53683cb3504701828da08d8f71e16e9486eb23a33", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796612, "uuid": "2b5ceb8f-5213-4100-bb37-1e82bde840e9", "value": "T163854A0ABCD108E5D0AA977289B762A23B75FC190B3223D32E90B67C3E727E05D75754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796612, "uuid": "24653705-17e7-4379-ac02-460c0f651ebc", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796612, "uuid": "52b10b7c-488e-4f95-8ac4-28cc222f09b5", "value": "24576:V/2+ancs/XxbwJ0DpHFb4GN9cXZK6rtPR800Gm:V/Docs/XxbwJ0bbR9cXZK6f80", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772796612, "uuid": "0e570165-5114-47eb-9e74-4004e710de7f", "value": 1856000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772796612, "uuid": "6363d573-799b-490c-aa76-ad959443e17e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796612, "uuid": "08768455-2fd7-4800-aa17-7af165b7ea39", "value": "source code of carbanak backdoor discovered.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36314a37-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772811375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811375, "uuid": "4cf9cb21-7710-4a9d-bdb4-f307aff189c5", "comment": "Malware payload (AgentTesla)", "value": "ed66a2421f42b193933d0521e2d02051", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811375, "uuid": "7185452d-11ee-4efc-9b7d-be7f2cc5057c", "comment": "Malware payload (AgentTesla)", "value": "2a2fb0c60155a69114f6e3a372e8bd19b321c78fedcc5a6c39f53a4f86d8f572", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811375, "uuid": "238310e3-df85-4be2-be31-d46af4a2dc13", "comment": "Malware payload (AgentTesla)", "value": "d3e4e0186543585870603c4927cf9063b2536616", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811375, "uuid": "0790dbba-7b81-4cbe-8653-292c7289e872", "comment": "Malware payload (AgentTesla)", "value": "5b3c474e996dcec489aca3887e047729c3c77bfe1f72d245a7d60f9e0e35cf59e9652d999cf6ee2e630639dde13717d1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811375, "uuid": "bb0bca17-b5a2-4e19-a5df-78903e9d1183", "value": "T1614533248A75B82BD7D74B7249A7AADBEB92FC1C4011915F27102F1C776FB438D08BA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811375, "uuid": "ed999b14-ba1d-443f-b23c-1b9b3e2796b3", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811375, "uuid": "7b099feb-6ab4-4562-bf0d-db20fa0bdf51", "value": "24576:WHk1cX0b1gdAZP7kc7zNtCTPTCfklOos2x:F1cEb1gdANkcbYTCf6zs2x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811375, "uuid": "b2ef1dc3-a310-44e9-bb7e-ba83843ef4f6", "value": 1179504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811375, "uuid": "b5f9e9fb-cbbb-4732-8f0c-a83e3641e093", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811375, "uuid": "425449f9-1d48-4a1e-8caf-0da4802fc98d", "value": "2a2fb0c60155a69114f6e3a372e8bd19b321c78fedcc5a6c39f53a4f86d8f572", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fcadde9-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819256, "uuid": "def3ca71-a3b6-48bf-9d1b-78d67e1c90c0", "comment": "Malware payload (Mirai)", "value": "e6f6845f67078dae17a032fc05dbaf88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819256, "uuid": "bb66f43a-e82d-4224-8d4c-9333a80e8aba", "comment": "Malware payload (Mirai)", "value": "2a67099dc581ad83885f6604b97268cf514793b65b9dabafab00eb5a93bb71b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819256, "uuid": "ed549e23-75bc-4d8d-8dc8-fff9298bb0ba", "comment": "Malware payload (Mirai)", "value": "ed0f125ea90191d7778f1c3c8e0eb01942fe1606", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819256, "uuid": "9e42d6e3-7125-4f85-a8c6-e3b6aee60eb8", "comment": "Malware payload (Mirai)", "value": "166ac46f6482150b3c2940d22ceed065f2ba367bb6be8bc3d963dac762e8f538d0d771fdb83e3edbdbe9100effb7932d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819256, "uuid": "067fc842-84dd-47e4-b2ff-ab0874baadb7", "value": "T10A343A45EA418A13C4D617BAF6AF414A3332A7A4D3DB7206C9246FB43B8775F0D67A02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819256, "uuid": "f16f485e-1cd2-4b24-82e5-3d9ff7e67d98", "value": "6144:CFNEAy4vjt2abaq40Ba9cnYGUomzmqjM/9n6zOyUR:SSa7t2abaq40QaYcdqg/oyyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819256, "uuid": "a3b7ec00-67dc-403d-92f5-8b3b11790736", "value": 236201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819256, "uuid": "c2322f1e-7b9b-491b-ad32-359a32d0bec9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819256, "uuid": "b0a49dae-2f40-4c05-963b-07469c4a05fd", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe34b776-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772809133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809133, "uuid": "6002a07a-7e7f-4bbc-9d3e-6df4607ecd51", "comment": "Malware payload (Formbook)", "value": "eb7ba3dd15563dcd18b05f0dc9dc852a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809133, "uuid": "e692653f-0a61-42ee-a071-71068b396236", "comment": "Malware payload (Formbook)", "value": "2a698fec192f93a373116fcd7e3ea6587a232aaeb079f342d461b348d1274158", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809133, "uuid": "c6b7abab-33a5-4563-81e6-3cda28d00481", "comment": "Malware payload (Formbook)", "value": "220b9fc4b6401c5cd5ee4dd5717a53c663d2cd08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809133, "uuid": "06593553-68c7-436b-9eb2-d00362fbed9d", "comment": "Malware payload (Formbook)", "value": "b6bc931643f17ead69d4d415471bf8455f8a4522c082996bcfd887122d6e03751bea6c64523a2b78288f382bf49dddb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809133, "uuid": "5a3ffb2d-e69d-4198-8158-76d967e83a30", "value": "T1165512142729DD02D0AA4FF55971E2B08FF46E8AE912D343CFE7ADE7B8363901D45682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809133, "uuid": "10588925-b308-46c1-9218-a7690a43bc7e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809133, "uuid": "adda4740-7f9e-4da0-bf01-c244efa97d2b", "value": "24576:Dqu2VxNjXw6ntt9Q3LHU501r2sk71t/X7B3JpJp2wzUjbWUFmI9+PW7tGv:DeVbrxnttILHU5cdij3/JpzUTmIcG0v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809133, "uuid": "f6ee8d5c-7e84-42c6-b52a-d873e717c236", "value": 1345536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809133, "uuid": "bea7bfd7-889a-4a0b-89c8-666ba4ed816f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809133, "uuid": "b12286b2-8016-478b-b3a4-6d9fc34ca385", "value": "2a698fec192f93a373116fcd7e3ea6587a232aaeb079f342d461b348d1274158", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1415c1ce-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772809599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809599, "uuid": "6157e03d-d855-4517-aa83-9f354a693346", "comment": "Malware payload (GCleaner)", "value": "3e1fd764670bcd2f568e38064f0a1e62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809599, "uuid": "d728bd58-2a60-4d33-8014-fa77da5a7410", "comment": "Malware payload (GCleaner)", "value": "2a7a06f5de094c4ffb4fa67b3f42fd2233bc1af690eecad2e82d8a60f72b72bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809599, "uuid": "b6276ae2-6de7-43ab-a7cb-bc8eed515f28", "comment": "Malware payload (GCleaner)", "value": "c1df4b6aac76eb24958b8c817f0848d8aaceb2c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809599, "uuid": "691b62ff-0c4c-4b39-bca4-24b14305a175", "comment": "Malware payload (GCleaner)", "value": "0a1f850d76c5928fe9a8e140d29720f8b4faa2cd865380779f5c811a1ccf6f2e0c0f179fa485fa1409f0b25f687ce3f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809599, "uuid": "3fcc12ac-50f2-4105-9748-918e0c5484e1", "value": "T1B4E49E22E6F08437D1326DF8DD5B92B59825BD913D6878462AE81CCC9FB838D352D393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809599, "uuid": "d3e90a91-e770-4a4b-9dd2-1325af7fd7c4", "value": "345624d13ffc2b7f296b9d2972b1c0a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809599, "uuid": "9804ce7b-d5d3-4aec-a43a-436f1f9b915f", "value": "12288:A48VY65TrPsgNDHZ8nqReafokTUxBHrAor8cgHUhWU1n+3rW:Z+7PfJZ8qBfokyBHrfl+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809599, "uuid": "969e514b-4bb9-4caa-86e1-ec62c2199975", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809599, "uuid": "30522149-2e38-4867-8ac1-7160ee2b51dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809599, "uuid": "6e7c1402-15c0-4f2f-b43c-258a35519f62", "value": "2a7a06f5de094c4ffb4fa67b3f42fd2233bc1af690eecad2e82d8a60f72b72bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "392e991d-196b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808373, "uuid": "b10c670d-77ea-434f-97c5-16f581f406ed", "comment": "Malware payload", "value": "aa86c4995590def9f283c3770d986ebc", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808373, "uuid": "f6a73d70-f8d6-4faf-a142-fe0913b5e5be", "comment": "Malware payload", "value": "2abf9d6ed195f9d061f4948972e0bdb67741b5d19f9ab60eb55dadd79c529698", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808373, "uuid": "adebbb83-2c6c-4141-b88c-806b3dc26d92", "comment": "Malware payload", "value": "16959c37b33657fd1edca5d6aa59b7c8dadf27a5", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808373, "uuid": "e2802c31-2926-4e37-81d6-4d3ce4f0f9b0", "comment": "Malware payload", "value": "87a174f742a57c7964382bdaa435c1dfd91408059482c13a73528ddf13ac1038e5f295fea8eafd04165d3e0612b79334", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808373, "uuid": "3821106d-387b-4bdf-a079-aac480302d51", "value": "T1EEC57A07B89465B5C5EAD2318AB682D17B31BC890B3127C72A50B7BA2F737D44F39394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808373, "uuid": "f10bfbed-2050-4ed4-bf0a-0cadca2ff1e6", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808373, "uuid": "f034ecb0-e75c-491a-8f9b-0d67045f2ad7", "value": "49152:JWiq3Krb/TmvO90dL3BmAFd4A64nsfJWXovqGgtAR6AwLD1s4sO2b5SGW4+LOlQz:I3XovqURl3T5/5QL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808373, "uuid": "734cc7c3-10a0-4baf-9138-de9c28181667", "value": 2511360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808373, "uuid": "16f1a967-9e33-4963-98f2-4eebc3cfcad4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808373, "uuid": "2df5d573-acd5-4c2e-a2fa-6e53d6b6738b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83fced1e-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819236, "uuid": "33bb8a44-325f-499c-9430-73a99910c359", "comment": "Malware payload (Mirai)", "value": "ed1bb069b0bd52698b8c9ae9a397b310", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819236, "uuid": "bd5083c1-81a3-47fc-b565-e7b177d56d96", "comment": "Malware payload (Mirai)", "value": "2b41fb20d104908f7c4a008e8539930e77ceed5bd431993b2f4407228a3fc115", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819236, "uuid": "348db669-601e-4314-bc8d-d3d862fa1e04", "comment": "Malware payload (Mirai)", "value": "f86c962c9ca916b74b88411bf57de8b0dbd377a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819236, "uuid": "b7d2be39-f474-4853-b350-b8abb63c8992", "comment": "Malware payload (Mirai)", "value": "cfa6ec8c47276d12957e6731cb380ea78ed9cac9c17e69d541c0d8d975a974ef2cfed37b010a369d5ff2ca922e892457", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819236, "uuid": "9b3112ad-051c-46cd-8c3b-c2e3d8dc73bc", "value": "T1B9E35C8AF402DE7DFC0BD5BE84670D09F931E3A131831729569BFDA3A8321964D17E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819236, "uuid": "da201dee-7b13-4e61-9569-8a4352c0d0e3", "value": "3072:IWXww0qbt+Z2ACoePMg0D5pR8CZ+mq1+vumP1d9:H08t+Z2loeoD2Fmq1wP1d9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819236, "uuid": "959c6739-34a1-4e0d-b969-03ea6a386ce4", "value": 149648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819236, "uuid": "f5e7c8d9-4a82-49a9-ba3c-e9daf6fd7742", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819236, "uuid": "6ff4be40-7520-40c1-8b9d-84a99618ca01", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d8de60c-1966-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772806314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806314, "uuid": "8cf0e833-4834-4a27-bcd0-176d5028ef45", "comment": "Malware payload", "value": "2cf29f8c095b36607cab9acde5148067", "object_relation": "md5", "Tag": [ { "name": "172-94-9-250", "colour": "#CFC547", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806314, "uuid": "7c2e036d-ea06-4a64-a4b8-164ba219db56", "comment": "Malware payload", "value": "2b528e876b772217e575288ce2757183feb05735731efeaa70904fbededeed1f", "object_relation": "sha256", "Tag": [ { "name": "172-94-9-250", "colour": "#CFC547", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806314, "uuid": "422ae1c4-3fd4-4107-afae-d01871d84b28", "comment": "Malware payload", "value": "688bd521ade5de6b0ab5c32f3446e8ffaaea8991", "object_relation": "sha1", "Tag": [ { "name": "172-94-9-250", "colour": "#CFC547", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806314, "uuid": "c78b909a-f26c-43e2-a1d3-afd49ab09bee", "comment": "Malware payload", "value": "4b41c0f1004a7b4745dfd69a484c2aac0b3d3c523cfb0dede3806d60be8b66ea09b192bc025f6b53514a7fa1a7abcae8", "object_relation": "sha3-384", "Tag": [ { "name": "172-94-9-250", "colour": "#CFC547", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806314, "uuid": "31fd0a60-fe92-4715-bd3c-c7c3f3320167", "value": "T1D162E14E710C04394507C4D84EE625658EFD3C859B14787735B4A54928BCEB94EBA3F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806314, "uuid": "51a7eeb6-8f8e-42e6-aa55-e38c4bdd1223", "value": "384:n8qL1CI3m0RkadW0h3ghR7+WxmWkbTIKZ:8qL1CedkadW0h3ghJxmWkbTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772806314, "uuid": "6e82db22-d939-42b7-8600-f923019fbef6", "value": 15635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772806314, "uuid": "af61ccf8-2150-42b8-91ba-d4996b20314d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806314, "uuid": "4d5f55c5-be00-4ade-a166-95720c1f563b", "value": "xxx59361.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8805b544-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819243, "uuid": "57e11edf-8585-4a60-91b0-da5f2fdbcf10", "comment": "Malware payload (Mirai)", "value": "523987c5cb89a11f9cd984ffac3787c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819243, "uuid": "24acc1fd-a462-46e0-8c1e-68e9d6dfbd50", "comment": "Malware payload (Mirai)", "value": "2bc52739f60e5752d95fef1e0e142ab7256c62de6a11a7678182c87ed2f3ad63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819243, "uuid": "02812e12-912a-428e-bfbc-70f509c79aa3", "comment": "Malware payload (Mirai)", "value": "ad4a51f650778f15e77a4807e3528158b31720f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819243, "uuid": "10ff14ef-b468-4bb4-97de-745ae9f41c15", "comment": "Malware payload (Mirai)", "value": "1196ae0ed192e35e16b321265f87fe22f75cc913d9497943bde8647093584c24df6ec6fd505558f3562df6342ae5e316", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819243, "uuid": "ecd4c8d2-9d91-4bef-9b60-aa4e84098513", "value": "T177730942BD829F13C1D222F6F7EE01993715BB68D6EB3242D821BF9137868DB0D67611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819243, "uuid": "860f4a1c-fb0b-4b0d-a5f4-66ee27cabf25", "value": "1536:URNLmkaXxzxXrCk48tOAKjEMyosYP1s/FRm:URNLKrCPxJyHlRm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819243, "uuid": "75cd439f-90c9-4231-b056-64f35bb28c3d", "value": 74484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819243, "uuid": "2be5ab0f-d70b-44f2-ade6-e5d8d9c331e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819243, "uuid": "1fbfb72a-5319-433f-9927-24584add6a13", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db8b5d6b-1950-11f1-a769-42010a9c0008", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1772797049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797049, "uuid": "ec7d63f7-ac3c-4742-aeab-b6434c35a050", "comment": "Malware payload (Socks5Systemz)", "value": "35dd72fccdcbff478cccc5fa0e1deeab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797049, "uuid": "977aefd0-9093-485d-b659-71808723ae6d", "comment": "Malware payload (Socks5Systemz)", "value": "2c2caad15e5af13e6290b84f03b10f43b21ffc3dfdda0581fa24caa3450484f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797049, "uuid": "22e8a5be-7c82-435d-acb8-109eac1e480c", "comment": "Malware payload (Socks5Systemz)", "value": "490e352202fccf4bed5afb7d1beb3a51002cc02e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797049, "uuid": "c039c4ae-4bf7-4146-bc65-f5d86d7ee633", "comment": "Malware payload (Socks5Systemz)", "value": "09ca970c4f57cd44036d253b6af010f26c0847bd20f88ad90f730985c75d0b55f4f40bc915c8a646b2d8d9eedc37faf3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797049, "uuid": "7904513a-beef-44a3-aeaa-ebdf0a166d44", "value": "T1C60633A086218479D01181B59CC6515CE6BF3D7CE2BD98CA7AFCA66F5B02BE71DC3324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797049, "uuid": "6390218c-808a-481b-9acc-01447be0e9a8", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797049, "uuid": "d7baf6e1-8eaa-4535-ac28-40a9b9eb3bdd", "value": "98304:NcXYwkTa67D6mrbW/wbQ2SU3s7j5PrzG/REO/4:5TaSDjrbKOxoNOg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772797049, "uuid": "94591ab1-30e9-40ea-8b1b-8275ff12db2f", "value": 4016795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772797049, "uuid": "3ce0366f-a6a2-463e-a5ca-373f8861d946", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797049, "uuid": "3cbd1029-60ec-4a26-b45f-d55e83a9b66a", "value": "35dd72fccdcbff478cccc5fa0e1deeab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59f9fc60-1969-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1772807569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807569, "uuid": "8448336d-b3e3-428f-9db4-cf2e44968ad3", "comment": "Malware payload (SnakeKeylogger)", "value": "373d61ea18647878b8b0bdc57ff665dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807569, "uuid": "de044e02-f779-48b8-a442-787e9367bd2a", "comment": "Malware payload (SnakeKeylogger)", "value": "2c428a260e28ffeea365c4013637f9a902d2e9b295482fc7a9c8fffeb78a3f45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807569, "uuid": "88abfc3d-6cdb-4023-960b-3d42dde90d6c", "comment": "Malware payload (SnakeKeylogger)", "value": "fbf4b5ca1ca1c15a9584fa97858389502e7bb233", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807569, "uuid": "ee79b7c6-c14a-415a-87e1-3e2c841a12a1", "comment": "Malware payload (SnakeKeylogger)", "value": "27ed47f53f712b49d7099702c20589c00611be2aeab79540801847ed730c73a070afad0098c7067535d9401533baacb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807569, "uuid": "db05205f-ea2e-49fc-aaf2-eaa66f9ea181", "value": "T179942301B6519137E7B29B3205335B574EB69D2022E0830FC7A0BB9ABD32657C53BBE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807569, "uuid": "e0840d89-abbd-467b-87ea-b229a84224b7", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807569, "uuid": "2841c72d-3909-4317-8b31-d2ca051a3301", "value": "6144:6bfopLxCQPZ+PoRjhNLu9ExBtxadZ/AgJ/OYWpNjdedR8cOJbTJghgfKEo7t0b5q:6b6xNh9LuCtx49s3pTedoBHo7ub79+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807569, "uuid": "3f5d07f3-e5e6-4f6b-ab8f-768126e5f845", "value": 417920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807569, "uuid": "b7edb254-0116-4883-a9eb-98369dccb5c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807569, "uuid": "da6a359e-9e5c-4772-bab2-2f09881d3955", "value": "2c428a260e28ffeea365c4013637f9a902d2e9b295482fc7a9c8fffeb78a3f45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c378b2a-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810069, "uuid": "10c0e2ed-88bc-4c3c-b7a3-96e738d3d75a", "comment": "Malware payload (GCleaner)", "value": "ad900b756e3021756dfecaeba021d0da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810069, "uuid": "31131608-a3cd-4145-917f-7d423707c4a2", "comment": "Malware payload (GCleaner)", "value": "2c9f5c8908f00e337b272a8174341e0ab5f619345d51ffe46360e4c5f286f8af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810069, "uuid": "d69c74f5-5b18-446b-a47a-6e7ae04b739e", "comment": "Malware payload (GCleaner)", "value": "194150029fe832c54fb396889a56bdaab7039fdf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810069, "uuid": "5e7853db-8247-4f7b-989c-25fee1db3099", "comment": "Malware payload (GCleaner)", "value": "8b24001b07f4d3481043935c5d66bebdfa1721c98363bd21e89fca4a25750e1b7c5bebfb99363b076e319a2ddac1c1a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810069, "uuid": "36cf6176-8bac-4fd3-91fb-383fd553ab46", "value": "T13FF48E37EEA08C37D163693CDC1B6657D825BE906E2C694A3BE91CCCDF297813425293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810069, "uuid": "e5f28288-e52e-414f-86f9-1111d23b1c02", "value": "c475b6e242f56325f64c2b76233f720b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810069, "uuid": "52eeb93b-e77e-4254-b7ea-4e10e67cde97", "value": "12288:beM9gzhW/BsjB7V+bRO88pvnHU7/j7mC0COhHBrvHDnjnvU:6K3/q7gR8G/j7mC0Cwh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810069, "uuid": "e2fcdc9e-aa0b-414f-bdd4-3bc5c166343f", "value": 736256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810069, "uuid": "715464f2-48fd-47e8-ab76-6ef2ab4dd06f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810069, "uuid": "f8b71220-4d99-4846-a6d1-4f4e6c441e65", "value": "2c9f5c8908f00e337b272a8174341e0ab5f619345d51ffe46360e4c5f286f8af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7eada52-196e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809928, "uuid": "4e8d119d-f80d-4036-b6be-09d7072f0b93", "comment": "Malware payload", "value": "7e38ad41e76c95095070ab0cc88bc2a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809928, "uuid": "947c7631-a633-47b3-836e-cbc8e9c09d86", "comment": "Malware payload", "value": "2cfa6c6e8069781cac1cee634e4fd346c714b7ebe244c92c8ca02d0b240e0f5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809928, "uuid": "76b88b95-0c19-4ccb-83cb-10ab140cb851", "comment": "Malware payload", "value": "d1f6377458ae72a1f087325b5739e024f3f95064", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809928, "uuid": "9f760792-d199-42dd-a6ad-3afffc1fd516", "comment": "Malware payload", "value": "81f0c6157c4ec08c9c8f51853b5447bfc389692cb080d4b0310af7f6e7206e1ba1bc78b901681041ecc22602006babe8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809928, "uuid": "de22b40a-bcfa-474f-b3fb-539042799fd4", "value": "T1C645235C275AFF03D5934BB81D21D1B487B89FD8E412E2434FE66CE7B82E36549882C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809928, "uuid": "fcb2cc8a-5028-47ff-ba0e-5ffab175bb3e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809928, "uuid": "b1451180-40d1-44cd-9e0e-6f3191eeb7ac", "value": "24576:A/tws/S2LoUw9unn8mvq5QRFKWxdrOe95th0n8tfLD1hclcKd:A/5IwkQ6WzrnT08tfF6q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809928, "uuid": "14bbbc96-2342-4d23-8e9d-f592d205fe4f", "value": 1239040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809928, "uuid": "a06bd49d-9396-4fe7-b1bb-d8458c4276a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809928, "uuid": "44a15a15-3acd-4734-9d59-3e07251ad338", "value": "2cfa6c6e8069781cac1cee634e4fd346c714b7ebe244c92c8ca02d0b240e0f5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cc35140-192c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772781267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781267, "uuid": "d4f7a36f-fd7e-4d0e-a983-8e59d6fafb29", "comment": "Malware payload (Mirai)", "value": "995eadb4c672b09f2acf57654f18c05b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781267, "uuid": "9ec19296-3370-4a0b-be9e-a3870e8f83e5", "comment": "Malware payload (Mirai)", "value": "2cfdca173c2cf8cc5a12827385f6bb6d69ba5b690084784806aa868989686d3b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781267, "uuid": "8ec09729-7603-4ac3-85fa-5afbe44b662f", "comment": "Malware payload (Mirai)", "value": "ad3e8b5d0c72a4a1e093cef20d5eea566e2d3fde", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781267, "uuid": "087b519a-fe14-40f3-bea8-9f199319bd67", "comment": "Malware payload (Mirai)", "value": "74d3849e6f3da84262ba7ed01a8f4593f749ceb95d6916c2ac474c3baa958077de6a5fa7603b8575827e583ff4d3db75", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772781267, "uuid": "b6f94398-1f73-4748-b537-b91be55f840c", "value": "T1E2F30946F8818F15D5D256BEFF0E128E33231B78E3DE72029D245B347B8A86B0E7A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772781267, "uuid": "1c70a812-eaf4-45a9-98a5-a1b59f042685", "value": "3072:uhdez2TTkhbUqwClsfg3aOAz+M6+xJnJRNnCshypTBH:uQ2QxRsf6aOy+MVnjEayplH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772781267, "uuid": "a2ac46d0-bb1a-474c-8fd0-40e473817c3c", "value": 160796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772781267, "uuid": "a145400a-9b86-48c4-9a91-93d012f5514e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772781267, "uuid": "7bc1e5cd-fe11-4918-8197-3b6e144c1d82", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89a7199b-1969-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1772807649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807649, "uuid": "fd1e7fd8-778e-4c3f-b291-00ca7ae94200", "comment": "Malware payload (SnakeKeylogger)", "value": "c5a78318e683283b1a4eb7d847f4018e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807649, "uuid": "848b7fd1-1b49-40de-8eb6-9a1f60b9bd2b", "comment": "Malware payload (SnakeKeylogger)", "value": "2d01c3f31e4492fb29868a71df7f644a3b9cdebbdea08c70971c48216176853e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807649, "uuid": "caf28433-857a-4b96-bef1-73d59c965298", "comment": "Malware payload (SnakeKeylogger)", "value": "d5909725bb1f7f52d675d681261fc56c434c0426", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807649, "uuid": "a6f80a3e-bc29-4df4-b7f2-dd6a8d28cd19", "comment": "Malware payload (SnakeKeylogger)", "value": "078faf41a45b6980e4405a19bb67035f637ad0eeec840f7e52e3c2e0e808d2cf7fab8bc5fea91ed47df354cfe0bf37d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807649, "uuid": "bb9e4bef-16c3-4836-bfa2-d14d93f24e77", "value": "T130F3128B5113EB9AE86B5EB0F96C633DC1F13E870A5E0683C39E75127C344FC10A2A19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807649, "uuid": "52cd3460-ccb5-4864-a431-9b44bbb010b7", "value": "60559adcf3698c3eb3c69577ebf28413", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807649, "uuid": "8d12cb79-5799-4445-84c1-92fe4ee1cc4f", "value": "3072:yngLAcQCydu0Dakny5DVsWZgdAnekJnenaIxtPqkzyfxHXhT6GsOL:nfQCUu0DakmRd6OtenHMkghsPo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807649, "uuid": "3caf39e9-dbfb-4c65-9866-341abb5ab703", "value": 169984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807649, "uuid": "c11900b9-9b59-4c41-bb3b-1f4c90c44e88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807649, "uuid": "2f7f9e17-b723-49ec-a17f-8eb75ebf5752", "value": "2d01c3f31e4492fb29868a71df7f644a3b9cdebbdea08c70971c48216176853e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3d732b0-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772809948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809948, "uuid": "dd387bfb-683c-49f8-b3e6-e159b71e5740", "comment": "Malware payload (PhantomStealer)", "value": "035dfd4d5cb12a6a174d0a7397e64b9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809948, "uuid": "e1d7437e-637b-4ec6-a17f-0d242a3ae717", "comment": "Malware payload (PhantomStealer)", "value": "2d25183399313fb16386572a5da861ae441a78f488c2c5f8ba771849b36816df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809948, "uuid": "8f7f7ca2-14ed-47dc-baa3-c919ec932a14", "comment": "Malware payload (PhantomStealer)", "value": "171523d6ca08d08ab25735b2692af7b551cd5673", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809948, "uuid": "4b2545bc-cfa6-4d8d-9b8f-62d1eb16c2c0", "comment": "Malware payload (PhantomStealer)", "value": "55665b474f1c5f14fd0262773cf01f55818f7fb5c0a6af24a84828bbbf9eb3bfbd1d0a1f3431357ccd219a28cb6b493a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809948, "uuid": "985e591e-ccf8-4e09-8041-f4e099e613a2", "value": "T1BE652348B2AEDE03C4AA0AB41A50F67433741E8DB51BC2535FE6BCE7783A3E45945387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809948, "uuid": "def53768-1848-4592-af03-e5d1a32c6647", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809948, "uuid": "254bb0a2-0768-4fe8-aa0d-601131ddca15", "value": "24576:2/G6TkKRY+FsWvh1xwRJ0xvnHbBeMEnIZm0FMs7BStd/L/wfLWPO+g9eYe9SiLlA:2/GsK+Flvhn6J0xv7gmY5b/L/wTLx9U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809948, "uuid": "ceb843af-86c0-4d73-8f9a-3e3708088b27", "value": 1548800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809948, "uuid": "aeed338f-c3bf-4deb-9dd5-191b044a5031", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809948, "uuid": "c2bfb048-6071-4924-a167-659d0a29a5ed", "value": "2d25183399313fb16386572a5da861ae441a78f488c2c5f8ba771849b36816df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a41c055-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1772819193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819193, "uuid": "02c0966f-6f62-4770-b60d-d9b8c9d97e40", "comment": "Malware payload (Gafgyt)", "value": "801e0812d1e3d4242a92e89c938892cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819193, "uuid": "e0f1319d-ff77-4f2c-972a-6f90276ddf83", "comment": "Malware payload (Gafgyt)", "value": "2d45e9558705c9a7e6ced29e5989a8958b9c689874169cd879d0170485d36c06", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819193, "uuid": "dbfa3485-f171-47e0-bfff-2a94528e775d", "comment": "Malware payload (Gafgyt)", "value": "b5bbafe09ec3570bf7ebfb921e206132234965af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819193, "uuid": "10d4b680-b898-41d3-a8c2-b31e33dcc7ef", "comment": "Malware payload (Gafgyt)", "value": "cb85d22084ce9541c6d22771b087bbc7ec15e5fc89efc883ac50add901ee403e5c55f919d8641a404f1f8668661f5e1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819193, "uuid": "56095f04-a2cb-4b94-9027-f7c74e64f397", "value": "T17FA24C928CA40E14E65D7AF0B1214F367723FA68DB072FBA1A1745549093E8CFA5837F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819193, "uuid": "ffbf4075-bbd6-4312-b94b-f937297a2d28", "value": "384:6SYHWhYQ5gmwHuOUM5lXg73+EU3sUmIqog+R/xqBHImFsEe:6S8KYQ5RwOSSLpUeog+RxU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819193, "uuid": "6fe7553f-4a91-489c-b567-9580a243bb88", "value": 21480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819193, "uuid": "f679af30-3c62-4436-a772-44540c3b8012", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819193, "uuid": "95597f87-f864-41d0-801e-c6de5220edcb", "value": "violetsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10a1760e-1982-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772818184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818184, "uuid": "1ab6a208-f0af-4fda-be74-a807e539c45a", "comment": "Malware payload", "value": "209b5ac518dbf3faabbaac295ecd8e01", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818184, "uuid": "df1a8930-9fe6-4750-afd4-8ad536b427ab", "comment": "Malware payload", "value": "2d839c9e682c3061140b88ecea85adf03e2b341e7db2c60b2c274fbb88bf667e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818184, "uuid": "4a958fc6-2961-4333-b78c-15ff07933b0e", "comment": "Malware payload", "value": "d3cbf03435b944e20dbc6e2ff09ccc640d1907cd", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818184, "uuid": "a6052dfc-30a8-4f98-9c4e-a9671d7cbdd2", "comment": "Malware payload", "value": "8cc38d6f18c4b669c5e3053f7c01fd6a2ca6b1be668e577bc912db1707ebdc6369828fd06f91615aad220a26ff82e0d3", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818184, "uuid": "98f53104-c29d-4743-833d-446a135ce075", "value": "T1E9862323E28EA33EE46A593549729A10543FAE61541B8CB3C6EC7D4CCF395A01D2EF47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818184, "uuid": "20f9576e-b07b-49d9-aefb-04a610980810", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818184, "uuid": "ba6765e2-1b6c-440d-9e4d-89f12132e404", "value": "196608:rDbPuzokdemm0hWrUatDQzZUVeUx3AeEKF19pKScaJ:rDbuvrhQVKUV/uKF19p9J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772818184, "uuid": "9e2f70ce-6a77-4755-8226-5f88baa12c3b", "value": 7904769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772818184, "uuid": "0f37c89c-c239-42d1-8e4f-7e1c34e35108", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818184, "uuid": "ab4a91df-09b9-46c7-8f0b-2587b38514a6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9269cf00-1968-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772807234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807234, "uuid": "0d57ad44-14ca-4db1-9218-330e4d1d7af8", "comment": "Malware payload (Mirai)", "value": "129ed011cfa9904fa52ad150b6950824", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807234, "uuid": "bafa9d91-06b7-434b-b2d3-a917d433dc92", "comment": "Malware payload (Mirai)", "value": "2dcd703a5aae615d2311be8729842009e2bc09fc514373ad9eea879b28983bdb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807234, "uuid": "995de2f3-eac7-444a-b7e2-45e8fa28c4a1", "comment": "Malware payload (Mirai)", "value": "872df6ab8532fe3d1b1245fc147bb4927b92d4a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807234, "uuid": "b996ff76-3a8b-4a2f-bd7f-35003a06431d", "comment": "Malware payload (Mirai)", "value": "3889bc63174f0acff6e30462668fa6639312b507befdb735334a972076455ffa952a3d878d3f03ad11aa0ae0c6b60e00", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807234, "uuid": "9ec97cf5-6636-4d2b-9920-dd86514f73d5", "value": "T193141B85DA417F63C0C66BB9F6DFC24133B39B14E7A723059528AFB03B867994F26106", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807234, "uuid": "2bda5196-a929-4d6f-b2f4-2c292f1fa482", "value": "6144:frMHGxaaVAlBXXGq/Noj1dbBciM/RFqfaXxmk2WdZyJl:fIHGxaaGlBX/FopPcr/rqsxmkDdZyJl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807234, "uuid": "370cfa60-8212-463a-9722-c74c06fbe7f0", "value": 197198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807234, "uuid": "80207193-25f7-40b3-8667-165cf87d430d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807234, "uuid": "2ffaf4e2-6bcb-4a5f-89fe-6fe1dc9697fa", "value": "m-6.8-k.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5705ee83-1950-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772796827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796827, "uuid": "290552c0-adbd-4795-aa27-a20b11f0a33e", "comment": "Malware payload", "value": "453a4b09014e457346f4aa06d7e456de", "object_relation": "md5", "Tag": [ { "name": "94-158-245-153", "colour": "#0E67A3", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ink-approval-com", "colour": "#8059F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796827, "uuid": "c2a36d7a-c652-4d00-8d3d-23b6b32473bb", "comment": "Malware payload", "value": "2ef95cd2ef6b59eddc3283a77e818442ff330a860199c61a7e16c0bd5b24091b", "object_relation": "sha256", "Tag": [ { "name": "94-158-245-153", "colour": "#0E67A3", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ink-approval-com", "colour": "#8059F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796827, "uuid": "ea5ecbf6-c755-4562-a5f4-e9fcca586273", "comment": "Malware payload", "value": "b1a13a8bb1e3f763aacfe7f6090b2456496eeb97", "object_relation": "sha1", "Tag": [ { "name": "94-158-245-153", "colour": "#0E67A3", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ink-approval-com", "colour": "#8059F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796827, "uuid": "d54f8c70-865f-4237-b6f3-48879ccc8343", "comment": "Malware payload", "value": "e52967c8e432ef1f4dbff013eb6adcfc0e15cf2b7e101f551e67987b072814a9f9518b96674734aae218501b1ce682fa", "object_relation": "sha3-384", "Tag": [ { "name": "94-158-245-153", "colour": "#0E67A3", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ink-approval-com", "colour": "#8059F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796827, "uuid": "9235d79b-8cb4-4236-bdfd-b1483fb3f974", "value": "T1A1E12BFA81C861028F4757967B92BE8D765ADCB04363FC9E7D21618EC201B1ED821D77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796827, "uuid": "2f065926-d9d1-4fe4-b75f-0014033048a3", "value": "192:4UBmYXJjRm35n34+e3JC9n5o0HwJC8MkEGMJPvo96K8Xcca:4UBmkhS3re3JCJG0HwJC8vEvA9TgcV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772796827, "uuid": "9d34fc35-f3ed-4981-ba39-3556e8fc45b0", "value": 7075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772796827, "uuid": "bc4b7425-aa9d-463c-83a4-05ce98aeda86", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796827, "uuid": "7b7eeaf6-9edf-4109-a293-969e423572a1", "value": "evidencelumber.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaae1170-196a-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808241, "uuid": "bb02ac73-5116-4e0f-9b75-fb717fb2f8aa", "comment": "Malware payload (GCleaner)", "value": "3db28b9de21ee47617d78a050b40a550", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808241, "uuid": "1d76b377-cbaa-4282-8197-76188b81b756", "comment": "Malware payload (GCleaner)", "value": "2f37a16f1b50df0851d34e6075a36055ba8ab1bc7245944ad586247e3451852b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808241, "uuid": "7c6b4779-1f5c-48bb-9159-b671c323833a", "comment": "Malware payload (GCleaner)", "value": "834ea45cf88e2f576373a1600493688b7f5dff31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808241, "uuid": "208707ea-db41-4a10-9914-189f41e67e98", "comment": "Malware payload (GCleaner)", "value": "d5a564589deced522c208cdd396496281cf42d552f7654bb93531b55b5e5a635710436aee46b9205b3b7289ddb932c89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808241, "uuid": "941fec81-e717-49bd-b49e-d8b693e1c79c", "value": "T17706F19812E74D7FC7296FF81CD131B4992FBF009CE89E8997A58C195E5E8F03098DA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808241, "uuid": "be8b18b8-ab83-4728-8488-3b8ba192e50d", "value": "336c69b6e8562d1c5231f219b62d7473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808241, "uuid": "83b385a9-1309-4486-864f-4d58cbdb1bac", "value": "98304:X9zuuYXYvlekegQEByWCvtRnfNGmErIaYzo:XUXcQt1WC/fN0i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808241, "uuid": "b9b6c722-9b43-4bd0-9773-948f5a4f60c8", "value": 3919360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808241, "uuid": "cac2c459-f65a-466d-a032-9273a6bd2c8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808241, "uuid": "62e8ae50-df1c-4b4a-9f7e-47eb98977fc7", "value": "2f37a16f1b50df0851d34e6075a36055ba8ab1bc7245944ad586247e3451852b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfc7a3bc-196d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809512, "uuid": "5ac96c4b-ecf7-4de3-bdf8-9e9fbb132e37", "comment": "Malware payload", "value": "7687bcff0459b9da2ce1ded5c127d07b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809512, "uuid": "bfadf190-b4aa-4894-a40e-e74c2ad8842f", "comment": "Malware payload", "value": "2f562924165559feab82e3cf0fbec9c7691a7db7c4964a9020e6c4bd6e6628a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809512, "uuid": "ce775e7e-4e69-4406-90db-f53f4ab962f0", "comment": "Malware payload", "value": "bb42db70f90d6122093d36f6d1fd125943adc5d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809512, "uuid": "fd0d7e3d-7926-46b1-94fb-47464d356248", "comment": "Malware payload", "value": "449690dd0c6ad080e014386226144636d964363173bcd601f1c09fadf403a3eb15e810e5c1d20c1fb4a9a0c9e0af0237", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809512, "uuid": "61c7ed63-94e0-427a-9a30-b7b155e2921c", "value": "T1CA2522381A65EE03C1D50BB85C71E27947B88ECD6562D6034FD5BCEB78BA7A068843C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809512, "uuid": "1a0b759d-bfb5-4014-b9c3-6217a9be1a6a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809512, "uuid": "57643d47-5794-47c2-977d-0d525af76f79", "value": "24576:l/GibrIp30C+entWJ6W6aTH5QAbptdXySQ3Bu:l/vAEIccW6az5QA3pyS4B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809512, "uuid": "1cf3bba0-f816-4338-b172-3662f70e13dc", "value": 1032192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809512, "uuid": "b5a5735f-1538-4262-85f9-1ea89b10966f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809512, "uuid": "8ad0494d-7eba-4b23-9f92-b64c14307645", "value": "2f562924165559feab82e3cf0fbec9c7691a7db7c4964a9020e6c4bd6e6628a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e2f15a4-194c-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1772795121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795121, "uuid": "cfbad896-220c-450e-b68f-c8f102fa3425", "comment": "Malware payload (CountLoader)", "value": "32d854912f58bbd965031a5a7eed28f2", "object_relation": "md5", "Tag": [ { "name": "37-221-66-127", "colour": "#F2F866", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "explorer-vg", "colour": "#86C1A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795121, "uuid": "64c96f3e-322e-43bc-b7ac-c06c793ce738", "comment": "Malware payload (CountLoader)", "value": "2f56a2d6896008f4b85b1ffa1beb9ec044a4ca70794db3fe2dccf8a5912a03fc", "object_relation": "sha256", "Tag": [ { "name": "37-221-66-127", "colour": "#F2F866", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "explorer-vg", "colour": "#86C1A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795121, "uuid": "df0b2278-ba64-49d8-b9fb-e9eada741636", "comment": "Malware payload (CountLoader)", "value": "e94e5603d784eb25ff706e07bb496b9a8bfe0f05", "object_relation": "sha1", "Tag": [ { "name": "37-221-66-127", "colour": "#F2F866", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "explorer-vg", "colour": "#86C1A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795121, "uuid": "e151675e-8f9d-4796-8d3e-485e78e3f526", "comment": "Malware payload (CountLoader)", "value": "f9061439c4c3b2be7c57d5753b472e3d125af68073f20b66e64799311559de11e1354cb66c31c7fa18be2c22b1a4fe5c", "object_relation": "sha3-384", "Tag": [ { "name": "37-221-66-127", "colour": "#F2F866", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "explorer-vg", "colour": "#86C1A0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795121, "uuid": "8c90077e-c3c7-4f5f-b1b8-3ccedfc03d28", "value": "T11EE523ADBEE9545DF0980378CBB2060257237C779AE64EDF301872205FB22852D76B5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795121, "uuid": "e9075289-33ab-4054-b92c-0870c56a63a4", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795121, "uuid": "6c059140-1764-4505-a044-e1bf6512c54a", "value": "49152:np/0auwTKqDdbeaT8gXbzBwyx9i/jfRPeuoW:npAwVBQMbFwcYj52U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772795121, "uuid": "4b16d535-ead8-4b5d-9874-baa8663c0090", "value": 3152894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772795121, "uuid": "f7f387d1-fc1b-4e6d-a94b-a7e3b00bfd1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795121, "uuid": "223763ef-1dda-404a-8c2c-86e2af16fefc", "value": "Setup_Installer_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d03a100-193a-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772787254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772787254, "uuid": "7fe20a05-ef49-4875-972f-b13937c92d70", "comment": "Malware payload (Formbook)", "value": "8a3541629d3a562f18082b4d79eda869", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772787254, "uuid": "b585e686-647c-47f1-bc71-a8723892046f", "comment": "Malware payload (Formbook)", "value": "2f8632acd66d9798cfbc6efac4e900c1ec6ec5600e11f58fcb2da0286c016887", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772787254, "uuid": "0e957d20-bd99-41cb-b6e9-d62db08f58b3", "comment": "Malware payload (Formbook)", "value": "839ec03ca4e2e928987e99c193c0cebd0754408c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772787254, "uuid": "df511b27-a457-4014-b579-f989af9d8329", "comment": "Malware payload (Formbook)", "value": "06d1c3b4d7c95ac1cebc639dddf4baaf2b5e4494a82635fa07c01cd729d103c2afb68aad41ad8622cabd70bb1e2ec8b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772787254, "uuid": "7b635cf0-c8a7-487b-84d2-79572571efd7", "value": "T1B354231225356897E06918FAC0676CD1E51FC3BEBDB266C6322E495AE47A00C1E07F7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772787254, "uuid": "031d9543-ad8e-4de5-98d7-eeafb611ce2c", "value": "6144:J1edRiAhijqxDJrkR4w3UcmIwuXaw0rfUkX:JcTxhVxNg4w3OIzKvrrX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772787254, "uuid": "80c8e4ad-d82c-4566-9a24-75ea8a2daaa8", "value": 293380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772787254, "uuid": "7cf2974c-5d53-401c-81bd-bee3e161b34b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772787254, "uuid": "f6f9009c-62c8-4003-84c8-cd634f2a0160", "value": "SecuriteInfo.com.Win32.MalwareX-gen.68616644", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89816b3b-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819245, "uuid": "f6153204-f98e-4efe-849d-f7b76ef6c02b", "comment": "Malware payload (Mirai)", "value": "11bdbe144af165893691c7c2eb4167c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819245, "uuid": "df8c525a-5338-4c2b-a243-65ed5f35bb55", "comment": "Malware payload (Mirai)", "value": "2f8c0b7c42ba3387afaaf6d1dccb749d5a23065e2d239213dd30b1ddd77e14ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819245, "uuid": "1a0551ab-4fbd-4042-aeeb-e5da2f2da280", "comment": "Malware payload (Mirai)", "value": "d37dd334ca064302e54ebf31902e9a1e2e442212", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819245, "uuid": "e8e7390c-c157-49f5-bc92-9b5afa6e5d7f", "comment": "Malware payload (Mirai)", "value": "e5c627fc29e1ae9073dd8aad32407b6026bb7157a9011850e647450417ac609c2dcf4ae245ee4abe1508ab163cf180ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819245, "uuid": "e764d2ad-fc7e-4c50-8e9d-1284ef61a0f2", "value": "T1C7242A93F905DEF7F40EA77604D30B257232FB610A531A32B21779699E3A2C4246BF46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819245, "uuid": "af3c32e6-8d8d-406c-b0bf-9e070943186c", "value": "6144:coiP/vwnyxRXh7VJu8upxLQCeZe4NWevDOjFc+Sctha9byTuC:SPwkumCeBvDOjFc+Sctha9byTuC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819245, "uuid": "e1beb7ed-cd21-42f7-8d0b-8c7f9ca49a7f", "value": 229748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819245, "uuid": "9fc15b52-e656-45d8-ae6e-6c521a8911a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819245, "uuid": "d81f79a4-b2a2-4071-8d25-17b12e986efc", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "178c892b-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1772809176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809176, "uuid": "a9887e9d-1f04-4cd1-a0b1-4286a5f95593", "comment": "Malware payload (SnakeKeylogger)", "value": "1cd744ddafa95131b6b6718e0c823d4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809176, "uuid": "2c61db43-d0db-4e77-b620-1ea355421545", "comment": "Malware payload (SnakeKeylogger)", "value": "2fa3ce0a1eb7d35983af0fad9bc133bce29a296fb0a246cb9942e3bf913ffc80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809176, "uuid": "bf5ab01e-d82b-4f5a-81f1-4507e3314fbb", "comment": "Malware payload (SnakeKeylogger)", "value": "f24a79d29ac38b4ff28ae2bf65c5487fe394a5c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809176, "uuid": "dccf9b02-58cd-4662-822c-bdb5899b1b96", "comment": "Malware payload (SnakeKeylogger)", "value": "e8ce7497ee1cb1f6a0f226aa4a4ddc4c202fea4cc004817ffaf8ffa0af14818006c28e18fa081708160a050f3bd62a9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809176, "uuid": "bbac693a-94f7-4de3-be96-7f6d24f73aaf", "value": "T1885512442379D902D0B60FF40AB1E2B58FF95E8AA922C3539FFAADD7B9363501D41247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809176, "uuid": "efcb7e63-93a8-4afa-8eaa-8907dd3d4628", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809176, "uuid": "11d067eb-a40d-4c01-a457-1caf10bf3abd", "value": "24576:Cqu2V3lnO2nEGAlwsvmfak9hmz6GfKs/g48JqECAfbMZa0fTu0z0UejY7XM:CeV3lnOmRAHv1k9hdGSshEtfbmRfTu0G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809176, "uuid": "4aefaa98-5c64-4d5b-93cb-65ffbe16100c", "value": 1314824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809176, "uuid": "5ce5986f-7c81-4da2-babc-5a0188eaac92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809176, "uuid": "13f0574b-56d7-4d4d-b592-af0fdbddd057", "value": "2fa3ce0a1eb7d35983af0fad9bc133bce29a296fb0a246cb9942e3bf913ffc80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "136a0252-1956-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772799290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772799290, "uuid": "23ec7cfa-4467-4774-9928-2f6d7d60f27f", "comment": "Malware payload", "value": "4af488ba4abe900683477bb2a1065ca6", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772799290, "uuid": "d4d7415e-f824-4927-87e9-06c4774642b0", "comment": "Malware payload", "value": "303a09eb23736481748f307d4945bc332a76f45a2fa5fc137fcfdc009b4cc289", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772799290, "uuid": "01396016-480d-4aff-a3e3-a9b770358086", "comment": "Malware payload", "value": "fd76103e4a371e9b3a04bbe9adb20055ee2a25f9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772799290, "uuid": "35c37316-8c04-46cd-83a8-1d21724a42ef", "comment": "Malware payload", "value": "3748794ebc3064c8030b672d257943d6bcc2f5a9b13387fe920b89f1de6614b6466dbd0070b46b8f22a2f0f31cc278dd", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772799290, "uuid": "1db22b2e-16c3-41eb-afe7-8e4ab1f0315f", "value": "T104C5236642E801ABD576077659A2F27396B97C644B2360DF32D5FD2BBE323C22431B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772799290, "uuid": "1c309df7-e58d-4538-a95f-0793325e272e", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772799290, "uuid": "4b1480dc-818f-409d-952d-b464b6ee3b01", "value": "49152:i3peTk2HGvmGrjbYnOcHjo1Is+E00m5EcC2kpleD:i3YTJHTy2OmZVE00mycCtE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772799290, "uuid": "85ff0b32-c2a0-4869-bb59-610a10226c4f", "value": 2647856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772799290, "uuid": "f15ec90e-df12-491e-9439-925a1ff1b467", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772799290, "uuid": "1ee53a38-986e-4cc8-87b4-76a5c42cb5ea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "035c85d6-1973-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811719, "uuid": "ffaaeaa7-2479-46e8-a325-652908b9b64f", "comment": "Malware payload", "value": "b609d88dc6a7fa489af9f6784919c833", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811719, "uuid": "b7746c9c-1cb8-4542-86e6-fbf2ceab8c26", "comment": "Malware payload", "value": "305a37e5c5db5879c66a8516b8366b15fdff7e968ebf307864098d6fb6953fb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811719, "uuid": "b1e6112f-9006-4d85-8b02-0a428f482694", "comment": "Malware payload", "value": "4abae6be98c093f8bfcfc86fb342478b597146e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811719, "uuid": "fe0bb22d-281d-4791-8400-aea7abe18537", "comment": "Malware payload", "value": "490bc9548fb785b47823a7ee84bd8cbc0075fe07a58702a68ed34f45f6bdb5423ad3c97a1f7704eb98667b041b005d33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811719, "uuid": "73b70800-6eba-427e-8651-f10dccb2d45c", "value": "T13725230920BCD002DAE612F445276365EDF72E569060AB8327343F7F7EF69B1C41A6A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811719, "uuid": "2368fbcc-613a-48b5-9bae-b89ce1d76340", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811719, "uuid": "06db83b0-203b-45a6-a0a0-eff73b3b6df6", "value": "24576:gXaVX4O/PXPWtiVM5sfWx2j7IRUCAm504gmfZoeYCQ5:i6hPOQAspj8t04gmmL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811719, "uuid": "d800fe36-d2f0-42ff-bb83-fc2880f6a46f", "value": 987560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811719, "uuid": "cacf03d0-cc2d-4771-bbca-ded7ba7a28a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811719, "uuid": "bfb0fdf0-40df-402a-82fd-54871fc6c052", "value": "305a37e5c5db5879c66a8516b8366b15fdff7e968ebf307864098d6fb6953fb3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9f8b4bf-196c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808992, "uuid": "265f0246-6ddf-4012-adfd-335c6f602a45", "comment": "Malware payload", "value": "d89b02b9069a753ab5093a6ce407fde6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808992, "uuid": "98f3afeb-c41c-4a1b-bbe0-57e5ffc396a8", "comment": "Malware payload", "value": "3067ab57df2d64d01ba4bfd933095e1949e982382926ee073ad0786f00548db0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808992, "uuid": "3340aed4-ad4c-4664-9c19-cbc06edd41e1", "comment": "Malware payload", "value": "23a51ec5cd6762eac4bfabb58ec9f0165265100e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808992, "uuid": "9f49b993-a2e4-470c-9ebf-e08db6afed91", "comment": "Malware payload", "value": "f1a8dbac79ac4e8210574dd0cf9ed4bdf5e2ccd3e037553513cf71ee592a81fc2ad767dc20ad60ed75367c311fb33315", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808992, "uuid": "47f36b07-9607-485b-8e41-136ab66ca865", "value": "T17315232119D1DA83DEA61630343A46B36AFFED375E68434E1365FB4D2EB36430A0B352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808992, "uuid": "0ac056be-36ee-4551-b8fd-179ab20763b1", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808992, "uuid": "7472f9e6-02a7-4b7e-96a7-681a141e5f80", "value": "24576:gN84ClJtLYRZX+5kVMMvjSxifGkFL1bbxJDQVuoqjyFa/nJNGrka:An6URZB/9fh5VonKUahQrka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808992, "uuid": "7ed617bd-ce29-49e8-a2cd-681619f0079d", "value": 884591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808992, "uuid": "fadbe081-cb5d-4043-995a-0c15d96e78e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808992, "uuid": "2c79b29d-37fe-4499-a0ad-2323cb756076", "value": "3067ab57df2d64d01ba4bfd933095e1949e982382926ee073ad0786f00548db0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9f6eb16-196c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809072, "uuid": "2830dd1e-c296-442d-87e2-84a4d08c5f61", "comment": "Malware payload", "value": "d7f9b9a0fc34553552a08a83d3e49d60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809072, "uuid": "9125c9db-2f53-4230-a4ce-6da2e10504c5", "comment": "Malware payload", "value": "31113f22d502f729d5fe022e54d1fc0101056a25c622c4b537f5fd1b98b599c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809072, "uuid": "7a4a38f4-16b5-4627-b7bf-9f896ed666ff", "comment": "Malware payload", "value": "13908b2f0dc7aac2b99def438958e4b04d041391", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809072, "uuid": "10273534-287c-42b8-8a00-4f9e3f5b3803", "comment": "Malware payload", "value": "9189b3395ad93af4f71f2d6f2a74679240b629b69e4fce8f89c9c5d4c207ebfa1a9acf0ac54edffdbdccc590bbbdaa27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809072, "uuid": "10bea9c1-286a-4660-8360-e3807b0310f8", "value": "T197841248B675D063D8658A712C1BABF30A64EE162928432F37807ADD3D7079DFE0D399", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809072, "uuid": "f8715065-ddd6-49f2-9ce8-b4bd1b703dde", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809072, "uuid": "12a7fc1c-d8a4-4bcf-a586-007159498233", "value": "6144:A4t6LsyAWYRsw3HWstpqvp2Ocmrx27o62C6Prv7FV3gQmS7l836PcjbeQ8AFQTH8:AkdW+Ttovp24Co62PTvfJUjbhqH3sb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809072, "uuid": "4d64975d-adde-4a8a-be5c-63b23a383226", "value": 385912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809072, "uuid": "1907c14b-e353-4d55-94bb-b47b2963e5e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809072, "uuid": "4c768dc5-7dab-4702-ad87-7d0f705b025a", "value": "31113f22d502f729d5fe022e54d1fc0101056a25c622c4b537f5fd1b98b599c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89883ac8-1982-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772818386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818386, "uuid": "42294c90-9e73-4e4d-b968-4ba567909c07", "comment": "Malware payload (Mirai)", "value": "2688b64303ffad23b3a276656a5746c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818386, "uuid": "a0f309b5-fb04-4a02-979c-1d30e086e4bb", "comment": "Malware payload (Mirai)", "value": "31429fffba08d2eebbf70e6ef2efc8a4560c981a91056c750d2a72ac99edd543", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818386, "uuid": "dfb541c7-d667-4839-b5af-535ba80ebd49", "comment": "Malware payload (Mirai)", "value": "e703c02b50fbc552a25cc4dcfd39423f921f3fdc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818386, "uuid": "1c835a45-f5c2-4cdf-9fd6-3354fb0c805e", "comment": "Malware payload (Mirai)", "value": "c5582d74f2a88280fa79b160a8452442fd9c96534d25d9200a17375d2b2dfea932d1e5a030149aa4a743a448b219b120", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818386, "uuid": "803b69cd-c965-4716-9043-cb7e5815c446", "value": "T1AD041A05BF150EFBD89BCC3B45F9270529CC581A22EA6B36B934C858B54B25F1AE3D70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818386, "uuid": "41df03bc-c69c-44c0-ac1d-b6a587c14dd5", "value": "3072:J60NEpL/RdBtJN9xFZ9hkOmG5RdelJgtTwn2APPMuEzvQ6WJ9G2/7ZiYlTBVmJTT:J3CTRdrD5GFnrPUNsNzZt06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772818386, "uuid": "89b49206-daee-4f4c-a3d0-6e9e108fca73", "value": 179916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772818386, "uuid": "ab8af38e-2082-4fab-8ced-d947a2eb1b9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818386, "uuid": "aa04b79c-aa6f-4264-b5ac-6898604d7181", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d29e01d4-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1772809060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809060, "uuid": "636598b2-d303-4af3-b4f9-265f5b505e35", "comment": "Malware payload (GuLoader)", "value": "7578c0ec048e56a8cedcb4a67b4d44b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809060, "uuid": "b8be4256-3cec-45a0-8680-b730bb607101", "comment": "Malware payload (GuLoader)", "value": "31a6b7c0fff43f956bd590b85502b6da248574fb02f692aa4f9fdc4cb88d5197", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809060, "uuid": "6dab1a00-85d7-41d0-bb92-4ba7cf893761", "comment": "Malware payload (GuLoader)", "value": "4d0d717a851d011bc44c8a36b08411b8d031b878", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809060, "uuid": "29d73488-59d8-439f-a7bf-17d2e18a2190", "comment": "Malware payload (GuLoader)", "value": "9a97bc817fd569b3d8e5b57bc4fa27a81592fafaf1b281edd8754bec41a2a56839d5b39671597500cb343c4f2dcdedc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809060, "uuid": "0bef86dc-dd0a-41e4-be45-71fe182ebffe", "value": "T1386412453B20C0B7E5A21EB02D6A3E974EB2CB051828A75B27607FDD7D327569D0E387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809060, "uuid": "7720cc65-c296-46b5-8d7d-a7a9a820b362", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809060, "uuid": "f7061af2-f703-4906-9d35-c59f77c7e4a4", "value": "6144:k4t6LsyAWYRsw3HWstdrAjMAUKtsFWEm4hQ3W0Qx5TDdjJtcl6O:kkdW+TtF9Ktu1h0Qnyl7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809060, "uuid": "2546245f-7f39-4dda-92eb-46ac7d6c8806", "value": 324840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809060, "uuid": "f09d0faf-c75d-499f-993a-cebb39a51de1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809060, "uuid": "b80390d7-7716-4198-a18b-2a935edbb58c", "value": "31a6b7c0fff43f956bd590b85502b6da248574fb02f692aa4f9fdc4cb88d5197", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "509b2436-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808412, "uuid": "eb2b16fb-baf2-4db0-8d96-de5c0693c4a0", "comment": "Malware payload (GCleaner)", "value": "8301a3ad053bcfbc35b975b8c68ab2ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808412, "uuid": "9eaa637a-361c-40b4-aed6-af102f4139c6", "comment": "Malware payload (GCleaner)", "value": "31b10e25d4a9385c3f7d512dae95370bf3a63a86f799574c43e464b8df291969", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808412, "uuid": "07983b12-7b65-426f-8b42-a000c3d28ead", "comment": "Malware payload (GCleaner)", "value": "40dbc90d6f20d5c02b418a0adf94a4c27559d44b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808412, "uuid": "cf209455-01a6-4c04-878a-fd4b20d42637", "comment": "Malware payload (GCleaner)", "value": "a72cf2cc0838f175e722b04ae585f93256289aeffeccda8eeeb44fe45e18d49396d0611a5765ca860e2c51cf34b0e62c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808412, "uuid": "ace8d763-eafe-4bc8-a6c8-f75a890cc82d", "value": "T10236DF0B63A89474C99477BD48AE6FCC4D4BE6543831998E2B514ECF9E1814FECAC1F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808412, "uuid": "6db4813a-350b-46e7-8b7d-12d9556562f4", "value": "336c69b6e8562d1c5231f219b62d7473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808412, "uuid": "d94caddd-b7d1-4b81-8e0d-0cc2bd8d9be4", "value": "98304:19zuU+sNE1mWDSrla12o84EON0KYHs0tM:1z+dwWWMyONIY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808412, "uuid": "98ed91bf-1abc-4cd1-8caa-4eb57c08682c", "value": 5024256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808412, "uuid": "00050371-e5ca-42a6-a854-2d382945ce4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808412, "uuid": "d8705827-8f3b-436d-9de1-b89a826a201a", "value": "31b10e25d4a9385c3f7d512dae95370bf3a63a86f799574c43e464b8df291969", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccb5b2ab-195b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772801749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801749, "uuid": "a0bdea94-8746-421b-a813-5ca59c270838", "comment": "Malware payload", "value": "4cbd2d697fe52b159d4adb4629c0c803", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WikipediaJsWorm", "colour": "#A0BBD5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801749, "uuid": "cc814d5b-5f89-4838-afba-2ae5e878788e", "comment": "Malware payload", "value": "31c242f2e14fed9774288162a41ea430a6b39bf2909b3e583353a6fc0f3e6bb2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WikipediaJsWorm", "colour": "#A0BBD5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801749, "uuid": "3e947881-3828-4722-8705-3a47c0be11a2", "comment": "Malware payload", "value": "fd657992146306c2e1a9ee3a3b64f958e848176a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WikipediaJsWorm", "colour": "#A0BBD5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801749, "uuid": "5beeeeb4-ceeb-4a48-8753-908fca877c93", "comment": "Malware payload", "value": "b74ebf2ac0a5ca5b27ba2cfbac6204fbee621e56400a38f2457081bb7b8c20883693d01420337f76e445cfc8bb5af14d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WikipediaJsWorm", "colour": "#A0BBD5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801749, "uuid": "22acdf87-b4fa-4b6b-8bed-31623ddb496f", "value": "T13DE2DBAC72239C6DDC63256BF19E735EE2601F13F5ACA0507A4C10486FE4C9ED14AAED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801749, "uuid": "cdbaa944-11c7-4b33-9d80-7adb12ea19aa", "value": "768:r/yCus7+KRzihuh0/zU/yCus7+KRzihuh0/zS2:bn17+KROxzGn17+KROxzN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772801749, "uuid": "66ff4f24-2220-463f-921a-fb2943b191fd", "value": 31981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772801749, "uuid": "26556b9d-6fb2-4881-8c7b-06db92359022", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801749, "uuid": "b07f10d9-5948-4601-bd0f-d2e28b80b4b1", "value": "31c242f2e14fed9774288162a41ea430a6b39bf2909b3e583353a6fc0f3e6bb2.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffba5300-197a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772815149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815149, "uuid": "56f4f1d7-4104-4a42-92c9-ce61116c866e", "comment": "Malware payload (Mirai)", "value": "e102509e16d9e46a059112bea113a5e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815149, "uuid": "ecab36dc-0cd8-4efe-a23d-ae1e6be2fa49", "comment": "Malware payload (Mirai)", "value": "31e527a5040594573feaac114ac5f81c8ef46ba2c984f90f4c0c024775b2eea0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815149, "uuid": "c90a31c2-702f-4c1a-9648-cef01b2afe06", "comment": "Malware payload (Mirai)", "value": "0113a383f2eb768fcb43bace752e35e09a626ac3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815149, "uuid": "50dcaa96-5b7a-400b-854a-e21d2e764a8e", "comment": "Malware payload (Mirai)", "value": "55c171760144adf43f6ab8f2e76a28f8aced8b4e20957a0ad9850cb889add88f16d63b430b2e01f28330dff95e7a881b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815149, "uuid": "8eb0b0b5-da24-48c6-8457-4f06f29b1a5c", "value": "T158E30A45F8815B12D5D111BAFE1E128E37131BB8E2DE72029D246F747B8A9BF0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815149, "uuid": "3bb356e4-37f3-4a49-b262-154322af91d6", "value": "3072:Ox/+cJUUoEq9XouuIjoanHidsJLLtSysBkoya:S+4H49XHuIkaHids1ZsBkoya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772815149, "uuid": "763f049e-6e14-4e46-b18e-95070e1bc120", "value": 146268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772815149, "uuid": "fa148ee4-542a-4974-899a-7a4df03eb9c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815149, "uuid": "0b6cd715-a699-42bc-87c9-b9b96020d807", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a5ef35a-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772809637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809637, "uuid": "484c91a3-5a29-4a44-948b-86d5bcee2032", "comment": "Malware payload (AgentTesla)", "value": "3fb8410ee52692b5289649edba7a6660", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809637, "uuid": "5719221b-284c-40aa-ab2a-ee9ca9654076", "comment": "Malware payload (AgentTesla)", "value": "31f03e7a7e6a55cd725d80020ebf7fa35b77a85e131d328445467b40206314c9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809637, "uuid": "f8907c32-caa5-4e7e-a71e-4e24f7bcd29c", "comment": "Malware payload (AgentTesla)", "value": "e319a3d6faea4449afa14fafc8af6cec59e01385", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809637, "uuid": "2880f174-ec14-4e7d-bd3a-b16fc2591a0a", "comment": "Malware payload (AgentTesla)", "value": "86da4cf4b36fb18d27b29eca3bbfddddc6952e8052436110047675336d1fef8401bacd8ef4eea3b9a18e67431d21890d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809637, "uuid": "db703cda-a9b6-4d29-953d-91f64ff0397f", "value": "T18E94F157FB27A860C2864476D9F088FBD7705C63E066083E33527F1A5C3A59ACD191BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809637, "uuid": "87ea150a-f6d2-4a22-a60c-7eafd6897b84", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809637, "uuid": "e24dec5c-b229-4ed7-ae8a-a0a739653861", "value": "6144:LNDlOLZLClTgENjEtqTH9SVTRyhSCBBXjXS9ZYxs3NbOM:Lk8TgENjfTdEyh7lXuoM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809637, "uuid": "6cec62ca-d80d-4217-9a98-6eb1c41d85b9", "value": 413312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809637, "uuid": "0a8f77b1-6971-409e-98f1-4bfba97a8d77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809637, "uuid": "7fac71d0-1c0b-4bc4-812d-f69e13175634", "value": "31f03e7a7e6a55cd725d80020ebf7fa35b77a85e131d328445467b40206314c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9320348-1968-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807407, "uuid": "afef205b-947c-499c-8f64-2ad199e1efbb", "comment": "Malware payload", "value": "1e939b008d9b7257f29613fef5e7a12f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807407, "uuid": "19ff0489-40d5-4236-8d32-7e5cf29f75df", "comment": "Malware payload", "value": "31f7ed8a31c353eedc8fc2e6d3b3c1595cc6b586d97b0d3d4692e0807e52d6f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807407, "uuid": "a0b7c79e-9aca-40de-9a72-8554c76817ed", "comment": "Malware payload", "value": "753a087b0c63eb6747621090d5d6b2ef269289b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807407, "uuid": "9eae11b5-50ec-4cf3-ab7a-09aa340fd317", "comment": "Malware payload", "value": "e57626799f84353b267ee1bd68eacb83dde2638ab05b62fe1698f92b635cd05d2017263376bb37b4b27e78168a44c261", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807407, "uuid": "1f08c284-e899-4465-9ef4-ac6a0f205ba6", "value": "T1532633A697D3C644D043D0311A6352E5EEAD1CE1C5F4137B06CEDE99AAEA2F01E3C94E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807407, "uuid": "742561d7-08e4-4ce4-8a9d-be184a368f37", "value": "459038dd913bd7fa2746dd2acf101131", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807407, "uuid": "02921e6c-57c7-45a1-ac43-981041845410", "value": "98304:V5kOFk2dA35uySfdGe9lhkZxhYDpMeQpxnFZVN+xBdYyLFAqTtvm:V5kOFJApu5dGe9PkZ8MeQpp+xtFftO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807407, "uuid": "bf5b17ea-65df-4752-97fb-9b06701f4b28", "value": 4612096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807407, "uuid": "2ae034d3-1d56-45c6-832f-7a1d5a71f3dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807407, "uuid": "6db067d7-0cf4-45dc-ad3c-597056aa3668", "value": "SecuriteInfo.com.Trojan.PWS.Stealer.44341.10719.25421", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f529be6f-1972-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811695, "uuid": "852e8232-d82a-4ec8-8370-dafc34ad8c3b", "comment": "Malware payload", "value": "f4c849118459cfef69795a64c71e7f88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811695, "uuid": "b5e07630-f183-47f9-b879-b70984aabdc0", "comment": "Malware payload", "value": "3246fdc5c32e6b265880c004ebee3d7aa2d9bcb0c01874c03616e2b736f9e825", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811695, "uuid": "60c3a37e-25ae-4cc1-b34c-9ef26e29a335", "comment": "Malware payload", "value": "636034e634a92fd176726fdac88053413fadd88b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811695, "uuid": "3010ff8a-5a35-4c1d-81ad-8beb6a273590", "comment": "Malware payload", "value": "a63b98f9b772176fe650bf699788c876d87b45cc0c0fad6a3faa96483aefa0b3a31a25cdf5115660bb9faa767e163dd9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811695, "uuid": "e42ce044-50f1-4df4-90f2-d90313f0d474", "value": "T1DD35D00A0EC36B94D1984F78D2A604E827F0D65B5212E36F6FDD52F4DEA3F4AC907462", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811695, "uuid": "2a81bc94-244c-47b9-90af-ab85b8665b4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811695, "uuid": "49ee23ca-eeeb-4f85-98f1-ae7524b8e0a8", "value": "12288:dG5/0OmtTYokGOuXJxNB3+MLi6xsvf5vknREwIi0+FlN6YMSK31xo/R21KObAS4e:05sooNOYwMWgkWEd9qlNc3oo1KObD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811695, "uuid": "52f912ae-af95-4449-918a-e192c6d48aa8", "value": 1157120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811695, "uuid": "c3415f27-a381-4666-9f6d-729f4c00f42c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811695, "uuid": "33ccefd5-6449-4fa1-be54-2976b84f757a", "value": "3246fdc5c32e6b265880c004ebee3d7aa2d9bcb0c01874c03616e2b736f9e825", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a78513c-196a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808080, "uuid": "4f94d43b-9d62-423b-a648-62ff259ea45d", "comment": "Malware payload", "value": "b6b2ac4d2724542e71717f43fc8c63d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808080, "uuid": "de7fde67-3fd5-41cb-b9b4-059bba770753", "comment": "Malware payload", "value": "3277c24c43e3d510767b68bd850d82a29c50088807a58cda091ed91d96832ee5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808080, "uuid": "fdca07d4-a603-4bbd-a748-6463e46d7fc3", "comment": "Malware payload", "value": "371c80242202731d831d06dac55c3e0ae5e906d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808080, "uuid": "911829f7-e98e-4ecb-bbec-9966379b1935", "comment": "Malware payload", "value": "48ac063a52ade80dec50760e395ef00aade4a69a6704f739336d5dc22b46390c156e5265c5e41b4a5409ed7d01cf285f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808080, "uuid": "ebbf21fc-6933-4201-ab9e-59800189dfd0", "value": "T13035E00723D44E68E5BD9B7991BA04E147FFBB479B32DB1CA80951EB0D22B41DE01B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808080, "uuid": "cb14b378-2f1a-4aa5-a467-0ba87407491c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808080, "uuid": "517f4356-06f5-44aa-8f47-ba42ebdbad47", "value": "24576:ssfZNC8ZHKJCX0fI8mVS7zXng07ehUT3mYle:7ZWWgI8mcHgGehUd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808080, "uuid": "7d44cb7c-a81e-4e83-b57c-f978d501b1a2", "value": 1139712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808080, "uuid": "bf63b939-b678-485d-b896-9f1ced4d4b0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808080, "uuid": "6a993a0c-1f1a-4bdb-ab0b-fd57b8d95bb4", "value": "3277c24c43e3d510767b68bd850d82a29c50088807a58cda091ed91d96832ee5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "191a079f-1959-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772800588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772800588, "uuid": "3f9c114d-3c64-49f5-a9ce-e71e46597fbc", "comment": "Malware payload", "value": "34a010186d65142d6936bf00c1b78344", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Trojen", "colour": "#2193A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772800588, "uuid": "5f72b96c-db3a-4e0c-b8f0-2bef1eae73c9", "comment": "Malware payload", "value": "327a404f2ff2562d7e7f49e9fca68bb814128eef47dfea688680de3da91b04cd", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Trojen", "colour": "#2193A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772800588, "uuid": "975d8c06-d640-402c-85c9-c695eb2f0d4b", "comment": "Malware payload", "value": "ddc36c561fb8a2d2b4dd000cf158061eb1129634", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Trojen", "colour": "#2193A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772800588, "uuid": "fbd19f48-f076-4686-963f-25184b9cb573", "comment": "Malware payload", "value": "3a2df1447846f265087272616f3297ab14356003b55ece5e0c85a6d180d4d29b12e9fc56bc2306a5ba977f063744b902", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Trojen", "colour": "#2193A7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772800588, "uuid": "a30f5609-1fb9-4000-9192-1b697726a883", "value": "T13B863348A0B5CAE7ECF2C5480D2FC64D7693C9D463A24FB6D6DEB1ACA19DC14A4B3113", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772800588, "uuid": "cde90bff-7299-4ca4-bc1f-a3391e751b5f", "value": "196608:eu13KQLN5sjPV0EpN2hgKOljlvDLifVR/0oR3IAd2:LJLGVLb2hQljlvMVRYAs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772800588, "uuid": "03f3ec55-ceca-4e98-b0c5-fba9c0a47f8e", "value": 7903134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772800588, "uuid": "c11cb12c-b8b1-4756-9399-03e48bca48b6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772800588, "uuid": "e03454bd-40cb-4de4-a559-e838c00d66f2", "value": "src_1.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b37cb2c2-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811155, "uuid": "6090eea1-8f39-43e3-8e04-3d25d900d6e8", "comment": "Malware payload", "value": "f281898667b92e6686914737de37ee92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811155, "uuid": "1afa7888-4a35-41b4-99b4-9e6ca2394c92", "comment": "Malware payload", "value": "32c0cef6e680e6fb7e01bdd189b0674cf336804eebe09fbbeb7f05ff14b52f91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811155, "uuid": "edc4bf58-0147-4980-82e1-446f90e30897", "comment": "Malware payload", "value": "7800e4eea050e74c5836395de42ff18965ef8fe0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811155, "uuid": "7e0fe372-9100-4799-ae32-cd54f16d1f8b", "comment": "Malware payload", "value": "4b0dd89d08d8286467f2c072244df801c2ca22164da15b0b9cb5776b1cf79afc5de57e84ea1ac1abf2f7a26a29f21771", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811155, "uuid": "75bcabc9-734e-49fd-8005-ae06e88ca367", "value": "T17CA401237391F3BBE555C73B70AE93174F34A4265712292B3390F76A69F3132A74620A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811155, "uuid": "b3eb218f-b34d-4eef-935a-e825e1196913", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811155, "uuid": "1348b161-a4f3-47c9-8f77-bdf6c151bb6e", "value": "6144:16dE91NycbxZeQodWG498o6i60BqHIHTpbw5FD61i1MIQzVqjtcpWH8Wj:1ZZeQoj46KBHHWPD641MYjtcpWcWj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811155, "uuid": "2c404065-ca14-4f0d-92b0-4c13420f5f75", "value": 477240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811155, "uuid": "491d397a-9e69-43ec-b397-2ae97c98ad89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811155, "uuid": "63e589e7-52c5-468d-b096-a51e8b27f359", "value": "32c0cef6e680e6fb7e01bdd189b0674cf336804eebe09fbbeb7f05ff14b52f91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68bd778b-1969-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772807594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807594, "uuid": "e5915063-f252-4454-ba82-f2f42807c5ff", "comment": "Malware payload (AgentTesla)", "value": "d1616ef271b5ce924f5f360b23e84a71", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807594, "uuid": "b6ecd540-ddcb-4cff-a51d-dff8dd68dec6", "comment": "Malware payload (AgentTesla)", "value": "330aa9b600d16462d89f74f06fa2f8b1933a0f62a3221e1043720fdbc34c57f4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807594, "uuid": "d8f8c209-7804-4797-82fd-cb61b7790e8f", "comment": "Malware payload (AgentTesla)", "value": "c00dd4a692e4f4fcf0617df421a8f207901d6d05", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807594, "uuid": "00bab05c-e262-4d4b-a3af-78a3b66a1521", "comment": "Malware payload (AgentTesla)", "value": "0b9a3b743b4adae176106f9f7dba008faa637da723eba70a539f122b798882d3bdf4ed708171f9eec2833203a5f4e000", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807594, "uuid": "4b1e7d3c-da31-4c6a-ad9c-9e4be19fdb49", "value": "T1D8452324235DCD87D46C97F50425F37293B88E6A6521E38A8FED7EEF7419B42A818343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807594, "uuid": "081f7498-404f-49a1-86ee-5745cc8f41d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807594, "uuid": "81939230-67ff-4e1d-af00-37e993caccb6", "value": "24576:HguQKHuotDYMoLrTY9tzfkNUd3exBfeKMhke4m4Vict2:Au/7tDmrT+twed94m4Qc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807594, "uuid": "f3f8030c-9cde-4bba-8737-dacf6a856730", "value": 1241088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807594, "uuid": "23297d02-66ed-41b5-8300-d7deb790cfe4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807594, "uuid": "3216d769-cdb8-498f-9167-eec6a6f266b7", "value": "330aa9b600d16462d89f74f06fa2f8b1933a0f62a3221e1043720fdbc34c57f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99354d6e-1995-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772826573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826573, "uuid": "0368fd4b-9a55-4c92-b45b-6e2369004c50", "comment": "Malware payload", "value": "fec9dcfeaf091e839a7c23cfebe90baf", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826573, "uuid": "48b3255d-064f-40ce-8ac4-870139634773", "comment": "Malware payload", "value": "3344af492cb1cf92cc283b9b642428e77d8843a203d825761296c1500dd62653", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826573, "uuid": "82297e3e-b387-4ac4-bfdd-eb447e1759f0", "comment": "Malware payload", "value": "2c1b871d826506048ab525c25e9dd4f22e2c55b8", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772826573, "uuid": "6abd4b06-111d-4700-8419-a6233ef88e1e", "comment": "Malware payload", "value": "8e1f3bffa3d2cb911a2a50c1165ee0c9ce6c3079f85bccea8d6460e73580ed3717ab9156ab449b4d770f6352c4d289f4", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772826573, "uuid": "bf649410-f7b1-4649-ba29-50666f658fca", "value": "T1D0352303FAD0EE9BE5034B3668D46101201ABC589B5D9117BBC5B32D7C7A23B9AFB54C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772826573, "uuid": "fd78cdb7-9418-4e74-9e81-7e6620ea7737", "value": "24576:lOaY0IJR8lffiwySgo7eR4zJsxliOwHBuV6Du:lOjZGiwyS3e2klZQMG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772826573, "uuid": "8cfdbd1b-0c07-41fd-a646-3bb08e4c1b8d", "value": 1068544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772826573, "uuid": "bf5a0746-0099-4fb3-acec-a622727a1c31", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772826573, "uuid": "80cfcb8e-b712-4048-bcf5-2288d4d111c6", "value": "SecuriteInfo.com.Trojan-Downloader.Office.Doc.32201.20163", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee5b913c-196a-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772808248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808248, "uuid": "01b7024c-a849-4f84-b99a-ea8e05e3fc9c", "comment": "Malware payload (Formbook)", "value": "0232659e4b87ceab745d8db18f07a4ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808248, "uuid": "31fef04c-59a0-4092-b2ec-dbb3f77eb3aa", "comment": "Malware payload (Formbook)", "value": "338b32fc3495b5f09e41a50a7b96085dd5203b51faddb5e2da08436378d5ed03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808248, "uuid": "5e6bcd20-59af-4d25-8c73-205a69fe7b74", "comment": "Malware payload (Formbook)", "value": "4a1234543490bc0652689c0a29ea5093a78be89c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808248, "uuid": "6ad18c18-16a7-412d-b906-d929b4f08de9", "comment": "Malware payload (Formbook)", "value": "b5367e90964a7be3d425ad2f928da4b30922a532ea5ad2a703d5792549c18fe5149b02a2e41eb49c483b0d7718b5d7bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808248, "uuid": "15633b2a-2ad5-4cae-b333-0e6f91a440da", "value": "T11D05AF1DE5E260D1ED2188F20F5E97D08D1B7313A7A5189723B806044B978FB6F6EB27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808248, "uuid": "ac7c82cf-fedb-4a82-8bf0-f8b10cee0fdd", "value": "79b51b0b8fa06ebea3a256fd7f7ce2c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808248, "uuid": "a9ee0b79-4ebc-48bf-8094-39ac1876bcfb", "value": "24576:TayxlisvcLe2UetcJZQl2v3GOOYDVHvkMjJzuk:TakcLHU4eZy2v36YflCk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808248, "uuid": "b4b6186c-eb2c-49e7-960f-0efcfd00f7d4", "value": 869888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808248, "uuid": "71ae219d-49e0-436c-970f-c4297ba7a9ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808248, "uuid": "de372b9f-9833-4db9-bc9d-9e8e9cb24297", "value": "338b32fc3495b5f09e41a50a7b96085dd5203b51faddb5e2da08436378d5ed03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10bceb84-192a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772780388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772780388, "uuid": "3e72973d-a03a-47e5-b190-ca5fbc4e810e", "comment": "Malware payload", "value": "c5e3aeb72def4e422b48103a18d8f2d1", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772780388, "uuid": "5b9a315c-d216-42f7-a0cb-399b79ade8a0", "comment": "Malware payload", "value": "33a29949d535a03dcfbd68e1bf31fd8525b7d8823e3e32785a66c65724d9c93b", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772780388, "uuid": "2858bb7c-de71-4ac4-a04a-de7efbe9218b", "comment": "Malware payload", "value": "81a4db4baa1e7c9606badc2001def090e86ff71e", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772780388, "uuid": "1eaad21e-e559-49f8-9467-1567dacfbb0f", "comment": "Malware payload", "value": "fc3cb878428bccaae0fbb18372bba24c275d71af36e6095bf57038a54cac5b7bccadc7b0a4b07bda7ca7f932836774cc", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772780388, "uuid": "9fc3496a-3ab6-4ea7-82d7-ce69a05914d8", "value": "T16E23CF11A3E64248F1F76B709EFF1406196AFD0DAD31DA0C0118E55CAAF6E5A4C66F33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772780388, "uuid": "a48e1a42-9cb5-47aa-8964-2a3d1dd7a0dc", "value": "768:MxiGBRsW2XC9gJRBpL3nfJdCq4ygc+gr9LskxqFFUsvW/i/Vk5rBTZAYj0n4op2:giGB12pft3fJdCqKgr1sAqFbWGV2rBTt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772780388, "uuid": "7bb2d2db-5503-4326-9bca-2436076a6041", "value": 47244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772780388, "uuid": "75e490c2-3098-4e35-bfd3-7928bf73c362", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772780388, "uuid": "4059fd39-99af-4ad0-8064-28f66e4df37a", "value": "33a29949d535a03dcfbd68e1bf31fd8525b7d8823e3e32785a66c65724d9c93b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "614f4123-1964-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772805434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805434, "uuid": "b185fa32-4992-4cae-b301-85b56beb65af", "comment": "Malware payload", "value": "7711c81c6d11f1416b61a03738795827", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805434, "uuid": "cf7796d0-dc2c-4d1d-9462-201b8530d741", "comment": "Malware payload", "value": "33c19114562bec2cee74599723c483ca21085e686d79eeee399ba2e28bcac0b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805434, "uuid": "134491e8-6ec0-4f5e-952e-cffad73d499b", "comment": "Malware payload", "value": "a2243ed14f8ee371a25245212cb0c7a0a6140b3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805434, "uuid": "9b401cbe-0466-4e2d-ba4e-5c43412b74fd", "comment": "Malware payload", "value": "54fe8ba221de4359f9145f1697febab73e9fe5461ca867d016d281c31bee6f58da346f5b19451f713646b370d5b0887a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805434, "uuid": "13851093-ab11-4e32-b349-8f53151516d7", "value": "T17C32C517A7BBAE1BC4D037770193072162E95F916024472FBD0D1C8E6E9B3412E3EBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805434, "uuid": "ae2678d3-193b-4603-85cc-7f208764ef8f", "value": "192:xvrOR1CQOsz1NxfAzMH9iG0GhWaDpU/O7Q89AGSybcqeif:xvrbCzfaM2GwIU/kwGSbUf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772805434, "uuid": "80fd83cc-f973-4c6d-ad2a-f98bc9796eb3", "value": 11024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772805434, "uuid": "b68befda-7a56-4e37-bf76-959855485295", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805434, "uuid": "be3b3767-a402-4a68-a8eb-0a0d9d3deb2e", "value": "iran.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab8b2a45-196c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808995, "uuid": "7677bd21-3474-47ea-bd34-5406a4fc5b50", "comment": "Malware payload", "value": "8dac95002f0871c96666ca690a84096c", "object_relation": "md5", "Tag": [ { "name": "res2erch-sl0ut-com", "colour": "#6451A1", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808995, "uuid": "80f9b8a5-77c4-4314-a13b-a8a29faa3b9f", "comment": "Malware payload", "value": "33e1637f9543bf61fa835bc150c4bc9383c3ad054fec55b46e6ab6254cd31756", "object_relation": "sha256", "Tag": [ { "name": "res2erch-sl0ut-com", "colour": "#6451A1", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808995, "uuid": "12c03003-cbb0-49ee-9aec-df31f00d89b9", "comment": "Malware payload", "value": "9e55feb7627e3d7e6b2c1b04b969a1bac72f1766", "object_relation": "sha1", "Tag": [ { "name": "res2erch-sl0ut-com", "colour": "#6451A1", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808995, "uuid": "a1ccab26-cb5b-4fde-b7f9-55c84d08e22e", "comment": "Malware payload", "value": "c851875867db5a3b18ce5a2216cb7306b6be8beb0ae6e16586977454c1e4d5f9a3e79b15a0b3b668d6e1aa5e46faa692", "object_relation": "sha3-384", "Tag": [ { "name": "res2erch-sl0ut-com", "colour": "#6451A1", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808995, "uuid": "b750968f-b16d-45b1-a20f-f806c0d7522c", "value": "T1F40165EF343224731F9346E64C5391934D76C23F5BD05D9868D1AB3409AD050622122E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808995, "uuid": "c6343a22-6646-450e-a2cb-7c311802c4fa", "value": "12:Sh897dG3BCFr+Bnx8jiFHYfDlKpFeixnLQmT/adGXhG1ugykYP9RcADB73O9y:/xdGxCFnm1EDlgNjTidGXhGIBFVR989y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808995, "uuid": "f16f802c-ab49-4554-bc66-853e845ddcb4", "value": 744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808995, "uuid": "01737fc9-cb37-4363-8987-123d3918f584", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808995, "uuid": "6cb3fd90-96a7-4ea5-95db-db79f0e4e632", "value": "33e1637f9543bf61fa835bc150c4bc9383c3ad054fec55b46e6ab6254cd31756", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "925debee-196a-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808093, "uuid": "99daa12b-0e28-449d-972a-bee910f79986", "comment": "Malware payload (GCleaner)", "value": "58922d11363b8d6fb551e03ca1ac0610", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808093, "uuid": "7a7153a6-7afa-4422-9eec-c62396575389", "comment": "Malware payload (GCleaner)", "value": "345e91abb5513824367a1ce0a12718958541937455f6a2e28ac6d225673fe1d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808093, "uuid": "4b51c25b-a3aa-45c6-a1d8-bcc26155d488", "comment": "Malware payload (GCleaner)", "value": "63a879d255fef90580522e87d33449fb07262c29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808093, "uuid": "42a364b2-791b-426a-a24d-8a8c44023dde", "comment": "Malware payload (GCleaner)", "value": "aa6179f649d4dbff6a06c6bdb35e06deadf585747af3f5f74a5fbdfbe132b499d5258472637f65c6b5c0f8b2ba621a19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808093, "uuid": "e770b363-312d-4bd2-aa68-1287f2ad24d3", "value": "T19B46E02767650824E0F9DF36CC6D82159FF7EAE01A341C79575E0BC8FAB190FA61029E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808093, "uuid": "1e0083fb-c689-407d-aa53-7adaecac9aa8", "value": "336c69b6e8562d1c5231f219b62d7473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808093, "uuid": "a7782dc4-9a0f-487f-aff5-135c65f01dad", "value": "49152:39t9u3D4mIC2ItXf2wD6hb6o2t4WQcuLaI8Y74dRV/eTLWfLgts/5Z7Zz+SWRD6a:39zuzFnXf2wM22VcnITsnXfhDp+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808093, "uuid": "8d87506c-05df-48d7-a078-2a5af756a4fe", "value": 5805056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808093, "uuid": "f6a92ed4-5b9f-4c9d-ac36-6ae3a67582c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808093, "uuid": "f5965dcd-313e-4291-88c0-77392087d2cb", "value": "345e91abb5513824367a1ce0a12718958541937455f6a2e28ac6d225673fe1d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43255708-1982-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772818268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818268, "uuid": "cfd46977-c4ea-466f-97de-6760f8d79ce5", "comment": "Malware payload (Mirai)", "value": "19bc85789a5ad880d2d7deee467d36c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818268, "uuid": "7803aa9a-dee9-4a3d-8968-ee5319a51dd7", "comment": "Malware payload (Mirai)", "value": "346a587cfea8edd725938e6179f7e1581eeb397249b9a75cef398284dea40bdf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818268, "uuid": "fc1bc2ed-d061-4918-bd09-d1df333f6047", "comment": "Malware payload (Mirai)", "value": "6586521f91df44bdd7ccd15c689de6be18d8319e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818268, "uuid": "6f5bda1e-cfbb-4832-936b-5d526222aff3", "comment": "Malware payload (Mirai)", "value": "b803e087fcbeea52168709ebc6d4a9072687763d37e17048c63c6fc957f088612f8ad0efff675ca9b458b587e08efb1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818268, "uuid": "90a06d74-79dd-4edb-9156-5658e6bcb2ef", "value": "T16493E551BC82562BC5E023BAA67E668D336477E4C2CF722BC8214B257BC561F0C63F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818268, "uuid": "a900a7af-d060-4261-a96b-d200a96bfa68", "value": "1536:Cd+t0rbCuNhS7CVha4m2WiLMBZO+WC27nVDuw8GSr8kn:8+tsCurVDN+ouw8L1n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772818268, "uuid": "c258c029-0bcb-46b7-b132-4e6575359985", "value": 95720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772818268, "uuid": "d0248647-49f6-4174-afea-54337dab7f7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818268, "uuid": "6a519c8a-4ebe-4ef7-9167-0324a8859ff8", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb2dec5b-1983-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819007, "uuid": "5000641f-519e-4f05-9435-bb2e8da5c972", "comment": "Malware payload (Mirai)", "value": "536c713801b9128020709e6f6a5b3b84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819007, "uuid": "1bcf3f90-00a9-49cf-8a48-ba47fad33a26", "comment": "Malware payload (Mirai)", "value": "34798d8838a176625c6789be353be30a943d5b0efb636c00a2818bbdaab6f07d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819007, "uuid": "c5b1b5d4-81c3-4263-9819-b18c27e12e9b", "comment": "Malware payload (Mirai)", "value": "68346ae10b2fe329da6771d4a3515f3a56347b88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819007, "uuid": "165bffda-912e-4b43-ab04-ece181231933", "comment": "Malware payload (Mirai)", "value": "56d3389dbc994843536786305b6c58336aff929fba3c6bfe82d4735470dd2f4fbfd71e443dd077ee5f6271aa1748b2b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819007, "uuid": "17c11d59-80e9-4b38-8336-fae08579660d", "value": "T12EB318D3F810DEAAF44EDB3B416305067230E7964F921A3B266B3557E87A1D42077F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819007, "uuid": "ddaf564f-baa5-4430-aa7f-2eb694318fc7", "value": "1536:8RHOqNMW1lqbgBsxq3rDTvBZM8W3nof6+T7U3LDxq7qUEwudc4TpFyn7KXx:8HN1lIqsQXTvBZkg7YLlwudc8Dyn7KB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819007, "uuid": "77778375-c750-4bd9-9510-e7cf6796ab4d", "value": 114056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819007, "uuid": "093a554f-e02c-43db-a8e7-b79ed7a312e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819007, "uuid": "a81f3251-dd24-4db7-9073-af0da9118ad4", "value": "debug.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0763c7e-1970-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810801, "uuid": "59894943-c990-4bc7-bea1-cfebf59439c4", "comment": "Malware payload", "value": "e0648d44983a0e697a72082e268a0c65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810801, "uuid": "0f68c57c-cf45-4561-ab22-042d84539071", "comment": "Malware payload", "value": "347b9df9429b4f9c84a32c172f7621a74ced365ec9f8c5a5fb8775e265b59ce6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810801, "uuid": "16da8c32-650e-49bb-9819-50b91cb837c0", "comment": "Malware payload", "value": "f3cc033db923f710146bb62d5632a0de91d578ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810801, "uuid": "e973e710-2ac5-4531-928b-c2ab94536f96", "comment": "Malware payload", "value": "d918297305e39d9717de85e517cf760afad222c620fb311669f3e68bbcaaac457893c715ed3adce4750a24cd1a64fa59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810801, "uuid": "cb10e9e5-0000-4ecf-92a8-5c963e6dd0f3", "value": "T1E4C422012AEA4857D8C22DF406F7173BFA74CA0226585F27F7A0EB98BCE2BD19415716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810801, "uuid": "a52f1c90-0e03-473e-af6f-442cecc1ea27", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810801, "uuid": "4335adbf-8db9-489d-a767-4418fcb85292", "value": "12288:Z1yDJyQL686PexZWlZ5ziO2eFu6BH2g8CtKmrwjWimn29ukbCBA51lcWb3wgQW:Z1yDJy06RPPZ5ziOggH2g8CtKLjWcfbN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810801, "uuid": "e0b788aa-f32c-4234-aae4-876efc83e8f0", "value": 578144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810801, "uuid": "1aff4076-5892-43d0-99fa-ed5375442fde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810801, "uuid": "e89b0490-6b57-4c21-aae2-df1beefe654a", "value": "347b9df9429b4f9c84a32c172f7621a74ced365ec9f8c5a5fb8775e265b59ce6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22b557e6-196d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809194, "uuid": "a08b711a-e69d-47c2-86f7-67d18353bab8", "comment": "Malware payload", "value": "c0e21a7b45f383823984c0c5a75d2026", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809194, "uuid": "ee473a0e-8494-45cb-9d95-1937af02ecce", "comment": "Malware payload", "value": "3486a642f30032d26dc0118267c172b7e6a43ca181a1ad679820c1b19c4fb11a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809194, "uuid": "cdc4567d-4089-4646-86e0-b1df728fabdb", "comment": "Malware payload", "value": "a4c7b0ddc91b269dd7bc4b39602d1a42a7bd705a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809194, "uuid": "d8627fa3-41ee-4ca8-80d5-56be56a3c1ee", "comment": "Malware payload", "value": "c741e0e4058f5a40a7ad998192cb3d2c293e56abc35904cbe24ac0a187992492957ab556866596c467161cc22c1e5d05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809194, "uuid": "5b1a1c61-84cc-4426-808e-41585f6f3a18", "value": "T16045BF027391C062FFAB92734B56F6115BBC7A260123A61F13981DB9FE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809194, "uuid": "2b485980-365f-4d7d-a195-8bf5f222c294", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809194, "uuid": "bb849a78-4c17-4b8a-82de-e6703a3261c3", "value": "24576:x5EmXFtKaL4/oFe5T9yyXYfP1ijXdaAXab7pxlaVF7Z2Xn:xPVt/LZeJbInQRaAkx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809194, "uuid": "88bf5e8a-6c35-4dbc-abe6-14ac80bbc343", "value": 1246208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809194, "uuid": "15119d15-a764-4e85-916b-3bf5eb3bf26a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809194, "uuid": "864571c0-2c7b-438e-a0f4-a3e7a11e2d97", "value": "3486a642f30032d26dc0118267c172b7e6a43ca181a1ad679820c1b19c4fb11a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fa8cd77-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1772810693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810693, "uuid": "e67223e4-5924-458f-920c-c072f15c7c16", "comment": "Malware payload (SnakeKeylogger)", "value": "dc878a6d7540b8a35a60b1aa1031ecd1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810693, "uuid": "447f445a-c52e-42f2-af36-085fe73a16e3", "comment": "Malware payload (SnakeKeylogger)", "value": "34dd4dc792c3b591e8e360f81b78d37163f87d1fc10130d10a139f1ee7fa7372", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810693, "uuid": "48abef84-a6ad-4801-ba53-07321e4e3643", "comment": "Malware payload (SnakeKeylogger)", "value": "d9ee8b82ebfce5735cd21d5a04614e50283d945b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810693, "uuid": "a3cb9d7d-a032-4452-b7d7-ac0445c0c0bf", "comment": "Malware payload (SnakeKeylogger)", "value": "ec1be865eca4b354ab3b6c18ed11e9c79f013b4b11a266c6572d26548634f8b13419a66f61c12d9ee68d4366c7ff6bd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810693, "uuid": "c78f1ef4-5901-4a51-b53a-07395ab07a52", "value": "T1F325129C2B45D913C8625B341772F7B51BB81EC9ED20D20A9FEDFDE7B8A2E615C04092", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810693, "uuid": "1dc67923-a6ee-4b14-8445-9f62bd230eef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810693, "uuid": "841efa6f-8b15-4e8b-95eb-91c7cafb76e3", "value": "24576:nbjuucDFhg9WulxTQzrL4NqTI4VVjxf+th0vjUdZTZVc:nbjohqnTA8qXVVMtGF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810693, "uuid": "94a16882-ddee-4c6c-bf65-ad2c5502d6c0", "value": 1041928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810693, "uuid": "b8432ccc-8dbe-452e-9233-65bc92eec35a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810693, "uuid": "9054b4c0-c654-476f-aa09-c1607143eaef", "value": "34dd4dc792c3b591e8e360f81b78d37163f87d1fc10130d10a139f1ee7fa7372", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d840564-1971-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772811118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811118, "uuid": "372b3beb-0b31-4ca7-8b9f-9e575dd01273", "comment": "Malware payload (AsyncRAT)", "value": "28d4923b1bfbdd460d19618a991f7d31", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811118, "uuid": "bcf86d08-00be-411c-b97d-a83ca332286e", "comment": "Malware payload (AsyncRAT)", "value": "3521caed0b797e91e5b7799797d1bc8a19faedcecca7ae2d3f069aa042937169", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811118, "uuid": "92edce22-ebdf-402c-bba5-d3308bd4f05a", "comment": "Malware payload (AsyncRAT)", "value": "4150e1e815d9603f4da49c689bdd2bb0a7140968", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811118, "uuid": "35d6e3aa-b040-4a9e-aba8-16f6fff7758a", "comment": "Malware payload (AsyncRAT)", "value": "2385a07e94f0a5f1c235452785c24c7686880b04ef5e5e5b2210971c54302dbb70c6835b6d927bdf067a592743dca69f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811118, "uuid": "5f038975-2f1b-4b12-91c2-e606fdd3fc89", "value": "T165F55B416BE4CE1AE1BF2775A4F201005BB1F849A772D74B5698EA7D2C637006D063BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811118, "uuid": "cd930176-f094-4ef0-9e09-a361b84e1ceb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811118, "uuid": "b9968f62-3ee9-43cd-a47f-ae3bd4222b6e", "value": "49152:GQFfDE45ivXP3+xbzRMAzU0LdBdo+6WuDayPor/NxJ:Gc5wXf+xxT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811118, "uuid": "f6de2626-6ed1-4c18-83a7-6c2ba8f3da4d", "value": 3486208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811118, "uuid": "d3de9dc3-dbec-432b-a358-88b3221edadb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811118, "uuid": "78d73c18-c9f7-456d-a6f9-d3e5cbb03571", "value": "3521caed0b797e91e5b7799797d1bc8a19faedcecca7ae2d3f069aa042937169", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa51331a-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772809422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809422, "uuid": "da2ebc38-d5cf-4385-9608-585e18b27ee2", "comment": "Malware payload (GCleaner)", "value": "c245739ca8d15616c3b35329f911bb18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809422, "uuid": "f81206d0-0cc7-4f91-9b70-a7ff801c459f", "comment": "Malware payload (GCleaner)", "value": "3522ac99882fe7f3ad3eba288457d6cbf89692033b04b8b3aa777e8ecf2dd573", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809422, "uuid": "1ba352da-59cf-41e5-887b-e84067724975", "comment": "Malware payload (GCleaner)", "value": "a2be6617dc469296c31f3d038656d3142e909023", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809422, "uuid": "e25c0f5f-930c-453f-93c5-3327000fb46e", "comment": "Malware payload (GCleaner)", "value": "674a5c00cdf34ca667c66a7d5b1be2a820b30a3e3e1ce5ce652dd7338052ac18233f1e355451df943fe12e017e2dcbb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809422, "uuid": "82844bfc-db7c-4367-8717-44cc3253c59e", "value": "T162F49E21F2E88436E5F36A38DD5772A598657EACE938644A3BE41CCC9F383D13425393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809422, "uuid": "94a157cd-d4b1-44b0-9427-99913af3b2ec", "value": "345624d13ffc2b7f296b9d2972b1c0a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809422, "uuid": "d0eeb369-5920-4c15-9d7a-4566a2a51b93", "value": "12288:M48VY65TrPsgNDHZ8nqReaSokce8okeiiCBkM/xw:N+7PfJZ8qBSokioXex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809422, "uuid": "d0dda8c3-a86b-4968-bf2c-29387b04d1c5", "value": 728576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809422, "uuid": "d7cf864c-f97f-4e45-a2c6-8bef686ea9c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809422, "uuid": "48deccd4-dffa-4c80-8546-930a0e69a04e", "value": "3522ac99882fe7f3ad3eba288457d6cbf89692033b04b8b3aa777e8ecf2dd573", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "310d1995-196c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808789, "uuid": "2adec67c-eddb-46b7-963a-d393a3a862f1", "comment": "Malware payload", "value": "7b0d33244517ca7ebd2e64fc9c1b14bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808789, "uuid": "4ccd0dde-a218-4273-a2a3-21f264836191", "comment": "Malware payload", "value": "352bf05172895a399a20cedd368099f233e0fd033fc8788614fb9c0ceecf6a3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808789, "uuid": "5f212c5e-8434-4b95-924d-7016411c2c73", "comment": "Malware payload", "value": "41a8cdcf79aec69636be393b553d89f2ddccc32e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808789, "uuid": "bdbede15-86bb-4987-800e-aa35d41f5ed4", "comment": "Malware payload", "value": "7c5e995c4fa2487335c7614bc1cce492c6355b70d9bd4041763f3a37dc2f10ad61a24320c1844d502b652fddc5e4ffdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808789, "uuid": "94e8a650-188a-424f-8d6e-c11180101c47", "value": "T1172502593729EE03C4A65FF00A72E7B01BB49E9D9502D3439EE6BDDBB43A7451E00293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808789, "uuid": "8f455e36-b226-4671-a3e5-02bcceb1c4bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808789, "uuid": "ca1e567f-5728-49a0-9697-3904e75499b8", "value": "24576:7qu2VVSZd4tS/TP0CHUCiH2XVvEviX2Bh1:7eVVSZmtSbPzVXVvEviO3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808789, "uuid": "b2cf757b-67a4-4892-85a3-544d8a027dae", "value": 1013248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808789, "uuid": "51b01eea-ab4e-4f47-a84c-11a88188c4ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808789, "uuid": "8476437a-9d2d-407e-af3b-8fd46e572b49", "value": "352bf05172895a399a20cedd368099f233e0fd033fc8788614fb9c0ceecf6a3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbdd7b72-194c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772795305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795305, "uuid": "bf4c2400-2837-4b8e-a448-6cb3117eacdc", "comment": "Malware payload", "value": "cd78347abbcc1f7a871b3a6933c6e286", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795305, "uuid": "21fc7d58-7b94-43ec-ae78-7edc40d33e99", "comment": "Malware payload", "value": "35ba3aa9b07db5c5c539bfccb6ac2331c039b21b769d75baef84ba2dac0d70a9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795305, "uuid": "4b430863-4112-48c8-bb39-767649da889d", "comment": "Malware payload", "value": "dead1aa6245d5d30ee4c57d9681f2127322deb2e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795305, "uuid": "b44599cf-05d5-4606-b735-e015c0fc6645", "comment": "Malware payload", "value": "52b0fb2b2a43d4bfc52ae2d5299648b4ebb7bc299ed3302a5298dd2020b70d3cb3405310c3f39a6f499fdb8c3932e5c0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795305, "uuid": "d1cdcb2b-352f-4e9c-aedb-1faf90946a78", "value": "T18DF68C13AAD08274F6EB52FA86F93729897D9D011338C2CB55C828985F31AE13E3D757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795305, "uuid": "f8d82ad7-15c7-4851-b6bf-5ebebf05d92f", "value": "0bf4447fda89303e8c2644bb6df92eb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795305, "uuid": "79a422be-3c14-4e59-96d2-19df1163e22a", "value": "196608:NQke5A05AXFN3delxDtPAFGfcn+hr7eeHD8hytsPcGaQvi5q7iQTdENPgk8G5ySy:NYA0aFsDXcn+B7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772795305, "uuid": "e1d589e1-a7bc-4173-93aa-48609ecc67e2", "value": 15816968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772795305, "uuid": "cdce9b06-7eec-4275-8448-5d80ce17f701", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795305, "uuid": "c70f918f-97a1-4463-91bb-fb34a6461efb", "value": "wke.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2e3f482-196b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808685, "uuid": "ff5312b3-dea9-4ffd-b617-5a2429233db1", "comment": "Malware payload", "value": "93b762df0d83da055994fef01fc94849", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808685, "uuid": "7f678538-dd8e-4de7-8d87-14228ca1c90b", "comment": "Malware payload", "value": "35e00c98706ccf0289ac7767adbf059b5ba4a0a97ff42f02bf0c9543bfcc549f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808685, "uuid": "f967cc31-57f1-467b-9135-6ce3e9e5a7e6", "comment": "Malware payload", "value": "d95692b5ac2a3610280f6a826cde5073d273263e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808685, "uuid": "15a0fd80-50df-4608-979b-35e942624749", "comment": "Malware payload", "value": "9b82fc4a38183bbcd1d241bad36976160219a31f119f6b504576bbf9afaa681e688245298f71647829daf86be29ec676", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808685, "uuid": "622d88ac-2550-42e1-ad05-55675b1eb4e9", "value": "T19D35D04527F84958F4BE9F39287465144BF9BC27AA3AD72D2A5840BD1C72F40EA21F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808685, "uuid": "d5151d9a-396d-458e-b42d-027fb33bf534", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808685, "uuid": "dd9e15d8-3e15-42b8-a1e9-7f289b64eaf8", "value": "12288:WKPzZyKMf5+cGszIMjy1j89CFnLT/N0HPNI0iAxxrKXBxoo1C7HDx/l+POuHizHz:LlhpLT/4PPH7caoc7jaP3HizHbdnM5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808685, "uuid": "085f7184-2340-4f4b-bce0-c7e801f87598", "value": 1118720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808685, "uuid": "7e9d4589-58f5-4e84-a180-2c55ca7b220d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808685, "uuid": "437f773e-0ca4-4e2f-96de-08839fa916ea", "value": "35e00c98706ccf0289ac7767adbf059b5ba4a0a97ff42f02bf0c9543bfcc549f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81200fc8-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819231, "uuid": "fe9b1eb3-7ac7-4cd1-9321-b202d5a1704b", "comment": "Malware payload (Mirai)", "value": "440246dd418fbff880c2c495d7e64826", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819231, "uuid": "718bd461-cc62-4ce1-a646-568a5c1c0548", "comment": "Malware payload (Mirai)", "value": "35f312ba2ebb404bfce5211f6cad35a1ed8c0c839becf5b27fbac8cbd1316242", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819231, "uuid": "c5080663-54cf-4563-9255-9973058e2cd8", "comment": "Malware payload (Mirai)", "value": "2cc84d8179427502947aa5aad72aeff3ae4af6e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819231, "uuid": "0566ebda-2e47-425a-85c9-efe82d129f16", "comment": "Malware payload (Mirai)", "value": "96b6bba86f49d0fcea9fec32f75bcffd50afb166d484eb6de36fedb45a863c248154aa46145fb0750c52c4691e836b0e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819231, "uuid": "e70fd7d5-2f11-4d7f-a940-9ee4b219bb6d", "value": "T137A31759F8829A02C5C515BAFE0E518D7313176CE3EE33168E348B74378A6AB0F7B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819231, "uuid": "303f7025-715b-42a3-ae9f-c72a907a593e", "value": "1536:/hnqk7enkk4Xk4oN8YgIq9haEMOrgMvit28SAxrDc7ae5E2VvyWe7ya:InkzoN8Kq9haE58SAxrgee5pp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819231, "uuid": "8317e690-5521-4f70-8af2-994706a35f25", "value": 103740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819231, "uuid": "80cd4380-c81e-4980-bbc5-e61674981757", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819231, "uuid": "7760eb34-c0cc-4ae9-acbb-628f81d98628", "value": "violetarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "813b0a8b-1941-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772790455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772790455, "uuid": "e83dba8a-ab5b-4e4f-8456-51d5f24ac4a1", "comment": "Malware payload", "value": "3764a1f3fa64ebea4863f14a8fc8f27b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772790455, "uuid": "6e89835d-d840-49b5-997e-6320a6b32284", "comment": "Malware payload", "value": "3619fbcb12d39bbc5009f473a25dcfc95b543f67cbdb88ab203bc4259903eab1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772790455, "uuid": "400e755f-eb81-4142-a0ac-e7a561f67c65", "comment": "Malware payload", "value": "753950d33a5e9c05e7b8a10a8e0d67c90fc6aa37", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772790455, "uuid": "f7b168d0-6d56-48a7-b379-67543cc30080", "comment": "Malware payload", "value": "bdc2daa5af9b6370efb0090127c4504d071a888a51011d0ffd509b99b9e7d6ccd7472a5b9456aa610bec8f17078c5a2c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772790455, "uuid": "a7240a47-5379-4423-b2f9-c4d0b72e4ee7", "value": "T11E924CB512896C79FBD1CE399F3C6F4DADE882C42124A3ACBA0F39215A1166DCB0535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772790455, "uuid": "2b221203-02eb-4852-bf82-08b65f39229e", "value": "384:6BcuQpWx+BL0SWL0gOzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:6B8i+BL0SI0ZzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772790455, "uuid": "8cbb7f7a-1181-4add-a60b-5d38b3cc27bd", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772790455, "uuid": "a8503d82-c279-4bf5-8140-0463a6824dfa", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772790455, "uuid": "158dd234-1a4c-4572-b9ef-c6925f22f293", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a23bfa0-1976-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772813126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772813126, "uuid": "816a23f5-bcd5-487d-bc03-bb8b455a2ec9", "comment": "Malware payload (Mirai)", "value": "1edf2acff82311b33951a4c4171f8ca9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772813126, "uuid": "ae3688c7-7fca-4940-8158-711aed7ae4d1", "comment": "Malware payload (Mirai)", "value": "361b1792d72c314a9079073c512401dd3f902826e438d1df89ba570c5c85893a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772813126, "uuid": "44d4e027-920e-41ff-9a7d-5f9dbf852cef", "comment": "Malware payload (Mirai)", "value": "5982608772352aad877e27d945d82eb2ae4f1709", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772813126, "uuid": "cd75b8e8-4e7e-432b-837c-d651fa51f65e", "comment": "Malware payload (Mirai)", "value": "15d7c2ed80f3f656c714a4f1b4fc8d93165fd37859d65c5dbf2572c7562bf06494015664241a67b26b034fd8b2499208", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772813126, "uuid": "e08cf20c-4c8b-49d6-b6a7-a3c331f3d06b", "value": "T1BC735C0375C080FCC88AC07597AFA236C473B57E1279B14B27D4EE16BE8EE511F69A85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772813126, "uuid": "fecb6573-af4f-4a89-b17e-60957f97d5c4", "value": "1536:1cFaOaaaITnRuGB/Msb8iy1r1Qvn+E+x91XS9v2kMRz:0a3ATnRbysby1r12n+R91XSAN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772813126, "uuid": "b809b73e-9f95-47aa-a10f-4b50b0c35e99", "value": 78720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772813126, "uuid": "4f287d15-9301-48b7-b0cf-e342e141167c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772813126, "uuid": "e7c3a96a-771c-4cd0-849a-097ef7cc10d1", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe7bfb20-1936-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772785941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772785941, "uuid": "e0b8e19e-9dc4-4b1b-95ad-358d9d452cb8", "comment": "Malware payload (AsyncRAT)", "value": "644fe240d4b97d1a48fa0eb8cc35cefd", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772785941, "uuid": "2af1273f-0f59-45a4-8caa-bb8da8c0dbb6", "comment": "Malware payload (AsyncRAT)", "value": "3647a92d3475a23b6996e9c90d849bb6d14c510ea84e98c0251b229aac8cda28", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772785941, "uuid": "e6c0c774-3596-4f22-856b-11e964bff785", "comment": "Malware payload (AsyncRAT)", "value": "e75bfb30e246d7a2def3b736a4c9e64d5a0faf6b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772785941, "uuid": "13259ca5-ab2c-4a0e-adc7-dbd12e3bc157", "comment": "Malware payload (AsyncRAT)", "value": "a99d053c11d8c956508ec5b928b4177e74df978fa663c4e984155ce6c6f41c117eaff1616f2fd1fa99ef93e488f13f9e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772785941, "uuid": "c0b33b00-5ef5-419a-bdfd-212cfd7ab249", "value": "T1B3F24B0573E58665E1FD1B7D5C3686044372FA478D22DBAE2EC450AE2A237C8CF25BE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772785941, "uuid": "dfc3e88e-892c-4435-9532-f92ba37eda91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772785941, "uuid": "8344107b-508b-4164-9e16-c37537b2c753", "value": "384:EMTh/ik19HKliohulE1bdcWOebX093bayseHQxnC7O+WmlIuufGfrfCHLWWCEQ+:Eih/r3HKlJhR1hV4RbJwB+WWOdQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772785941, "uuid": "5d58ca52-b43f-48c9-8ca0-815ca77a7271", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772785941, "uuid": "85d8ae7e-d091-43b9-bbb6-f150f76695ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772785941, "uuid": "3b1a4d53-7621-4b0e-b1e6-db30a6d73e42", "value": "MalwareRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88d2175c-1982-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772818385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818385, "uuid": "0db7f005-cb64-4556-bdfc-7d573cb51aa9", "comment": "Malware payload (Mirai)", "value": "0932d467be6354d8f8c522766bc810b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818385, "uuid": "bec83c31-a231-4fcd-b6cd-75d21dddaa35", "comment": "Malware payload (Mirai)", "value": "36723c70b4d3629c334f811a3721e5a5522747d4697e6fa8865a38ae8420664e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818385, "uuid": "b86ad707-40cd-4dbd-aa66-7ae3b1fa9701", "comment": "Malware payload (Mirai)", "value": "6c98e9c23d594170f6bd7d2633e44954a440bc1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818385, "uuid": "e11566ba-611e-4f80-9e37-ff38bee77ae9", "comment": "Malware payload (Mirai)", "value": "6025067980c0976ef1f729ef56d9416ffbaa7a9c4eacea7c3a9b5b792064f26292c8e4949fcf08645133ef555f0fd9a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818385, "uuid": "61082ae9-d32b-4203-81c0-2c900f70359b", "value": "T12BD33851B8829A27C5E523BFFA6E028D331563E4D2DE72178C215F217BC691F0DB7A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818385, "uuid": "a300360e-a4a3-440b-ae47-f33cf87f7d86", "value": "3072:JuVeGJFWOgt9ctajH1I7sb41o+YLyXzXgvA:JuVwt9cUH1I7sbMeLmLgvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772818385, "uuid": "0cd21390-654e-4443-8fa8-36b568401425", "value": 140756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772818385, "uuid": "0f0f8fc1-4abc-4195-8a16-4cecaaaf86cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818385, "uuid": "c550e6c3-137d-47d0-b0c4-137f4430c2d7", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2679990d-196d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809201, "uuid": "13cc7b5d-f104-47de-86e8-3d3359ad85e7", "comment": "Malware payload", "value": "80729bc797dbee640483bb60614baddf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809201, "uuid": "c3b044f2-9bbe-4495-9deb-8e04df6510d4", "comment": "Malware payload", "value": "3689c44195a68a995e863026ba622bd3c1e6e6698075dee0c9292c56b9225a99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809201, "uuid": "f15f141d-2e1a-4463-9fc7-44d4fdb16ed8", "comment": "Malware payload", "value": "22758e13e939d93b984f0e04b51aa9148771c65d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809201, "uuid": "dcaceb7c-3cfc-4ba9-9c24-67b98727362a", "comment": "Malware payload", "value": "2f354078a79a965a4670f9010bad6fdc283524adc9fd35c2150a57b35179314972c754a0b9c9a85fa07ceff92832f5ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809201, "uuid": "acc29095-7f2e-43ca-acaf-be878d338d2a", "value": "T1608512142726D903C4A74FF45E72E3B40FB85E9AA501D313CFE6ACEBB939B5119812D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809201, "uuid": "049ebb1e-2bd3-4771-a014-a2a7610b322b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809201, "uuid": "c940ff69-838c-4018-832b-9295db5eb4b4", "value": "49152:/eV+RbtHsSVYUecsWMcd3wLR3d0c7Lvi0Wi7Ys:nMSVBecsrU3wLR32gi0Wics", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809201, "uuid": "d4da276b-03e1-45ae-9a5d-85da2feef3d3", "value": 1767936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809201, "uuid": "0b58652f-2f54-4f6f-b1dc-2d7f3f80c1b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809201, "uuid": "75de420d-7060-4e0b-a390-5df03177360b", "value": "3689c44195a68a995e863026ba622bd3c1e6e6698075dee0c9292c56b9225a99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fef4a18-196f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810076, "uuid": "d4345c3a-9fac-4f2c-9b91-a81b22a4a0a1", "comment": "Malware payload", "value": "8b66fbffaddc3679edb1d7dd165e5fd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810076, "uuid": "508a2817-c686-4e96-985b-83dc1a4a8820", "comment": "Malware payload", "value": "3693c668323b247512315b36c10efc426c98151cf3707946c03c8eb13d7ac88e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810076, "uuid": "291d2b2a-669e-4fd2-bbdf-b980a7abf597", "comment": "Malware payload", "value": "da722c291af20606dac1ad532eaad1a6cc520318", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810076, "uuid": "33cd2b5a-88ba-4ccc-9df3-775cd121e844", "comment": "Malware payload", "value": "28f8844cf84d1a568cf4bd61e06bbc50c48a6fb700a8cc892256572da624899a12a753f8cb412dedd81c1726a745dac6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810076, "uuid": "684141ef-f6f3-4253-bec8-3b0e75689184", "value": "T16AE4231173D2C893D36A077042F2EAABAA7D7D3CA19562075379963E78738B34B14DD0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810076, "uuid": "142164c2-f7a1-4ee3-b043-4023315fd695", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810076, "uuid": "15be0b33-5342-443d-b77f-28e0220a0dd2", "value": "12288:uHadNN8JD18aLqYmXCM2bHAu6C3iUm1FdxcmLDRJDmrP7RNDT2lLclo:iadNW3XFp1bVDi1Fd+mRJDmrzbcYG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810076, "uuid": "e8ca89df-2ea9-4701-baa7-bd4f1623d121", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810076, "uuid": "e73d8149-3c0f-483c-adbb-5bb75949e7ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810076, "uuid": "52b2c6cb-d45e-4ba3-8d70-7f18201ee3b0", "value": "3693c668323b247512315b36c10efc426c98151cf3707946c03c8eb13d7ac88e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fa17098-196d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809162, "uuid": "ee58496d-621b-4705-bd6f-29edec839f37", "comment": "Malware payload", "value": "e98e200684f4a4c4b28ab71f229f9e63", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809162, "uuid": "808ef1eb-ad22-4ba9-80b1-cfc8c0daee14", "comment": "Malware payload", "value": "36a47272f3b70411cd1430d467454feb4413250605b62b98a23cdbd931a696b6", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809162, "uuid": "cf96e3cd-2a60-4e83-9c14-e3404f289c4f", "comment": "Malware payload", "value": "1ad574cce8c25c02c88cdcf150738bb471a7e0f8", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809162, "uuid": "a4f4bacc-3ed9-4cd7-88b7-633843920b67", "comment": "Malware payload", "value": "48ca69a8e123c1faa43133d0611dbbf5284837d4a25bfddfe0bcf23e693e94abc44b6704a5fced40879c07828f3f1580", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809162, "uuid": "32212a4d-b313-46de-82aa-71fd3e4f707c", "value": "T14871C85F4EDCD89EC807423B05718A8AFB36818D8A4DDF1FA26421945CD19473F49BDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809162, "uuid": "4478f751-b157-414d-991e-6c79db5dba06", "value": "96:si+sSpkkEZw9P7FU2TwhF2BVcH0kMSOX2RzoWKMiAtTi:RkEZkFhTwh4BqrMZ2RzoWKMltO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809162, "uuid": "03555607-e650-4c00-95be-97c0a859f5d5", "value": 3536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809162, "uuid": "071d063b-b0c8-48f1-a5c0-afb3a24b3a01", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809162, "uuid": "cbd0f2da-c961-415b-9f2a-f2f993184ee4", "value": "voidrealms-1.8.9.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f51ecab-1949-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772793942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772793942, "uuid": "b3620dde-285b-44d8-9939-fcb393991e0b", "comment": "Malware payload (Vidar)", "value": "c530585ed6a172161ef6349fa671710c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-OpenClaw", "colour": "#525D1F", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772793942, "uuid": "8f6d69fe-c7db-4dd4-be3a-c1262a175c92", "comment": "Malware payload (Vidar)", "value": "36c4bb55b7e4c072e0cbc344d85b3530aca8f0237cc4669aecdd4dd8f67ab43a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-OpenClaw", "colour": "#525D1F", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772793942, "uuid": "4ccd98da-c660-4773-85d3-e266a50ab2cb", "comment": "Malware payload (Vidar)", "value": "3a25221e8efa0191288dc483899beadbbe8534f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-OpenClaw", "colour": "#525D1F", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772793942, "uuid": "73be1ed2-cf03-441a-9bb3-b55ae79007e3", "comment": "Malware payload (Vidar)", "value": "830672bfb358e456ab7c64387ce60b034d74ca962a1d51eef3f32863a317b1bfd953ef8a597bb3cf863d035dc87dcddc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-OpenClaw", "colour": "#525D1F", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772793942, "uuid": "62b2bb14-10e5-4dfe-98f2-05c5386fab9a", "value": "T1F4282342BA8B1964C05EC8B4D2474A934F3130DB163BA5BF50E942683FAB3B49B3F755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772793942, "uuid": "780eece4-9e41-4222-bd73-e3ba84a6df10", "value": "e61251d70770a939fcd72f2941900a06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772793942, "uuid": "2cc3c7e1-968c-4576-9e0b-4b25b1b9e743", "value": "1572864:6+EyfxBpoYRS4XSJB4Gn0fXt8wrWhNEx3PX745pSs97tFfBJtUe9LAs7B9k:6ByfxBiGS4XOl0fXtcPd5pJ95FfdF3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772793942, "uuid": "4c127292-b6f9-421b-84c1-7cb874f5e65a", "value": 99634176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772793942, "uuid": "cdfcb41d-a38a-429f-94cd-42f81a8d6593", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772793942, "uuid": "a6934d35-588d-47c0-9575-556247dc1233", "value": "36c4bb55b7e4c072e0cbc344d85b3530aca8f0237cc4669aecdd4dd8f67ab43a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be820583-196a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808167, "uuid": "8fcb2d05-1a3d-412e-a39b-769f2b9e119d", "comment": "Malware payload", "value": "730547e213a4b8684936cc9453865886", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808167, "uuid": "855c035e-b5bf-4038-b2e7-f5878835227b", "comment": "Malware payload", "value": "3709e6f489626cd6300e0a4f3506d12d4aea80973bfa8673608b1fa20d2fd71a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808167, "uuid": "dc28ff9b-1383-47f0-b33a-383143e43411", "comment": "Malware payload", "value": "22be3ec9cdd4faaef7144a44f1df62b0faeec94d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808167, "uuid": "52880a01-013d-4376-a648-43462aa95c53", "comment": "Malware payload", "value": "1f86c538a11a8753253df42bc8b551755f56dab979b88bf41053eb6f6043e6992f352705a5ce2c8dbf4918168606ab7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808167, "uuid": "f39afdc8-73bf-419e-a7cc-02d15f40d786", "value": "T17F252321E3E4E542D4E00A365A36A7F2CEEB9D40485413875B187FAB7E336B2127B717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808167, "uuid": "15c407f1-dcb3-48d4-a0b6-ef5b61196f0f", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808167, "uuid": "cd7a8d90-52fb-4acf-a788-006e36fc93df", "value": "24576:mfLGzbYdRAuw8rjKRS+Le3vbtZWrlk5b8KIJ4LUwv/GOFlmuxqfyt:EkY8F8rKlL2znWBk5b85aXv+kmzM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808167, "uuid": "845e0c2c-204b-4992-881b-0ee244d376b6", "value": 1055464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808167, "uuid": "04165931-eda7-4d65-95cd-8f7897b9ead0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808167, "uuid": "2de63c6d-cf43-4e18-8ba4-eeb37bc040fc", "value": "3709e6f489626cd6300e0a4f3506d12d4aea80973bfa8673608b1fa20d2fd71a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b30ae8f2-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (DDoSAgent)", "timestamp": 1772809007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809007, "uuid": "f4930fd3-8d62-44dd-ad6e-9cea7ba56cc4", "comment": "Malware payload (DDoSAgent)", "value": "2b9283f8505ba8fa1b955234af5e651e", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809007, "uuid": "0737fc01-e20e-4f86-aff1-a9d9b83613a2", "comment": "Malware payload (DDoSAgent)", "value": "371ded4f85e45cd412cb364146208381bcd8047b9618b09a1a668f467e013996", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809007, "uuid": "7c6c844a-aa3b-4492-a24b-d9489e1fa420", "comment": "Malware payload (DDoSAgent)", "value": "9ed3242251105a30d104d2fda5afc3e21cd1a74b", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809007, "uuid": "95428848-76de-4922-8fc2-a170dac87829", "comment": "Malware payload (DDoSAgent)", "value": "39b1b2d664e46fe75c223173eeaed1e68f58b362df02deaf06ca1b46c7561e571aeacffd1a8fae2cdb42277f02ce7b16", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809007, "uuid": "284e30fc-9aac-4ba9-863d-152646f0ef46", "value": "T177575B07E8A544E4C8A9D531C662A223BF717C894B2163D32F60F7386F76FD06A7A750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809007, "uuid": "abc11df4-76c9-4273-8d13-3961528b835f", "value": "98304:okmMRs2VRBp4avM+SPauph61LTz7ZStPy2jhxKH/3TiCR5ikD6kODTjEkxn60dNB:osVRBpBM+Sjy1P3kXMuCU06xjnniDI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809007, "uuid": "11de33c3-306a-4529-a451-cd97c321037a", "value": 27775268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809007, "uuid": "bd7b03f4-fcf0-4cec-9e8e-f1e6ea406dd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809007, "uuid": "a8ff545d-c20e-477a-b355-76583c147969", "value": "apex.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cd01345-1967-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772806661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806661, "uuid": "844f2d4e-065a-419c-ae60-cc3550046cf1", "comment": "Malware payload", "value": "0bd1d615616cd67b08ca5971bf53452e", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806661, "uuid": "45c04460-593a-4cbb-aed1-7c5d39296c31", "comment": "Malware payload", "value": "3752880d4b55d6472e906dd22bd18a0a05295bc81f5009c16fe0f2e8674fe15f", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806661, "uuid": "a2249ab0-87e5-404d-979b-3f2137c7fbf3", "comment": "Malware payload", "value": "dafc34a05d95f908987ed843788575d101351afa", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806661, "uuid": "444d4bff-37e4-4fe5-b0d7-0c6e118fd429", "comment": "Malware payload", "value": "7ab67c70dda16526df5cc1ccc2f602e9d80933f4257e43ae11d46cf66bf8725385a15e93fc2c769c1d168005ce06ca49", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806661, "uuid": "e5e338c8-1285-402c-8f71-d0020222a713", "value": "T13E46AE15B3C515A5E123CE39C715A333D2B2BD620BB6E18B4A96F6090F77A508F3EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806661, "uuid": "6128b40c-fd4a-496c-885e-17e92b9886cd", "value": "2907406e0aabfe26fe4f317d0be652ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806661, "uuid": "51700cae-f9e2-4aea-9c2a-f94981460e8f", "value": "98304:K/paz5KlofbO4EDiypE7rdqZowh3RvxsOmkrLssM242LXohD+TGRM2+ocgEs9+e:KMAlibOPeyp4ooARp3sJB8osKKYcQ0e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772806661, "uuid": "fc43165e-2a20-4eb7-8a51-cbadf020b6c0", "value": 5548032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772806661, "uuid": "659de901-8072-4b3e-a1b7-d3e28389c8a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806661, "uuid": "a8454370-e47d-4b27-99ef-a656096372ec", "value": "libpsl-5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55d07174-1904-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772764183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764183, "uuid": "118ff863-fe94-4cc2-872c-42b93a84000e", "comment": "Malware payload (Mirai)", "value": "a45831942181d111b5cd41c9e4e37ade", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764183, "uuid": "3544720a-31d7-480b-b9f6-5528e0478b00", "comment": "Malware payload (Mirai)", "value": "375b90f092061faa5842a013514d17dca2f9d1f326c73aaece02759875ae1fe0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764183, "uuid": "24499c2a-afdd-41c8-a152-911429d1fedb", "comment": "Malware payload (Mirai)", "value": "3236232d6612ea5c503770b42ef8c6c0b1a313fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764183, "uuid": "d2f154a6-9c63-4ed5-bcee-5fe2da8d6a30", "comment": "Malware payload (Mirai)", "value": "faf129afb71743c7549ac38c47361256dc240d0f6eab9966a628d5b466c085d7c501184adb041f2ed62584e06bedc9e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772764183, "uuid": "258249aa-7834-46f8-9670-69fb0ae88e67", "value": "T184343B45EA418A13C4D117BAF5AF418A3332A7A5D3DB7306D9246FB43B877AF0D63602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772764183, "uuid": "c75883d4-88c6-4837-b5aa-ddd6cc5873f9", "value": "6144:Ego/jNgGzHzakeqacEp1d4n1trkbf9ihM/9+AU:EDhgSHzakeqacE3W1e0G/4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772764183, "uuid": "99c0e3ac-8a5e-4252-8afb-53379e363510", "value": 230976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772764183, "uuid": "3b36bff1-a348-436f-b847-6e73a53750c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772764183, "uuid": "fb1b017f-263c-4f14-9351-f1aabee19164", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b3e8bce-196d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809343, "uuid": "431967fe-9642-44b6-9610-c16165789dc4", "comment": "Malware payload", "value": "86c3cbc0aedce8c3a1193fde23704f11", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809343, "uuid": "1a38e4ee-9a71-4b06-839f-dea34e754e26", "comment": "Malware payload", "value": "377f255d9ea926842f42af8f7703b8377ef778323106ca39097c302314f23372", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809343, "uuid": "05cc1995-9967-4a05-8089-5e005d8b5fcc", "comment": "Malware payload", "value": "ee4c20e4cc5fc411dfedbd6400f68a8385993e55", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809343, "uuid": "8cf8c246-4571-48f0-a50d-ed68ce5edeeb", "comment": "Malware payload", "value": "5bacc0ea06d61efc2dec5b1b750e1943efc37dd6fa3949e58411d057ec3bee79d7b099b7662773c570b5e983c85a24fa", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809343, "uuid": "be49bdea-2337-424c-accc-f8c2b90ce71e", "value": "T1C6C57B07BC90A5B5C5EAD2318A6682917B71BC890B3127C72F50B7BA2F737D44E39394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809343, "uuid": "e4bfa213-fc8c-46c0-9fc1-d10de845267d", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809343, "uuid": "4f065ab0-8981-407d-9409-e8ad819c469e", "value": "49152:NzQymMu37rb/T2vO90dL3BmAFd4A64nsfJHgtAVbmmQD1JHqc9sshg209c+:NNu3LVKJqSsW09H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809343, "uuid": "7b9d45bd-8fdc-4fe5-98b4-5923e4407d63", "value": 2531328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809343, "uuid": "0d98aa8d-9b05-4fc6-8075-cfee1566c7ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809343, "uuid": "1024b002-2838-4356-8b37-fae82ccdade9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "125e21c6-1968-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772807020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807020, "uuid": "9157c40f-cbd5-49e8-8de9-486543bf52e2", "comment": "Malware payload (Mirai)", "value": "49671900301801f070d200430627c2e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807020, "uuid": "c10b492c-1666-4b81-8a17-91d94967f7a8", "comment": "Malware payload (Mirai)", "value": "3793fed9a61871510488ecb27bdd6b822b04c19a792cd5c88b6464d991fa82a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807020, "uuid": "a0516e38-6694-4237-b850-c1c15c3d644e", "comment": "Malware payload (Mirai)", "value": "7cd466e7533e34e148c53b06436717ac89d5f2f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807020, "uuid": "30c6421e-cd91-419c-8c37-f335b8805e56", "comment": "Malware payload (Mirai)", "value": "0906a8eeeb239cc0d40aafde90c7856960582a53d0e7780dfe5fece13925405317d295a02df6b4f3148c828c8d14732b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807020, "uuid": "b0c79b2e-4a86-46b2-a5aa-99489917e498", "value": "T18A930749FD406B10D8D635FAFF4F024973934B6CE3FA7201AA245B2523CAA6B0F76516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807020, "uuid": "34a836e4-6b09-4719-a7ca-d9a28ee47576", "value": "1536:wqnZK8D4zgUdtS0tFbvacgzafVAweBuqKlUI9HiWNRIbT2gZ1Yvn:C8NUv5nTacgzafVAwe4BNRIbT2gXo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807020, "uuid": "7e2180ef-287a-4bf1-8c86-e481d2e29b86", "value": 93252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807020, "uuid": "a1927e23-60ff-4236-89d1-df7332c024de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807020, "uuid": "33c69e26-560f-42ff-9a04-0b64a5d54f04", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "864e5f24-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819240, "uuid": "d41116c1-d3f3-4d79-8340-acf5cc855878", "comment": "Malware payload (Mirai)", "value": "c0c09c31405cc599ed25680fa70e8a1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819240, "uuid": "c9eea0ae-1b31-4204-bc0c-d933ce4ceba0", "comment": "Malware payload (Mirai)", "value": "379d8463f451c4ef78d84e0707d98b3a8b22274089096c64b2a17d550dd1b05e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819240, "uuid": "ed4973f4-6b7f-4086-974e-38ed7da4bace", "comment": "Malware payload (Mirai)", "value": "9678ff43678826d10d3bc5c68145822d65766784", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819240, "uuid": "5a40013e-904d-4800-ac97-e2c26176588b", "comment": "Malware payload (Mirai)", "value": "2f25edf6a55b4ce2b87cef1ec7032c07ccbbae525ffba3c5c750e218bc2dac6535c890f6bf1881b0088eace588ab4d0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819240, "uuid": "ef158f44-2d59-4b48-b9c6-da004cfb3c43", "value": "T173342B05E6408B57C1D23BBAFA8B425933339B58E3EB73059924AFB437C679D5E36102", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819240, "uuid": "bb721cf3-2367-49df-9fe4-19c924c5a89e", "value": "6144:g2v4iUqEr7ADaJorKF1jt/nb81Vx+GiTlDgM/R802m6d2yYZlege:bTEr7ADaJbF1jdA1VxrADV/32m6dZYZi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819240, "uuid": "19c30024-30e3-4164-b425-4aa581094628", "value": 243059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819240, "uuid": "c27482f1-0224-4c82-ac57-b45e6b92993b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819240, "uuid": "95d880de-f542-4736-92ca-2ae137fe34e8", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "057666c4-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1772809145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809145, "uuid": "db624ef3-16aa-4d75-b204-737f808dfe38", "comment": "Malware payload (GuLoader)", "value": "eceaa017d7c45b81dbfe192b71de63ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809145, "uuid": "e30fa6f4-71a0-4020-abd6-32b239d202ef", "comment": "Malware payload (GuLoader)", "value": "37aa05adb1f5408e886287c8b1ea074315a42ece0d47cbfe6678c26b6c396deb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809145, "uuid": "f9e39f75-1ec6-47c3-9a12-ee8bb0e34c33", "comment": "Malware payload (GuLoader)", "value": "d6ddeb437483e8e4efe73bb6d6aca345b351406c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809145, "uuid": "559e1dfb-6b21-431c-b290-62f935d3ead9", "comment": "Malware payload (GuLoader)", "value": "5f0f14b7869310571af69c24bc555d2cb05d6e9ecbe5b8762ba13e18f9f8c50ecf9e0f426387e01215d8c1911a2032db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809145, "uuid": "3255cace-65c9-43dc-8ced-650259378ff0", "value": "T19394E147EB1BA820C24544B3D8F589FAE7709D62A556047E3382FF1E98365CF8E1827D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809145, "uuid": "0464407d-d7cf-4a63-beb1-80719f84e6f4", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809145, "uuid": "45d9bf7b-3566-4a1f-bbaf-b030c1d746e9", "value": "6144:dNDlOLZLClTgEN/HqnXYPXBNSBsiGAgynWxGiQBhTqwwM8Lt:dk8TgEN/HOExESAhkjg+wwM8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809145, "uuid": "d0f43ffd-923f-4286-86fb-a89e5103b575", "value": 427648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809145, "uuid": "cfe4f473-a9b2-4535-989f-acca01421438", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809145, "uuid": "0a9913a2-cc05-4de2-976a-6ff9ceb71acd", "value": "37aa05adb1f5408e886287c8b1ea074315a42ece0d47cbfe6678c26b6c396deb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "753d77fa-1951-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772797307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797307, "uuid": "e01c0148-1d03-4c84-8f61-3e16f3087a5a", "comment": "Malware payload", "value": "5d01fefbd4dcc4ed8e43e4de8fcd221c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797307, "uuid": "0b3357bc-2f62-441a-866a-8b176894ab06", "comment": "Malware payload", "value": "37b86c4a87633aba320b23ef7ecb94b84d175025aa235ebdb2eb0c27b4180931", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797307, "uuid": "c38694c0-86cf-46c9-af80-04045b6eb786", "comment": "Malware payload", "value": "ce7c84dc03fbd188df3b66c9d6416aec45e9efa7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797307, "uuid": "c068ab50-20bc-4c06-ad79-fb0cfc0e63d4", "comment": "Malware payload", "value": "bb9e478a8e43c4c2191fb6c2862faf02f7d6bb4290e2e2853cc778054a84b849031a55d01161e0b2c4920f7ee17e0284", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797307, "uuid": "32e0508b-3a8c-41b1-a585-30764eced987", "value": "T18241E79733FA367A829624B7442ED40AD6354F900C065C10BA8D0E0B6C8D79C3FBAF28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797307, "uuid": "b494b8f5-1a4c-4066-8065-40306dda1836", "value": "48:7jOgo7b5jag3L8GbE4+EvPbjrXecbtlaw6QRnpoQp8Owg/RG4WQeBE5AnL:7jqjHG4PPrXecbuNQFKSRG4uq5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772797307, "uuid": "40307fbb-2223-4e9f-a812-af1e37230533", "value": 2177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772797307, "uuid": "2a8c8a9d-7db0-40ee-9f6e-942294e69240", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797307, "uuid": "ee8b53e1-c6b5-4f8e-b122-55093c310fd0", "value": "37b86c4a87633aba320b23ef7ecb94b84d175025aa235ebdb2eb0c27b4180931.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "affd4561-196c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809002, "uuid": "7b62cbd5-ea43-4458-9fdc-d54015021da1", "comment": "Malware payload", "value": "96a4ff15f2ab4d2a61ad43e66214d294", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "res2erch-sl0ut-com", "colour": "#6451A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809002, "uuid": "16ff355e-96fc-40be-8ffa-0a5d88ec42d9", "comment": "Malware payload", "value": "385ad1da674183e937ef2ddf10efaacffda197b1112226d16ef6f8e38acd4fb7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "res2erch-sl0ut-com", "colour": "#6451A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809002, "uuid": "706fd543-8360-4961-b34a-a220e488caf2", "comment": "Malware payload", "value": "ba89884a964ac31b050a8ecffa68645d96a280bf", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "res2erch-sl0ut-com", "colour": "#6451A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809002, "uuid": "88a024fe-7675-47ef-b66c-2131f1304108", "comment": "Malware payload", "value": "2cce5d0cba5dcd603b51f25000ad04c7188c43626b51c3fe06eee1f1e0b00e2716b98f543b757b4c2edcdc138358daa2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "res2erch-sl0ut-com", "colour": "#6451A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809002, "uuid": "8c6a63b6-a306-4c17-8789-7b39dcaa3960", "value": "T13643C8077961273FE65DC70AE19409BC976AC35D422BF17DC2DDD02F180DE8EA632AA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809002, "uuid": "1b731110-104c-47c1-9294-8d3edd040f45", "value": "384:/8KO1MznZHOZa1Gqot68NZ8pxtO+3pByOT1DnmGyc3ZZethlLpfqz+DfTTb3oLnC:COOq58H8XtO8fpT3ZY1LBqPix", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809002, "uuid": "ec77fd2d-5c3a-46cb-9470-2f77170d8c62", "value": 57639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809002, "uuid": "c718adb7-b04c-42ff-b6b5-f6345e17b0b8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809002, "uuid": "fae2ca49-2312-4779-a53e-b843ae9dc84c", "value": "385ad1da674183e937ef2ddf10efaacffda197b1112226d16ef6f8e38acd4fb7.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b5b43e6-1976-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772813101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772813101, "uuid": "84ea8d06-6b05-48fb-b213-77add34c7c43", "comment": "Malware payload (Mirai)", "value": "ba99cce81b3dbdf8d2d2e9e57e573959", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772813101, "uuid": "9f35c476-e3b6-4715-bf9f-0d816d0edd56", "comment": "Malware payload (Mirai)", "value": "38952573242f93f1035bf87d1f36ebe6b90e16f1f01437c4864de4fb9a6fab5d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772813101, "uuid": "cdb1a92e-6465-4bfc-a670-934db4b2cae1", "comment": "Malware payload (Mirai)", "value": "fb472e5d4df38e2eabc3701508ac80c9070068f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772813101, "uuid": "d17b7272-e28e-46f5-89ed-d89381f795fd", "comment": "Malware payload (Mirai)", "value": "d465f17cc6397d1eb5a2ff01d58481b7c24c6b4fa86b556a705fd5a1c9ede3e94f52b28263bcc5322b0bb25765198743", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772813101, "uuid": "cbcc0095-c43b-458b-8005-de83ce4476eb", "value": "T18603E177226ED734C8A1B43401972AB1E416351F6E0E176A4CC839BED8F6E1EBD21658", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772813101, "uuid": "5a9599d7-7063-46a8-9564-9495e0cd7b99", "value": "768:gzj6d1mS9npcxOF1FNcyRl/5Fo12oKAdn1apfLTdTGM7Kwfs8ObfCEAx0rVk:Fd1mepcxOMyRVI12/Adn1iTGMu7jCtyk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772813101, "uuid": "73de2d8c-e043-48ce-9dd6-92f4098974d2", "value": 41324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772813101, "uuid": "6b5bf1e9-7c09-4b43-a4d0-47024d0ccbe6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772813101, "uuid": "6206a117-7aa2-4154-9a6f-88497f8503a7", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aad3a2c8-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772810711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810711, "uuid": "872396bc-9d82-4179-be8f-4d1fc4bbf446", "comment": "Malware payload (PhantomStealer)", "value": "28b8d95853485623014f60a41dd1fa0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810711, "uuid": "6c72e9d5-fd1c-48be-b48a-144f1ccc49cc", "comment": "Malware payload (PhantomStealer)", "value": "38a7ef3260f432d67e3328304936494f67ec110b2bd086ef4cea6f9edde669d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810711, "uuid": "1553562b-af6c-435e-8a1c-28258e73f416", "comment": "Malware payload (PhantomStealer)", "value": "942bedab51ca7690d8ffe55610bc33f2454eefc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810711, "uuid": "c178884b-af65-4791-886b-5c41c32dc4b0", "comment": "Malware payload (PhantomStealer)", "value": "2deee6929c1301813aa86cd26b8bbce832f40adb9ba74a11a7a5b4670d3c0ce7e226a443847301880c8862435391c082", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810711, "uuid": "fc7e8c99-54f9-470d-ad08-957b5521a7a1", "value": "T1C965225C1A46C803E5456B3806B1F678037C6EEEA911E21B8FFCADEFFA65E555C042C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810711, "uuid": "72e8b02d-c4e3-4934-b0db-9afa3d91117d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810711, "uuid": "631a1921-d50c-469c-8307-f6b3c943932d", "value": "24576:DEjwWOp2WC9x0SkH3f+bIVKsnHs9ICNcz3qnEIWbmam2qZaJQ:DEjwIWlFXf+0VKsnMWeK3kWb6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810711, "uuid": "d87a739b-70b0-4db5-bcb6-4d26d1c877b7", "value": 1538048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810711, "uuid": "fbe8b1e3-7aaf-4498-8414-acb74bd69dee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810711, "uuid": "3b6df799-fe27-4216-98c0-2d7ff2e51bf6", "value": "38a7ef3260f432d67e3328304936494f67ec110b2bd086ef4cea6f9edde669d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5cc475a-194c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772795348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795348, "uuid": "0e0a99f0-ed84-45e3-9d54-00b3e52e89a5", "comment": "Malware payload", "value": "c43de198b7985ec194ce8ec01f27ae28", "object_relation": "md5", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795348, "uuid": "aea1a107-1ced-4d01-b509-3a898c322a46", "comment": "Malware payload", "value": "38be16184e096d283bdfdffce1323201a1049494b86206146b1a149cf04daf6a", "object_relation": "sha256", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795348, "uuid": "e09f74c0-9555-41b2-a1ba-3d4d6fb28853", "comment": "Malware payload", "value": "9013bdfff469deb1b4e84670b3b835aefeff3c7e", "object_relation": "sha1", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795348, "uuid": "518c2a37-0195-4781-9bc0-1e98f669f27d", "comment": "Malware payload", "value": "1eb87ccb340d8ee8745b17c71bfe8c5fc1e40d7a4cb391c98bf5dec174dcdce1ab423660631eb49ebbd453a8c77e7104", "object_relation": "sha3-384", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795348, "uuid": "7fa5d06f-efb3-466e-97c1-10ac8a04204f", "value": "T196473351CE7DF620D78451B1C613A836F2846A5BB1F867EF12123864CCE69B9B600DEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795348, "uuid": "697f913c-04d2-4a24-b48d-f4371c081037", "value": "786432:Mh3vc2PTXPfYVZ8/hA52rZ06rtp2GgGBm5oqozDeRQdE:kvhX34Z8ZAaZbRHv+ojE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772795348, "uuid": "65ebbbce-4f8d-48f7-9d84-80db4fb082bb", "value": 26164392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772795348, "uuid": "153808f5-aae9-474c-88bd-571a6cb53f6d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795348, "uuid": "cf2bba2a-6651-4d96-86e4-de7a5dc35e86", "value": "Main Setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ff89323-1900-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772762536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772762536, "uuid": "ca59c66b-4476-492b-b8e5-dd57875e4b81", "comment": "Malware payload (Mirai)", "value": "a2b58c193298cdd45bb91256c1438591", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772762536, "uuid": "600716c1-8246-469d-b3d0-d943d9672645", "comment": "Malware payload (Mirai)", "value": "39d68839e8a19b23d13e68bae166b5ae36596fe9831decaf68d5f1d1e2f1588d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772762536, "uuid": "960d4ebc-f0bd-4dcc-a6da-006bb0f6ca19", "comment": "Malware payload (Mirai)", "value": "046c59ca3c30bdc9340b2a92869cc1a310b9bcb0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772762536, "uuid": "a6b9d459-a6c6-47c0-a11e-f6716ca63b32", "comment": "Malware payload (Mirai)", "value": "14d5be75d1ae869514f138fb9ed8761dad11e03fd78fbbf75b2cfd1d3650d2a2fe1df5f3ba39fed1dc6832407026881f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772762536, "uuid": "732b10e9-2847-4eaf-8c2d-f35aca7407bd", "value": "T1C6D35C0673180E17D5A349B02A3F1BE083FEE5D121F0BA89691F9B6A8676D371485FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772762536, "uuid": "00043fc5-a9cd-436b-828d-e0311f802870", "value": "3072:CV0zui1ZhMHJCIqWrpP7OUK3y0uMg9FkiH:LP1Yiwd7OUKC0uMg3kiH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772762536, "uuid": "152240e1-7c3d-435f-83e2-699f26c391e7", "value": 134336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772762536, "uuid": "56e2cd3c-a9c7-4e6a-8319-3a05199b292d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772762536, "uuid": "8f42a1b2-e895-4f92-8ed7-3f18aa7ebce8", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5daca8c4-1961-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1772804139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772804139, "uuid": "13c80dfa-5369-409c-9ef0-d7cc0c0fb145", "comment": "Malware payload (MassLogger)", "value": "51325df3d9168860c21f65bf50dc1642", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772804139, "uuid": "5119e283-a415-4c8a-9e81-e20ddda2499d", "comment": "Malware payload (MassLogger)", "value": "3a3a4110dcc3baba9e0ae00b5a47a77ab0e3d639e547419478130b2a0469cefa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772804139, "uuid": "7c4b543e-f533-47fc-b5bc-59cc5c0040e3", "comment": "Malware payload (MassLogger)", "value": "a6cfa3ed776fdd2660ae5b6949636fe192a9145a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772804139, "uuid": "94ddee85-bbea-473b-8ea3-dfc403cec2a1", "comment": "Malware payload (MassLogger)", "value": "aabc10c1ea285597d0c0b710fe5fd685b5c2656591f9f8c4a140f15ae46a4b7c053d5a8aade5f3470aa092900c40243e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772804139, "uuid": "e243c62c-d520-41e8-9d70-3eea15984be1", "value": "T122259E027391C062FFAB91334F5AF6115BBC79260123A61F13981DBABE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772804139, "uuid": "adfb8681-9906-4d3f-ad14-5a81f7fca03b", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772804139, "uuid": "e0912818-a97c-4f1a-857c-51369e3e4f99", "value": "24576:K5EmXFtKaL4/oFe5T9yyXYfP1ijXdaDhFlAa:KPVt/LZeJbInQRaDhF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772804139, "uuid": "857fabff-8fd5-48da-9010-e7604c329bcb", "value": 1033728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772804139, "uuid": "d79ce58f-5dee-425b-895b-748ffc3b4e57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772804139, "uuid": "9f178f30-ae82-4bc0-8c95-057c4bdb4691", "value": "3a3a4110dcc3baba9e0ae00b5a47a77ab0e3d639e547419478130b2a0469cefa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e32568a1-196a-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808229, "uuid": "86aaaba6-2d04-4432-a55b-744550ffdd49", "comment": "Malware payload (GCleaner)", "value": "63c6c285bd2f654c6f56250b82fe405f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808229, "uuid": "bdd061c6-319a-460a-9c7c-74dd33378dd3", "comment": "Malware payload (GCleaner)", "value": "3a4b89c22dd10c4c399a241332eba906e7f517d31bd83feaef83fd9345182f12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808229, "uuid": "97ed9ef1-774b-4156-b94e-ae5708062de0", "comment": "Malware payload (GCleaner)", "value": "c12a4a37abd064c5acbf77d234479ca30ae2421b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808229, "uuid": "1a4076cd-0ff3-4c51-ba21-76931009497a", "comment": "Malware payload (GCleaner)", "value": "1a08a78978e4378f56592f1e9084883acc9a42248052d14f062a82ff03599324ec4d4dfcf68221f170aa9b8147b3d3c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808229, "uuid": "3b32c63f-d2af-4584-acba-9e2b8db07305", "value": "T18016E17B618C8D75C72F317EB196615E74CC38BAB4284431E6D0BEDD54688E3B03626E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808229, "uuid": "47b23b53-fb3c-4025-8d9c-9c054786ee62", "value": "336c69b6e8562d1c5231f219b62d7473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808229, "uuid": "c03c373c-d636-479d-a28c-2fb48cbff485", "value": "98304:Z9zuGEY4VAwKvvLQSkX9CCq1UoQWOCj0hLuRv:ZKOESkXQ9UoQWOC4hL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808229, "uuid": "cb3923fa-f5bf-4387-a4f1-5f8fbf3618c4", "value": 4269056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808229, "uuid": "c1de780d-1bae-4fd4-a9f1-411c89167e65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808229, "uuid": "b37ee876-11b0-402c-bfca-75ea858ed8a3", "value": "3a4b89c22dd10c4c399a241332eba906e7f517d31bd83feaef83fd9345182f12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef07d4e0-196b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808678, "uuid": "b143ee0a-a09f-4cfd-a2a1-da666d5a0249", "comment": "Malware payload", "value": "5b4ce823248157e64ebe9b0bedc6e7d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808678, "uuid": "e749c51d-b788-4c01-8b2b-1076cf7e97e4", "comment": "Malware payload", "value": "3a62c1ae1eb80997af627ee0a4a669d055a8a759c8b25a391a43d4122171bb90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808678, "uuid": "99c41754-509a-477c-9ae5-f07c9e1f670a", "comment": "Malware payload", "value": "0f5301c41ba97e36ac02bf3085c8762013269cd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808678, "uuid": "2133eea8-0e6b-400a-96c8-92532857c80b", "comment": "Malware payload", "value": "0415f7dfe99420fdadb76a56be95c1b3b81a720b92580fefd78b51eab2f45fc5696dd235b69e6786158c6f825e95a263", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808678, "uuid": "b11f0f30-9863-4493-9f56-dd76ef9dd8c8", "value": "T103351245371ADC03D4B28FF11A71D7B056B8AF9DA801E393CEEAADDFF4696412C41292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808678, "uuid": "cdf55dab-4c4a-4f5b-88b4-ff161a3b09eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808678, "uuid": "ed4881d9-f026-46dc-a31f-fbfec26393d1", "value": "24576:DZqu2V2/xEbowG1df0Ab6RrnZeOm08MM6IuND/KngTGs:9eV2/xEpidxbaZVQMvVif", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808678, "uuid": "3f92e41f-62d9-41b6-8a2c-bf5b4b626c12", "value": 1086464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808678, "uuid": "c1a1a25b-a232-4869-9d2b-fb32003bf660", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808678, "uuid": "dc888a25-405c-4074-aced-238ded13fd37", "value": "3a62c1ae1eb80997af627ee0a4a669d055a8a759c8b25a391a43d4122171bb90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57fcad60-1968-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807136, "uuid": "2e9a41d7-0aaf-4609-83df-9cb87ac62b99", "comment": "Malware payload", "value": "f0fb5ec669ca4f7870454372857bbdd2", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807136, "uuid": "f025a497-d2d3-459c-b5ed-8bfb89a02408", "comment": "Malware payload", "value": "3a85ba5c84ce4adf7eb3ceeb49fd5ae331bc8b9936dd6432bd07d7a17f07e71f", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807136, "uuid": "382400a2-fe3c-4e57-8594-0c3e3ce21868", "comment": "Malware payload", "value": "a2a7be8335056f077ff2f9b0fe64929c1dc9c930", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807136, "uuid": "7333c699-5ade-47b0-aac9-d5388a57684e", "comment": "Malware payload", "value": "ba760397b8e926342f3846349b1be6ab7c87fce908e31a335980b374be2cba7757dec31080a0347c7e44b154259724c9", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807136, "uuid": "cc629bf3-b30e-42ad-85f3-a96051d80fdc", "value": "T18C85AD15E3A811A8D86BD734CA669333D67078420730E58F0699D64A2F73FD29BFB712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807136, "uuid": "8b4a9df9-b25d-4ebb-89ab-38d672665690", "value": "7b1a4dc12ce22c7907a2498889d735f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807136, "uuid": "c00d09f7-23a5-4f4d-8dab-0cc6dcab17a3", "value": "49152:iu8RY3Z5Q5Hj9uR66jU4CR2OoWqz1qtbuGFs:GoAtXS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807136, "uuid": "eed04c2e-8d68-49b9-944b-13a96c11d6ba", "value": 1843712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807136, "uuid": "538c3d4b-497d-44cd-a04a-83a4d634eca4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807136, "uuid": "5ef0c791-1e79-4615-b13e-5b08020e9abc", "value": "libpsl-5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc107b3e-193c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772788406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788406, "uuid": "04ec9e2e-64ec-4a3d-aea3-085fc72a9957", "comment": "Malware payload", "value": "e71af071ddb9d4c8a8937c13912d1874", "object_relation": "md5", "Tag": [ { "name": "157-20-182-49", "colour": "#B32581", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788406, "uuid": "a76cffff-4c3c-489e-8047-53494a1ef936", "comment": "Malware payload", "value": "3a8a3df66049bc95248c68da8e3161131db317460d64a589a0a632093ba6bb97", "object_relation": "sha256", "Tag": [ { "name": "157-20-182-49", "colour": "#B32581", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788406, "uuid": "a4080cf0-c7e2-4e0a-aebc-492a9dcc9e8e", "comment": "Malware payload", "value": "eee6cd69974b3096c8eba3c8de76e2cab1e7f0dc", "object_relation": "sha1", "Tag": [ { "name": "157-20-182-49", "colour": "#B32581", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788406, "uuid": "d0736933-4892-4cf5-b1ad-5fb5e3fdf3c3", "comment": "Malware payload", "value": "d64be3697c9b8276226d460510737ccdaf9ded8bf7fe28b7868b64e08f02a48a47ecda4339d3b1dc36fe1cb11fd87005", "object_relation": "sha3-384", "Tag": [ { "name": "157-20-182-49", "colour": "#B32581", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788406, "uuid": "96290941-03b9-4e44-a7b1-653680913e6c", "value": "T153365B17EC9155E6C0EAE23089629652BA31BC497B3123D72F90F7382F73BD05AB9714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788406, "uuid": "0fa5bbe5-abaf-4cf3-845c-cb01a3ee5990", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788406, "uuid": "9ede800d-cdfa-412c-9a24-fff7f4de797d", "value": "49152:uyYaoPhVkzMM/FH2jhD4Ck0F4AnO/NF9HAU8DuOTzDfpYwKeK9KEaer05E:ugSQFCO/9suaYDeE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772788406, "uuid": "cb58d625-9572-4eb1-9042-6644ba71d1bd", "value": 4960192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772788406, "uuid": "17d0d989-ac73-4175-b371-c9ed995b10dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788406, "uuid": "dcbd06fa-08ea-45ce-924a-ec80a4d2f466", "value": "3a8a3df66049bc95248c68da8e3161131db317460d64a589a0a632093ba6bb97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "640cbd63-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772808875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808875, "uuid": "6db6ad89-4a1c-4fdf-80ec-d950b944a7b6", "comment": "Malware payload (PhantomStealer)", "value": "0e2bf97b3b911fba98e3a79dfed600ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808875, "uuid": "0a92b997-ca40-420a-bffb-79c39f77f748", "comment": "Malware payload (PhantomStealer)", "value": "3a980e79d7f3daa71a99bb7d7307af048844a6d2b3ff9f9aaf11124afb44498e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808875, "uuid": "8bacebbb-c846-4b9e-ade0-67dc228c8b76", "comment": "Malware payload (PhantomStealer)", "value": "aa203fc64e13c7bddd5c6ac078b42da7bdd9a88b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808875, "uuid": "b7dff47d-7fb7-4c7c-ace7-e22c601d6caf", "comment": "Malware payload (PhantomStealer)", "value": "ce1614126a0f98d7a6f9893002629ac9843dcce8e7ffab29a532326d3828fb6738608e1887411431e34eb4cc7c690a04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808875, "uuid": "ff9b8cd4-54dc-4a21-973c-8ebdf4548e58", "value": "T1898512151766DC02D0F60FF44A72D3745BF92E8AA912C3138FE6ACDBB93B3816945293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808875, "uuid": "44cb8b15-7723-49b0-bdd0-4c8b4ee1536c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808875, "uuid": "4d4f38cf-6d9d-4e24-97d7-8c5110ceb79a", "value": "49152:2eVu9gbrCHD4wvSaxxCLd7yS3tXes5Znhfsm:u9RDP3M4u9x3hfb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808875, "uuid": "aaf4d35c-7391-4265-8c00-5ebf72b9f89b", "value": 1789440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808875, "uuid": "08f06d0f-37b2-4336-b62b-79d86164a2fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808875, "uuid": "9af745f3-68dc-41e1-ada4-996287cc0d8e", "value": "3a980e79d7f3daa71a99bb7d7307af048844a6d2b3ff9f9aaf11124afb44498e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88b4cf34-1972-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811513, "uuid": "a5ee6073-10a7-4078-8050-7b371e2a9847", "comment": "Malware payload", "value": "dbb9eb309d03dbe0fcfa870f43b14e2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811513, "uuid": "b1b0e6ed-82a9-4770-b11c-2725de70f748", "comment": "Malware payload", "value": "3ab27b0f9d1e943f4f6064f2dff199cd85c84141dfbc24ac4df755f5e580ac0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811513, "uuid": "c2749d42-aaf8-4374-a1e4-b88626780148", "comment": "Malware payload", "value": "d96b050cadf1b371adb6dac872554f698659af77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811513, "uuid": "da33c25e-2c1c-4ebc-8f3e-db4a03ddcaca", "comment": "Malware payload", "value": "ced72059485f34970bddac22fab7ce1d6584345ba478e2325a39b10bc0eacdd9a206fa53510abb1bf4ae30cbfb56dc10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811513, "uuid": "e5ca2df9-8969-4c8e-b374-5d7b8bed132a", "value": "T115A4C616E660B42AF88709703D79B657792D3C362640DD0BBB899F9A3A71583B0F431F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811513, "uuid": "40faee02-d23e-402a-ac3f-a4e71bbbb5e2", "value": "57df06b815c700f6bb4e7f79b8bb3c33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811513, "uuid": "8d52916b-c4b9-48df-83b2-4c7547ce07ac", "value": "12288:Cc5ymGOdJJ9HCZRRmbpix7qPP63X1lY6NAlO:sOzJUuqlWlO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811513, "uuid": "7da3a9c6-dd31-4d3d-9e59-074d11ef8c00", "value": 491520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811513, "uuid": "b0c51454-4869-4eb3-bcf7-e9b79431d09c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811513, "uuid": "3ac3c965-5a98-481f-88fd-6480096e022c", "value": "3ab27b0f9d1e943f4f6064f2dff199cd85c84141dfbc24ac4df755f5e580ac0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d92d1986-1970-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810789, "uuid": "22430766-273a-49aa-a98e-37e9ade487e6", "comment": "Malware payload", "value": "30242a0c1147da42c36779136958a594", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810789, "uuid": "0fb0804c-9399-4791-aa37-bcbd4bf7d847", "comment": "Malware payload", "value": "3ae3210709fea96cfea9bfd16c0f0bb8f36c49f669744908c4162f824acdb91d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810789, "uuid": "1322b8fb-c3db-4885-af2a-c6d6c56dd108", "comment": "Malware payload", "value": "72df88caa9bc5e87fdaa4df299ffd852ca47dbc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810789, "uuid": "b319c07c-194e-4c5e-ad88-0039f0467f87", "comment": "Malware payload", "value": "4238147c98f92f4cd391decaf9f5af7bc5edb85a57165c8317c6fdded494c725d6684834dcdf1a7bf8d072d6ab1aa1a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810789, "uuid": "0025dffe-6599-4544-9112-95ef03865a02", "value": "T1ABB42306A7A844B7C8971D73036B524ADAF89C2308243A63A7109F5D3D3F76AD51F3A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810789, "uuid": "06d2e218-f186-4313-ab43-b05d006a99cf", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810789, "uuid": "29efb9bf-1dc7-4446-af46-b1491cca8094", "value": "12288:O1yDJwoagFYdPVUwYYR8qiATzMS7dOHHITpJJ7A5CqWp:O1yDJwoExVU2RiATJ7IHH8bFYk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810789, "uuid": "98c3f194-b27a-4041-b9d6-f38873484f78", "value": 536408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810789, "uuid": "b9ece460-ce6e-48f7-bd3f-6f4ed5d119f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810789, "uuid": "1cb22ed8-e747-4a93-abfb-9f2c1814ee52", "value": "3ae3210709fea96cfea9bfd16c0f0bb8f36c49f669744908c4162f824acdb91d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e6f5072-1992-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1772825106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772825106, "uuid": "4ee8e56d-721e-4962-9960-ce963c63f8f6", "comment": "Malware payload (njrat)", "value": "54b55ebd4f7d751ed8aef582696eb049", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772825106, "uuid": "01ace84e-d2ef-4ec0-82d6-f1ab30ec9ac7", "comment": "Malware payload (njrat)", "value": "3b16e21fa47d1ec4b6d7239b4b5c654661d516929374ea4de9153e9ccd012001", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772825106, "uuid": "2ece8f08-a8d0-49ea-ac22-4b82f382ead2", "comment": "Malware payload (njrat)", "value": "1ed38e5308d3d7620c8a3cfec5c5e43f4175d192", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772825106, "uuid": "94070df3-aa18-4b1c-8ae7-c5470abed302", "comment": "Malware payload (njrat)", "value": "f81db75a6d3d4eade11e6945bea5dc6ba0d33bee033cb070c0466aabd5527267191edd0609397934fbfe2582400a0a98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772825106, "uuid": "60ab0405-fa3a-422c-a141-9d423724a755", "value": "T176236D4037E8C136E2BD8BB4ADF3A2418679D6671903CB596CC414EA2B13BC597136FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772825106, "uuid": "e07b1250-ad82-44d0-b42b-007d7bfb31a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772825106, "uuid": "8cac67ba-55c6-42fd-bba6-a3bac9c85cf3", "value": "768:BOEuILWCKi+DiP1JKk81yI/4isl8YbAgeBv4M/vEgK/JrZVc6KN:BOtm9wjwBzbnRM/nkJrZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772825106, "uuid": "c537fb8e-2df6-4605-a37e-401d9cde30e1", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772825106, "uuid": "3d70b7de-3fa8-4c07-a4b0-5fe797d73199", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772825106, "uuid": "fb6da4e6-820d-47fe-a811-ce5386a14e2f", "value": "3b16e21fa47d1ec4b6d7239b4b5c654661d516929374e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c724619c-1969-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807752, "uuid": "f9d78ed4-7b17-4c80-a789-512d8f5fb14b", "comment": "Malware payload", "value": "545ba2e32245d542fd77c2a26b293d1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807752, "uuid": "afe4f041-dcff-47d9-bb04-596543afaf20", "comment": "Malware payload", "value": "3b284233b05f48d7a22247ff1da9351f9c2ba4d7cf188e8e55080dbe9171ac15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807752, "uuid": "87ab6c02-dc4d-4ce2-be6b-04b456392ada", "comment": "Malware payload", "value": "93a99536082d5bba98bee7c7ec6f774075736a48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807752, "uuid": "7de69d8f-e5fa-4341-8e85-4702bd86a163", "comment": "Malware payload", "value": "8f346211a8ab177a03396d3805dbfe55bd88a291d6eda24496400f42fef9e47ec33d0d92fdc3bdc830e63606da53e2b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807752, "uuid": "bade9e5d-b515-4dd3-94c8-f45831b23004", "value": "T1DE3512ADBA15AE52CA4C5B77C003A00D85F3C113FAA2F3B94ADD58F50F6A768C44D963", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807752, "uuid": "7ce8c1af-3534-43c1-acdf-761735888268", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807752, "uuid": "7fef3c62-2e4b-4595-a129-fcfcc6669148", "value": "24576:Rkijw0dx/SUV43Et6LTZyVT5cX4ileHZDwP701:Pjw0XzRMLTZfX4CQDcw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807752, "uuid": "1e8611d6-a0a3-48d1-828e-f98bb357054e", "value": 1113608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807752, "uuid": "be7e7d1b-693f-4984-9f03-cc7b275a385f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807752, "uuid": "90adf358-7ff4-4939-8321-46ee094931af", "value": "3b284233b05f48d7a22247ff1da9351f9c2ba4d7cf188e8e55080dbe9171ac15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06d98421-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819026, "uuid": "6edae141-9c53-4fac-8f58-bf9a5e84f411", "comment": "Malware payload (Mirai)", "value": "1466315b9a8f25ef6479ba6c77915467", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819026, "uuid": "d47bc62f-9471-4f67-a4ef-91858532443c", "comment": "Malware payload (Mirai)", "value": "3b30f6ba290fd6e8bfd7385358de98ff45704c428c1653dd97853382223a659f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819026, "uuid": "ccfabb15-6cc3-4410-b613-74f232d8e7b7", "comment": "Malware payload (Mirai)", "value": "5f3068b7ba505c2689be042a4e078f1b53ca0033", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819026, "uuid": "bf5de007-d354-49e6-a4d2-1ab17831d33f", "comment": "Malware payload (Mirai)", "value": "318cfb956da0ac0fc36f4f07de524a1efc8a1d6e900fe72b36bad0b4a15cc7b0a13884c1de53b7e21bec98d695c1538a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819026, "uuid": "204fffbb-4fbb-41b3-9a1b-f11fba423e95", "value": "T19DE35B97BE831490CCA386F012C3075E2BB342605F7E64E3BC5E556EE976DCA162A7C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819026, "uuid": "2d502b50-b06c-4bcb-95d3-c1dbd6c80bfe", "value": "1536:gQZVV7c6QffviGuekMl1WjmUugBYOl815e18bx3meRigKNE5ueBiC/LW2:Y6OzuBMl1i79BYO6e18vigOKueBiCq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819026, "uuid": "4f50287b-f521-4809-9d8d-4cf11930be32", "value": 149264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819026, "uuid": "d19709f9-f8b0-45ad-b07e-3b2a6b7b908b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819026, "uuid": "c7810115-6cf0-4788-b3f3-51af37f62858", "value": "debug.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27af6b47-1904-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772764106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764106, "uuid": "96a541d8-04cb-4c05-a248-1b19337fcb92", "comment": "Malware payload (Mirai)", "value": "334be5764140c0ee6485abc163ff4c5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764106, "uuid": "2873d94b-e613-488e-9963-d59d949b406e", "comment": "Malware payload (Mirai)", "value": "3b348dffeb399e4887968bcc4563a1ca1c1139238df72fb7e90e4c321097b4dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764106, "uuid": "69212a18-87bb-4eeb-89c3-3fc2ce163d5d", "comment": "Malware payload (Mirai)", "value": "ce3b28c1e70b5af92354f02f02e3f128f4c7f627", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764106, "uuid": "666aed86-3248-4e32-adac-19f0a417f064", "comment": "Malware payload (Mirai)", "value": "15d23568349034db19b9cd53ef372e50550ece45a85a8047b2ab09eb7460a17a0d5c3ed7c724c2c1ceb06a2ffb2a8384", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772764106, "uuid": "8dc8568c-cee6-4cd4-a8ae-c9371c9f2da4", "value": "T1FCD31A41F9504F23C6D622BBFB5E428D372917A8D2EF72039D256F64378696B0E37602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772764106, "uuid": "9a69da47-6824-4db3-8698-e217ac10868a", "value": "1536:hFN2l4G58dxS6HauEl2wgAcW0AEGL4V5ilT6IJEJ4XVbOl1qTo9IYfJ+ILl8+wyQ:hFN2Ps3EutW0C46lZJEJ0yHaYh+9oG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772764106, "uuid": "76ccebb3-bafa-48cf-b9a9-c188ce245727", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772764106, "uuid": "584134f5-8687-4590-b080-319a9c944141", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772764106, "uuid": "92fabe37-185e-4f51-a499-6a795e69664b", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab9066b4-194b-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772794821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794821, "uuid": "257a255e-7619-4124-bff3-8f16c3256e9c", "comment": "Malware payload (RemcosRAT)", "value": "66cf8e08cbcd52e8df13fe5cc498212f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794821, "uuid": "5c314ac6-22bb-420f-b01b-0741b23d1f41", "comment": "Malware payload (RemcosRAT)", "value": "3b5c621c788afbe5c6d56b18385175bb15cb3a3cc8389160e5ad3bd385389b82", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794821, "uuid": "394f6875-73f3-4f31-b5d0-ccc710e03e52", "comment": "Malware payload (RemcosRAT)", "value": "8de816727595143ccfec4430a8638b11247d1155", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794821, "uuid": "9ab708da-8773-43c1-a59d-025d84097228", "comment": "Malware payload (RemcosRAT)", "value": "08b7f6d927693784470d1ea68965a36c1a703c2624eedae8762ad74f19976860b37298a8b48a479af1674dd4d17339f2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772794821, "uuid": "6eecaf2a-0284-48f5-9f69-61d967ecdb85", "value": "T1CAE5BF0C49D4439FC4196B0E70FDD23DA2E247CB25B83F5EA7BF6D497A9E484A10A16C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772794821, "uuid": "3861935e-6439-470d-8a86-f6a3b6fef299", "value": "24576:6v9x3NyyaMpTR9DpIuYPcQSsek3n0SO65MuQY6yXf/eC8+5+KkX1JOR0jMeXdoHW:6vIQmtv1zuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772794821, "uuid": "3f9fa89f-fc78-47fd-8882-6fc1935e276f", "value": 3120028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772794821, "uuid": "a71aa588-5fb3-4bc6-b921-b3f12498f020", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772794821, "uuid": "1faf515d-0994-4396-bc12-453fb7ee326f", "value": "ProofOfPayment.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fa36923-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810505, "uuid": "e60db95d-9872-4243-8f02-7adb7a7fc032", "comment": "Malware payload (GCleaner)", "value": "e7a2f019b1dd85b43e966bbd8582d99e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810505, "uuid": "f1c68bb1-e31d-4f5f-82b9-f4001e756bdb", "comment": "Malware payload (GCleaner)", "value": "3b8a372205f5ea6adde1c6d6ce647230f23f569ec6774bdc5eddb911a9240c53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810505, "uuid": "8b5c9af2-c61c-4a21-b1ae-17f459fac73c", "comment": "Malware payload (GCleaner)", "value": "91d0963c629800f2bddc9a6c76e22ae4215a3736", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810505, "uuid": "35202e5e-f747-461a-a76e-beefd764bb55", "comment": "Malware payload (GCleaner)", "value": "d0a16f79f55085cdc59061379314f9409a3b6f3aeaff7cacdafe5def6fee20bf01bff22d3a90983cc25c52b9728c6084", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810505, "uuid": "acec13e8-8524-4d37-ba64-b48aa8304b75", "value": "T175059E22B2F18CF3D16766389F5F725C5829BE10396964462AD4DECC4E39781F82A34F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810505, "uuid": "9c712119-d795-4029-91df-46313999757e", "value": "5343399a39928268750ade4858cbd1d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810505, "uuid": "0588ffb3-625f-4930-90a0-4ab015a0f4b1", "value": "12288:C2d0/V6Chk61Wd0Mv6jE/h/skoa97bUC8/nqD2:P6N31WB6YJPB97bU5/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810505, "uuid": "cf327f85-ca4e-4146-a37f-93feb6a879e3", "value": 826368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810505, "uuid": "4bd9d8be-827e-457e-be74-aebba2e9b77a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810505, "uuid": "13db8a3c-05b7-47b7-b668-857e4a74afb4", "value": "3b8a372205f5ea6adde1c6d6ce647230f23f569ec6774bdc5eddb911a9240c53", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "764f1e6f-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819213, "uuid": "a3238aa8-f949-4b8d-aace-ec90757c01d6", "comment": "Malware payload (Mirai)", "value": "ac07fea70ac5182f091c822877ce7f30", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819213, "uuid": "34b1083a-1fea-425a-9618-bf0283c6bc90", "comment": "Malware payload (Mirai)", "value": "3b9a075cfeac91b279daf407fe49f03741750f7d39dac7a09ad9457c87621071", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819213, "uuid": "99cb0d4a-7817-475c-9938-30f127d92ac8", "comment": "Malware payload (Mirai)", "value": "03f91e21e4a2dc5cab2dc0a6e2b8552d2352a7da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819213, "uuid": "db38d83c-775e-40c5-8903-94105502e28e", "comment": "Malware payload (Mirai)", "value": "8783641ef87d08028ff255e2aa7fe9ab168ef3b44514e495687ee5e5f70b0bff24376883c1e3afd191eba8906916c44a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819213, "uuid": "90360d73-7465-4d30-8660-3dd0f518f2e2", "value": "T1E1936C02B30D0B57E2571FB0293F27D9839ED6D052F0A58A261F9F8593B1B322947ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819213, "uuid": "42c4814f-535b-4e64-9459-31a66fc6c073", "value": "1536:F6sZZv4PQnIBppBpQCgayBhuhAXRye1qVdW5ipjEpcUgm/KbaAy8TWe7hb:xEQIBppBD2huyRt2d/pj/UAm6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819213, "uuid": "bbe84547-8f79-4961-aa4b-f4548b952717", "value": 93032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819213, "uuid": "0df10931-0e71-43c1-b174-ca06afe4f7a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819213, "uuid": "1b23e8ca-2c32-4ff2-bada-8cf0b06a2eb4", "value": "violetppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b934f50a-1971-11f1-a769-42010a9c0008", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1772811165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811165, "uuid": "93583fb5-1ff3-4b70-ad89-df44310f294c", "comment": "Malware payload (ScarfaceStealer)", "value": "af030a1b93eee4d0992d04f7ae7c5a4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811165, "uuid": "516f0dfc-d4c6-47d2-8c07-7100efe9b02a", "comment": "Malware payload (ScarfaceStealer)", "value": "3bb845fc71fd512777b68e66a1fed3a601af04df9bce4f9415b9316e25bb2a05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811165, "uuid": "14bc29cb-e170-42dc-99c6-b926dc2fe610", "comment": "Malware payload (ScarfaceStealer)", "value": "34ba707954344b47f944abeb12947e56c03ce5b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811165, "uuid": "1a7f02df-0ef0-4a74-a1bc-1559a143dcfa", "comment": "Malware payload (ScarfaceStealer)", "value": "74dad96d9ee41e029e69eb0c5edac66f17261d1ea4804e0617849f9827a9bc3094e1d54cbf68af4cfa7fb3db8d35c3f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811165, "uuid": "e5d1d7c2-7126-43cc-b024-cab6f27dea0a", "value": "T114F7594262EA04C4F9F7DA359AE65217D673BC166F3081CF325C172A1F736E08976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811165, "uuid": "46a27a87-dc4a-49e3-a81f-37d6c3e42b10", "value": "772ec87d3452991a9933a3ba0d9963a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811165, "uuid": "311b02b2-6874-4ea3-9e8a-e46fc58625e3", "value": "393216:1n1XQgPR2k3m5C507G9ITEc5eAlkLbQurxMWhAsIyNOPS0B4AycWsCYaxFzwW/tL:11XR7AsxYqt2oRGj5rs3wb8/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811165, "uuid": "361a718b-ef80-4ec0-af81-a28baaa4abe4", "value": 71521280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811165, "uuid": "9d7c6a3f-87fd-41b4-be90-411f2c4f1620", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811165, "uuid": "1e01dcf5-2694-4e02-97e3-07aa4c445416", "value": "3bb845fc71fd512777b68e66a1fed3a601af04df9bce4f9415b9316e25bb2a05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69870206-1951-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772797287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797287, "uuid": "2644a29f-f9d1-4428-ba73-7aca750e1763", "comment": "Malware payload", "value": "01fafc32682a5a5a78e9b320570c093c", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797287, "uuid": "f38d8784-1767-49d8-be14-4fb82b0b5112", "comment": "Malware payload", "value": "3bc461557b49469631359401c244ca25f76f3305e26c96f485fe4749aa23f6a2", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797287, "uuid": "4d2c832a-555e-49a7-b4f2-aa308cd939c6", "comment": "Malware payload", "value": "410d45ade900e795cd5a9d55451c460aafbeb033", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797287, "uuid": "103edc0a-b819-41fc-bf57-b9febca0de7d", "comment": "Malware payload", "value": "61470c687dbc4ce00a6c1a2952a27e8b2eaa8573bfdf7a6aa5feb4b294272f2f72b16122e12b118340d4b2caf520945f", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797287, "uuid": "b058260a-5f72-43dc-bb6c-790d5580d4ae", "value": "T194C412B719D1BE7EE15C02F36917B0B8B2268C42C17879A2195317DC4E9B41E0B2A5FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797287, "uuid": "eb4c6859-a86d-451f-9a12-944a3e095a38", "value": "12288:Hktl/NXlQBkUK1Dvgdecm9Rcw4w8hnf88of7/H6dKFcFUdKWO:ix6k71D46cbLbw7SdRWO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772797287, "uuid": "6554f855-345d-4721-ac07-ebbf7476b731", "value": 551120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772797287, "uuid": "dbac87a9-0afe-4c66-88ad-6d95bb64a69b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797287, "uuid": "c3ee75b5-61cb-4ee2-81d3-0591e01b7b60", "value": "Invoice E-way bill.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88a1a516-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808506, "uuid": "e2c74ce3-7761-4ecf-8a6b-f588981f2dcd", "comment": "Malware payload (GCleaner)", "value": "8adb50c00684b3148565eb0ed552f571", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808506, "uuid": "71daa504-a15c-4560-ac51-1e260272dc0e", "comment": "Malware payload (GCleaner)", "value": "3bedde554291e12285abb97a4fe6ccd4dcf7286cbb9105e59cb02c8b2616af47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808506, "uuid": "e071621e-842f-458d-a213-a2853ec39105", "comment": "Malware payload (GCleaner)", "value": "f35cec86ebf05de10a41b9a451a872cd460a206a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808506, "uuid": "d3bcdcbc-c935-4179-9e12-e493c9759207", "comment": "Malware payload (GCleaner)", "value": "49b2040d0e34cbe8271c1f40a712356da336c4b7d597d2166ab841b266250e3b7abede50ef69bffa77e599bd4d37fbb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808506, "uuid": "74a68544-5c73-4fc6-9161-2d8463fdb9ea", "value": "T11126D07263F301E9E0115E798E6E69AC342B3BB337942F68DB9C09DFC1146523CA54DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808506, "uuid": "ec6287b2-6716-4234-810d-4159e29cc637", "value": "c243d5a6283f8eb7bff20dd0797e21c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808506, "uuid": "03c82ace-b2f5-451f-8e24-57936c20ed04", "value": "98304:LH5rSFYRRUV4nulqTDcORffStrPramvEMMlCnSeAm3cebaOt:LBa1axZSxTxvEESeAm3fzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808506, "uuid": "518d78a1-ffad-4e22-b357-a41336aa7193", "value": 4700672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808506, "uuid": "0560c6f8-bd15-4768-9fd9-08fe9b18fd3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808506, "uuid": "146fade2-5002-4bb9-9280-c5c516590c90", "value": "3bedde554291e12285abb97a4fe6ccd4dcf7286cbb9105e59cb02c8b2616af47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5154711c-198c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772822587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772822587, "uuid": "153122c6-cdd7-4835-8ac1-2934be2ae903", "comment": "Malware payload", "value": "f828f29febe7f22ae630e50aaf23ce5a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772822587, "uuid": "34139846-1c2d-47f0-95ea-a457f060cf24", "comment": "Malware payload", "value": "3c63aa190a8008580443448eb6685bca9bf5b2ec3aaf8b1f07b355cc496385f8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772822587, "uuid": "04b90d81-e27f-4ed7-b370-5451d7148227", "comment": "Malware payload", "value": "c6c2586473e2e4c6741ba584c66e571ec9b3ec00", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772822587, "uuid": "ccdc383b-4f95-4181-a6e0-9af82e4a3f00", "comment": "Malware payload", "value": "b007e013ec0c9a8c7acbc7ddbd3492ef72155ba79d4a94f72ecb42bfad85a170b31ed6efa9e39c35bc55f6b9d974b75b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772822587, "uuid": "3c312432-a692-4bcd-b543-47fa83009388", "value": "T1884509126ADC28A9F5B72734EA76616B26347D2D8F11C4EF70543B8E5472BC0CEB1722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772822587, "uuid": "7fbc3854-9fd1-4aa1-9fe0-2c19a97c89be", "value": "5806f995faef2f2c9a26843c97e4e628", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772822587, "uuid": "f985715d-71e9-4946-8e15-c119e18fef0d", "value": "24576:k4u6MfqXTNTulUxgNRuZqykUFSYqAxaTbjd5qGUEe99f:k4u6qqXTNTulUgNLZd5he99", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772822587, "uuid": "24c6ef95-8ba8-4341-8166-be42bb5421b6", "value": 1230336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772822587, "uuid": "c48c9159-3759-47e1-8ed4-33923cb39a5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772822587, "uuid": "581d2d22-00cf-4932-8f07-6d25f27010c1", "value": "SecuriteInfo.com.Win32.MalwareX-gen.89319235", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "724906b0-196b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808469, "uuid": "17d099d2-8e35-4e7f-904f-9d88eea2a78e", "comment": "Malware payload", "value": "e32cd5561f0c2d2104dcbdfbd327dd84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808469, "uuid": "36835234-8469-49d1-9b0e-4b1c56d54415", "comment": "Malware payload", "value": "3cc3af9d88fe88e63fa15aa813dc429c8ada43063c8bbba519bf42b52b06e211", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808469, "uuid": "29b35f99-7269-4082-b212-042a0fd3fda8", "comment": "Malware payload", "value": "13b0526c71f7e8826e50bd13f16b29611046da59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808469, "uuid": "4ef543e0-bf2a-400f-bded-e6537fb87261", "comment": "Malware payload", "value": "dfd1ff4ef68fb8d5284e562c1390e373ab5ce0eb8f4f2cb45303faca7aa6d70aab0cb18e8e140f3d02c017be772322e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808469, "uuid": "706511f8-8af7-4b44-8234-5b0d315b09ed", "value": "T13E3501122D872658DA991FB8C1AA15D833F0D96762CADBBF6FEC01F49EE7B41CD01421", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808469, "uuid": "19bce195-2943-4401-a99b-f4e59addb4b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808469, "uuid": "601a1e0b-6559-410a-b2ed-8b641dfb98b2", "value": "24576:YOq0gSFJynPgKzfjEXfmRyl/OZbEXng07ehNHnz:YONhOPgufjEXf8ygGehN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808469, "uuid": "48da51ec-506f-4d7f-a901-ace06705dadc", "value": 1147904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808469, "uuid": "1e28a2f0-90b8-4807-b9ed-33bd122c730a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808469, "uuid": "076a22f0-65f1-4a40-b3e4-4bef4ab726bc", "value": "3cc3af9d88fe88e63fa15aa813dc429c8ada43063c8bbba519bf42b52b06e211", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53d31058-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810565, "uuid": "099b03da-14fe-48f8-bcc5-f541758c100f", "comment": "Malware payload (GCleaner)", "value": "09b72892512fc737763c8666008c8881", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810565, "uuid": "20a98b5d-e4eb-4bda-bb41-54ccd007fdba", "comment": "Malware payload (GCleaner)", "value": "3d5429ce7fdf355be4c2964090e7399f248e1a87c7f2c64f1dcfbe41fdcf1b96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810565, "uuid": "9409ee62-ff20-4781-90e9-1cc19cdbc196", "comment": "Malware payload (GCleaner)", "value": "f0e1e8a7377cf4db8e963734756dfdd3a37760d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810565, "uuid": "213c1ffc-8f48-4ba6-88d8-d9a2ed93fc83", "comment": "Malware payload (GCleaner)", "value": "617bde3850ecdb3f6719d0a2c2069fd862f9063700837bd5acf19535f7c471b988fda8aa04f09c62e2d406cb01eb35a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810565, "uuid": "572504f3-e3f6-4bfe-9a76-eaf62d7dba08", "value": "T168059D32F2B14837D3633A789D5F765C9429BD406D7D68C66BE81EC81F382813D2A297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810565, "uuid": "b5a5fad8-d7ec-44c9-81b3-847b1d18a306", "value": "5343399a39928268750ade4858cbd1d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810565, "uuid": "5b21572c-faa7-4b38-85ab-62e97e541cc6", "value": "12288:q2d0/V6Chk61Wd0Mv6jE/h/5kvdTtoUfRt8iBPnaPA+PwI:H6N31WB6YJS42/RPnaZP7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810565, "uuid": "fc774869-6408-4646-8246-f4135dc3e157", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810565, "uuid": "12550d11-7b19-478c-819c-bcff5ac20c40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810565, "uuid": "037af42b-7e97-4924-9bf1-8ec11eedd5ae", "value": "3d5429ce7fdf355be4c2964090e7399f248e1a87c7f2c64f1dcfbe41fdcf1b96", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ea3d00f-196c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808892, "uuid": "af0872cf-171e-4d25-972b-51ac72468669", "comment": "Malware payload", "value": "b96e69b4075b324dfefa8ef9f98f577c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808892, "uuid": "24cfb352-d236-4556-b4bd-4a6fe5e5c0a4", "comment": "Malware payload", "value": "3dbb135314eaec7d907c2f94c75cfdf3d82eca5ffbf722649632975f7e642530", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808892, "uuid": "a6a31c5f-45e5-4982-bb14-9874facc1b3c", "comment": "Malware payload", "value": "822d35d613c11c7049b1ba98b343f3fa7d4dda3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808892, "uuid": "fbd73959-e9da-4a4c-b3b8-25edf52878f2", "comment": "Malware payload", "value": "e24429e1b897fc807f0d712e2241795d852871475feb361fd2504265ce1aba21d17fdb4fdbe6feec7dd0c69708b6cc91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808892, "uuid": "33efdd79-1957-4a9a-b3aa-21f498f6ebd1", "value": "T1BE85E00273D1D062FFAB95334B6AF6115ABC79260123A61F13981D79FE701B2463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808892, "uuid": "8fa38656-c3b8-467a-a8a0-428c193c5ce6", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808892, "uuid": "6be7541f-1042-4acf-b47b-eaea326ccb60", "value": "49152:8PVt/LZeJbInQRahulN9mWnMyo1g9ddV:CTYbInQtvmWnMkdd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808892, "uuid": "39834d82-9c8d-48be-ad36-6946acd14d38", "value": 1734656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808892, "uuid": "0a1b69a7-61de-4d22-a60d-5dfb7cc0a2e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808892, "uuid": "6ce56303-17f7-4ca0-85ce-827ee9211f02", "value": "3dbb135314eaec7d907c2f94c75cfdf3d82eca5ffbf722649632975f7e642530", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7d8a396-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772811646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811646, "uuid": "fa45526c-4c80-41da-9cda-52cde212e9fb", "comment": "Malware payload (AgentTesla)", "value": "bbdf1e2c8997cd2b913925f99d1b9bbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811646, "uuid": "6167bcfa-97ed-4da7-b16b-6ee77a565758", "comment": "Malware payload (AgentTesla)", "value": "3de6916c996862fca34d1e1be8fd826371ba94fffd6b51d1f51cfd7398b6b1d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811646, "uuid": "8c395989-c55b-4fcc-acf3-a7cf5a9e9d33", "comment": "Malware payload (AgentTesla)", "value": "9f990a0eec55935468e17bb44a77ecd5fe82bce8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811646, "uuid": "40e9f3d9-a5d3-4ba6-89c1-9cd81e6e2871", "comment": "Malware payload (AgentTesla)", "value": "757a7733e67e9733d361ed5401537dda8479934b9eda340b4d615494a8f08c83b1e167591a8cc583a0cf26cef70b0815", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811646, "uuid": "dfc4a6a4-a593-45c3-add3-85fbf57c17db", "value": "T115F4229759C06EA1C2596334C8328D6189BA39B19E41767C8769F06F3831383DBBB71F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811646, "uuid": "7e79f668-eea8-480f-a97c-48f5b166d051", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811646, "uuid": "95f110d1-8a1d-4e9f-bd78-35767b2f4d2b", "value": "12288:6z7hU5I5yuNHIgzSFKxWltRohBfSTso93UXIDnTAyVMsZh7mCYtuPsUpyqL2yJb8:6f+iN57Gtene3UYTAyVMAh7BYtApy8J4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811646, "uuid": "d6f45582-b16f-4781-9880-ff1990e23eca", "value": 742400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811646, "uuid": "3285436b-5bb7-47ac-b097-d01988d24d78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811646, "uuid": "6b97c40a-0dd6-49fa-9e8c-303a43f460cc", "value": "3de6916c996862fca34d1e1be8fd826371ba94fffd6b51d1f51cfd7398b6b1d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56ff6bac-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811000, "uuid": "60e10845-c652-46b3-b33d-67c94ecd26c5", "comment": "Malware payload", "value": "6b5781eb6d94c66693cddd463e86ab25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811000, "uuid": "b8ff7852-80db-48b3-9e78-baff56cc3ab7", "comment": "Malware payload", "value": "3e153a7edb74f3950d50bcf968418184648a7f195fd81268f77525e9b97c6960", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811000, "uuid": "2a9bd44e-df0a-4fe0-b46d-42150c117245", "comment": "Malware payload", "value": "03cef69bad17e0c3b02e2601258d733354d5e2a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811000, "uuid": "06b2f9dc-d639-4a97-a5a5-ef131722fd74", "comment": "Malware payload", "value": "6d0ae530d64e71d5cc29493fd2350811d2cfd417e494bdc5be5c1447cc7baa46932967e0705da982187339513617f88f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811000, "uuid": "7dc5154a-57a6-41ac-bb74-bac995b03542", "value": "T1FFD5F1302AAC91B6E59D75F1D05071323B79FDAE4B9E4460B6C861A90C15EE73E3F322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811000, "uuid": "4b8ab536-597b-4a05-ae03-37cb602c6b9e", "value": "ac8d714b899fdcb6b2c2a33c5510782b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811000, "uuid": "8649a948-269c-4ee9-8eb3-a53b449fc63a", "value": "49152:VFz4qvhFWMNn2wkh0Vd4/F8zw5x6+tkhVLzcejrEHSd0:Vua60nbA/G+8LzcuEl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811000, "uuid": "7b7e36c2-8025-4e29-a0dc-eb01037fd5da", "value": 2915392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811000, "uuid": "20a76b58-2085-4ff7-b848-b73114b33b5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811000, "uuid": "cd4af0c8-7815-4f1b-8b5e-c6a639b17cb5", "value": "3e153a7edb74f3950d50bcf968418184648a7f195fd81268f77525e9b97c6960", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b974d267-1972-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811595, "uuid": "03da7558-b10d-4c51-927e-e08037b0fd13", "comment": "Malware payload", "value": "3e3a9e7667b27e337a94d6c1c12c0fb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811595, "uuid": "f98dd7d7-d097-4b60-aea5-20d756a89c12", "comment": "Malware payload", "value": "3e9d504758ae48a0343d2abd920e712171726751e411f3be92bbe77222d79fcf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811595, "uuid": "60cb88fb-fc64-435c-821c-9af8dd3353c4", "comment": "Malware payload", "value": "8678d7f578524a3aaf82f1a57f1d62d00f8b8ee4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811595, "uuid": "4987d89d-4ed8-4fe6-bc8e-6f287b50f67f", "comment": "Malware payload", "value": "aa86b0917a867a20da0dd22f1b049f33ae0ec3a3c87338363b0c70be64267297be01764252acc2782ff4f9a6b79f7d3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811595, "uuid": "16dcc4a3-dbe5-48e3-9e54-f3945c5ebc66", "value": "T1D2B402133391E3BBE956C277709E83538F30A41647161A2B3390EB6668F7172F74A25E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811595, "uuid": "730b0729-4172-4ec6-9fd0-f49161a4eb1e", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811595, "uuid": "2232634a-10e0-4464-ace3-9af972438b83", "value": "12288:XZZey8kGh/TPhKiaCIfPGw5HN49tcpWcWm:JZeymlPxaCBw5HAtg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811595, "uuid": "dd120043-9bb8-4f0e-9171-ba3928e084aa", "value": 507480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811595, "uuid": "eece58a3-94c4-43a5-bb8e-cd503c66641e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811595, "uuid": "13f45b3e-6b8f-498a-943b-e1b40dc98388", "value": "3e9d504758ae48a0343d2abd920e712171726751e411f3be92bbe77222d79fcf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3570c9e5-1953-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772798059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798059, "uuid": "794a4168-f5cd-4f52-8bef-6d3e4df3d3b5", "comment": "Malware payload", "value": "47da8d3c86b7b90a63ffa4f5ca24b761", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798059, "uuid": "0449c5c7-8ab9-4116-94dc-569b23d3a0d4", "comment": "Malware payload", "value": "3ed254376109a5a0419ceab44386b0f9bd06fd391b06c82a3e566c0f44875a38", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798059, "uuid": "1c83a05b-3af8-4b2c-85f0-c14b5d86f969", "comment": "Malware payload", "value": "1f9788ac90d7db50e760214e32fa61a6d1e60f91", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798059, "uuid": "21fe6637-1496-4437-a403-c03fa5b2b3dc", "comment": "Malware payload", "value": "7498de3614b4bb256967276a1cecfd79c37e6d50a7603f0e822f33f02c54aaf3f48c405568486baccf5a2932ce9c4a89", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798059, "uuid": "07bdeb2c-6a68-4fa2-800d-dee76aad6c2d", "value": "T1C635125F45D5A390D78B67E8F61E2815B9AC212EF00107FD628CC9ABAE5385D0FB3325", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798059, "uuid": "c75ca58a-7cd8-4102-8a41-6ddffc505a6d", "value": "24:8kTAjFpr4wFg8M329yLgJ8mzIeBtmIyBBI737c0I:G1gBkC6mh6z7E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772798059, "uuid": "5c9d5fda-22b7-47a4-a402-20c1bdb7eb32", "value": 1115822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772798059, "uuid": "61ea5810-b9c6-4384-912d-e557945464ab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798059, "uuid": "b12cdd5c-120a-446e-b9cf-695ad69d9c32", "value": "47da8d3c86b7b90a63ffa4f5ca24b761.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b5fe525-194d-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772795653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795653, "uuid": "ef6efa28-67f0-4057-abbd-7ebe2c3cd0af", "comment": "Malware payload (Smoke Loader)", "value": "90137bb535b8047d4143a2dc7c41f369", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-4995", "colour": "#496C42", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795653, "uuid": "bfa74cec-24e2-4342-bca0-bbeb42eea1b6", "comment": "Malware payload (Smoke Loader)", "value": "3f0003aeba017d37e5fd0c1acf199b3c67e1acefcca71dc2875f190c8f639672", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-4995", "colour": "#496C42", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795653, "uuid": "dc8ca23a-0172-420c-b830-1d08f5d0f74f", "comment": "Malware payload (Smoke Loader)", "value": "88c326191f0a2f1396485ead5f2aa1617ca88fc3", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-4995", "colour": "#496C42", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795653, "uuid": "7fede12f-aedd-4261-a045-fdd243b36b4e", "comment": "Malware payload (Smoke Loader)", "value": "e5a0cdb751352ac8b17a03994728fd3afa33d53583aae76f1cfee522dbe9ffe51643374a53e9a70bb49da7ca4528c5f3", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-4995", "colour": "#496C42", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795653, "uuid": "b4581de1-0083-4060-856d-fa474ddd02de", "value": "T187E633269E3576F18EA4403FF1A45F54F72283249A54799D3288D7BF6F0998EAC20CCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795653, "uuid": "9c71f1fa-37e8-42a0-b237-b846750d7730", "value": "393216:pAHmUSDGC6MfAPp8wc/wDiBJFZoc5fj2wXW2DY:p8p2APZc/wDiP/rjEAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772795653, "uuid": "fa317e2b-3a4a-4c17-934e-1ec4e5a0b956", "value": 14539555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772795653, "uuid": "d5475cce-dba0-41d6-9137-0bdda485a019", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795653, "uuid": "160ee47f-ce47-44f3-a52d-f784c27613f8", "value": "source code of carbanak backdoor discovered.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e73b65de-192d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772782036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782036, "uuid": "e9dcb8f8-ff2c-4f6a-9c8b-d7d1c21e00a7", "comment": "Malware payload", "value": "ba8138df7e0c33c568b8444323f7e387", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782036, "uuid": "7917f49b-7016-463f-9f28-9f96d960f5c5", "comment": "Malware payload", "value": "3fd08e667f1c50944a5594bd05cbed0272ae0b35ea4301ed60e96dab302ee6b8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782036, "uuid": "f99202b0-37da-458f-8aa8-b3189ddacd4a", "comment": "Malware payload", "value": "154f7c4966b96d48cde71184f20cde4b5c02e0db", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782036, "uuid": "720c3e93-eb83-4226-9d8b-0e4221c5381e", "comment": "Malware payload", "value": "54b5e390139fe49bb19355c54c4681f74f1d63c8134c96ea56d86220291df67fc40d513e9c2e7f1f8b5d84e87a00b88c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782036, "uuid": "2ea159af-1b85-4274-a7d6-716d396a5fc3", "value": "T11034121E0619C3ABC57FD67D600C0B938CE24154922BD6B7980A134F46DAB66FD4EE3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782036, "uuid": "634790ed-07ca-43e6-9dbe-d18cbc4baac6", "value": "6144:/OJtNHl1WMQ0k5U05weA8q04sHGDkiKNg:/at/4wk5lwbp05iD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772782036, "uuid": "123a0e95-583b-46eb-adba-e77e66fcb8e6", "value": 247244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772782036, "uuid": "f0dc8c45-07f4-4c71-99aa-673aabbe8ced", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782036, "uuid": "51d11de1-5a20-4d17-a6ba-098030a91262", "value": "spankki.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76aac466-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772809335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809335, "uuid": "e49f3fc2-30aa-4eb7-9e3f-de63f06eee3b", "comment": "Malware payload (Formbook)", "value": "8a77eed03a6ec7ea42367cc6b2c769a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809335, "uuid": "f8d400d0-6843-4840-8b8f-d1eb047a0f28", "comment": "Malware payload (Formbook)", "value": "401b7bb4653506a6382c8204574c37dc49078b5e0aea939a675b5dbd28affb60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809335, "uuid": "b43845e8-8f75-470f-8570-e70b9ec71dc5", "comment": "Malware payload (Formbook)", "value": "db7ee576008480d1129762bf9834f511134e01fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809335, "uuid": "1f7e9518-cc1b-4425-8e3e-315e7f9880ee", "comment": "Malware payload (Formbook)", "value": "74f328a5620f78ba49d95a531e1aff888c18cafa1d8b5a86efbf8940405369f71e1e2fc960169a450d4413a8787fc167", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809335, "uuid": "441b95b8-6e7d-445f-b81b-37d76657a1d7", "value": "T15D251268320ADB03D0A71BB40D70E1B417B82DDDB166C3538FDABDBB797A6A518443C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809335, "uuid": "3ce93795-91ea-47f5-8df9-685d3c2bc1d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809335, "uuid": "6c6459f6-b514-4b43-bf4d-0b05b04a41c0", "value": "24576:p/j2eKWUzX7yxNYQ7frgA11zCf/1BUrDgCwNP:p/fF0OPfgA11zCfdBvCM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809335, "uuid": "84a5b5b4-d300-4f3b-a6c3-da59fecd2db3", "value": 1033216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809335, "uuid": "533c3a9f-f0a0-4b66-8432-956d9619a88f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809335, "uuid": "09c69bad-8bf9-4e1e-acd3-0d7e8cb9315b", "value": "401b7bb4653506a6382c8204574c37dc49078b5e0aea939a675b5dbd28affb60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f90c3328-196a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808266, "uuid": "a774c170-92e6-4b55-962b-7b04616e8fcc", "comment": "Malware payload", "value": "1f08b73d277a1810f3d7b27160938076", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808266, "uuid": "c8827e3f-4e7f-4ad5-975e-9764d686e23d", "comment": "Malware payload", "value": "401c50c10e105b44dac2079d99d7e6980639ff05511ec7e44a9e2be391dbe8a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808266, "uuid": "953749d1-a37b-458a-ad9b-4779d606ece0", "comment": "Malware payload", "value": "f95569aef37292e73f131430b9ef205f1d421f8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808266, "uuid": "262f3119-4643-4ee0-985d-8a7161e47a5d", "comment": "Malware payload", "value": "1557ab4bb38523e6a7110525c384ba8be559e987ba9d5588b72c0a5af5da6a35e1346b055778c22011563a37cb36d72b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808266, "uuid": "cf88381a-7542-4fae-b66e-08faa47a2953", "value": "T1E625DF0527E95B68F4BEAB7991B4142087F2F903E732DA9E7D8C41DE0A32B41C652733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808266, "uuid": "c6c09fc7-027d-4faa-bc3e-f1b0a5d37d5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808266, "uuid": "b5c55a5d-6c15-41ec-9186-3375f2f23210", "value": "12288:O669o2tVX5rVBo83tUsm+u6cgJxPLX4D11K0XGeglq7ehF4h8V5F140ZI:A9oarVBo6tgNExj4DDXng07ehzI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808266, "uuid": "66e3b8b3-efbf-477f-a24c-50d35b98722a", "value": 1048576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808266, "uuid": "2f6e2e41-8d88-4c5f-8321-f26f23fe2632", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808266, "uuid": "98f3f6fa-d244-4f37-a9a8-31835082df1d", "value": "401c50c10e105b44dac2079d99d7e6980639ff05511ec7e44a9e2be391dbe8a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "593cfc81-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772809286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809286, "uuid": "b90a2ec3-d712-4db9-91bf-48c592523a60", "comment": "Malware payload (RemcosRAT)", "value": "57df3640d43a6eb609537dd2a486cd43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809286, "uuid": "dbba332f-c768-4aa4-83d1-cc4b69493c3a", "comment": "Malware payload (RemcosRAT)", "value": "41065376e44e187979cb05bbbcc102ea7d61b110c49907195e2640ed3500843f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809286, "uuid": "23f7803b-8727-45fe-8280-0cd3b0902b1e", "comment": "Malware payload (RemcosRAT)", "value": "129499c72d72e6a3efd7186dffd1931427d9a56a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809286, "uuid": "8c991375-4ea3-44eb-b7b7-d0539bc9957b", "comment": "Malware payload (RemcosRAT)", "value": "00fdfdd234866d709a6c77b030a41f6a2b87cf9b56dd3a3c7a0e82f48179251dcee4e451bb24dc881bcfac81008b0d5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809286, "uuid": "abe1b0e2-872a-495f-9a8c-909eee86bba0", "value": "T1BD5501372DC31660C9A50F75D2A914E973F0CA5B1155E7BB6AEC02F4ED62B0AC8235F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809286, "uuid": "d76d364f-d789-4305-8dbd-8f5fa5e34083", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809286, "uuid": "f9b7ed64-8a53-4ca4-b46f-a203d98d67a5", "value": "24576:m167hpLT/4PPH7caoc7YCnRveYepqMKDmfC4KOSSn2n6kJblNB1:FLzswaoyRveYkqM3fC41p2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809286, "uuid": "02fcd284-b0b3-4f0d-b894-12c066b03192", "value": 1390592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809286, "uuid": "9348c551-31de-4e43-854c-99eb71357103", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809286, "uuid": "659b4a63-0ce5-4af1-8619-d399a93617c0", "value": "41065376e44e187979cb05bbbcc102ea7d61b110c49907195e2640ed3500843f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0bad596-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810292, "uuid": "bd5ce77e-b1ff-4c18-96a1-551b78f3e800", "comment": "Malware payload (GCleaner)", "value": "1c015fe916d377e3c1710beae64bc22c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810292, "uuid": "c5b2b48d-0c25-44ec-b61a-a151f25fc0f5", "comment": "Malware payload (GCleaner)", "value": "41363a642a6a8990422315f9bdab709f04e0e634d2a7fdf0f0856610b689dcc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810292, "uuid": "ccd763ff-56b3-47f6-836a-c7e0ef7602f6", "comment": "Malware payload (GCleaner)", "value": "ace71ea50ab25685a4c72843ea00433c7548bc63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810292, "uuid": "23088884-157e-4512-aa43-9a0ad7909076", "comment": "Malware payload (GCleaner)", "value": "c77c971562a162c5965b1ee822c252fcf60f8e4fe1ea25e2436bd77c24eb09278f7d5ff541480c334f5756889d0cf169", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810292, "uuid": "3f941406-f743-41f9-a15d-48bc5ba60e13", "value": "T12E45AFB2B29A4032CD7117399C7757DC5AA9BE102E38B84AEBE50FCE5F7414174342AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810292, "uuid": "019df5c8-834d-44a4-9f72-30756bc6312b", "value": "0eefadf8e9087d6d95cc4aedf30a5018", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810292, "uuid": "e25d1fd5-5f9f-4a49-90b7-ce45e3106534", "value": "12288:dVLMD7V2wGymFSmu4eDCQi0628ZhcPaGfEdERlSdpgdICRii9L97teH82+Mn3DlL:dVwXV4HSmYq7MPPfEd+epg3f78H9+MJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810292, "uuid": "8fb41be1-8098-4b3f-aa3d-00936bd9e6e2", "value": 1258496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810292, "uuid": "b69ea4f8-b8bb-4177-abee-e86a8011e165", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810292, "uuid": "6f181230-f0af-4d75-b489-2053fcc0753b", "value": "41363a642a6a8990422315f9bdab709f04e0e634d2a7fdf0f0856610b689dcc9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bb36c44-196d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809317, "uuid": "102fcdf5-a226-4791-983a-a8d6cf0d286b", "comment": "Malware payload", "value": "4aedb1303a0527919d7f8cb182438e1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809317, "uuid": "944ad3cd-39c0-4ad7-a17b-6290b4f84062", "comment": "Malware payload", "value": "415e3136d4a107b9de336ef34b51c9f303a8e88fa79a2145575667ad2a5879ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809317, "uuid": "3c627417-28ef-4206-9c36-97d96d3c5b2f", "comment": "Malware payload", "value": "5af2cd9cf0f22b9fa50cc72ec8e6e5dc7b158a6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809317, "uuid": "58012347-821e-48db-9aa9-1dfa6fac1fb7", "comment": "Malware payload", "value": "1f78ecdcb358073084ed15218e51c55556716df1b18ef11c18a9021b7eb4ff6c3209f32c185cd9fa7e9dc3d81910501f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809317, "uuid": "1ead8a93-b0a6-4a32-99c1-7688d3e9203e", "value": "T188C4AFA1E711DAABD5AB0ABA4CBBC4313567AC5E86E2111E315CB62825F331111DFF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809317, "uuid": "b9206a0d-e489-4abf-ac93-ed1ad864dbd5", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809317, "uuid": "56d6e064-ba9a-4a76-9578-7b6cd9cea629", "value": "6144:kwq3NpQ3wDIywUF5ykHERIe6M3O8l8h/D2HXZTf7MIRWs/Smbb1vTep4f2RLo:kzcae6cxl8UZTfgIRWIzdCa2Rc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809317, "uuid": "1ab92bd4-7363-4bde-ba5f-39c740943ef6", "value": 548616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809317, "uuid": "628400f8-7c8e-448e-bcb0-a1038221606b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809317, "uuid": "53ec2b9b-82d8-497c-b547-dacd6c9d35f6", "value": "415e3136d4a107b9de336ef34b51c9f303a8e88fa79a2145575667ad2a5879ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12206079-196a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807878, "uuid": "24ac6a39-abb7-493b-b725-ccd0ec81df9b", "comment": "Malware payload", "value": "5bc60e1523a3cf71f433c8c4382b2f2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807878, "uuid": "92fc5707-9d70-4943-9a98-6029af4e063f", "comment": "Malware payload", "value": "4198db90e1806f265dbce14b5f4e78e5814a8de700bd86345b2051c6f1245358", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807878, "uuid": "dcea805f-6c8d-4787-9cea-47a56c179334", "comment": "Malware payload", "value": "9a639a40e38cb3c307e415bcf880e87dd4b6ed6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807878, "uuid": "247c5bc4-393f-4792-b635-a29a6e8020c5", "comment": "Malware payload", "value": "fc6d1cc26151dbe1423d4ac13cd02478d822473f683fa1fa2081809f9ee44d70edd6986ed47ff008a9f9e59fd072829a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807878, "uuid": "95c8383e-f337-44dd-bfa8-8af381759999", "value": "T154150248370BDD03C05403B259E1D23513B29F4AF663D2875EE96EEB76A6BE619D8303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807878, "uuid": "38980129-c38e-41e4-99b9-96297a2a2c49", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807878, "uuid": "22c247fa-931c-453c-a59f-3c510052f4d0", "value": "24576:U+9v3+0XWEM7oS+kb14GphI88Me1uwLFbcguQlVictA:tVTM7oS+kb14Sh38Me1uyuWQcq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807878, "uuid": "44514498-528b-4f63-900a-f46f877522a8", "value": 879112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807878, "uuid": "1d88a04e-f11f-486d-a92a-4089268b11c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807878, "uuid": "083835ce-4694-43e2-a2f7-d3b4db751997", "value": "4198db90e1806f265dbce14b5f4e78e5814a8de700bd86345b2051c6f1245358", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c1581a2-1971-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810982, "uuid": "840f366e-cb31-486e-94b7-dc86fc00c9c5", "comment": "Malware payload (GCleaner)", "value": "97c2fdc928065a50f6a6bd35c67745e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810982, "uuid": "885db467-62e8-45ae-b3b1-fcf6a40c7186", "comment": "Malware payload (GCleaner)", "value": "41a94ea209617e09d6f6a7f947ae4b74aba87dfa2b3762c9b335d4837f5c4102", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810982, "uuid": "52f45381-fe26-40ab-ade3-abb2edfd733f", "comment": "Malware payload (GCleaner)", "value": "fba08404f395e71e67f2848d24127c626dd415c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810982, "uuid": "b50e5c56-a0c9-4579-a4b5-b492f9a738bb", "comment": "Malware payload (GCleaner)", "value": "81a6fa6b63f863bd3ce645a6775a99f1dcd1b38e45f54af03383b10681148fe11ddb77730b1ce284473baa21da4816da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810982, "uuid": "226e6e4f-8859-4733-a6d9-451517a333a6", "value": "T10BE4AF26F5D08437D1E269F8DF1B92A498357E80292B5B466FF85CE8CF34385F526283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810982, "uuid": "0ac3ac0f-db82-4809-bb0a-e4622a9e6876", "value": "ce7a1d07b14b49824555865592c3af45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810982, "uuid": "3093ee5a-98f6-4da7-a9af-4772b61e11e8", "value": "12288:/kAJdZJGY+5K/Lo9r7WTB+rPAB4Dbd097xSzlJMF4zay4O:dXZJeK0Z0PGndexSRJM2za9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810982, "uuid": "24a0d4ce-42d4-48b1-b2e7-5840ac48a780", "value": 699392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810982, "uuid": "3e4558de-5431-46b3-9137-b6d8e6bc204c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810982, "uuid": "195b30fa-d089-4858-8cc2-bc7d57ba0266", "value": "41a94ea209617e09d6f6a7f947ae4b74aba87dfa2b3762c9b335d4837f5c4102", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dfae068-196e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809643, "uuid": "03b01b51-0992-4fca-8b3a-6882aad9d91f", "comment": "Malware payload", "value": "dfcd16796e48904689a094d93a2ee1b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809643, "uuid": "86c746d7-5e77-4228-adc2-4e366234a39e", "comment": "Malware payload", "value": "41b05aa5a035380c93d37c6327316d927bbaa8cef2a8074a77614a6709b3fb0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809643, "uuid": "83a4debb-1048-45f6-a93c-0cb90e2fdc3b", "comment": "Malware payload", "value": "56463cc5d5c6e166c7a28a2a036f9ae24d562e5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809643, "uuid": "c3704ea7-6797-4bb4-9a82-b1646d9b7796", "comment": "Malware payload", "value": "e8bdac638b777b32b86fb1f9c68b2fe7feba5b0ab3fec8d47adc6e5903778e2bfc88cf5ef571492cab70acf98e63fdfa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809643, "uuid": "73a2fb24-751e-4be6-bc23-2d589c77b8fb", "value": "T1FAC4AFA1F610DAEBE5AB0AB588BBC43035676C5E8692111F316DB62865F331211DFF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809643, "uuid": "3c97cab0-b5af-4df1-a0a7-c691e41c41e0", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809643, "uuid": "b7571b2b-78b8-4a99-b0a7-f7617e1cf07e", "value": "12288:0zcae6umGppQ3CGd4yQJG2ZsI/91OScjqsCaU:aumYQP6yunZLgPCaU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809643, "uuid": "b708a3d8-dad0-46cf-9ae9-9c7a2fcdf2d5", "value": 555856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809643, "uuid": "3185786b-e2e6-44a3-a243-6e4ff33238df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809643, "uuid": "9e810a2b-68fa-4ff6-ace5-804a910ee6f5", "value": "41b05aa5a035380c93d37c6327316d927bbaa8cef2a8074a77614a6709b3fb0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4928405-193f-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772789790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789790, "uuid": "e9f62764-bf43-4c7c-88ca-92f36f9c2b21", "comment": "Malware payload (AsyncRAT)", "value": "3d9d39d5d0b41cc0dbac6aef09042a95", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789790, "uuid": "f7d821e9-fd30-458d-98ce-c05e476648ae", "comment": "Malware payload (AsyncRAT)", "value": "4220773101860bc41dd86e6bf2e25df445de1135ab525c868f4146913de5566e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789790, "uuid": "cc5f69db-81ab-4711-9a84-b24703603d16", "comment": "Malware payload (AsyncRAT)", "value": "c205411b24845e2f27122171d56535193797232e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789790, "uuid": "45a0053b-11f7-49cf-bede-95df0d1af194", "comment": "Malware payload (AsyncRAT)", "value": "935652e957f22cc3a0e2be7c6031083aeaffae5c70fdb9ddafd1714ef2272e40972f70b8fc886e442004a88ae656cf8c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789790, "uuid": "fcf98a61-57b5-4c9b-a95d-27dd74fb126e", "value": "T1159302411ED9C8A8C68ED537079A664A92B546F716292C90BE4C3BC47F808DCCBFF6D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789790, "uuid": "8943f873-290c-445b-ac36-3ee6f3c0df43", "value": "1536:Dy2i2Ny7AmZMV2lRS48kJSe68JGnBG1b8AJhyuO+a97vhJFmHR/0v5/m5Uv+UxsA:Dy2iQSU2648G6+Gnw98kO97ZJFmHlgtj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772789790, "uuid": "ec9071ff-3517-415e-a640-641816454366", "value": 94837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772789790, "uuid": "2e6d448e-1be1-4164-af4b-453c6669c5f0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789790, "uuid": "f9977633-89be-499e-8c02-79cc17332a25", "value": "loader.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1018b710-196c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808734, "uuid": "e243570c-6483-4db0-9bce-abb2a80e3bdf", "comment": "Malware payload", "value": "5a01c75789b62b18293d8b7380d853ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808734, "uuid": "7f6cce02-2908-4e04-bb33-ad2ea5ce433a", "comment": "Malware payload", "value": "423ec290859607655dfce4f545692bae1f1074a8a7275c5bd8303f89429f2219", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808734, "uuid": "a376f873-4397-4baa-addb-8665f698fa16", "comment": "Malware payload", "value": "88395bc6498c447999cb1e089d9b793bb844c632", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808734, "uuid": "4222a60a-a253-4afd-9f93-c7c0ba4582d6", "comment": "Malware payload", "value": "12dd459e29c8fceac2c976cb6a7bfe86078a3875faa3dbbb49d4d5a11d7497702a7f59a73015a68c1db31c6a6fbe1459", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808734, "uuid": "afced6ce-9d03-482d-b524-2b6d6e233252", "value": "T1927512103B2ADD03D8A61FF02AB1D7F057789E9D9411E3838EED7EDBB0796412D91292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808734, "uuid": "978b466c-823a-44a1-aa6f-bd6882529db2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808734, "uuid": "29b0f441-b343-4ae4-b039-7ed2847c46b6", "value": "24576:OZqu2VEWJEHzjeG09rApFkQVLdJCt5GbqGnF6yAwAW+cRkR5l4SrrbsReGa/:GeVEIkO9r2At5xm59ANJPDseGa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808734, "uuid": "c7d6b5c4-e120-4aa2-94ee-2d7a60cb66fe", "value": 1583104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808734, "uuid": "95ea00ef-b553-4449-a0ff-eb779e653cb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808734, "uuid": "4f2b423a-aed0-47be-b0da-83aedd27eb29", "value": "423ec290859607655dfce4f545692bae1f1074a8a7275c5bd8303f89429f2219", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e3c071c-1953-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772798047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798047, "uuid": "445432fe-e478-43c3-88cd-f1162d5293fa", "comment": "Malware payload", "value": "bbd81c5aee62fe307ed7608aa56526d9", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798047, "uuid": "006e73de-4cc9-40e7-910b-cf56c9c5c82d", "comment": "Malware payload", "value": "42448d6daf260d3c5fa633e4469f801f0528c0e56182ff8680c7e7fa2c832aca", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798047, "uuid": "59eb3660-bea7-4262-be92-fd58a6b7e761", "comment": "Malware payload", "value": "e5539fb432e618dbffa2f2329ceef84bc44de571", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798047, "uuid": "4142fde0-8413-4dd0-99cf-2aafc63667ef", "comment": "Malware payload", "value": "7fbc42c7ffc1b76b84de9c6058315c0dedd262257642d78651214a53600edeafd3f16f9d555cf4517bf26e050c442830", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798047, "uuid": "210fee38-e54b-4e95-a69e-4f8993d7ad88", "value": "T11BF4F13127E6BB5E88354F34C1FCA27817B1865E489B0E9FEB27BD406DAB0D050971AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798047, "uuid": "5a79228a-9021-44ca-9120-52d2b0f91599", "value": "12288:7gIhwHzkQZOiYLJPn2Dq6ufZus04t/PMOi8U9I3/nCMU7YH8Hj2nzkGWKp26RJJ:7gI4zvZ7CNJG+2Kvn4YHGKnwGWYv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772798047, "uuid": "1fd006b9-517b-4208-995e-fd8468709a10", "value": 749354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772798047, "uuid": "eb71c150-ca8b-4863-b253-321ddd8bf8e6", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798047, "uuid": "0b7ed1f5-3056-4fa5-9953-52fe12e44754", "value": "bbd81c5aee62fe307ed7608aa56526d9.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ede835bc-197a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772815119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815119, "uuid": "01310547-88cf-4395-b69a-edf311d951fc", "comment": "Malware payload (Mirai)", "value": "7d27186c1db01bbea30510cfc277e4c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815119, "uuid": "9be49678-673d-4954-88c6-e0f5c37a988f", "comment": "Malware payload (Mirai)", "value": "42c15fb2b72d2f7d997fb4b7a0c82c06bad2704c6caf10cae06a713bb87b3dd8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815119, "uuid": "605106fe-4ccd-4255-8d32-3065bef18d54", "comment": "Malware payload (Mirai)", "value": "a5f184172709a6375ce8e827bb0eb40530102f9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815119, "uuid": "da6c7c41-8ff9-4488-8a8a-d101653f7552", "comment": "Malware payload (Mirai)", "value": "7f9a19d45a466f1cf3891ead0d4929b7edf890222574d80233418be6417a10520b238445daf8fa01d52ac61910fd1927", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815119, "uuid": "69ca4fdd-4327-4a5c-ab37-7e6e387def35", "value": "T1F104975E6E228F7DF668873047B78D25A76833D627E1D644D2ACC1106F2029E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815119, "uuid": "de971fe3-244d-434e-9fd5-775852ae9917", "value": "3072:5AV0vz6qOWKZO4idT4SS5q6xfnmBYgZMD1y:qVIeXY4IeqAn4YgZH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772815119, "uuid": "c5fc1529-3624-4ad5-8f98-47a18f7ad32e", "value": 177772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772815119, "uuid": "24b10a26-8538-4f5f-9d67-965044ba9ac5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815119, "uuid": "22505beb-488b-4988-88d3-a9cd2286542f", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6728b979-1963-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772805014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805014, "uuid": "67401881-c1e3-483a-9c91-f05c4918a4d7", "comment": "Malware payload", "value": "c67db58506439801db7577f15a2a126b", "object_relation": "md5", "Tag": [ { "name": "abcknIe", "colour": "#31F8E7", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805014, "uuid": "2362e646-d04e-4658-8054-34d8dae90431", "comment": "Malware payload", "value": "42c7650c2ebbfd5690624483dc4e46ec7bd941a0ffc1e3c380f468ec12317162", "object_relation": "sha256", "Tag": [ { "name": "abcknIe", "colour": "#31F8E7", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805014, "uuid": "8d87bfdd-84f2-463d-8575-f5e12bad4e8c", "comment": "Malware payload", "value": "da88e2e7ac50823a11f0a691c53e81394af8fcc9", "object_relation": "sha1", "Tag": [ { "name": "abcknIe", "colour": "#31F8E7", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805014, "uuid": "6451d9de-d2bb-41b1-9748-56be97129104", "comment": "Malware payload", "value": "e541178a92e4c79887e81b24c43f2ce9a7433db469aa97d298e82d2b55fe5e144bce0294e987a76c3a886908a0ad5375", "object_relation": "sha3-384", "Tag": [ { "name": "abcknIe", "colour": "#31F8E7", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805014, "uuid": "022a904c-53e9-4c52-b26d-c0c29172859e", "value": "T1C7A17DB0B2ABF1E6CCD9016328FD86094556D80926101F29B354F7B85CDEF026E942B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805014, "uuid": "0adecffe-4b36-4ade-9a1b-a776c2a6d9a2", "value": "96:SaImbksFGfzPaD3r8cSlwNimmF5WzOMqT4Seyc0wbW1qO+:SpmbksFwzPa1SlZIzW4P0wbWp+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772805014, "uuid": "55dda84d-5ea6-4510-b530-125e3bca621d", "value": 4677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772805014, "uuid": "6136593b-b0cc-4d6a-8288-d4f447d0cf12", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805014, "uuid": "00e0f3fb-54ba-452c-b3f0-9b7964f97f68", "value": "Bank Transfer Form.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a1f9b60-1953-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772798013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798013, "uuid": "868fc965-5385-4153-8d36-856a6a35cffa", "comment": "Malware payload", "value": "5b8e884a930570b712ca6b65eb1606de", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798013, "uuid": "f6ec7be0-d0fb-4939-afde-b9407f4829d8", "comment": "Malware payload", "value": "4343106fb3ab3623b8d0417a03506cd40a0b42f2b3e03d9057d9bee2fd9f6687", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798013, "uuid": "bac94016-6c0e-4e59-8fa8-086a546f9acc", "comment": "Malware payload", "value": "037006bdc400bb0ea906a46f7d27d9ef24f07909", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798013, "uuid": "47a5df45-0860-4fa2-a132-fd8cbee87189", "comment": "Malware payload", "value": "6040c0ad6da52ac877238fe893581dd4b907f8bec49a56bf3c4bb8245319a3fb93424d8a5fdc7c787cf8db5ea7a1ea50", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798013, "uuid": "571f1e6a-f69e-4762-a9d0-7d8427b13504", "value": "T13E23093E851694DF59C860025C00264A079AAD37697925E1BFCE0CD7CBD6C5FCE2B68B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798013, "uuid": "e9aa7e36-730e-4308-9a05-9e8865356dc0", "value": "384:NInXB6sCrnXE8qZEQgCormKCnX/vnXYxJnpn6Hp/nXY:cR6sCznqZEQgCormKUPv8RxyfI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772798013, "uuid": "9058194b-0c09-4760-b1f8-9fc04bdf6e8a", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772798013, "uuid": "feecd149-e75c-4a86-a004-6c8c992e88c4", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798013, "uuid": "6ca6c4b7-b317-4971-ab95-547480d04846", "value": "DHL Receipt_57216218402.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fde3c28b-193d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772788946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788946, "uuid": "d79f181c-bf77-4020-a387-a79d68968cda", "comment": "Malware payload (Mirai)", "value": "5055274fcddccd2d53ea5ef1dec50ba8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788946, "uuid": "a60026c9-0e6e-46c5-9abf-e3ba280789c6", "comment": "Malware payload (Mirai)", "value": "43759864611d45b591cd2343833ce27d04aaba5d56cd82e251cc90c01713d487", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788946, "uuid": "94183979-a18a-48aa-a709-584aba856cb0", "comment": "Malware payload (Mirai)", "value": "6691ace0c2aec41ae6117634a11a3dead5ec9223", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788946, "uuid": "b517afcd-681e-40d8-9878-d7dc301715cc", "comment": "Malware payload (Mirai)", "value": "69b2a6b59ac5852fabcc343cbe0e961320add5a4bfdb9c541d0e2da55a4087c67d0937c2ea9ff7e5601626d522154d41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788946, "uuid": "82c49182-cf30-41a5-9618-44a60802aa81", "value": "T1C213E1CEB2A87D89D9FD1A7E66E8273C0D4521A0675ED7C387024C6DE67590FB0083B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788946, "uuid": "dfd939b0-42ab-407a-94a3-5adf28451747", "value": "768:3/jFoKGhirlRa0dT5JY8P4iBE4KqpsnEjXPx698ace9LTCezCkagacWM:37WthoFqU4iO48a/UuxWLOezJr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772788946, "uuid": "1cd8ba03-f1dd-4331-87f9-1eaa6417d77c", "value": 43536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772788946, "uuid": "4923c815-cd4a-4718-a0b8-e2227292d09a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788946, "uuid": "7de9a745-9caf-4738-9ee2-155e05e6b9cc", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f9918a4-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772810156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810156, "uuid": "1fb6bda0-38fc-4a8a-b87e-18e099771baa", "comment": "Malware payload (Formbook)", "value": "c21610e8d0d01127634603ff67963120", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810156, "uuid": "1f93ca12-c1b6-4f86-ae17-b7aec723aa41", "comment": "Malware payload (Formbook)", "value": "43fc5815ff2bcf00b85a7a9056eb177294161c2ee9e2dd890b2691bb18cdbb9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810156, "uuid": "ee5ed027-668c-46ef-bf92-350f6d0cbbc0", "comment": "Malware payload (Formbook)", "value": "2573ef9b7e0cd4fe52e467e34afeb58a8bfd805f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810156, "uuid": "8b21860e-4329-43f1-a10d-f497e432e235", "comment": "Malware payload (Formbook)", "value": "2db97a3632ea842e9966f9e2934d8e721830b37c7a31da031acacf0b6aaf8baee54f402de416f81b29df0c522bf5cd6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810156, "uuid": "6559573f-cccb-4b62-86b7-e25443e3b908", "value": "T11845CF027381C062FFAB92734F56F6115ABC79260123A62F13981D7AFE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810156, "uuid": "de86185f-a57e-4d30-bfae-2191faa674a3", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810156, "uuid": "02f02116-be4a-449e-97ca-5ff94eeca790", "value": "24576:A5EmXFtKaL4/oFe5T9yyXYfP1ijXda1Nhlk1od/Ag15c0bZzng8J1QsUc:APVt/LZeJbInQRa1Nzk1od/AI5c0bZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810156, "uuid": "895bed67-0f0d-45e9-9f95-a28bd4ec72cc", "value": 1246208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810156, "uuid": "65ffb53e-f05e-409c-a6ee-27669f7c0bc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810156, "uuid": "645eb9fc-77b3-423d-b802-0de6805ddf8d", "value": "43fc5815ff2bcf00b85a7a9056eb177294161c2ee9e2dd890b2691bb18cdbb9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "438e6b88-196c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808820, "uuid": "f443ce71-7062-4834-82dd-5128e4086cb9", "comment": "Malware payload", "value": "c947df984897370e30a8eb0921b7ecf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808820, "uuid": "d3ead4e0-25c6-4824-8f06-c9ebf2c4467e", "comment": "Malware payload", "value": "441dd55f2aacf3e99ec620662e882d0ceebc99b8b51aa5fa8d255b57a7c87735", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808820, "uuid": "89b9709a-4e94-4e33-b162-97382cf6192a", "comment": "Malware payload", "value": "2b3800a2210a74773b42aac355e94adc959c0aef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808820, "uuid": "dace0966-779f-4e34-9497-5d1fe43defef", "comment": "Malware payload", "value": "654e72d340f2d649bf6c6809723a9191ff81acae6fbf8b120077c9d2e4052ddbce1d1ed085c3b521e5c0d862020b7801", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808820, "uuid": "3de22f74-a396-4c73-92a1-ea1c64166e3d", "value": "T11045BF027391C062FFAB92334B5AF6115BBC79260123A62F13981DB9FD705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808820, "uuid": "730e6d4c-c68e-4c61-a5c8-003bee25b158", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808820, "uuid": "1f63879c-7b44-4457-aa30-97bfc2ca6a81", "value": "24576:F5EmXFtKaL4/oFe5T9yyXYfP1ijXdaDb9QDPiFPc8h2X:FPVt/LZeJbInQRaD+UPc8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808820, "uuid": "a9629dbc-6323-45f9-8a95-d5f4a92f9765", "value": 1248256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808820, "uuid": "1630a284-253f-4c0b-a5f3-6704c3b847b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808820, "uuid": "194752aa-d5e1-4396-86b4-70118f76e31f", "value": "441dd55f2aacf3e99ec620662e882d0ceebc99b8b51aa5fa8d255b57a7c87735", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "973162e5-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810249, "uuid": "581736a0-3abf-454e-8368-fcb4232b2891", "comment": "Malware payload (GCleaner)", "value": "a237ba59c7c883c9ade85f029923bd4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810249, "uuid": "1dff7a6b-d654-4e2b-8ba9-0c0d35c68670", "comment": "Malware payload (GCleaner)", "value": "443f2395c4367e978be2bc3320ac1594f32625245771c5d9f78b3bd5d6743677", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810249, "uuid": "dec37472-dc43-431f-baef-378c7a15407f", "comment": "Malware payload (GCleaner)", "value": "55842085f6153404670b10982f5305ed97d1af56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810249, "uuid": "e0c76807-5745-4cf7-b1a0-676c90bb9eda", "comment": "Malware payload (GCleaner)", "value": "f21952db1034589a8b2a406ae4afbdfccd3fcf5569caf685532f89499eadf2dbd70e627e09b5ed7fdec4f60adabc3f9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810249, "uuid": "02e29419-b15a-40f5-90b6-76695c48d07d", "value": "T1B945AF23B19A403EC17216389C275795D829BE133E38B84A67E53DCCDF7D24978B42A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810249, "uuid": "e829a4f8-5e71-40e2-87ff-c6dad6aac20d", "value": "0eefadf8e9087d6d95cc4aedf30a5018", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810249, "uuid": "71e2dc04-1bc9-49ca-b8ac-60f58b624895", "value": "24576:QVwXV4HSmYq7MPPfEd+epgPdgbsYKONB:hcOfmBgVgbsYKO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810249, "uuid": "b1fa2c9c-7a08-471d-8597-adc05a1e14a2", "value": 1256448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810249, "uuid": "c6c687ee-399e-4e6d-b364-468d29771e16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810249, "uuid": "b9c024ab-a371-4c65-ae2f-7fa7d1d93400", "value": "443f2395c4367e978be2bc3320ac1594f32625245771c5d9f78b3bd5d6743677", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df520971-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1772811658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811658, "uuid": "5ec95bda-2e68-424f-88e8-f2040f20e96a", "comment": "Malware payload (GuLoader)", "value": "12311bfd87a2f1ef73d3064f0693c34b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811658, "uuid": "c88a3cc7-e868-4562-9eb3-0a3742e7d2d5", "comment": "Malware payload (GuLoader)", "value": "44887812f1f0fb51e5c691e1e9fbe18bfc3717f2b766f0cba51b38cfc6e10427", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811658, "uuid": "6c1bcb04-d2ff-4503-868d-630f2fe569f0", "comment": "Malware payload (GuLoader)", "value": "477f24b9b1893cc5dc8abfc9c8720e17a15bf3db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811658, "uuid": "9873e6c7-4575-42ba-a6f1-5e7caf91005d", "comment": "Malware payload (GuLoader)", "value": "149a6547d50c9fcc59328c334e76a4b5087490a28c02ab3dba87a18c6fb8fc8f8ddc82513d43973e147461c87126cc56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811658, "uuid": "ff36aab9-46f8-4db4-b63e-747bdd216d50", "value": "T1E32523896164D813EAF51674066B92AAFEFB6F0884516B8B13283F7F3EF2D704005767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811658, "uuid": "813f9f47-a57a-414d-b77a-55c46139c48d", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811658, "uuid": "fa376fdf-62a8-4046-a06b-bc03b2bc821f", "value": "24576:gXaVwL8BQwrkEi5t/32j7IRUCAm504gmfZoeYCQh:i/I1dj8t04gmmLh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811658, "uuid": "039cba4b-1f3e-49cd-82b4-90724ba477f0", "value": 971912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811658, "uuid": "c4b58c03-51d0-4151-a542-936afaa8b121", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811658, "uuid": "73982c46-8e20-4ee2-b663-c72deb9f9614", "value": "44887812f1f0fb51e5c691e1e9fbe18bfc3717f2b766f0cba51b38cfc6e10427", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0108390b-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819016, "uuid": "0ccacec6-e839-4224-8d91-56f0a8a3cb38", "comment": "Malware payload (Mirai)", "value": "44b6d2467c389f02b1fc9bc450b773a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819016, "uuid": "f8d21532-2fdb-44b1-a3fd-5561d91ccac1", "comment": "Malware payload (Mirai)", "value": "44e0eb07373a95a0c4e1e6f176e20c371f687d20763b16887d15c40565dc1ad1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819016, "uuid": "59821876-e2fc-4ddf-9ccb-60e950746225", "comment": "Malware payload (Mirai)", "value": "84a9cf7c10445641841cadfbf47313db4ea4828e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819016, "uuid": "c92f9779-ad04-4378-a8ea-518b9457ae37", "comment": "Malware payload (Mirai)", "value": "d7b7bdd24e0eead08679e05ade05bb10e7724384e803ed8ef07ab1908ba18c9441f20110911c1fc57269791df6a1b9eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819016, "uuid": "eab53ebe-a783-4ec7-b7b3-44761e4b2cd1", "value": "T16BA35CCAF76BD1F1F90606F03073BB569731E13C5015FA02E7A52833E825616A627BAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819016, "uuid": "c5a843d1-94f5-4d60-a59c-4046bed4a99a", "value": "3072:tQ8KCEPE+JVm3dk+9bzZYB9p31B+lO5UuxBM:tQ8KCU5zmKV3ntSuxBM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819016, "uuid": "1b80c43d-25d7-43fb-8603-8d31a69f4a02", "value": 100048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819016, "uuid": "3ff15543-ba8e-47fa-8273-bf7baf8e8b34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819016, "uuid": "c98ce7c4-c419-4eeb-bf2a-92e6182e5f49", "value": "debug.x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62bf7f50-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1772809302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809302, "uuid": "d1d5f05a-9ae9-4747-860d-e6a981ce0f79", "comment": "Malware payload (MassLogger)", "value": "3fec26c480282ba96eb633c615364f89", "object_relation": "md5", "Tag": [ { "name": "bot8257734127", "colour": "#A03FE8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809302, "uuid": "5f41f703-ddf0-412a-ade5-ac412222c403", "comment": "Malware payload (MassLogger)", "value": "45bd83ee77d9018173098716e1fe06c71539bb2e92c455d83214734704879be9", "object_relation": "sha256", "Tag": [ { "name": "bot8257734127", "colour": "#A03FE8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809302, "uuid": "c7fcec53-99c1-4cf7-a6bd-77cc8a40db45", "comment": "Malware payload (MassLogger)", "value": "ca84f740e995b7d6c6c05e96fb5d2babae9f6beb", "object_relation": "sha1", "Tag": [ { "name": "bot8257734127", "colour": "#A03FE8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809302, "uuid": "a3a30b63-b5c9-4028-9fe1-bb30bad7bac5", "comment": "Malware payload (MassLogger)", "value": "b7a0115a30a492f0295b1482ac89600cc28c928cf9ee915ee10544de0f75da8ae2765574a5f9e802c7489a5dfbd41548", "object_relation": "sha3-384", "Tag": [ { "name": "bot8257734127", "colour": "#A03FE8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809302, "uuid": "55941bec-89bb-4b04-95cd-2ca1345933dc", "value": "T1B24419443BF95619F3BF5F79A8B050504AB6F92BAD1AD30D1C8620EC2E31B51EE50B23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809302, "uuid": "9f7d77a0-170a-4be8-8817-2f17f74d409a", "value": "3072:jRYyGJwDsUAoyV0CdWvHZBdoTSBEegmIWZu1V1XnWO8j9XQIvn5bfIQ7SairKDyQ:jRYfaDsh7WxBq2n9AoxgrKDz/XVv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809302, "uuid": "5738107d-831e-4a5b-86b6-0c5b8b411edd", "value": 261632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809302, "uuid": "78715a1d-de03-4557-a29c-7a2806650b75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809302, "uuid": "fb6007d6-9043-49a7-8892-a4bd07961885", "value": "45bd83ee77d9018173098716e1fe06c71539bb2e92c455d83214734704879be9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e03aae74-193a-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772787608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772787608, "uuid": "4eacb841-a000-4fff-aadc-bd7ac73d38f2", "comment": "Malware payload (RemcosRAT)", "value": "f1eae4c8ac1e3f317c31a3bd90f302a8", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772787608, "uuid": "36be9bbf-1480-4024-8612-31cbe2736d1c", "comment": "Malware payload (RemcosRAT)", "value": "45ea96a958f4f2b2fe495daef883360d989f57c8c9470670fbf4c10ae3e6aff9", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772787608, "uuid": "9f077b2a-b6cb-4879-8909-ab8b4a27db86", "comment": "Malware payload (RemcosRAT)", "value": "f91d3cb54cd21f4bb373531f7926c4df7df4d318", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772787608, "uuid": "c9ba08ae-6aeb-423e-ade0-f355b5e6bc2b", "comment": "Malware payload (RemcosRAT)", "value": "7d32db126f593276d1635eb000c2cad826b26afcc86c245530b2ff1b123fc4ba2f4b7b923f3e5ef66fcb9cb3a463316a", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772787608, "uuid": "5e8ab457-3090-40a2-bdb1-2dc7b64668a6", "value": "T19171A3549B54928A284A54B5698B4481CEFB52F2DC04127F7BE2B03F0580A3DB33FCF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772787608, "uuid": "72110a5c-67ff-4b96-ba59-0ab6678733c0", "value": "48:6afmIT2H8Jh1U6QFm69JheoluMpHmNkUYxdkk+wMvjLPZm7RteBD/IWfxQGRpwDS:hmh0EpeQxpHU5LNmdsBD/IWfKuM7O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772787608, "uuid": "20cf94fb-0f52-4cc3-9163-45721137e5c4", "value": 3732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772787608, "uuid": "4ec2175a-2689-4f0a-92d2-d6b8cd13492b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772787608, "uuid": "e333abba-eb4e-465d-bd1b-aa0c6bfdb84f", "value": "rRFQ_OrderSpecification_Quatity_pdf.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08fc95bb-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819030, "uuid": "65ca6913-ffdb-4bee-b751-2d4a06bc9c0d", "comment": "Malware payload (Mirai)", "value": "4029ecd14102ef8643cf812b4dc59008", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819030, "uuid": "0c786e05-b1f1-4d8a-bdab-8d7512812123", "comment": "Malware payload (Mirai)", "value": "45f5da2332c5d791e59d8c3c28fbddef4220c764658d507761c7636929b633c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819030, "uuid": "8aa7b6d3-9007-4099-8232-1ab899125705", "comment": "Malware payload (Mirai)", "value": "757f91fcd19685deef91e1abc6113d9d3db686e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819030, "uuid": "811a5720-63a5-456d-b719-5c194fc9f460", "comment": "Malware payload (Mirai)", "value": "6ca139a2f3bc7c320aed0712744e18ba4dc9738c86049be1c97029dc13ddb5df6ab0c806c276e49d7b19185801d22c48", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819030, "uuid": "4d461d8e-4764-4408-bfab-dbf912d5e058", "value": "T1CBB31ACFBA0C0583C5E34EB81E3B37E58FBDD62211E46742551AEB8442B193A4267FD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819030, "uuid": "454e81ed-3fdf-4f06-9150-9f7fd3be2991", "value": "1536:8DR+/XVNbeu7XN1GNjv5uVRXVBFSjfsWaOaOWRSH39WdAid+2P1XyFukBf7D:82056XVBFSj49030AYaukBfv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819030, "uuid": "97875f88-97cc-4f8f-a66e-81fee90a4e2e", "value": 116632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819030, "uuid": "36c84c28-fa48-46df-bc66-3134f28caa5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819030, "uuid": "b043e3fa-f607-4533-a419-bc2c3f061b6a", "value": "debug.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "723c58b6-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1772808898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808898, "uuid": "d338e50f-f43f-4f84-b6ea-24d05d6ca450", "comment": "Malware payload (GuLoader)", "value": "5965a9a1112be2f0c1e24fbbf8d02b32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808898, "uuid": "46738739-9db8-4517-8451-3b1920ead7d6", "comment": "Malware payload (GuLoader)", "value": "45fb15a78e1411771b4e49858e1ecfc013ee10bf05e544768b7dc807ea4220d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808898, "uuid": "cc154d91-9081-4322-8481-fc7d0b4f1dea", "comment": "Malware payload (GuLoader)", "value": "2118d8ef99867272629f62481993239299a1b7e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808898, "uuid": "c40e8d87-e4f2-41db-a152-a76cbe4c1c91", "comment": "Malware payload (GuLoader)", "value": "5f825d1c8b30140eb14b4e25f6963231c920105dd26420334ab7634686639271a8d5a0451e3477cd99997dd8403c0f55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808898, "uuid": "3c478992-71ba-44c1-a101-8fa110acf9ce", "value": "T1E4341206BA71C4A3D17607B06D3A9A67AFE2D61212E54BC737AC6E1DBC331424C2D2D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808898, "uuid": "0580bbe5-f040-481e-9306-7abad712e7db", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808898, "uuid": "413d46a1-b46f-464a-96e3-baab1ab556be", "value": "6144:kcBvWb0Av4hxgyUIB8r1Qf4RKaO6xyancOl:tO0AAhxgfrawRKaO6rncI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808898, "uuid": "9bfa9937-8a20-47c9-a390-46bf75e87088", "value": 240204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808898, "uuid": "08895688-a526-46dd-8e01-9d65abb2109a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808898, "uuid": "3bc441a8-a322-4438-a2ac-a350d9ea85c7", "value": "45fb15a78e1411771b4e49858e1ecfc013ee10bf05e544768b7dc807ea4220d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36ed7ea2-1901-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772762843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772762843, "uuid": "1b9fd17c-6246-441d-9c57-7f6301e3b1fc", "comment": "Malware payload (Mirai)", "value": "b3a7a0a9c3555bae5cf857c8e6908f41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772762843, "uuid": "6f12d38a-ac1a-4b74-bf40-1fb682f9141a", "comment": "Malware payload (Mirai)", "value": "46212ca5c0c12c9cba5e5f1888ca664e14f59869122268eba1ea3b203d568b4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772762843, "uuid": "11392935-8631-4465-835b-1e0b7f485046", "comment": "Malware payload (Mirai)", "value": "e78855db6e8adb69ac301e08971b559c6539e5d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772762843, "uuid": "a59491b8-82d0-47b1-9b35-4c7f220d05db", "comment": "Malware payload (Mirai)", "value": "97fbab7f633a88807d2fa96c14386a0777bada5790936e514f854e67408f5c05502bb4769adf66049b8f7f4251199d22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772762843, "uuid": "88cab37b-fc0f-42a3-ac6d-4789ca499ed8", "value": "T1EEE47C99E787D4F1F26344F1024ECBF21534A11A6057F6F2EB842A6778727A22F1632D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772762843, "uuid": "1d9facd8-dfad-4c8b-932d-35778332bb3c", "value": "12288:h2oafjouFul5hSvhtGTbGeKhKXb1ZuMClRclsUZw8gyZ/hsYek2P2rlVt:h2oaf06uDhSvhWXb1ZrClRcKYw4yYem", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772762843, "uuid": "62d50af7-05be-4362-b0e0-973fbfc1f7f2", "value": 719300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772762843, "uuid": "bf68b38c-1503-4011-82b2-f90c4aa621d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772762843, "uuid": "d8a92046-b314-4011-a2f1-91e998461427", "value": "bot_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d3a2293-194b-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772794556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794556, "uuid": "3a7a0806-5341-4982-92c0-41c2409642fc", "comment": "Malware payload (NetSupport)", "value": "eede94cffe8708c896d29658655c27ab", "object_relation": "md5", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "aoaoalsflfkfkfk-com", "colour": "#34764F", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "notaoaoalsflfkfkfk-com", "colour": "#841C7A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794556, "uuid": "6e82e9f1-8a57-4bda-90b2-7bef530441b9", "comment": "Malware payload (NetSupport)", "value": "465b040f238a9909fd2e40cdbf008a5906917f6047df8379e1506e3a6f47d83b", "object_relation": "sha256", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "aoaoalsflfkfkfk-com", "colour": "#34764F", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "notaoaoalsflfkfkfk-com", "colour": "#841C7A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794556, "uuid": "abee20bf-fe03-4c5c-be60-afe5485b1d1e", "comment": "Malware payload (NetSupport)", "value": "5b429891581385265ea75a3d53ae2c374c40ae59", "object_relation": "sha1", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "aoaoalsflfkfkfk-com", "colour": "#34764F", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "notaoaoalsflfkfkfk-com", "colour": "#841C7A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794556, "uuid": "4de15546-843a-4642-91aa-0652ab91588c", "comment": "Malware payload (NetSupport)", "value": "b78f669aef77aa736de3c8b791868e22dd671f93f850bb910d5cacac2d3998a3d4a465d1f5c7a51436d43d4b32b4ff0f", "object_relation": "sha3-384", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "aoaoalsflfkfkfk-com", "colour": "#34764F", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "notaoaoalsflfkfkfk-com", "colour": "#841C7A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772794556, "uuid": "afb6686a-6813-4ae1-b94a-4d57c6af85f2", "value": "T160A5339A990989DFC91B4F74C10B5E1AD33E3A41F25E7080F6728252CC89B9F5BB871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772794556, "uuid": "a9eec736-9293-4a04-aa1f-31352642d56e", "value": "49152:fdWKcquaZYrp7ynWVnJTmm3F+WVcBdj3b2+3bw/0JBAThAnc1N9R:foqukS+W/VYj3b2+30/wB2VR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772794556, "uuid": "add4c10b-34ee-445b-8c8d-365978a6bee3", "value": 2214666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772794556, "uuid": "171a0434-0443-4cbc-a78b-2f7a5dffa65d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772794556, "uuid": "6d870c54-7161-4a8a-9620-8acca5810aff", "value": "at.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "653b0cf6-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819184, "uuid": "615aad7a-ba7a-4afe-ae8b-9bb46359f448", "comment": "Malware payload (Mirai)", "value": "06c0088c6d03fd1732b030c781ff0fad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819184, "uuid": "774947e8-891f-4e21-be7e-7c8267efd6e2", "comment": "Malware payload (Mirai)", "value": "4680003fd59b168497f446bf79aa9e5d16d1a946eddd480a8491e9cfaaaa9bba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819184, "uuid": "7a5f265e-38b8-4a9a-8b4c-0a20596b42c4", "comment": "Malware payload (Mirai)", "value": "f620cf22979e0ef9048fae44e8cb468ec7d9fee9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819184, "uuid": "49f5165a-5f87-443b-8d67-0b8247c3a2a1", "comment": "Malware payload (Mirai)", "value": "fb2766db29f28b827e9dff42315e8ea545eb6a2927244376da99e99963143f94b8ba927a5edf17423000b76b18246c25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819184, "uuid": "497089b1-5096-4989-a4d9-0f014769cb0d", "value": "T16773F842BD829F13C1D222F6F7AE01993715BB68D6EB3242D921BF9037868DB1D27611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819184, "uuid": "eecf609d-c468-4d15-8d74-21a07ba9dc33", "value": "1536:Il4gXjRk4xO9mRBR8JcG8/O6ErSWWUdc9ms/FNm:Il4qEoRwlXpWa6Nm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819184, "uuid": "67a26f85-df6e-40a5-8895-aa89ec003e7f", "value": 74484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819184, "uuid": "70ad02eb-aaa9-4b89-89b1-f8a6217e3b11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819184, "uuid": "6864fec1-ca95-41a9-a0e7-e8e493dae77d", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55e1ea9f-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772809710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809710, "uuid": "341cd559-e5ce-49bf-81cf-b9574a1917cf", "comment": "Malware payload (PhantomStealer)", "value": "55a22d53788ba29a6328f112758841f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809710, "uuid": "172b3bde-9b97-4ee1-8841-99607320429f", "comment": "Malware payload (PhantomStealer)", "value": "4690fe7dd78cf815ea311d64d6503a5fe8b32865ca8e4e74a1d1e1bd2f384a7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809710, "uuid": "6d82bf02-f749-4ac0-b81c-d85dea81001d", "comment": "Malware payload (PhantomStealer)", "value": "4cfaba917d4611f38b3826bd13c1821b687894ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809710, "uuid": "ab421acc-cde4-44c5-8407-a262119d26f0", "comment": "Malware payload (PhantomStealer)", "value": "183fc76d405c88ac6d5ad8d0a66b91465a29e5c71665a120833d33d24463721a34da633eebc07212dc06e4d4114fd84c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809710, "uuid": "60ce6a08-6baa-46ac-9962-6e6dae2765d3", "value": "T10865231833C6DE13D8E54A755A71F23027B92EDC605AD21B8EE6BCD7B93A3D00C81697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809710, "uuid": "f77df936-1348-436d-b883-d922ea55a6c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809710, "uuid": "d0a1303b-a2d4-40ac-9b90-c2fae9dc4057", "value": "24576:s/GKMZDknqnUms4PWVlka9YHHsfddDATuHidNM9ipRSBlyjbp6fpEvdpwH3EbdbW:s/bnG+lP9YAdWTuHiopBlyjbtwH3idbW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809710, "uuid": "39d09e0b-882e-4f17-9651-2e34d1ace597", "value": 1531904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809710, "uuid": "c251ef3d-a9ed-4729-b61a-2227a41cdf26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809710, "uuid": "22953599-6e52-46f6-a0eb-3db45c5aa283", "value": "4690fe7dd78cf815ea311d64d6503a5fe8b32865ca8e4e74a1d1e1bd2f384a7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e423fd1d-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772809519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809519, "uuid": "416ef30f-ff0a-4bdf-b9e8-d4531d645472", "comment": "Malware payload (Formbook)", "value": "9d9e78dcc34ec1661dee86c7ba7adfd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809519, "uuid": "a61806fb-dd52-47b4-b093-f8d71e4945b0", "comment": "Malware payload (Formbook)", "value": "46adae2243b4d7d96f40071a9946bafbd301ed0cb82aab5647479bc6344b839b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809519, "uuid": "4542207e-2af0-4440-a74e-394c816536f4", "comment": "Malware payload (Formbook)", "value": "73b980e23af60698cf94bb401c45cd0d84a6ec35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809519, "uuid": "b162d2be-527c-44eb-9fa3-3a052758558d", "comment": "Malware payload (Formbook)", "value": "8973c3da1ac97d424d2bcd10a66ab5005781c4be2e6de6bfe067fd4fd93459e43a61e7b2b62733cafc0721ee547fd878", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809519, "uuid": "f188758f-2865-4dc0-838a-bf581efc86a3", "value": "T1E6059F1CA4A6B0D1ED11D8F30E5E97E14E1B7313AB9A1C5723B803444B968FF1F6AB16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809519, "uuid": "8dabce5b-5f2c-4c21-b252-a62ff7d40bc2", "value": "d45ddffb05d99f5ddb39bf8a22c9fa9b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809519, "uuid": "e3b4cb46-2826-49a7-9767-9bd9a8861be9", "value": "24576:thFxIIFF4aqTiNyIQWKt57qYZxWuB2WaP3T4:RRQTiNy2Kz7qYuuB2WaP3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809519, "uuid": "0d145558-9787-4fb7-8057-3a385d4b68ac", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809519, "uuid": "b3b45888-1711-420b-8ca6-357280a2508d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809519, "uuid": "c3933738-f6d0-49f8-a978-b1c7a8387c0f", "value": "46adae2243b4d7d96f40071a9946bafbd301ed0cb82aab5647479bc6344b839b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "932dc164-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808524, "uuid": "bd2f9fd7-ae7c-42a0-a06c-fb86b44a9914", "comment": "Malware payload (GCleaner)", "value": "c350bc2e0ebc18fbadf76226056b96d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808524, "uuid": "93f7ce20-1721-4902-9733-1485a588670b", "comment": "Malware payload (GCleaner)", "value": "46b729842072b39d1e79783d05bc0dcb38951a2799abecb940cf68f01c7ce61d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808524, "uuid": "46a55296-efc0-4d43-9115-53c9e052916a", "comment": "Malware payload (GCleaner)", "value": "361b09a7d46e664289b4814c5323950c15e20479", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808524, "uuid": "6feb60c0-572c-4ec2-8351-4aad320004af", "comment": "Malware payload (GCleaner)", "value": "6ebce57514ff317c9ae4bc02bd25efc205b4b3f9fb40fd80be993c95f03902003c88f5fe42ed98029f4dc83605a9e7c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808524, "uuid": "c85ac66e-ab06-409e-84c5-d176a6047f99", "value": "T1A746E027C694142DCD19453CEE3A4A5D10D1EF2674BF481395883DCBCB9E1CF2A1AEAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808524, "uuid": "62c82664-b507-49cb-9822-6aa4337bb45d", "value": "099b2b7fa2a0044e2ca25418be2f8a70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808524, "uuid": "beadd7c2-9f00-4aac-9bd9-fc336ed82036", "value": "98304:ateg+023wQe5WdqsTM6x4p0sWsf53MsbfHKWr:aEwv5e74f/ZMsbSW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808524, "uuid": "623e3313-6562-4687-b3dc-b5bd09907c26", "value": 5815296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808524, "uuid": "d217e423-f999-4fe1-847e-a8f25c08a2c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808524, "uuid": "5bdd02c4-ef5e-4501-90fc-dc0b9fcfe86e", "value": "46b729842072b39d1e79783d05bc0dcb38951a2799abecb940cf68f01c7ce61d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7afccff-1983-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819001, "uuid": "b77f86c1-c93c-4b19-9ccd-8b236843b2d7", "comment": "Malware payload (Mirai)", "value": "b664fc818c44394f4f722f40290302bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819001, "uuid": "1d64bd6f-670c-46bc-9f87-5d194df4d3b4", "comment": "Malware payload (Mirai)", "value": "46c6afe2d46cdd1321f3ff8a01c165a9ab2ca3ebb1bef0e016e4110e9ba66564", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819001, "uuid": "9dda37d3-3bff-421f-8ed3-e0749d9a3096", "comment": "Malware payload (Mirai)", "value": "a78f77168a19dee231161aed36c3d7babfc02063", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819001, "uuid": "e0012c98-611a-409b-a26f-6dd101c294c4", "comment": "Malware payload (Mirai)", "value": "5370d69ac79e58de979172727607c31db346f1fd30c623bc6b3cba7dce531800243c40780b87e1317f8916f611827c26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819001, "uuid": "5647297c-b9ea-4b84-82c0-d2c6d5c3fbaf", "value": "T11B936C85FB43E0F4E90609B011ABF77A8A31DD361014DD6BEB98FE72AD32A13911675C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819001, "uuid": "2de82d60-0396-41a9-9076-236750f8f723", "value": "1536:nsm9i1KJdfC+Sq0zPUoUeRNjRmnj82QRiqoaRGUw31QUHLqEUuKGr:nsesIdfCpVYoUeRNjRmnYyVuiYHO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819001, "uuid": "3458909e-b05f-4ca9-b2b9-41a2feb3c9a6", "value": 95508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819001, "uuid": "bbe9bdfc-f3f1-479b-a16f-87625fc733ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819001, "uuid": "32bd5fc1-688c-4466-9ef8-7ba4fc4d0da7", "value": "jawirbot.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cc6e4bb-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808862, "uuid": "67125c3f-dcb8-45f4-8df4-460a97ffc07d", "comment": "Malware payload (GCleaner)", "value": "b84e8e94da85a6fc212dbf0eb95aa230", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808862, "uuid": "ac734845-b8f3-47c3-aca0-3ffe48b0750e", "comment": "Malware payload (GCleaner)", "value": "47fa339b4f1c4d79cfdf09bb7622040d13cbaa1ec03f879851e5153c89ba0cf9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808862, "uuid": "77530cf0-b930-4e86-8752-0d3963209770", "comment": "Malware payload (GCleaner)", "value": "648b0f934a4516770950f85eb3aac388e887ee85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808862, "uuid": "4a711d70-7918-4a8c-a00d-70614bb07167", "comment": "Malware payload (GCleaner)", "value": "fde110aded7bf5299d1ce53c827e589758b95966092896dfa8fcd690163b4ad23395d787d57f4beb4d13f8ee190b2029", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808862, "uuid": "25d3e44c-5005-44d3-98bc-b477383035fc", "value": "T17746E05CF2846FBEC2DD83329754A66C26A519C636EDB3C0D18ADBCC1D0F2C7651DA0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808862, "uuid": "3b136c42-0a6a-4f6d-909f-c120b826e6a0", "value": "234372fce9eaa047bc4c39047910954c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808862, "uuid": "89cc99bb-b933-44c7-bdc2-bb96596dde32", "value": "49152:oGQJM+ofHuDelP+oVk4qWRm7cCvlZTwhJDwKT2wgb6em+EGTRyWzUFSDUW:oBJMZJ+oOUUcCQrDsoqRNU4D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808862, "uuid": "e7927686-7264-4276-a8b9-fa13a0b82a43", "value": 5530624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808862, "uuid": "a768ea12-b4a6-4936-8f2a-fbcff20765dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808862, "uuid": "17c6d037-119f-4f39-8e68-0a5802c7f8b3", "value": "47fa339b4f1c4d79cfdf09bb7622040d13cbaa1ec03f879851e5153c89ba0cf9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23923869-193e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772789010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789010, "uuid": "17b3ce3f-4207-434a-8e79-4ef20ec01e85", "comment": "Malware payload (Mirai)", "value": "97f5deb812443ee2510aa8c756d7cd24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789010, "uuid": "54040e11-a3a7-4923-842c-16f78c4ea1b1", "comment": "Malware payload (Mirai)", "value": "485cc1e430a234e80e8b11a49a8bea643e9eb2dc05261e6f938850edc9bef254", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789010, "uuid": "8aef3e0b-7150-4899-a156-97e7c884081a", "comment": "Malware payload (Mirai)", "value": "c74b8d3b9ac9048947fcf968486af7fed1f38bd1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789010, "uuid": "5a16278c-91e7-4f71-a553-73740d08f6b5", "comment": "Malware payload (Mirai)", "value": "2df8329bcc594a3d0532f2ece4baa4caad94301ee247163c4f0d1748c00f6e8ccf64aef1ae3c660072c1c27152a32bc5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789010, "uuid": "efd829bd-deaa-4a0f-8a05-2d96137b873c", "value": "T1EFB3C84E6E218FBDF768823047B34F25A75823D63AE1D6C5D2ADD6101F6024E245FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789010, "uuid": "4ace86ec-634c-4190-aafc-28fb7de91f47", "value": "1536:Rhzos8B/D+BnjqnBQCldTs5BiYm82I/2tLedriKSfirghV7:3QB/ujKB1s5BiYSI/S9HfVh9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772789010, "uuid": "e9306e97-873c-4e5e-be21-d8888499c410", "value": 110076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772789010, "uuid": "c17b1530-7872-46f7-8036-eff77aec1da8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789010, "uuid": "9842c6bd-9527-41f0-8f0d-001509329783", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bff60dc1-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1772809029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809029, "uuid": "43dd6e02-8be1-430b-b950-1c1ecdaf503b", "comment": "Malware payload (DarkTortilla)", "value": "078d3846e218ad3f8b8a58460d40de18", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809029, "uuid": "e9ba212f-3ce9-4892-b7e1-e4aea4474b39", "comment": "Malware payload (DarkTortilla)", "value": "489ccd9807e0c63e43cbbec56ed0043151fc47cf84cde1e5dd405ecd4d1fdd6f", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809029, "uuid": "899a61b3-d96a-42e4-9d24-84322991aa3d", "comment": "Malware payload (DarkTortilla)", "value": "7562c29066767547a7dc03a79eacebad970bc841", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809029, "uuid": "b2b22c2e-1e83-4ee9-8401-bf54fc7385f0", "comment": "Malware payload (DarkTortilla)", "value": "dbcd1cbb445b8d2c79c029cefe6ccb353d02dded25cdc11571bc14356fec0d58652bd50172d3e6a775f8f79c1724276d", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809029, "uuid": "57dc6fc5-4753-4f38-bddd-02199b41e16f", "value": "T198E4F1325E822A20D9690FB9C066109577F0C857526AEB7B6FFC01F46DB3F49CC279A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809029, "uuid": "2535f73f-10e8-4fbc-8c4e-cb7b30d91496", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809029, "uuid": "1135060c-3a6d-4177-9aaf-dac70eacbfee", "value": "12288:Bqy/ZDD3GszIMjy1j89CFnLT/N0HPNI0iAxxrKXBxoo1C7PHQaeJblNB1N:VDDchpLT/4PPH7caoc76JblNB1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809029, "uuid": "6eaac90c-e424-469b-b6e1-eacff79c9ec3", "value": 671232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809029, "uuid": "08390963-e06a-413c-8489-474317b877e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809029, "uuid": "a586927e-bb0b-4985-b9ee-a01257d8ace1", "value": "489ccd9807e0c63e43cbbec56ed0043151fc47cf84cde1e5dd405ecd4d1fdd6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af042254-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1772810718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810718, "uuid": "320425da-eeaf-46bb-84f9-22705821c205", "comment": "Malware payload (GuLoader)", "value": "a03ca2d71feb691db1ce725b9983739d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810718, "uuid": "fe5546fb-e545-481d-a019-c36e35ade262", "comment": "Malware payload (GuLoader)", "value": "48a0c3b93362dae744c054e94cd1e62f6e02e5f0ae8b3b48ae0ca24c5da51340", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810718, "uuid": "3b3a53b4-4ad1-47ea-a701-512f8ece2a08", "comment": "Malware payload (GuLoader)", "value": "be86d6d149b0b814c45c71131aabdd6375b955d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810718, "uuid": "10a79714-92ec-4a0d-8da5-25f092b0ea09", "comment": "Malware payload (GuLoader)", "value": "d935b8b5af71aa2a95a9816abe73fcc2ba27f64103bc87644f8fba254de550631f9ea004e5cf2c0356d430303917bbde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810718, "uuid": "f1639a53-a64f-41d3-8311-3df4a573cc4c", "value": "T1D345D09CA8FF4497D77D3A70FBE764794A9392BAE2F22A6A357540214F52F000D0B523", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810718, "uuid": "01f49822-bf7a-4f46-895a-3c85140033aa", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810718, "uuid": "a7e9ae67-4af7-4055-8bc4-b51539be3730", "value": "24576:Lo0blzGT6ZmeCpRrFH8JmC+KlUunOKZQYuObYX2/tqJahTuIk:ciURrR8YC+MUuJZww3VxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810718, "uuid": "cb784b90-d155-435c-856f-66eb3cdb5c2b", "value": 1239183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810718, "uuid": "29f2f2b2-f63e-4e75-847f-a25d7996a1a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810718, "uuid": "256b4fc9-9b34-44f7-a4d2-60a75e1400b5", "value": "48a0c3b93362dae744c054e94cd1e62f6e02e5f0ae8b3b48ae0ca24c5da51340", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5952bac-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772809548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809548, "uuid": "978051ba-9ba1-4e81-9671-e0b34f8d3d51", "comment": "Malware payload (PhantomStealer)", "value": "89deddf2918580b776ee1a242b70d04e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809548, "uuid": "404846a5-3b54-4c8b-97e7-5560cd1f7eb2", "comment": "Malware payload (PhantomStealer)", "value": "48f2adcf18a6e77923a921accf888bce1aec1826088d245111c5655a6ed78087", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809548, "uuid": "68acb601-a21c-4d6a-b2dc-f689e1e075f2", "comment": "Malware payload (PhantomStealer)", "value": "f58313c8964e559d937c38b7c1f2c814414b49c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809548, "uuid": "cab1f28e-f366-4596-9a23-5bf7ba0efe4c", "comment": "Malware payload (PhantomStealer)", "value": "0199ac7afcd4f2a5c8b239e23578d7bead0c4ec34806a028f37c9249b43e67e4a5ed2cc4255722bf06b6661bfbdeccdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809548, "uuid": "2b51e347-26a6-4737-a520-6067dfd13851", "value": "T19FC533116852535AE008D3FC8EB4F123AE14561ABBD352F5313B226DFA81F7167BE683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809548, "uuid": "3a7b36c1-8fe1-4a74-9c1f-6d4923946bae", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809548, "uuid": "bc099156-ab8d-41f9-8f07-1d0eda9f371d", "value": "49152:4woPEBFtqUC8NA/yO5qlU81p0rkhlaekEgIzwnH4YskN36Hxvp:4FEHtqUCyA/JqE8oekQz/td", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809548, "uuid": "bd7d0e33-7fd9-445f-a45c-b9324562ad8f", "value": 2671616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809548, "uuid": "34e7e6ea-9611-4d44-84ba-36dbf26e8e96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809548, "uuid": "8a51c8c6-1cf6-4ae4-b799-4007811c2ef1", "value": "48f2adcf18a6e77923a921accf888bce1aec1826088d245111c5655a6ed78087", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19ad62a0-1970-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810468, "uuid": "9fb51c58-906a-478a-9e07-8523ce89f402", "comment": "Malware payload", "value": "85d816224a787fccaf973e36edc91b08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810468, "uuid": "8e1915a9-d194-46fd-9048-1ea5975164c8", "comment": "Malware payload", "value": "4915e81ffdd5ee0dde827c847306a3a625210db1cf2c67278484068fb5cd6042", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810468, "uuid": "29cf0557-dbe8-46eb-9e63-644f1c933c77", "comment": "Malware payload", "value": "93ec8aa0867d595e3282b9795ea6079a0575e88d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810468, "uuid": "5269a40a-6768-464f-bf61-4536a830b7d9", "comment": "Malware payload", "value": "cc37b2b247edd9bfc144d80618d9e0356a70d161bf64687184d81fd1ec9d1f9511799fc2030d6ec2a3c4ad950e3e5db8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810468, "uuid": "64e3401c-ff12-46dc-8583-898c20116a19", "value": "T16E1523D92211FDE3E8F20730C9A247FBC954DE40CE28B69B76567D9A3C376A5140E70A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810468, "uuid": "ac8defc9-c66c-4a1e-8bf5-744ac3e04eef", "value": "0293eec0b5432ad092f24065016203b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810468, "uuid": "dd524916-16db-493c-99a2-e8e1859e0339", "value": "24576:K65Dl/93z1QgeLoAODKPfJykLZ+Kd/2cc9+yyauEEjgP:nEROoAkV+KFpqpfuEqgP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810468, "uuid": "63de3df8-b83e-458f-a515-1c419bece025", "value": 948744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810468, "uuid": "99044366-9384-4b73-84cb-b72735928aa1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810468, "uuid": "4da26fb4-f216-448b-b994-9af0a32f1a51", "value": "4915e81ffdd5ee0dde827c847306a3a625210db1cf2c67278484068fb5cd6042", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06d94095-1970-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810436, "uuid": "dadc2d8c-2765-4986-96f2-f44cbe86ca2e", "comment": "Malware payload", "value": "2d78320a7f8548ed838ec11284fe582e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810436, "uuid": "da025009-7092-4beb-8a63-6f1b731d4bd8", "comment": "Malware payload", "value": "491afd4bfca310a9196bde3cdcd2b234c1db31bb055fee5163e37749d9cf3524", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810436, "uuid": "a7f6fed1-eb36-4e9c-ad3b-5bf46fb248af", "comment": "Malware payload", "value": "14758320105ca33ae26821162fe0dfb9bf13d61f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810436, "uuid": "4997b9ec-853d-480b-9db8-a10de823ab7d", "comment": "Malware payload", "value": "13fad7a754b4293ed40ade7fbaad398f27669f6f2d8f8cbb940bbffcd56b0a52c7b0ed30754620f14616794f3e4b485c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810436, "uuid": "0ac49c03-1d4f-4a2d-9945-2abaebbe6c2a", "value": "T136841260B925D42BD9E045314FB909F9E957BEC7805A03078B40BE5BBC3A6F19E27327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810436, "uuid": "08754b9c-9045-42ef-98d8-f8159cd7afcc", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810436, "uuid": "69110070-854f-4c4f-ba22-e7c4822546af", "value": "6144:XR+xXxN56n7m8rZQvabDtTfltsjMI7xkcbywLP3vwL7fFaszwoU0B+b05dCm3:BcN5w7zrZT7rAS43stzw8+2Cm3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810436, "uuid": "9ac632ac-892c-4484-b5bf-79b920c9f835", "value": 406912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810436, "uuid": "16ffbc71-5d9b-4817-b269-fcb4c9a0c642", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810436, "uuid": "cc48dd0b-c142-4d9d-9513-52dce047c43d", "value": "491afd4bfca310a9196bde3cdcd2b234c1db31bb055fee5163e37749d9cf3524", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaeb7128-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810389, "uuid": "266a56dd-f95f-4839-ab5a-5d80282c8943", "comment": "Malware payload (GCleaner)", "value": "f0570dacdfe3aed7e1dc98658d3549a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810389, "uuid": "0e3151e4-9b6f-4e7d-9a25-863c3398204a", "comment": "Malware payload (GCleaner)", "value": "49df570be9e1aec6fc08a8e319107281c034a6558b86a9530d467c29c4315dd4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810389, "uuid": "56ee963a-10ab-40dc-a5b0-e85f225bf17c", "comment": "Malware payload (GCleaner)", "value": "cc061f2145cffd03eb28b87a923a00215357b146", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810389, "uuid": "ee5d8255-2ccb-48e3-9328-b6a811dca317", "comment": "Malware payload (GCleaner)", "value": "4371c9c94f6a4ede2ba8b109e7786a23e88b6c9493ba8742f1c156a47767ee34514a8baa92c3195fce2e183667a35609", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810389, "uuid": "a17a80af-5c55-46b2-b89e-686a0705203f", "value": "T125059E26A1E16437C37F3A79AC5B5E58A82DBF102DE858462BE50DC84F3874F74621B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810389, "uuid": "64c2ef3f-3b7b-42ef-ba27-ae1672c5122e", "value": "fe4280c06246cc873fe89746dadec91e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810389, "uuid": "d90c0ebb-4a2e-48e4-a1e8-ed8fec64a345", "value": "24576:illuEBpPj6o4CPbE9taCbvIWuiI6X64M:ilwa1Vp3sG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810389, "uuid": "f18c8c70-01d4-4bcf-97ca-6a8b6529ea82", "value": 841216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810389, "uuid": "8a8dcfe8-ffe0-49a7-b89f-11da1aa8e64e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810389, "uuid": "f87923b3-4c6f-4939-b1af-2fc9b131031d", "value": "49df570be9e1aec6fc08a8e319107281c034a6558b86a9530d467c29c4315dd4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cfd958e-1950-11f1-a769-42010a9c0008", "comment": "Malware payload (CryptOne)", "timestamp": 1772796837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796837, "uuid": "b93b1f7c-ecf6-4b66-ace9-a74ba802c000", "comment": "Malware payload (CryptOne)", "value": "a845fe8e2698aaac472644dc70bf0def", "object_relation": "md5", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796837, "uuid": "958f0b9c-368c-4f08-b4a7-29695c5387c9", "comment": "Malware payload (CryptOne)", "value": "4a024b1c0bc95ddb35bec16e31933d1ffa371c36e1f11e9f4e2bb3e025124bf7", "object_relation": "sha256", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796837, "uuid": "3fc9b721-9448-4649-96bb-232afc6cfb79", "comment": "Malware payload (CryptOne)", "value": "4abb1f0132ad25b668be18470ecf2825d2066339", "object_relation": "sha1", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796837, "uuid": "002f279b-9047-4c7c-8e66-6e6270912da0", "comment": "Malware payload (CryptOne)", "value": "271f0e49d63f78266a0ca56096ec8cb3c45d934ebd2a8b33e67e2023e1c6f37e1cf14a540b950dc727ef00f5bb8f6ff6", "object_relation": "sha3-384", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796837, "uuid": "cb5791cc-1e9f-4444-811d-2bd64127bcbf", "value": "T1AC6602B6D321CB7ACCAE0D76980A968E0C1438DD39A48864EF8CB5E635E1E717D351D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796837, "uuid": "95d9404d-649d-4df8-b562-46860a8802cc", "value": "9b6b7a746f3489fa02f3177f6843a73e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796837, "uuid": "48e9899b-103c-49a5-850a-76736085aa17", "value": "49152:Hz3VIcmwxwawgBxxDxNpAcOTE6Sut8EQyFTWDmXMX98xZpM9tRiK4z0u1XCSH8pB:Hz3Voh+Bj2x3DKiXWOx4ScOx1VC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772796837, "uuid": "a44fecb8-9894-4220-8d62-3f134f588f0d", "value": 7043072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772796837, "uuid": "db5ddc03-8c8e-42f9-88ed-cd949fc7a64c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796837, "uuid": "acd6f6eb-5d8e-41c6-894e-8173c0bb2ef7", "value": "a845fe8e2698aaac472644dc70bf0def.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8513b9d1-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1772811507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811507, "uuid": "f2c282fe-03c4-4ad1-bacd-e6e8983dc139", "comment": "Malware payload (GuLoader)", "value": "f46329e59f449cdcd96a1d78b4e96f59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811507, "uuid": "05f84208-91e8-4e95-b570-c6818e0b0ce7", "comment": "Malware payload (GuLoader)", "value": "4a6b8d26d298279a62f2a27aa6a8a9b67db22a2195f9e4de3c19dccb0a0f8126", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811507, "uuid": "99f1c2d1-5656-4b0c-a5e1-532af9f819a7", "comment": "Malware payload (GuLoader)", "value": "007386fadca47afbe5632420c46f658a978eb688", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811507, "uuid": "b01cfd0b-7775-462b-b9a8-f9db2b00d0c0", "comment": "Malware payload (GuLoader)", "value": "8d5d80be5377f01d0acc94be0427c1982c2400068d6199a01f0be92526f8326506d42e9d3e2787d9b3163ef514f426f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811507, "uuid": "b9c052e1-d44b-4b0a-a650-6c3c19a5f033", "value": "T14225230AE0B99463E9F11170043766B6FEBB5F1155A0838BA7343F3F3DB58B1852A693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811507, "uuid": "55973144-bf63-49ce-9867-aafa2cf5652b", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811507, "uuid": "3bdb7874-f8e7-43f3-8eaf-a0ac5b9389f5", "value": "24576:RXaVXbFfDTwbaCoMoZ2j7IRUCAm504gmfZoeYCQ:FobVDsmn4j8t04gmmL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811507, "uuid": "6fb223c8-ef86-4d1e-95a8-aff25416b86f", "value": 985832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811507, "uuid": "4f6c4c5a-b474-43c8-8e14-ef11b3dd186c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811507, "uuid": "50b19790-e774-480b-a037-ef030c1a3d5d", "value": "4a6b8d26d298279a62f2a27aa6a8a9b67db22a2195f9e4de3c19dccb0a0f8126", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab3b2d9a-1969-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772807706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807706, "uuid": "b8ebbd64-0ed6-4a04-9f7f-cdb2781f195e", "comment": "Malware payload (GCleaner)", "value": "9386e72987c91a972d015d4c3ebe4b62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807706, "uuid": "7030874a-2294-48be-b600-c8666ed0458b", "comment": "Malware payload (GCleaner)", "value": "4add6b0dbf3c6b341133382c31245669ac85a5e115b68dbe65a07ae69b3c4ad4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807706, "uuid": "ecda00f5-ab2e-40e7-ae7b-c6363a3865ce", "comment": "Malware payload (GCleaner)", "value": "fd73050a2da1f32a051d01b0bc9bb82906352797", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807706, "uuid": "33e21339-8115-4880-8e9f-779655ce256d", "comment": "Malware payload (GCleaner)", "value": "26cd3f982d5c583f0fea9172ed025452a7d57e85df49132a9261be12fd6cb77e495206426ea5ce8abc4b0a42657dd076", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807706, "uuid": "daffa770-ca56-4f49-a415-122c76b92010", "value": "T15906F132B471D0EEDE23063AFC2E566CA6057818ABE58D16F9ECC52CB6716C3581D1F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807706, "uuid": "60e62f0e-cadb-4318-8b27-971f3e82eb6a", "value": "85f3ca0400d93842304463da19f2baf9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807706, "uuid": "43e163e2-244f-4a02-a190-3b60de1f0097", "value": "98304:lEz3SsN35FZ0Poptf5kWCjVt3fuWsdEUrz26J1K3MVoFJ4RImHL5:lOlbVkbr3GWkn2o8JC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807706, "uuid": "05284d55-3b9a-40d7-8e3e-430b4cb4b02f", "value": 3880960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807706, "uuid": "e3baba5c-b582-4ae9-abd9-35438c889e35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807706, "uuid": "2088a8c8-aba6-490b-9eb0-ed63b25d90e2", "value": "4add6b0dbf3c6b341133382c31245669ac85a5e115b68dbe65a07ae69b3c4ad4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a892fe3d-196a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808131, "uuid": "7f30453b-b81c-409e-ac3d-03f545b7e7cf", "comment": "Malware payload", "value": "fea55b4d561f96d703caac847584b7eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808131, "uuid": "f5511188-3334-4b9b-ae58-c11552cdfd71", "comment": "Malware payload", "value": "4baba9f76642a51a4acdeb13b211e512aad359aa09017a1d47faa0b2a4d7ef4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808131, "uuid": "2837d132-f89e-4b4a-8c8c-aa53cf3a8629", "comment": "Malware payload", "value": "cf531060be24e3fb6aa4545c12ee6d102a37670f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808131, "uuid": "ec3c003e-0a1d-416b-a06a-2271bacbdca2", "comment": "Malware payload", "value": "8ec771b4452f8c8a6a0d307c7b6f1a1cd8f18ed1e2f6897c995b6afb862fc5aa08537daece984f607f81293626526b8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808131, "uuid": "bb2b54d7-b3be-4f4a-ad93-99f58f3944ea", "value": "T1CA641200B694D923C9632370D9B7836647B1B93296CD070B77A0BF8A7E76381CD1DAC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808131, "uuid": "f5633036-90f1-470c-9dac-eb3ab9d69ecb", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808131, "uuid": "90557c97-712d-4abb-9ce3-51e512a904ba", "value": "6144:t+MvoJXYsbLSd6KjTKIaPHiPA7j1ejJePXkDqOJ3qN4Ukc5mrMYgDKj:t+FHbLSd6eSCcejuuqq6ijbgWj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808131, "uuid": "913768c1-5a7f-40c4-ab11-c9ccc81cad11", "value": 321728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808131, "uuid": "805c4ee2-240d-487c-a466-82b0ce2a2630", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808131, "uuid": "a12c946d-5e03-4ee0-8b35-12ae1f287dc5", "value": "4baba9f76642a51a4acdeb13b211e512aad359aa09017a1d47faa0b2a4d7ef4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "534dca2a-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810994, "uuid": "a75e2121-e7de-448e-b3f2-e1a19ca11a2b", "comment": "Malware payload", "value": "f7b3c1cf089b3347eb1ba5e9f667a9f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810994, "uuid": "55bf5f7c-20bd-417e-8e8e-70b31ecb8d5a", "comment": "Malware payload", "value": "4bb88d12593d6c5476990c1ddb96fe13ffbfc68ffb40c396d048c39cc06c2940", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810994, "uuid": "ec800da5-649d-401b-aa9a-86f3a10a7f61", "comment": "Malware payload", "value": "2afc232e74afca61a36f775e9116e2cf3d042261", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810994, "uuid": "85571cf7-e046-429b-b651-232aab267725", "comment": "Malware payload", "value": "63c1e77e5b93d0a4e129201674c1e40ee15f1b30e239552b55ec2734dec5f004a052b811bc0393ff22bf44b5b0e6f412", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810994, "uuid": "273957da-a74e-4beb-9bae-8585f4c6fad1", "value": "T14B6412267706E817D5C502708DB295F6D9AB9FA80428534B2F203FAF7DB27B14A1E317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810994, "uuid": "c0ada28c-69d1-48b2-b37f-3c8fedcfa445", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810994, "uuid": "4b6cc9d4-2ced-452a-8bf3-7aac4dbb7262", "value": "6144:IR+xXxGYvWqhx1/OYW4dWjF3e30X1XtibgaBR9VKmrElOxqlNdG2t4SpQyjH/Mcl:AcGkhxsQEVIg1Xog89VJrElHlNdG2thh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810994, "uuid": "3370640c-b51d-4e3d-85bd-be051a864ace", "value": 327480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810994, "uuid": "96f1aa73-3af2-4591-b270-bfb74c24946d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810994, "uuid": "ce3a5ddf-828e-46a7-8cf5-df80834ff938", "value": "4bb88d12593d6c5476990c1ddb96fe13ffbfc68ffb40c396d048c39cc06c2940", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51b7e032-1972-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811421, "uuid": "81ba698a-b69f-4f71-b571-ea4286a4e9b8", "comment": "Malware payload", "value": "1151be3e43597e4ee29ef91da693c159", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811421, "uuid": "f8750761-6577-488e-bbc8-f504275d7e9a", "comment": "Malware payload", "value": "4be75a1f4949de392b98b2a2ab16a469c20bb494bd34f23c270ef9bec086ced7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811421, "uuid": "91179b0b-8770-46eb-8847-0c424370bcd5", "comment": "Malware payload", "value": "916196f1a720829414e7e68141780a3255c0a6f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811421, "uuid": "6c699852-9d9b-41fc-9ae6-3546d0cfe5d9", "comment": "Malware payload", "value": "962df6208627f5c868d381f038fdd8cc9d60f0c186d94390a72ceefb2f252d04b7f5a8c146ee229569734fdeb228119d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811421, "uuid": "8a23bb8e-1bc0-4adb-b991-53645c1f72e1", "value": "T10F650726E640B00EF0A38174B569E2B7916E2C721458C81EF78D7B1A37706E779F172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811421, "uuid": "d4175897-9190-4e29-aa97-ce01e7b57a52", "value": "8b07ad58d25a6b73f77cdd25f11dab2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811421, "uuid": "5d50a364-e0a2-40db-8b26-efc807ce757f", "value": "24576:GnQHtOUTzK0lfCY6E0Bbmjs421KSIB/XZ:GQ4SlfCY+mjs421KSIR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811421, "uuid": "ff4a3b5c-0b18-4de4-bd7e-3c460eb7d7ac", "value": 1454080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811421, "uuid": "9bec265b-a4d3-4f7b-938f-19ead1828ec2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811421, "uuid": "f1b6193f-b59b-4ea1-b629-238d5eee21cf", "value": "4be75a1f4949de392b98b2a2ab16a469c20bb494bd34f23c270ef9bec086ced7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "690bbe5e-1945-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772792133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772792133, "uuid": "753e5110-bd9e-4a4a-9381-89bb3699fcde", "comment": "Malware payload", "value": "c69687b023f19800db5a82bd8857b3ab", "object_relation": "md5", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772792133, "uuid": "4b3baa93-e932-4d1a-aab8-38a73da2f99a", "comment": "Malware payload", "value": "4c45663f05b49b70af2bc404ea8f459ec5a576b887afdee14f471eafe1ee6be2", "object_relation": "sha256", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772792133, "uuid": "457725ff-112a-415b-bc4f-e2c70cae887d", "comment": "Malware payload", "value": "f6c656fb98394465e93f99af6b3a5fd2df865d44", "object_relation": "sha1", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772792133, "uuid": "618513a7-a435-4c31-8324-26f76e0f0f57", "comment": "Malware payload", "value": "9fef38d21ad5350bd46759691b11ad5bdba3b1f89a52e30f5d2e13ec1200806c9192780b8f8d8c29030c70aef2f72c00", "object_relation": "sha3-384", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772792133, "uuid": "1271ad8d-04ef-4a29-937f-d6a2609a195d", "value": "T169413212BBC61F14E3FF8AF46DB772441A14B0D2160B490D44E085041CB3EE9DDB8A2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772792133, "uuid": "eaaa4482-8565-4774-86d4-e6f0cd257e69", "value": "48:8pysGUZUeRtEvM1yjVwk2DR1DQ6XgQ8vj4:8fP6EkN6Xk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772792133, "uuid": "759addbf-9de3-4532-b057-601b3e5a7333", "value": 2373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772792133, "uuid": "32bb92f0-0a39-49d3-abe5-4b189f597df5", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772792133, "uuid": "91588ae5-80ed-4d1f-8489-84a4a0e19e79", "value": "neservice-lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74a66fed-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819210, "uuid": "9572acd2-bd28-4a4e-9741-a73679606d3e", "comment": "Malware payload (Mirai)", "value": "059cf07e9f472bbbf037ae238419ca63", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819210, "uuid": "6d68afdb-4f67-49dd-b1ee-3a5c73fe93ff", "comment": "Malware payload (Mirai)", "value": "4c6e3e8812cd240b454e05e89cbc7ac49f19066d7b6f251344d4df40bfa4482f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819210, "uuid": "d56ac3b9-f02b-4908-bc01-e465eba9044f", "comment": "Malware payload (Mirai)", "value": "5586813d68aa7ffcb35b158067f0aeeda4e0e2ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819210, "uuid": "4d69ec6f-da88-4c61-b962-b5bd9312a3a8", "comment": "Malware payload (Mirai)", "value": "6e430140bd8ebd4b949d83838a6e60fb0d7cb307df5f740c2d791c8c429f2732ee01be94cf6a6ef457b2e1fd7bde82a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819210, "uuid": "42e67508-e61f-4761-817c-155260b478e2", "value": "T1A35319C67A43DEB7E95311F002F3AB325A31FC3A096AD5C6E375FCA269115D0A50636C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819210, "uuid": "517f8756-9418-46af-9487-d46f0195ad28", "value": "1536:Bfm2PcWZeMAqkNo966o2pELGvTaDC+OfHlU8NRc8juBCKSfXbU:BfmMjZeMj9R9p9sdOC8DRjPU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819210, "uuid": "d4216b08-6387-4109-bce5-a774460e1bf0", "value": 63580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819210, "uuid": "f169b2b0-b232-4d4e-ab8f-25adec30d9f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819210, "uuid": "b7b974ec-14c3-48c4-927e-ca344e6db193", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2632102e-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810918, "uuid": "09f9f446-d705-41d9-b8d4-bb37450577da", "comment": "Malware payload", "value": "66c10f28378f5b73a0a3d19f3ac7f297", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810918, "uuid": "436ec33a-371e-4457-b04d-2298a1096191", "comment": "Malware payload", "value": "4cc2ab119438950aeee01fd33fe268802e5362cb0d38349bf5df6269d9b8462f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810918, "uuid": "e4030580-6663-4286-8965-3b8562363a34", "comment": "Malware payload", "value": "7b39d1b367c691be7f21e63594b02409c6e8a40d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810918, "uuid": "453482e3-d0db-481d-9a39-f8d8342bc19c", "comment": "Malware payload", "value": "8b920cb26149fd30a9ea54c96961752a03b98fea397d6d9fbe9e3e63d8396a0c5fc1bff593b040d4254247d0e0d91a73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810918, "uuid": "1f39a70a-649d-4beb-b86a-025c3642a3ee", "value": "T1A215E0228E626A38E55D1BB9C527086C23F1E307211BD71F2FEE85F94A62FD7CA17504", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810918, "uuid": "e2080228-14ae-4308-b353-66d0fe6e2e25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810918, "uuid": "6cd8b303-3049-4b81-a659-ebe540eeffb9", "value": "12288:J9dMjn1XAdpr+8Esd4sEwRA8DWSW/+2PmvszdvW9n4Z:9EOdZ+8EsdfRA8DFWm2dzded0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810918, "uuid": "8e9798b8-1622-45d2-8f06-a03b1fe6af42", "value": 952320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810918, "uuid": "c24fe264-8afe-431a-a2ef-c3c997b21cf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810918, "uuid": "7f0c8632-6b8a-4781-ac65-e33ced529dd0", "value": "4cc2ab119438950aeee01fd33fe268802e5362cb0d38349bf5df6269d9b8462f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba346f06-1971-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1772811167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811167, "uuid": "68489ec3-2362-4a34-b72a-41d6a4b4ba4d", "comment": "Malware payload (ConnectWise)", "value": "ba4a8da291e98615ce190aaa72f2dba4", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811167, "uuid": "fa50a280-928c-4b4d-ad00-23c900ecdb02", "comment": "Malware payload (ConnectWise)", "value": "4d24949840cbe6127c1a949786a10fd526693cb8ae286be0da8fcd776f635387", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811167, "uuid": "e08b146b-33b9-4f68-80dc-875e869d863e", "comment": "Malware payload (ConnectWise)", "value": "cdb529aa6077a3b490b16112b25000798b652359", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811167, "uuid": "498643bb-ae0d-4d5a-920c-c57bc39865c2", "comment": "Malware payload (ConnectWise)", "value": "6c69d4ad78c3b515be210efed87c2b1f978c49573660b5171247c08c4ae26dce8734f2a9885e537ab9f496907dee91a2", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811167, "uuid": "231ed318-d507-442c-a602-4566dab56ba0", "value": "T165A6232153F9D028E0F35B35EE7AD165AA32BE618E12C15F1354780E39B1E8196B373B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811167, "uuid": "f56fe026-cbe7-433b-9918-69953f384e1c", "value": "196608:kBn2hg5kEWmXhcfKjSVih7vGe2Bn2hg5kEWmXhcfKjSVJBn2hg5kEWmXhcfKjSVM:ggdEEijfDGbgdEEijsgdEEijSgdEEij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811167, "uuid": "dc3528fd-1e4e-4fda-88f5-abf9a809f9d7", "value": 10121216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811167, "uuid": "a23a3c96-95e8-49b7-aae5-5f6fa575aeb5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811167, "uuid": "83414637-3336-47d3-b797-d50bfbcb5405", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26c2f02f-193e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772789015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789015, "uuid": "a1af4af7-6284-43aa-a7cd-c5a33a82479c", "comment": "Malware payload (Mirai)", "value": "2cea8fc8007509cdfa6b3448f79ada0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789015, "uuid": "7f88e8f9-8b5e-440b-b8ee-163731308d30", "comment": "Malware payload (Mirai)", "value": "4d538e0ffafd519a096c9c630e6315c8432b04d6708842edff1157e33897a337", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789015, "uuid": "656c1782-43f9-48b8-bff6-2a66d2dc661b", "comment": "Malware payload (Mirai)", "value": "8880ac365d2144247a869215792ec8a272e0a288", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789015, "uuid": "cbc0b567-5f9e-44ff-bd26-a815ff574877", "comment": "Malware payload (Mirai)", "value": "8a8c4a52d44f161ae076eb6d6cad1cf188ce9e34ee8533fda3b5a7dc01487461e669b3ffd2ccde5f855915b958530fc0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789015, "uuid": "d3f4a93f-8bff-44ba-a0de-f3fc4a07d168", "value": "T1BC933B56FD818B21D9C112BAFA1E118E3313177CE2EE73129D186F24778B96B0E7B845", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789015, "uuid": "dd573c02-c1b0-4b6c-8294-1920c059a0bc", "value": "1536:n/nqxCpuHewdcOagKOZzgGPN36U5Jb5ad40YOVKUyi0ZJk0Dp7JKBY1F81:imuHejUKOtNqU7b5adEZJk0Dp4BT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772789015, "uuid": "175d7324-9012-47de-887f-e6af9e3237e3", "value": 92176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772789015, "uuid": "ca5c22d8-b640-4ff5-b224-347eaee6fee8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789015, "uuid": "5467fc3d-5714-419e-9f3f-f680d3c2ea66", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ea5f3d0-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819200, "uuid": "5e55e034-5274-4d3c-905b-0b820be4caec", "comment": "Malware payload (Mirai)", "value": "0157a6b4813cd7d48bd4e7ef94880ade", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819200, "uuid": "92c9c35e-b3df-497e-989b-1d60ef5529a0", "comment": "Malware payload (Mirai)", "value": "4d5ed15d4b6b6ad04fad1d9f73b175d484a6feb6198fd3dfd81d21fcdbafed45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819200, "uuid": "7d40647a-fd4d-491d-8373-7d091d95ef39", "comment": "Malware payload (Mirai)", "value": "91bfc8145e7fbe2c58409ac4a836797b0ae2a679", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819200, "uuid": "146f68a0-ad20-45a8-9718-d4aaadc2728f", "comment": "Malware payload (Mirai)", "value": "b57128e31de146119913aaf56037bdd12f8184d29fafa8e7343121884d994b818a5d609f18b6ea9b6cd6df1079fb78fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819200, "uuid": "4e3a90d1-deb9-4e27-a8ae-934c258e487c", "value": "T1A473F842BD829F13C1D221F7F7AE019D37166BA8D2EB3242D921BF9037868DB1D67611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819200, "uuid": "e32f5d60-79df-47e1-8c14-142b4492dc9d", "value": "1536:+ZCpnu/0VgqiBGZrYXp8/OPraSinB3TAbCvPs/FEm:+ZCpNrYZpIzWEm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819200, "uuid": "6e1666a4-d767-4633-aec5-0d18542d0976", "value": 78580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819200, "uuid": "a013340a-aebc-4e83-be49-25b500810b80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819200, "uuid": "6743f9bc-ce56-4908-a858-abd36719fb06", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67e62ff8-196d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809311, "uuid": "b8fc739e-9bab-400b-a0db-9ced652155f1", "comment": "Malware payload", "value": "0a79e4c8e615dcffcaab938465f0bfa1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809311, "uuid": "b3db0af2-b04e-4b6e-8d0e-6e8cae11e97f", "comment": "Malware payload", "value": "4ddeb9962531aba8d4eb01bc065b86edeec3d2f15d7c3f66f5730f7e025208f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809311, "uuid": "1907e79e-b00e-4f56-b59f-d684fd975e8f", "comment": "Malware payload", "value": "8fef0883b75c71d0cba845e0afd8bc3834ff1d5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809311, "uuid": "98019b2d-d42c-4c42-b6cd-3858e979ae57", "comment": "Malware payload", "value": "bea91750a551260ae7f2d8ff589a60d3fea333d95a16b9168357b084f314ebffcacd67e8e51fa9fadd865dadd6e69c16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809311, "uuid": "7f30ecbd-2c7f-4d7f-b780-387398fcdb29", "value": "T1BAF4F0321D462B14DA792FB9C023109867F1D857116AEB7AAFFC01F4ADB3B49CD235A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809311, "uuid": "b69f277a-beb8-4244-9a87-47cf5537e587", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809311, "uuid": "f2c2bb44-9e5b-4470-be09-e1c47a989cf5", "value": "12288:GVtrrGszIMjy1j89CFnLT/N0HPNI0iAxxrKXBxoo1C7hzu6DUhNJblNB1:7hpLT/4PPH7caoc7hFUJblNB1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809311, "uuid": "4869bd26-80cf-42dc-b790-85ebe912529b", "value": 756736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809311, "uuid": "0494f4f1-5fab-4196-91b7-987e2ea2a5bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809311, "uuid": "41b54119-0e74-46c7-a8f7-76d1d60cf36f", "value": "4ddeb9962531aba8d4eb01bc065b86edeec3d2f15d7c3f66f5730f7e025208f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "418847b9-1969-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772807528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807528, "uuid": "6bc4cb38-ffec-4a53-bf93-170930fe46e6", "comment": "Malware payload (GCleaner)", "value": "6fd13874d684505e3ea7e14d7b4b79c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807528, "uuid": "40b55db6-7444-4bb7-9d12-e0298445109e", "comment": "Malware payload (GCleaner)", "value": "4e00d82a772d8ab507e8aea0205e57f5094d5e23defca25162354e5196f3628c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807528, "uuid": "1c9b89d6-ad48-4669-9ce5-f05815ccc278", "comment": "Malware payload (GCleaner)", "value": "79f7d6427fc5a893fecea3aabebaeba64851901f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807528, "uuid": "104d42e3-f97a-4b45-8f0e-c5a3ce700c01", "comment": "Malware payload (GCleaner)", "value": "f62328fab59d88f43a1556464eb6c8704e976096ec9b0283ed5447d33a7ad2fd1a70426b22bbac2440e32f92585db4c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807528, "uuid": "f25fad66-b27b-425e-a2b3-43b02e415d53", "value": "T1FA56CFA3D691ED71F1873E7EFA174E6FD216B251FD3C2961AAC47CC888297018413A63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807528, "uuid": "4d9298e4-4144-4581-9e44-968881c4c1ea", "value": "85f3ca0400d93842304463da19f2baf9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807528, "uuid": "0428e443-ef4f-402d-9404-dd5801c2b8c1", "value": "49152:OuBqw3SmBftTN/YuAdRQPkrraOq4Yplo0ghOY4Q8VI0E7JnQa8jMAxtq:OEz3SmXN/Jsfabi+YcCv7JA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807528, "uuid": "876ab4f9-5adf-46e6-840b-49d61024737d", "value": 6214656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807528, "uuid": "094e7985-0d41-4375-82ab-bc16f8d675d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807528, "uuid": "b2e35a09-5f47-4400-a703-53c6803bd057", "value": "4e00d82a772d8ab507e8aea0205e57f5094d5e23defca25162354e5196f3628c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5791daa0-1970-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810572, "uuid": "51d4de61-6c9b-4708-909d-ebb2d4145da1", "comment": "Malware payload", "value": "e6076a92f8fcb862f0c9347514b1def4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810572, "uuid": "100f3ce2-9931-4bad-a35d-e7eaf2e8aa94", "comment": "Malware payload", "value": "4e091b9ed8dcb8328eaed042d47d10eaa8fe35cc6094e5127df7184f17ecdb57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810572, "uuid": "0d8b5eab-464e-46f1-b202-7087ab6052b3", "comment": "Malware payload", "value": "de9c3d1cec7238265c235ce09c27d34b4b21a824", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810572, "uuid": "1ed4b3c5-383b-4c22-a95e-c68cd4ca6878", "comment": "Malware payload", "value": "c884a703c346e535464276285e3c80100ac079e26f73946a476636b76c111cdd8da4c029ac99bd1437fe1b0f105666ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810572, "uuid": "5219baa0-5f4d-4621-bd55-651f97e492dc", "value": "T10A35E0E06304C921C86357B98833E6B762379E9EAC14D60E6ED5FF8B7D72706441389B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810572, "uuid": "ed1f4829-0d99-4df5-b148-29fac0799e89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810572, "uuid": "94c8433b-eacc-4b14-9256-2ec6f4a7dd74", "value": "24576:U8jBipudRE9a/+YX9zPIDTTkdhNWORM9BrJu9PA:XjBisE9mHXFIAdaOcJu9PA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810572, "uuid": "857c4823-945a-43c9-90b2-d84025fb31c1", "value": 1103872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810572, "uuid": "3c3f4342-f8c1-43b3-8096-65625c491dbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810572, "uuid": "04c68239-c40d-4d51-9aa5-279ec0b0bc5f", "value": "4e091b9ed8dcb8328eaed042d47d10eaa8fe35cc6094e5127df7184f17ecdb57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7c548e8-196e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809955, "uuid": "4deba0f5-bb92-44c4-b769-5516032d7199", "comment": "Malware payload", "value": "e19b940c1dc12d25544308f5d351b3ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809955, "uuid": "1b2bd4f1-54fa-4aab-be3a-b6d9ce079d23", "comment": "Malware payload", "value": "4e5d15afc37e313296a27f94002517b351bad2dc3f3d1125e26ec078b57edbad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809955, "uuid": "dee8395f-f42b-4a94-b1bd-b0bee051069d", "comment": "Malware payload", "value": "894e1796044c30bb634702e96db35b19a599ea0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809955, "uuid": "917f7fdb-a605-453a-afdb-ccaed62e3b1f", "comment": "Malware payload", "value": "0d2bbed25371eca176449232f59c508575484f70d0ba60c4cb86159b299ae660ff3ebe5fbb583c1a35d5f70862c33d68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809955, "uuid": "e1f506b3-8685-44e6-8cdc-84313995db39", "value": "T10635BF2537E50A04E07BE739967A0E500BF0BD52CA22DB1EBD5501FD6939BA18B72723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809955, "uuid": "d107e533-701c-4b06-888f-aac1ae5223b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809955, "uuid": "d0743fd4-17e6-46a0-be7a-a4556405c0d6", "value": "12288:kN55Cq7Jb8G26y7p3YS+quCvCY6+6WGEJ5Bjp1K0XGeglq7ehF4l8V5FHg0ktf/w:C7P4lTp3YHdCvVGEdXng07ehpIDqU/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809955, "uuid": "f90112c1-ad5e-419a-bffb-b50f97334f69", "value": 1058816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809955, "uuid": "d9ff47fe-3e0e-47c2-9670-89c6414600b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809955, "uuid": "a62548a4-e73d-4c3e-abc3-7d121badf9d9", "value": "4e5d15afc37e313296a27f94002517b351bad2dc3f3d1125e26ec078b57edbad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20898bf0-193c-11f1-a769-42010a9c0008", "comment": "Malware payload (EpsilonStealer)", "timestamp": 1772788145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788145, "uuid": "9dbb6692-cd5f-482d-ad44-ef3ad69eb03f", "comment": "Malware payload (EpsilonStealer)", "value": "860f53faeaaaef4eaadc40ea28a3f1e3", "object_relation": "md5", "Tag": [ { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788145, "uuid": "322bb1c2-3c99-4728-acdd-9cf67e6dd900", "comment": "Malware payload (EpsilonStealer)", "value": "4e7bc4bbb8199dd8aebb9dd01e624f0e9b63906af056b33d0a746e6604f0e9a8", "object_relation": "sha256", "Tag": [ { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788145, "uuid": "7c4dab69-6d88-41fd-b1c6-d28d9cef89cb", "comment": "Malware payload (EpsilonStealer)", "value": "7009165a49443c81987bec3a7d4e76ac1bdbd902", "object_relation": "sha1", "Tag": [ { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788145, "uuid": "6a71c4c4-7b9c-414e-b0cc-6c2b69cba4d8", "comment": "Malware payload (EpsilonStealer)", "value": "0e2c0ac417236abd1204982c4e16499360f582480056b728f2effe16d5c6b90c4bdec2f0c2e13af5781fa140dfe1aa1c", "object_relation": "sha3-384", "Tag": [ { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788145, "uuid": "9308dbd7-65f6-455b-89ae-7be6f134b5fb", "value": "T1EC0833FDA2A35BB3EF89193717F598176ABC45F80654DCF7827E1172DA02D821CAD028", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788145, "uuid": "6deaf7ca-deb8-479c-898a-eb108c855a43", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788145, "uuid": "3b3e72c6-91ed-43f1-aa16-1e9239881423", "value": "1572864:VSnyLU23CpuwCPfj+MBkQw14U2Ap0E2Mq40LNUib95cyoIRTp:VeyLUpuHPzirp4MNWUO95cyoI1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772788145, "uuid": "2db18f13-2808-403a-aab3-96f20114fa47", "value": 84147854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772788145, "uuid": "6df858f7-5ea8-410c-94b7-63594dbd58f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788145, "uuid": "71993f42-7760-4525-a313-6583a09e1d37", "value": "winhelp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b289a53d-192d-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1772781948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781948, "uuid": "b4a05f96-6fbd-4ca2-a594-808f0ee90125", "comment": "Malware payload (Gafgyt)", "value": "9fd2f1ca392011a3ac418b5ce40e64d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781948, "uuid": "b4c68303-583e-44d4-9ec4-14be196b19a7", "comment": "Malware payload (Gafgyt)", "value": "4e9fb4f793e7fed2a3a601b821ce802ecad9680ccea906ac2c495c9af65cfc1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781948, "uuid": "b34b0ed9-ab4f-4b1c-ad54-0cc58556e3dc", "comment": "Malware payload (Gafgyt)", "value": "51af39ebc306ae87f19979cee137a51f4d907ca5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781948, "uuid": "768cfc2b-e818-4966-acae-b0dad7a10856", "comment": "Malware payload (Gafgyt)", "value": "a514e13a163477131e2e568d9f15be25cb3e99c5101c2a8b0ff8614f43916447c75b8e40f348bb9f9033494499f41824", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772781948, "uuid": "a8a41d75-4845-40e9-9cf2-e67213cca691", "value": "T130F34A1BB4C180FDC8D5C2B44FEEB216DA72F45D2238B25B27D46E262E4DE205F6D250", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772781948, "uuid": "8dbf460f-6b7a-422f-92c0-c44b119ae76e", "value": "3072:XmwAM7GeyDW+GvdXTAmDfh80JCUvYvJSXMm/gm:OM7LlvxXbZsU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772781948, "uuid": "7ee7c2d0-436e-42d8-b130-2ddd53b039bc", "value": 169928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772781948, "uuid": "68900e7c-58d3-413a-934b-fbf60bbe0a28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772781948, "uuid": "38996d84-1c16-4c63-b903-95ca1539b8d8", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8825b4c-196c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809097, "uuid": "5d8e9108-7f2e-4599-9e0f-2cdcc96094b1", "comment": "Malware payload", "value": "09060f9ac4d13475d7834772949ae1bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809097, "uuid": "96867b49-dd70-4688-9653-cb3d8deaecc0", "comment": "Malware payload", "value": "4ea23bc9c4f6d5aac40a4c1073609febbfd0ddeee9312b7388e00d6225e14813", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809097, "uuid": "9d3d2839-95ac-4da3-a2fe-6b7ef760dfa1", "comment": "Malware payload", "value": "daf02c37d8be5ab61e11e816a238cecad4d5e3bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809097, "uuid": "4b42dcfc-6e39-487f-bbdc-706f35675d3a", "comment": "Malware payload", "value": "96e0970d62f138ea894978f4871e8d4953f71a5f55643d8eb2fb09e1c674ed0bb7a6b53e452f89ad097430cc7839c46c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809097, "uuid": "1c17281b-b3dc-41f8-9c5d-6771a5892871", "value": "T13B550218272ADD02C8E60FB45E71D2745BF92E89D512D3538FFAEDEBB4363416808396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809097, "uuid": "0618c613-2524-4d3f-9a36-9e5ec9b64aed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809097, "uuid": "66c172fd-6d97-4619-b73d-32d28af1320c", "value": "24576:fqu2Vnlr8YMhDuV0zyKXM8RCaQbHr/3GRGYk1UTQGIFUS:feVlIYMhYKXM8RCaa/2MYSUTRI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809097, "uuid": "7419a2de-0a6d-4097-89f8-13c27be9840d", "value": 1291776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809097, "uuid": "b1b68d06-aafd-4594-9282-48e32af45ec5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809097, "uuid": "2a26ec34-0835-4967-982d-5cebbdfb3590", "value": "4ea23bc9c4f6d5aac40a4c1073609febbfd0ddeee9312b7388e00d6225e14813", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5652783-196d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809441, "uuid": "21b0c8ff-e89c-43c6-a1b1-c9e0d85d2311", "comment": "Malware payload", "value": "6ece62cf5c457f0dc2eed82615234360", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809441, "uuid": "6fcee8ce-470b-436b-8b9a-02c27257964b", "comment": "Malware payload", "value": "4ea5f9cec6f993b1d7025c37c29f88c2e6d2108e97111b553c9117cdc06b4c94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809441, "uuid": "54f01de0-e032-49a6-b4b2-243880b692a2", "comment": "Malware payload", "value": "b2d5f706a7ce4222674d906dbed257d881056acf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809441, "uuid": "635ea0a3-9e49-4e04-ad95-dfa90a02840b", "comment": "Malware payload", "value": "408de7b2e1b9b5a521bde602cbcab6a926f8cf610d78175de730cc500ba63913b13127d85226a5f2d491cbb36349cb86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809441, "uuid": "196dc7eb-622e-4808-9b4e-d424b796288a", "value": "T19CA402D27181B277D42289726EB79EA65BD72C354A8166033360F72E7073872DB4BB43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809441, "uuid": "3635b2c8-f156-45de-8333-742c2f04e12d", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809441, "uuid": "1f350923-ce66-4237-8e2b-0b652e23ce08", "value": "6144:YNDlOiP+7wHtoS8CP/yvTC3lEkqwIBt6imIzWoWEhEHrHgh:Yl3f8IyvTC3qkqwIzZmPLHrAh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809441, "uuid": "ed04b3b9-713f-4e8a-8841-a54e12b2b2c9", "value": 456016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809441, "uuid": "35f1db45-69c1-40bf-8f41-3336485ff0e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809441, "uuid": "95bd5932-2376-4c4a-8ed3-145cdf7c9444", "value": "4ea5f9cec6f993b1d7025c37c29f88c2e6d2108e97111b553c9117cdc06b4c94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "747f4d08-196c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808902, "uuid": "1af47c89-cbaa-4c20-bd63-b5ff41593944", "comment": "Malware payload", "value": "ad7e519ba2fa49288af82d394fc7b97d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808902, "uuid": "0abb28cb-48ce-4551-aaf0-d4a910167769", "comment": "Malware payload", "value": "4edbe53c8bf965f8680a60339c20097b1b97eb218b1a617a29b501b7e296466f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808902, "uuid": "5dec4b92-f0c8-43f0-9a2e-e71a6ca49f03", "comment": "Malware payload", "value": "d2320da81b00b54e23819038845d4325c6bbd6d4", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808902, "uuid": "e2996392-33c6-495f-b92c-2a3e6c977bab", "comment": "Malware payload", "value": "7806e0d04fe501a0c69b6488ebf4cc8f7d1badafe399bf8ae6295861abdcb8eba9d7f962ab5d579ede33c7b07b072910", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808902, "uuid": "af7a2a3b-a398-461a-8117-7a7acbe21864", "value": "T11E517606D2F2316127529D2412B76E3FAAA85817DE07CD50355D1EE8BF76874FC03E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808902, "uuid": "8a042489-1827-4330-b932-d7be6caa94fe", "value": "96:3YPYSyiXfUJMPqUpIHHHHHP9naHHHHH/1WP3:3YP38JTWIHHHHHFaHHHHH/4P3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808902, "uuid": "fbecb5bc-dbd3-4797-a25f-4346689b07ac", "value": 3117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808902, "uuid": "4d4c2d6b-8968-4aec-be93-4ffd7f89fede", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808902, "uuid": "34be8dd4-c931-4f7f-baa7-c7a54ba9b213", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3abd09a-196f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810377, "uuid": "e3db04ca-76fb-41c5-b6fe-b90b45bba4ec", "comment": "Malware payload", "value": "febfc3a1583eb0fdaa61a4290890fd25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810377, "uuid": "f384eb68-4569-4c46-9d14-7441b162bdcb", "comment": "Malware payload", "value": "4f69024400000c827a30e308b4c0db2cf7a4dff1d171f1c407ec1dfdde80a7b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810377, "uuid": "1a1baad9-e43c-4e4a-bcdd-ced626b8aee0", "comment": "Malware payload", "value": "e7c53c7099eba7df128349b6737c63c1dcad489e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810377, "uuid": "421cbdb3-6e5f-4b6b-a0ff-5502b3cc0504", "comment": "Malware payload", "value": "ff3891c9cefedbe3d9d570f36121a5633568d41d8dbecefba5bfcf34321a7759c3893099a585d33c8d36641f72f207ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810377, "uuid": "e6b79ec1-f8f8-43d7-9d44-dff9a9a3d401", "value": "T17B05BF32E2E17837C17B2A7DAC6B565C6839BE1119BC984E2BE40DC84FF575138E11A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810377, "uuid": "ea4976f1-ce12-4f2b-8458-f43afaf27f58", "value": "fe4280c06246cc873fe89746dadec91e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810377, "uuid": "cd29bf27-27cf-4856-b50e-faf065a8a059", "value": "24576:flluEBpPj6o4CPbE9taCb+IWIwM2MC5zy28HQ+:flwa1V2B2b+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810377, "uuid": "fe6add23-0572-4987-a52f-6ca364a6b93c", "value": 862720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810377, "uuid": "21e1295c-7c01-4013-bde1-d1e1ccbe8561", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810377, "uuid": "6b75b5b9-9518-4239-85fb-0f8157416b4e", "value": "4f69024400000c827a30e308b4c0db2cf7a4dff1d171f1c407ec1dfdde80a7b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81b8e9f4-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772809354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809354, "uuid": "9e777e74-d998-4cb2-896d-16db4e22a8b7", "comment": "Malware payload (GCleaner)", "value": "40c6554f275c29502c423cd072dc24ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809354, "uuid": "9357eb9b-3061-4aa5-918b-1999cc28b80b", "comment": "Malware payload (GCleaner)", "value": "4f814801b95a2b762e1c49f6b277112912b4a3c3430513c285cfc64b514210b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809354, "uuid": "33c49da9-5004-41a1-a61f-46f08c170827", "comment": "Malware payload (GCleaner)", "value": "831462d0855e8d9dd530933c81dfae4055bdf52b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809354, "uuid": "798619af-b452-472e-9c51-6e35c18b53be", "comment": "Malware payload (GCleaner)", "value": "383c8779a7b1c7e65797c1cf5288b9709a4d1521df1014b84aee45b5206bcdc8c384aa685f788976637cdb11b64b4ab3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809354, "uuid": "2b24c04a-0f49-4870-ba39-8ff96307a106", "value": "T1FAD4AF22F2EC8437D1226D78DD4F56A55A25BE80A92858463BE84CCF9F3D781343639F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809354, "uuid": "e8de56d3-791b-47a2-ad91-274a5afed3a2", "value": "345624d13ffc2b7f296b9d2972b1c0a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809354, "uuid": "a4a43085-f208-4b67-a1dd-119e3b8295d3", "value": "12288:o48VY65TrPsgNDHZ8nqReaHokxnBOFakmog:h+7PfJZ8qBHokxnmpmo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809354, "uuid": "888711c1-ec7a-4325-ac27-7c0bd4bb6c04", "value": 650240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809354, "uuid": "bfa7f446-2c7d-4d90-b6fa-53b2039ae6cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809354, "uuid": "85b20c65-02cd-41bd-b688-1f8c42729f74", "value": "4f814801b95a2b762e1c49f6b277112912b4a3c3430513c285cfc64b514210b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28863b46-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810063, "uuid": "0ef5ccfc-f88e-4698-82d1-b932cb899cc9", "comment": "Malware payload (GCleaner)", "value": "779b646da66b862025464816595d7af6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810063, "uuid": "dd298d70-c1a0-4585-bc20-13dde65f4745", "comment": "Malware payload (GCleaner)", "value": "4fb806c520858db6cae7cc94fa790f555ab3ed1ad30fa88c54c6e91491de2488", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810063, "uuid": "90cc1897-9097-4a0a-a0b8-5301ccc8f185", "comment": "Malware payload (GCleaner)", "value": "428e08735b87c3669b5c5de61b3e619cdf7b3f21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810063, "uuid": "46429301-3a0f-4c73-8b52-10b6723b8130", "comment": "Malware payload (GCleaner)", "value": "024f4069322fdb0e76c6d43f5851afc46cbbadbf87fdb59dcd39e24e81c9e66350f88698032842a3076cda7bff12c98e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810063, "uuid": "00be6874-0496-4e55-95d6-403964860080", "value": "T18AE4AEF5E6F08472D2321D38DC1A56649C29BE912D286B5A3AF82DCBCF3D3C13465293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810063, "uuid": "65333e20-3423-47d3-b049-5488ec13671f", "value": "c475b6e242f56325f64c2b76233f720b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810063, "uuid": "4f5edd3d-ed66-47f9-9b69-42e4bad362fc", "value": "12288:deM9gzhW/BsjB7V+bRO88pvnlU8m3zctrVm1z6cWzaR1NiJ+niy3ETFrLtOOOOj2:MK3/q7gR8UItr2Jbf8J+iy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810063, "uuid": "a56cc662-3bb8-4dc7-8177-9f6ae2f7767c", "value": 697856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810063, "uuid": "d139ae37-0813-49c7-be90-c167b1a0dd23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810063, "uuid": "529c5ff4-a5a2-4956-aa05-c6065cfc1396", "value": "4fb806c520858db6cae7cc94fa790f555ab3ed1ad30fa88c54c6e91491de2488", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b36d9d9-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810900, "uuid": "ab910ce9-c537-426b-a73e-81b0dbc68c68", "comment": "Malware payload", "value": "fe71f338f5733a85ff532a8af682f429", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810900, "uuid": "0c6812f3-6fa8-4a37-8bfe-749a68406993", "comment": "Malware payload", "value": "4fba4987f80f1f78dc0edc7d5ede0f4cfbde340e016a073db8d02d5a38cbe78b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810900, "uuid": "6d046ed3-5765-4bea-802a-c7450ae2b416", "comment": "Malware payload", "value": "931b62097734a6ce0233b7fdf06ada836d13d475", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810900, "uuid": "6c07e263-a668-4eac-9109-5a982eb11fc8", "comment": "Malware payload", "value": "4a0b40b05f4a0711c0a9fbe19d3a4e46a3555650b0df1ce37a2a71ad36c972916e33d116594b34223ebcc64c335e6b53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810900, "uuid": "04c1609e-a7b6-4c30-8414-53c18be4ba40", "value": "T139E53379DE069BD7CD5A96B231B67193964F0C5B0FB4CFD2A2CCA3AB340691C4D9A070", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810900, "uuid": "18e136e6-de3f-4e88-9a64-03c4f1a96e59", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810900, "uuid": "1233e6da-9d9e-4f24-b8a0-cef3ab4e255c", "value": "49152:NktmGhY/xyXW226i+0MEpDkodPM46HHb/gwsI+/XEoKInEu+h1NIlHA9if9zYLM9:If++J23MEhkodb6H7ZsIyXj5xAOzWvC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810900, "uuid": "faeba272-9f4c-499c-a013-10dcad1097f6", "value": 3142137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810900, "uuid": "cf3f1b03-7c36-4fd2-913f-cda043341c46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810900, "uuid": "0a89770a-dea6-463a-9e19-063026c618ed", "value": "4fba4987f80f1f78dc0edc7d5ede0f4cfbde340e016a073db8d02d5a38cbe78b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b60451a6-1985-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819750, "uuid": "2ef4f2ac-d840-45be-988c-47f4695d1a60", "comment": "Malware payload (Mirai)", "value": "5a2fbc6b41e655d6407103adaeef89aa", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819750, "uuid": "7f0a5d2a-4369-48b2-b73e-0b4293d518a7", "comment": "Malware payload (Mirai)", "value": "4fd9ed6881d2b7e80d3d2db30c02eb20060e512e5bef4e5cbdd42ec15a9834e9", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819750, "uuid": "e628ab54-d504-44fe-bd4b-6c516b1d6fe9", "comment": "Malware payload (Mirai)", "value": "1ebf7d502a3297b1e59ae095c92f93481731614b", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819750, "uuid": "7fcbb2fb-1c14-4bbc-9ad5-955304eca4e3", "comment": "Malware payload (Mirai)", "value": "69f6ca2db4bfc1a5c39c3f96c27c2336736d2365880910cfd3b9bd1bc5ab199c124648fdc82494cb87751a0451a7b3b1", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819750, "uuid": "2a14cc48-ac68-4fbf-88cf-191cb3191fa8", "value": "T1DD969D45FC2E6472CAC976351E6752643335EC488BC2D72A2A24B77DF9F23588F132A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819750, "uuid": "356ca41d-e2fa-4400-a949-b550bc964ec5", "value": "98304:H/nNKWy8F0gKskb+eQJBE65+AJYScNCxG0PgokMKZzLJAiQ:HfNKWyLg8IPcNwGqkMKpLJjQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819750, "uuid": "c556cb46-3f7c-4f0e-9306-b770f7f688b5", "value": 9002328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819750, "uuid": "afe558d5-dea4-4232-a862-bbbc6c33095b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819750, "uuid": "72096378-0de6-4809-b2b4-77264836eace", "value": "bot.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "815cf6fc-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808494, "uuid": "5ae542f6-6a73-43b8-bf00-63896a4dc411", "comment": "Malware payload (GCleaner)", "value": "4933fd270c8a514371adc61f46651695", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808494, "uuid": "a60461b7-659f-4386-a882-d438560e3830", "comment": "Malware payload (GCleaner)", "value": "5005314e7796c187392ab56241bc342900b31faf9b0eb2106498f4f68ba56a09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808494, "uuid": "5d89ba3e-3cc5-4989-8112-1b411b15428a", "comment": "Malware payload (GCleaner)", "value": "edf0569beb61dcd9379ecd67791db023eec3a7ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808494, "uuid": "f95ceee1-64d3-4b8c-aefc-1e66cbeb4047", "comment": "Malware payload (GCleaner)", "value": "9112786e55f5c1ae9c0d0fff1a5b516405272b799e3b3166e77d1c5ab90aae14dbef3717427c6e67d0eca2fa86dc170f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808494, "uuid": "197c3bb9-3042-4e64-bf89-7d3f75ea3b2b", "value": "T1AF36D09396BD027CE7F6E7B5AD6EBA747FF628224C1824AF055F8EC4991050303252E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808494, "uuid": "72d6cbfc-7885-4c52-b6b6-143d6084de6d", "value": "c243d5a6283f8eb7bff20dd0797e21c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808494, "uuid": "6ac50dac-58ac-4d6b-9d94-3898e36fa7c5", "value": "49152:MH5nlZBmQuAvATedrjw9wBR8hsJVL+SpeutF1g82vaHWb4ykvvhM0:MH5wQLH5Qn85PyEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808494, "uuid": "4e1e15cc-7323-4483-8a0c-b50a936cea64", "value": 5251584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808494, "uuid": "2d985a6e-e713-4671-9072-05a21e73ee34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808494, "uuid": "5ba9f83d-3df6-44d0-92d0-53df54d317e0", "value": "5005314e7796c187392ab56241bc342900b31faf9b0eb2106498f4f68ba56a09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5411f236-196f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810136, "uuid": "90c2e533-c0bf-47f8-96a1-dec48e8de117", "comment": "Malware payload", "value": "cd1933708366737181cabdd34bd04956", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810136, "uuid": "591341bc-15c7-4b7c-ac25-b8eff0d699f3", "comment": "Malware payload", "value": "50090e722ce3c3c0b551f5c7df9d5c7e43bdf23ab84d70ab4f3730ab7d99e212", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810136, "uuid": "544a69a6-6633-4ffa-9ff4-ae30a2dda9c3", "comment": "Malware payload", "value": "5c567e3c16734b40400a98250d5c0697dd09290c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810136, "uuid": "0459cdb7-8a14-4b60-bfc5-d0fef1418bb8", "comment": "Malware payload", "value": "3abb0035b467c95443ffa3cd22cf9773ba0058a4aa2547f26bbb537969cd920444b8cf2f6f3ca4d68fe3e7846dc26e5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810136, "uuid": "fc6a8118-4043-4f0f-b419-81eb327dd0ab", "value": "T13025F1715D56BB70D9BC0BBC80161A4833F4EA0357A2E76B1FFC04F69C96B98CD6A052", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810136, "uuid": "f1d35701-f9c0-4607-b2c6-d57742e82614", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810136, "uuid": "a5bb8f63-c12a-4e4c-9ca7-9826ef69742e", "value": "12288:YOlFU1EZJWlLoRyEYLzXAPbCML87sgMXaO4RAD2YI1Qsc6F3lrK/CD8gIA:YOqEZslLoRymbJ8wgMh4C7sjF3lek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810136, "uuid": "ca53cd54-fda5-4ba4-9ab4-5234902e62d1", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810136, "uuid": "4a681f60-8adc-4a03-9d37-06f8bf2849dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810136, "uuid": "c9cb9758-059b-4f8b-856a-838bca926771", "value": "50090e722ce3c3c0b551f5c7df9d5c7e43bdf23ab84d70ab4f3730ab7d99e212", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10503fe5-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772809164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809164, "uuid": "f142badf-2c48-494e-bce9-3e6fb56a039a", "comment": "Malware payload (RemcosRAT)", "value": "ee718fbf8996ef12cf62f410ba489d00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809164, "uuid": "9d5e305a-77af-4395-bf16-4c079ba6698e", "comment": "Malware payload (RemcosRAT)", "value": "50116fca27249e42e0304690c9c3f41f237a9a80064896aa8caa5f781669fbb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809164, "uuid": "26bbcc67-3a5d-4dfb-a81d-e1cbdc5d48b8", "comment": "Malware payload (RemcosRAT)", "value": "f6e30751bede6bf6638cf2a5acd868d86364b5e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809164, "uuid": "08671279-663f-4e87-b97f-00de4d48b87a", "comment": "Malware payload (RemcosRAT)", "value": "a71671c141fece21d075f5cac341b246395474ce16408eebafc6b3bcefa9b9dc95d7bdfb880eaa27f20d26d56ed35e89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809164, "uuid": "8b03f943-a04d-4ca5-8c87-dc82aa01e663", "value": "T19355012B2DC31564C9A54F75D2AA04E873F0C65B1115E7BB6FEC02F4ED62B0AD9234B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809164, "uuid": "b27bdebd-5d1c-46c7-9311-39cd1d2f03ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809164, "uuid": "5dfdaad2-520a-4fa2-8443-29c7f9c05fb3", "value": "24576:SHSK//hpLT/4PPH7caoc78CnRveYepqMKDmfC4KOSSn2l6lU4JblNB1:MLzswaoMRveYkqM3fC41p2r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809164, "uuid": "e8697eb7-741f-4cdd-a63b-a456aa9beedf", "value": 1392128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809164, "uuid": "495b14fe-1840-4497-abb9-98854edbd34e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809164, "uuid": "14db7cd5-f64c-4e02-8a37-7890f3f264a1", "value": "50116fca27249e42e0304690c9c3f41f237a9a80064896aa8caa5f781669fbb8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cefb94d9-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772809054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809054, "uuid": "74abe654-4df0-4fd7-b094-24150bc9f40d", "comment": "Malware payload (GCleaner)", "value": "88d9a829a1fdfc2c4533701626f99cfe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809054, "uuid": "cea8f3cc-4c38-4abe-8b90-b08966b58e08", "comment": "Malware payload (GCleaner)", "value": "50775917143488cae39f01742e3fcdca74192c43d8d38a3a5d8b00d18791cab5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809054, "uuid": "9db57d5f-6f94-44dc-b13c-f66d469e77a9", "comment": "Malware payload (GCleaner)", "value": "58332271a9d6fc4f15fd72031387738c21f1efc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809054, "uuid": "e6601668-456b-4d26-8d48-6d6a1d49af72", "comment": "Malware payload (GCleaner)", "value": "d278843f9c68530a175a6b69d49858305848d07fa14bbe8cf96279ddd227cc9686bde4974e9e981e0c1328368f1a5a01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809054, "uuid": "912cb46c-1fbb-42f8-98bb-d22d81d28919", "value": "T18356E03ED070F17AEBAFDEF459B9129CB431B5C454162E8430E968C745E798823B06EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809054, "uuid": "a49472bf-2b28-47b6-8293-cb7685ad2a12", "value": "234372fce9eaa047bc4c39047910954c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809054, "uuid": "2b55ab8b-4090-4051-93bd-5b85eeb79163", "value": "49152:YGQJMCDnz6ZSdBcGCrgkvTXV4CKm+G/7KFRhHgJ0fKVIuUCP78hUVG+p6znNVeuh:YBJMW6Z1GGgSDsmmivIuoUVsB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809054, "uuid": "730bb837-2782-4990-9c65-c88d63b8014f", "value": 6178304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809054, "uuid": "30f82bf2-418d-48cd-9a55-2db8c0b580fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809054, "uuid": "d144249b-0289-47fe-833c-dafc623c1976", "value": "50775917143488cae39f01742e3fcdca74192c43d8d38a3a5d8b00d18791cab5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01c0c8f4-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819018, "uuid": "5eb77f26-d31f-468b-85eb-c1c1bcc4065b", "comment": "Malware payload (Mirai)", "value": "9508a25cd97a58468505adf3ab94bf55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819018, "uuid": "9459e710-6fdf-49c9-93f4-f7a68d1871a4", "comment": "Malware payload (Mirai)", "value": "50d3c1fce3f5adfa7a50c3e72e4409cea1bcca69f3a0f4ccdaefad74a5ddcffd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819018, "uuid": "9212a5ad-1f67-4c47-8d4d-167013fbf4ee", "comment": "Malware payload (Mirai)", "value": "f1d18c3dc5c40fa9d69c13d8a651bc1dd38e3a5a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819018, "uuid": "e4f37576-3789-4e96-8af9-623ea81fb828", "comment": "Malware payload (Mirai)", "value": "788b2d21bfb4cc1312d56d7f494fb1333b7e259a617d7e98d1ca7ebd910a3ba966186defdf0ee3ecb5ecdbddce680612", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819018, "uuid": "a4fb12d4-7d72-446a-ba4a-36cab8236020", "value": "T179935A13B9C480FCC889C13057AFB136D963F17E1279B25F67D4EA127E8DE512B6A680", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819018, "uuid": "95511bb8-6022-4a43-9810-b376d091a9a0", "value": "1536:wOJWCxljKvh6uTH/HwinvUsBvhzAA1x1Asqe+tHXXnlGJHqBO:wOdvjKvBTHzvtvhZ1x1AsqDHXXlGg0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819018, "uuid": "c58d117e-9145-47e5-b71c-4a0b96e3474e", "value": 88928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819018, "uuid": "42dd008c-ac4e-40dd-8827-d9e06dea40de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819018, "uuid": "104eefe5-2196-44fb-b276-c46ef86eb17f", "value": "jawirbot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7eba8ad-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808666, "uuid": "420d8788-1776-4367-a7aa-bc49851b0dc5", "comment": "Malware payload (GCleaner)", "value": "2bce8ce2acb1bf6b385ec0eb43091510", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808666, "uuid": "7ef3863e-774f-4bb3-8ed1-bf8e53101752", "comment": "Malware payload (GCleaner)", "value": "517830cb86f8f83207f38c9aee52665f44d3f5ff9abcd1c1d5fe90b9ec734ba1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808666, "uuid": "5c0a085b-94e0-4471-a507-a404474473ff", "comment": "Malware payload (GCleaner)", "value": "5e9aa381b6a82310ac6e668d6293f287cc9f9f32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808666, "uuid": "4f90fd8f-d88f-49aa-a318-eafe8264c38d", "comment": "Malware payload (GCleaner)", "value": "ca4a4a1c125de3b45a41b46b18c222f54e3b2caf5d0583be78228ab51dbe062914fa82daf55d7550804be21e733d2c61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808666, "uuid": "f27608bb-f0ee-4d0e-8a92-62433a165756", "value": "T1CB26CF15F7AC2372D268EB799B1A43C534FF742E1356B41BE2C86AD88E606463E34C47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808666, "uuid": "87468a06-0df8-436e-88a8-84522f068c81", "value": "234372fce9eaa047bc4c39047910954c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808666, "uuid": "521680e8-46b7-4d3b-a217-7a1568dcea86", "value": "98304:jBJMcIp6dE3EohsQAF5nHcSLWElEUAAy46Hq4mV:jA6DoiQI5nHcUgA0K/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808666, "uuid": "99dcb64d-5a83-4f88-b444-e86fb9ec7829", "value": 4592640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808666, "uuid": "a4c26283-2b6a-48cf-b864-2123fbdecf43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808666, "uuid": "7e295d75-3024-48c9-bf0d-3a9afaccd9fc", "value": "517830cb86f8f83207f38c9aee52665f44d3f5ff9abcd1c1d5fe90b9ec734ba1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "366b84f8-1949-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772793766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772793766, "uuid": "ddc20887-f9b9-4cac-93d8-e4fd5ca170ac", "comment": "Malware payload (Vidar)", "value": "54dd8883d08be44e8a22bd5748e87759", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-OpenClaw", "colour": "#525D1F", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772793766, "uuid": "7fa44102-aa4e-4daa-922f-66b7343399eb", "comment": "Malware payload (Vidar)", "value": "518ff5fbfa4296abf38dfc342107f70e1491a7460978da6315a75175fb70e2b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-OpenClaw", "colour": "#525D1F", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772793766, "uuid": "743d0130-e6ec-4543-ba02-19cc607386d5", "comment": "Malware payload (Vidar)", "value": "66c27ef465437a28bc13ced74253a712af3cf3ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-OpenClaw", "colour": "#525D1F", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772793766, "uuid": "eba5e9ac-1711-43be-b077-1950bf1e1758", "comment": "Malware payload (Vidar)", "value": "87f58c2eb3e829baed7b982e3514444b005b97de128b442627297402039771046764314295bb214858a44cb2b4c95004", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-OpenClaw", "colour": "#525D1F", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772793766, "uuid": "f35040b4-1c4c-4a92-b6be-e8cd1e3b6f28", "value": "T17F282302BA9A2974C05EC8B0D2574A934F3130DB123BA5BF50E942643FAB7F49B3E755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772793766, "uuid": "c0a16479-3d4a-4840-9a4d-dd9d5f0d179a", "value": "4254307620427790ca15f1d084261e51", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772793766, "uuid": "13991946-9a37-4c2a-be54-e7d41f11650f", "value": "1572864:K+EyZr0L/k71lrPX7qUeSLAs2dekoIxBpo3MhBGUhXRS4XZhNExO5pSs97cbOtrD:KByZr0L/kZMY32wVIxBi8hEUhBS4XZPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772793766, "uuid": "ec8c945a-317e-4bdd-8d27-a4ca97923d68", "value": 99131392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772793766, "uuid": "7f858d0d-7563-4f85-9804-0ba1ebf87c40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772793766, "uuid": "41a8ae4e-212d-4e97-b29a-f6b46f76afbb", "value": "518ff5fbfa4296abf38dfc342107f70e1491a7460978da6315a75175fb70e2b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec36cb0-193d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772788948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788948, "uuid": "13316fcc-8166-41b2-958f-3782d38ec7d5", "comment": "Malware payload (Mirai)", "value": "c1a96c23ffed6b452f1368db2929a031", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788948, "uuid": "3371bfa8-e1fe-4b6c-b3d8-dd9edcd51efe", "comment": "Malware payload (Mirai)", "value": "51d91d601fae9db7b1f2cd184347e3ded3df5afb9174133eb1235adf5cc47925", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788948, "uuid": "89271043-7a6d-405e-8473-7974d8a1a351", "comment": "Malware payload (Mirai)", "value": "d7ec13cfbda93aacc9e85b2e44aba89e61cbe1d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788948, "uuid": "50767b37-ba81-4e77-bc35-bfeade7416a9", "comment": "Malware payload (Mirai)", "value": "de195ac3f5d6d48f47230eadff5ba5b0a57e1999bdfd520204804c1693cfff8c2441649f802867e33aec750213e24e26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788948, "uuid": "038c5c71-9941-4cb6-b76a-a3f2f311d77d", "value": "T12B933AD7F400CDBDF84EDB7B44530A06B531E3A20A835F76625BB927AD361984933E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788948, "uuid": "97759483-b220-402f-8044-8ee303f38fd4", "value": "1536:eGXP6gt/it/zX/HyyPATI9RoP128D0yJZWyKN8Nk4urDTbhl/TVcdNp81b:CtLX/fAT4RoP19Hw8S4snTVcd4V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772788948, "uuid": "ba9ca5c4-dc89-41f8-8189-c63f74585463", "value": 90588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772788948, "uuid": "555e1514-f5e2-4629-8efc-82342e30db35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788948, "uuid": "e29d943d-085d-4a24-8ad8-90cad9ab9131", "value": "morte.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93eb0990-1968-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807237, "uuid": "03a2e642-368c-4b84-8462-1f0744b3aaf0", "comment": "Malware payload", "value": "f002a7b0c0055fcde6435e9ae5997f30", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807237, "uuid": "41b04763-1dad-4bdb-8c75-71dc58569d4d", "comment": "Malware payload", "value": "52027c64cde09012fcb8e453fd384a3cc4d5fd391f544b1f7694f97279c93f95", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807237, "uuid": "708876c5-9628-4d48-b02c-2699632e892f", "comment": "Malware payload", "value": "c4ca35aa87a4f2b3fff8c0d7c00bab856aa27e6f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807237, "uuid": "ece032ae-31f3-434f-a9ae-448b441f1786", "comment": "Malware payload", "value": "a1e7a42cfc6993f609e0d080ad1d26eab890c111da6e85f1ff8491f9c56bfa8cd1590226470612f628769fe780d093ea", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807237, "uuid": "c15f8982-8352-4e1a-b972-26ae4c4ba3e2", "value": "T1EB925BB916496C79BBC0DE7D9F3C7F0CADE4C1C02218A3ACBA4F39615A2069DDA0535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807237, "uuid": "1479d438-99a7-45f7-87a5-d343941c04cc", "value": "384:Zs0M3vgRjGlsaq7tzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:ZWmjfRzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807237, "uuid": "acc05b46-7ecf-4b6f-bd6e-c282642cdcf0", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807237, "uuid": "a6a72071-902b-474d-a495-85288d596f76", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807237, "uuid": "ae0653a7-bb3c-42a6-8bae-26a034b762ba", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "675ebe30-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819188, "uuid": "7632e655-5f5c-4db8-b478-e5772ef0d343", "comment": "Malware payload (Mirai)", "value": "398e7782535f72298eb08abe86039a8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819188, "uuid": "beca0522-e786-4589-8b6e-7f1c6dc012aa", "comment": "Malware payload (Mirai)", "value": "5211b6491710960a40d248e108d845fb0497b6c16437b23bb265068249477bf8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819188, "uuid": "e3defd8d-60f8-412e-b210-448144f14e69", "comment": "Malware payload (Mirai)", "value": "f54747989fcda6797a81ff6e1d39e2c786c58c5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819188, "uuid": "7dcbb9b6-5222-4deb-b197-8fa2687d7295", "comment": "Malware payload (Mirai)", "value": "5cfcc34ae5b3278686f783a4bee377f71416934ae984722e494d94e705631bcf9129eced47d762d7d41dd6cddc9d125a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819188, "uuid": "7ba12af9-a65c-4fc4-90c1-b4aa37cd9219", "value": "T186C3961A3E11DFBFF65D823147B3CA31969837963AA1C585F15CEB481E2028E641FBE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819188, "uuid": "cefa075f-ba9d-453a-a3b2-9599ec02bd06", "value": "1536:VqF6WzFPvtgTVsIqmiw0sf+y4PRYa2O0LeyY4K2xqs/VcCH:cAWzFPvyTVhqdof+y4PWa90DjxlfH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819188, "uuid": "e2fa33ac-fe7b-4b1c-a2ff-81e794f67f42", "value": 122052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819188, "uuid": "0b8d5217-2db9-4f71-a000-0c5a863fab13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819188, "uuid": "1f28cb3a-aea2-4536-9a68-dd24e990c0b1", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af9cdf0e-1969-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807713, "uuid": "1939693b-6dd2-42f3-a298-195159fc70bf", "comment": "Malware payload", "value": "a0bfd01b31d64a126473d5bbb0234212", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807713, "uuid": "9703919d-99e7-470f-b189-4bcc41dd3cbe", "comment": "Malware payload", "value": "522a30ee806efaee61721a63478abc144d5bfd8da69c93619191f611fa7d0d87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807713, "uuid": "058dc81d-428f-4cc9-a48d-cdc9fc25dbc1", "comment": "Malware payload", "value": "5b79f893c87389fce99b5e8f250c1e49832b4552", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807713, "uuid": "f0aaecf3-62c2-42b2-9dd8-25c65477245b", "comment": "Malware payload", "value": "235b23aeffb88c9ffe27bd04900a10f51e7b0a59192daa846e8809d0795364f53dd042a83158ac450140a54f31dbd6af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807713, "uuid": "f89a122f-3d3a-40b8-8828-2b6b6f58b853", "value": "T13215DF0B27D44AA8E5FD8B75D2B900E803FFB7079722EB5D6D0551EB4D22B429E01B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807713, "uuid": "61dcbf50-21d3-40fd-bedc-b0ac51bfc602", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807713, "uuid": "4d68392b-6b8e-4a4c-b647-3259e1b02a08", "value": "12288:ObzCiB3nlPAg0C6+6w6ZD5Ww702NUAHKbNCX0WT0D88NoV0NW+Lnc2h9f4Wbe3ED:S/h6fZNC8ZHKJCX0fI8mVS7h03EC+8G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807713, "uuid": "0dc159b5-91fc-451e-8d21-dcfc282ddf51", "value": 876032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807713, "uuid": "5c02a6eb-fa23-44f0-bcbb-80369de4ba7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807713, "uuid": "5b696ac1-f8b2-4a0a-b82b-e75438294851", "value": "522a30ee806efaee61721a63478abc144d5bfd8da69c93619191f611fa7d0d87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d52bfe88-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810353, "uuid": "93dfbec6-08b3-46e4-b371-b79c7e25ac85", "comment": "Malware payload (GCleaner)", "value": "80b23e8a9e6e4be9f5007ac0802898ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810353, "uuid": "4965657e-33d4-4b98-8174-b11d381b628d", "comment": "Malware payload (GCleaner)", "value": "524430020e76d6670fd23f26a2edcea015256db342b54131de1b322ff8a57037", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810353, "uuid": "7af2725c-322a-42e4-8a91-0a8e3452544d", "comment": "Malware payload (GCleaner)", "value": "8d0c6956fa4b42dfdda7184bbec827cd8292133a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810353, "uuid": "4f46563f-f5eb-4bc3-a418-e591484b976e", "comment": "Malware payload (GCleaner)", "value": "223ec23320550d16723d4acac5eb0c1fbbea9539acea64269c47ac6fdd82f19220ee0820631b588efb2bbaad455406d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810353, "uuid": "6e107221-0cce-4b93-b8ce-8b5e306c5328", "value": "T11A258D22AEE35537C1272B39EC5B6E987925FE10E9F858463AECCDC84F35241F4152A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810353, "uuid": "fc274153-5b44-45f6-ae98-5dd4ab9b49b6", "value": "fe4280c06246cc873fe89746dadec91e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810353, "uuid": "03d6290e-512e-455d-9954-201763f74622", "value": "24576:UlluEBpPj6o4CPbE9taCbEIWmOE+awleT:Ulwa1V0r5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810353, "uuid": "001cb62f-d002-4707-bb7d-d832ce99aa9e", "value": 985600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810353, "uuid": "c8b9a34e-4eeb-421c-a03c-df1aaba2cf01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810353, "uuid": "08b4c70b-49aa-45c3-8425-ce743ae00c0e", "value": "524430020e76d6670fd23f26a2edcea015256db342b54131de1b322ff8a57037", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d7a0d8a-1970-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810662, "uuid": "0efb5a3c-fa3a-4706-adc5-69155c391f3c", "comment": "Malware payload", "value": "808060c103a9aaed24de4be70dd076d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810662, "uuid": "81bb35fa-4378-44f1-896f-d66d8d8dbbd5", "comment": "Malware payload", "value": "5255291f09289a4bbb320bb8c97f20fff5bc4977fd3316bc906e0b2f2bab0a76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810662, "uuid": "7b280cca-cb4a-4b2d-b34d-213ceb624ae4", "comment": "Malware payload", "value": "9b43561829ead98430802803c1f5bec26433e9a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810662, "uuid": "268f004d-ab24-4f03-967a-01c3c5f9f5d7", "comment": "Malware payload", "value": "911b00a42aa0865c9673c1a42efb28b64981bef1c60be5aa62adb8c5962965fc65dbc38fac4332f8fca0c6f5874632c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810662, "uuid": "1a3529d6-31c3-400e-9127-73b2edb6cad1", "value": "T1070501A02325CA13CA5197745BB0F6B81B7D1FEEA811E3079FDE6DDB7AA2B154C04183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810662, "uuid": "b79d6c6d-3692-4105-8f2c-8ea49b82b594", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810662, "uuid": "65215a1c-c496-4ae7-92f9-70dd56ffbcbb", "value": "24576:zKLy9WHTBw9WuG2spl7EbmFTu4Micaejy:OOQT9Hj4bOQaejy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810662, "uuid": "94169e60-43db-4f21-9c7a-6047edb71bda", "value": 826888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810662, "uuid": "a9260cd1-1d19-4397-b965-e00c75b0961d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810662, "uuid": "2d09930b-5077-4a96-89a2-255445688eb6", "value": "5255291f09289a4bbb320bb8c97f20fff5bc4977fd3316bc906e0b2f2bab0a76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09cc90c2-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819031, "uuid": "02a60f7a-536e-43dc-af97-e4b4b623d871", "comment": "Malware payload (Mirai)", "value": "4dc0fd90987910e0b9f82e1512681c8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819031, "uuid": "6e3dc654-a119-4573-abaf-8a0a21dfbfa4", "comment": "Malware payload (Mirai)", "value": "527aaedef25c03c462a69ef5e511e5e4f62f45f5791a4a234c120db8aa43bcfa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819031, "uuid": "9607aad8-aaf8-4c5b-b656-0600d6543735", "comment": "Malware payload (Mirai)", "value": "460f2c8d4ac2e7cc92dc7a612b51d47bab9fca6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819031, "uuid": "eba35072-b1ab-4e25-b334-d418831172e4", "comment": "Malware payload (Mirai)", "value": "4516cae5d231132338ec347d0cd3242a789be07a43bd60a8f42029124e366b5691470fbdcc4c96e8609d9f397fd1ca3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819031, "uuid": "7a5977ce-c5c3-46c3-b078-0eaa4d3d560c", "value": "T1F5E33F1EAE325F7EF7989B310BB66E34935912E333D0E656D1AEC6102E7024C585FB90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819031, "uuid": "4bb6723d-2952-435b-a2fd-3714d43e0a16", "value": "3072:8jnYAVmfMlNt4BIxM51SKPo4TRmdY6duZBEi+9:8jJmfMCTncduZBEi+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819031, "uuid": "92728990-b5de-4c36-83f1-87f7163642bd", "value": 156348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819031, "uuid": "b696f40b-9f52-4ec8-9f8b-ec91c5f2e563", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819031, "uuid": "e3832dc6-97e2-40d3-81a4-b50afb17e378", "value": "debug.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73aef3bc-1965-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772805894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805894, "uuid": "8a9ca0e5-04f8-4e9e-9cad-1bc3450fa1b5", "comment": "Malware payload", "value": "799db6d0cc2d10f22842d9d5b7b73d97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805894, "uuid": "90b01708-2d85-460f-bb7a-28ccc3677074", "comment": "Malware payload", "value": "52984ca49620519ec8c3210dc15c56328e74d9a3621edbacccadfad3fcda2af8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805894, "uuid": "38d6fca9-ee67-4323-8276-03bbe2ca1fda", "comment": "Malware payload", "value": "7bc74069560674da84dc9a52e4c4a84bd63f3ed7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805894, "uuid": "f0fb11b1-29db-438d-8d99-d5cb12d935e6", "comment": "Malware payload", "value": "75423c95846d00bd7d4e54e380d688b9225dda82c6f3fdbe58fff1fdfffa5f2970ca02e9c920c3a42b7e9feb9093ae3a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805894, "uuid": "6f857eab-827e-4932-a10a-0b955836e0c5", "value": "T1C8E3885A6E228FAEF67C873147F74A20976D23D623E1D684D2ACC1141F6038E545FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805894, "uuid": "7039e3a1-4c23-4ecc-babe-78dae9e21123", "value": "1536:p+vTcKot8sp2MKypYz8ZOfGQ+v3eB/hub8mXRCTUGk4onuftL4VxydbK:p4lybKpzEOfGQ+vEubTt4ouftL4+dO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772805894, "uuid": "4a2698ac-c302-465c-9fec-151d3a81b38b", "value": 156680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772805894, "uuid": "f996496f-8f63-45c9-b576-1492ac939fce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805894, "uuid": "d867f87a-6ce7-48d4-99db-8412409c7f47", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a9b2674-1992-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772825126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772825126, "uuid": "883cff18-ecc2-4633-b9e7-fccc3a221be4", "comment": "Malware payload", "value": "805df090f52cfabae5b3090df492d34d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772825126, "uuid": "45b6c007-445b-46fe-bb83-0fe55ed39d92", "comment": "Malware payload", "value": "529c9f56c17eeb7f5f49fb924562da572c3eb2a291b33740476b9bafa3abb966", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772825126, "uuid": "85bedde2-14db-40b6-ae5a-b2502db2957b", "comment": "Malware payload", "value": "54c4f667352595712953bfb6fe0d86c5c5435540", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772825126, "uuid": "30884484-2fd9-4340-8e4e-3bd6580d917c", "comment": "Malware payload", "value": "da5da74d5d116aef7501ef0bdd78c94f5806ca4c66cedcec04d978ef22722cc2455aa04c8b36a720d328015965ea0121", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772825126, "uuid": "fff4f42f-69c8-4be7-9bf3-ff8f22785879", "value": "T17495749E8E3E92D6C0AEC5F4A73192A7B4503C8DD17077D76BC00B6D2723660E9A63C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772825126, "uuid": "1b6a8e68-888c-4e64-81fc-9dc9c79da607", "value": "0e6421c4f9fcf89bd5b84dae1d979cf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772825126, "uuid": "47560da9-c7c8-4e4c-9255-59ea75077f2c", "value": "24576:RYtJZPdOtwzwuSYXCL5alXOYiTqunKKcwFtotHp84V4fIBaFEz:kY5RUVpZV4fIBYy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772825126, "uuid": "b7dfd9ae-9ceb-42f8-9e78-b3455825c215", "value": 1900032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772825126, "uuid": "126c360a-916a-4904-9eb1-0f83c359b409", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772825126, "uuid": "7b9899d0-fab7-4b94-8e57-b385fc9dff32", "value": "2026\u7b2c\u4e00\u5b63\u5ea6\u8fdd\u7eaa\u4eba\u5458\u5185\u90e8\u8c03\u67e5\u4fe1\u606f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7d8e996-195f-11f1-a769-42010a9c0008", "comment": "Malware payload (N-W0rm)", "timestamp": 1772803512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772803512, "uuid": "7af3791d-687d-4a6a-a7bd-94f64fae936d", "comment": "Malware payload (N-W0rm)", "value": "602d7a1cb0b972c170d3a295e59c5244", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772803512, "uuid": "1eb158fd-d02d-4054-8e1d-849dacad1770", "comment": "Malware payload (N-W0rm)", "value": "52ce2f6b54f59176161c110aa56b42f1400ab17563c698ab27bb8d99aa7d8493", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772803512, "uuid": "369d4705-73a4-4085-83fa-a979902bf44d", "comment": "Malware payload (N-W0rm)", "value": "064591946b1e73ce0f967a182fe2c3fa55ba5b20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772803512, "uuid": "3fec3e69-2c86-4bb9-b2ff-fa2eed68d075", "comment": "Malware payload (N-W0rm)", "value": "813f7618b20de84e07810c3a585b6c19c578cd3e74b57241b9a6604ede45aabaa9044919cbd41cc6e66fbb44a4b68c45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772803512, "uuid": "7852d6ac-bc07-4038-b4ec-44e0a884407b", "value": "T16876223FB28F753EE16E1A3A3A72A620653B6A1065134C42D6F4C45CCF6A1711F3E786", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772803512, "uuid": "2567eac8-dac4-464d-8629-d5173da3f6b5", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772803512, "uuid": "e324ed55-d4e7-4c10-a97e-9b5626110145", "value": "196608:SyaEJoIio4Jl77IUMAi1X7+5BRQShdjZn:SmKZo4HIfAi0pDj1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772803512, "uuid": "3a756f1b-f052-48d7-91ed-008825bf3057", "value": 7633888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772803512, "uuid": "beaa7c2a-4209-4fad-a9a5-7eeb907f7803", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772803512, "uuid": "913391b2-2dd7-45fa-8d21-0add1035bd7c", "value": "52ce2f6b54f59176161c110aa56b42f1400ab17563c69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "768234cb-1972-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811483, "uuid": "c3ce0f73-8388-4d6f-9754-b6135f59de25", "comment": "Malware payload", "value": "d1d5e4c604dd63fc94561c778e293989", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811483, "uuid": "85878a29-9a44-4a65-8e0d-c29ddef0b757", "comment": "Malware payload", "value": "53296d6ead8510fb6858cc3719d0145baf34fdfaca52a46f3a7a7a4d585df9f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811483, "uuid": "c94ebe8a-e1e0-44fb-b090-b7a423cba739", "comment": "Malware payload", "value": "5b4ec8f126aad40538916aa5dec7ec60d7106f6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811483, "uuid": "c8d61c1b-51e1-449a-a2e0-0c73601032a8", "comment": "Malware payload", "value": "534c27386f3d33dae978fc1d3f8a2e93029abae68c2f289343c6042d80772646ad34db6d06d523993c1e3b77b23c5220", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811483, "uuid": "b296b9ff-218c-47cb-924a-11051cb98822", "value": "T15E2533297462068FEFB346FA18F88F222AE75B13252449CF9314B7DE3A4A754C51D3C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811483, "uuid": "94f5952f-f848-461e-bf6b-d07f745ea7dd", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811483, "uuid": "c827e02f-9b0e-4c11-8c8c-dfa576151fdb", "value": "24576:ooYiwHuKGH9FZDI0hMPdRCBlSRIsvjr03sd/Ei/vB:U6RFZDzh7kPLr5ci/vB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811483, "uuid": "a881d188-cd7e-4bdb-855d-66b15f079ad7", "value": 1049056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811483, "uuid": "5171195e-8cbb-4154-b783-4ed2cbf4fe07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811483, "uuid": "4ce3c417-908c-4f4d-999b-58234de82c6a", "value": "53296d6ead8510fb6858cc3719d0145baf34fdfaca52a46f3a7a7a4d585df9f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dee67db-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819199, "uuid": "c844565c-d58d-4c5d-b104-dbedc04f3595", "comment": "Malware payload (Mirai)", "value": "ad940d7ea077e4b0ecf88ad0b7c01494", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819199, "uuid": "2bb4a503-fa3e-4f72-a4fc-730dee06ea96", "comment": "Malware payload (Mirai)", "value": "5448aefaff216b89bc000559f6f6c1ccf06e5da5c4d4884d93dcfc67509566ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819199, "uuid": "31704c41-d850-4626-a880-f4e6ffed7d0d", "comment": "Malware payload (Mirai)", "value": "8df541f74a3bb0d97eb4ebe2f6e00ac9a5d14eb1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819199, "uuid": "699053ab-c73d-4790-8bd5-3fdc2333c8eb", "comment": "Malware payload (Mirai)", "value": "b7d6cf216012ae656177ecd274d93598921b2b2ebbceff5a064afc3dcb9d7e012587d561b6c3925f5cf028631d5cfe1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819199, "uuid": "46e50a34-9793-465e-a562-1e11b27fc168", "value": "T16F636B23DA269F46C10761F0A9F64E751F13FC9989630EFAA665EEE540039ECF5093B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819199, "uuid": "1f94c4f0-793d-450b-9959-2a6309755fa5", "value": "1536:pawwtrvFQgwu2N1K+wnLMKFpfhC4XgfKDREs/F:pjwFQgBQc+TKFpfhECND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819199, "uuid": "3d7efc06-866f-4544-9e1e-023505a4d3ad", "value": 66844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819199, "uuid": "18a016c7-fcbe-4629-b42c-d5d68f8b1e6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819199, "uuid": "be74e3d2-a787-4797-953c-2f54150c089f", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "606bf3c5-196c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808869, "uuid": "972adf17-b164-4e93-a308-70da89596138", "comment": "Malware payload", "value": "0bd4cfe09fdf8cc7f6698374ad545af6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808869, "uuid": "6b3bca02-342b-480e-8b9f-eb546cb19e18", "comment": "Malware payload", "value": "544bd4d4c374708cf13e874f9afd052484a8f822c4069452feac28be98e08bb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808869, "uuid": "9cbae8da-7e90-43dd-8eb0-ffe15bc95ac2", "comment": "Malware payload", "value": "2575d418f822aeffb09e073b482b3d4f7332211b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808869, "uuid": "f69f7d44-151d-44ce-8264-86dc1582b017", "comment": "Malware payload", "value": "32055d040ebb5fc2e0ecd7fcd40c34736d203854455f95519ec55141925ca3b13d78edc32a70f35b868d83017bf472ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808869, "uuid": "1a5fbab0-0d18-44ad-99a5-feef055ba5c2", "value": "T10645BF027381D062FFAB92734B96F6115BBC79260123EA1F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808869, "uuid": "ded9c3f1-bef7-4303-8873-67a178e495b6", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808869, "uuid": "647f374e-b8f5-43c1-b344-c34f0575b098", "value": "24576:Q5EmXFtKaL4/oFe5T9yyXYfP1ijXdaYH06DmIJKbuTk5:QPVt/LZeJbInQRaYH9yy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808869, "uuid": "fad2c33e-31a1-457b-8671-64d0b36bcc37", "value": 1273856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808869, "uuid": "8a2abaa4-42b2-4bfb-8d56-62e7a76fa1c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808869, "uuid": "41352637-1b50-4864-9e54-a8aaf06ad8a8", "value": "544bd4d4c374708cf13e874f9afd052484a8f822c4069452feac28be98e08bb9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9343222c-1968-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772807236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807236, "uuid": "e2d55046-2824-4071-9612-2fb6cc5e0b0f", "comment": "Malware payload (Mirai)", "value": "f94b718f6aaf8434f8128fc9b1911b87", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807236, "uuid": "cd6a71e6-fe98-4801-8356-a5192981208e", "comment": "Malware payload (Mirai)", "value": "54fb30d02e4910a880020c20ce6ac8e940c1ab31ffdbeaddb88e5ff822d8d9f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807236, "uuid": "d6eaf2dd-02d3-4bd0-8312-17d61dad7514", "comment": "Malware payload (Mirai)", "value": "53c053bd00737770dcec18423ee38245cda0f470", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807236, "uuid": "f11210d5-886d-4789-b27a-e5b13d7eac9b", "comment": "Malware payload (Mirai)", "value": "ccef184e2d1bdfc79be50f044ee08b54348b80bee43ee8cf02e312f58b2f53203eda23933d9679a6e92121e7fae07050", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807236, "uuid": "1f441ce2-9d5b-4a16-acd2-d0ac373bf06b", "value": "T18D3495563A22BFBBF1D9C67047B3CA2046D565912BE19346F29CD71C1E2028E681F7E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807236, "uuid": "690d26e0-1606-4dd6-9454-8a1e4c14cba7", "value": "6144:ALcnnOd8F1A8qhzjvzvP5XZGUR1dQhp+1J71:8dz/zvP5XZGUR1dQhp+1J71", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807236, "uuid": "bbb1eac5-f7f1-44cd-aa11-fc2ea61321c4", "value": 231318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807236, "uuid": "628b9346-a0ff-4079-934d-2253a647c26f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807236, "uuid": "bac1fd66-a122-4ab5-a8b8-d48503b143b1", "value": "m-i.p-s.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d18eda7-1957-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772799790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772799790, "uuid": "7154778f-dbad-4eda-b302-543fba7d8bef", "comment": "Malware payload", "value": "5b1f8c4dc9f3d891bb91ebbd9ecae54b", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772799790, "uuid": "73ec742b-a989-46b0-9308-fffa8d7ae3e0", "comment": "Malware payload", "value": "550d298ec1ffa48fe4060b95becd6851accd0174f148a728b884a7f85b7b8d75", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772799790, "uuid": "71bdf8a9-a215-4018-aecb-9d135915e1f8", "comment": "Malware payload", "value": "aeef84ebd9edb0c7eb1688978d71f5ce314a4da6", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772799790, "uuid": "75fc5179-c9f0-4cfe-847f-cc978ca45160", "comment": "Malware payload", "value": "92c1cb1fb9666d9f6386c332e8f03479a670db885add09008399fa294b90ad3e2b43caee7711ba8376235f08df05d240", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772799790, "uuid": "e9ca7b3d-107c-4812-b7df-aa7fdbb1c4c9", "value": "T1A6C73382BA93C232D9AF413441B7D7BF4A39AC018F2548D7A35C775C99712E12B3B35A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772799790, "uuid": "39315ef4-01fe-4c37-a1d0-7ac14e8221eb", "value": "1572864:kjrWGQC0xGXiIl7i/D7/wD9k4FbllKesPg+IjQtU:kjQC0SiIlur74D9k4BT/yt5U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772799790, "uuid": "2046db5c-614a-4fa4-8215-a4f5a17722a6", "value": 57319424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772799790, "uuid": "b5a7c87c-e73f-406c-99c0-f1ba4db22a8c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772799790, "uuid": "f0cbf3d8-4759-437f-a437-9be58a236ead", "value": "XML_FISCAL.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee954602-196f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810396, "uuid": "fa164025-efae-4bee-b7ae-02e0988e7ed1", "comment": "Malware payload", "value": "abe9a548a24cb6f54bb3d9f9dab49dc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810396, "uuid": "83f282a7-25c7-481f-bc1a-3fceaccad0ae", "comment": "Malware payload", "value": "555d3bdd7b5cac945d885fbd3e57a94b5261a9e6847ea62838d23ab5c0d8abc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810396, "uuid": "46ed50d3-8384-475d-aa5b-587d68b455d9", "comment": "Malware payload", "value": "25999b6d215465d8699beb47dbbd903da3a2d9d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810396, "uuid": "13131a84-4d4b-469f-b6b4-65490961e3dd", "comment": "Malware payload", "value": "dc0ca90302ed5c3976a5bec5f1a36676127f7fea4f663dbae2915495ac70870cb1a145ead433066adf605e6ae81ea6ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810396, "uuid": "f62e1d14-2528-48e1-80df-7d4866318901", "value": "T1E12533625BD1243AD3021971D473C5E326A9ED38058A5657DE41BF7EF873FA2884F223", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810396, "uuid": "a4dece25-047a-4c09-99ec-f6bcfb9532dc", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810396, "uuid": "37b9d64d-7bbd-4624-b9fe-9a9312dfa553", "value": "24576:kGXkL2lERLdcjOl1yFvDKZDX3X5ViTW97nCOZ1zHK6WTz:ALNdcjeyFvOZbXzjnCOZtUn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810396, "uuid": "ce1cc788-8a97-4b92-9e25-4238d555ce8a", "value": 1034056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810396, "uuid": "5c48295f-90bb-410e-a7de-9f8904588924", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810396, "uuid": "bf2f5649-52a9-4e3a-91ea-ffd9f026a173", "value": "555d3bdd7b5cac945d885fbd3e57a94b5261a9e6847ea62838d23ab5c0d8abc3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ffcba47-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772809673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809673, "uuid": "46e43b54-de0c-453d-a23f-355decdf98ac", "comment": "Malware payload (PhantomStealer)", "value": "a16f0d8380db597c0f705207417f8792", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809673, "uuid": "1857591a-b759-4e31-b69b-14ebd4f9ec6c", "comment": "Malware payload (PhantomStealer)", "value": "55a9d922e96e48f6dafe5d3a8026268cc10ae3958b61b9121f0e4c93edca3b29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809673, "uuid": "0cc2a89b-5b18-4fe2-9cf0-cb749df3e14e", "comment": "Malware payload (PhantomStealer)", "value": "4177a1e8e62f44d18c566b21b1f568e5e5e1fd02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809673, "uuid": "a270de98-1c33-4ee9-bee8-8c95d7b897d0", "comment": "Malware payload (PhantomStealer)", "value": "16a1851b90c5cf460bfa2248a147b4a3f74e43af3524db66f1f530b890285067c11debbeff75409c19b3b22f32adf364", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809673, "uuid": "3a6481cb-7df9-4b77-875b-921025b83c16", "value": "T10285F1357E834B41C627677AC5230E8423F0C5929653DB1FBFED01F8AA2A7B98A71351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809673, "uuid": "afdeca4b-f348-4ef2-8a29-8143990a778c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809673, "uuid": "68c0eac3-2606-4806-8afe-6516a745ba1d", "value": "24576:foEA2P4lTp3YHdCvVGEEKIcsjU6UsHMdrE6Jv3oqriYg1Ai4JhHo:fHA2PYp3MdCvMXvjxUsHcJv3fo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809673, "uuid": "63b94504-323a-4b9c-bcfb-523713eb510c", "value": 1764352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809673, "uuid": "948aaa18-78fb-47e5-92e6-f04707d6dad1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809673, "uuid": "16c91b90-bb48-473e-bf9e-962ec7e71bb6", "value": "55a9d922e96e48f6dafe5d3a8026268cc10ae3958b61b9121f0e4c93edca3b29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4e5aaf9-1971-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772811265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811265, "uuid": "11331055-48c4-46c3-827f-914da915bffc", "comment": "Malware payload (GCleaner)", "value": "5dacf83e155e11b0cf721dd9c60646d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811265, "uuid": "82e97aaf-8730-4cbe-a804-91d144e32624", "comment": "Malware payload (GCleaner)", "value": "56e75f28e9c262f902e1f17ac5ae8c3e495ed8a67243fe17fb32be292e54bffb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811265, "uuid": "335cf6e8-87ab-4c7c-aeb0-4199c50c0131", "comment": "Malware payload (GCleaner)", "value": "6264a6804ffd4f843b230aa576bc144bd033ac6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811265, "uuid": "6e43615f-df33-48a8-8dc3-e8a7eb6f6c00", "comment": "Malware payload (GCleaner)", "value": "2ca943ccde8d36fdcc954344a25f4155fa2a6d3cb244bbc1b9067d00201006afc741f9f38cb2f95b85e7d543a89ae3ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811265, "uuid": "36ac4e9e-6f90-458d-a4f8-5b6600a2ad54", "value": "T176059F35F69C84F7E0223D78DC1B56955825BE846B28BB4A2EE81CCF8F38781B525353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811265, "uuid": "8524ea79-a926-4335-9b47-0fce5115fa41", "value": "ce7a1d07b14b49824555865592c3af45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811265, "uuid": "d98993b9-0f03-492c-8c68-f0b49c8411eb", "value": "12288:dkAJdZJGY+5K/Lo9r7WTB+rP3cx6qLGpkjCCPoxpFHpNgljy:PXZJeK0Z0QMuk8xDvglj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811265, "uuid": "2e0eeaab-de75-4981-9cdd-7f65ce46e332", "value": 854528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811265, "uuid": "6668b352-376f-42ae-9ab6-f8b74e1ece1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811265, "uuid": "44fdf721-2e25-4fe8-926c-1c48dad51aa4", "value": "56e75f28e9c262f902e1f17ac5ae8c3e495ed8a67243fe17fb32be292e54bffb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "648c27c0-1984-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772819183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819183, "uuid": "aa8b83d4-1d34-4583-9890-1633d71e0b50", "comment": "Malware payload", "value": "1cf705a41d936c7d9b20783f041ebdfb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819183, "uuid": "fd464272-2922-4ad8-b808-08bd8d364b35", "comment": "Malware payload", "value": "57143da9ad8f68aec49cd9cc60344dc6b0447f62ef10283a31bcca945462e222", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819183, "uuid": "a8278132-084f-43ae-a87c-fe9e904c4936", "comment": "Malware payload", "value": "dcde4d1b37aba4120f57e3d94047be75e4c587a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819183, "uuid": "b4c40c6b-3d5c-496d-90f8-c37ff4f3a539", "comment": "Malware payload", "value": "b4a7a6368b0fa995bd4e32807bf10dcb46382fc6bd8105bc6b89e06bf27d90fc24e136053468a626c73f193f499daccf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819183, "uuid": "64b4365c-df6a-4829-a2d7-7427693eddf1", "value": "T1A5D2C70AEFA44EABEC7FDC73059A1B0235DD510A15A87F2A6174CC28F66E18746D3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819183, "uuid": "6581fb26-47a5-4c03-b0ec-8108f4c4c22d", "value": "768:g+VcDgFi/06elkki5AZzNLQPXiMxeuzSedMQ:gIcDWi/0Tlkx2ZzuxPzSA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819183, "uuid": "11d9e6e4-85be-4799-9c90-6f37566c9b70", "value": 29016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819183, "uuid": "fbb6f81f-c559-471e-871b-c9a1bae3ffac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819183, "uuid": "32b10e8e-871a-489d-8af8-7b6cc2913fcc", "value": "violetmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1022914-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772809890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809890, "uuid": "402dcd64-670d-44eb-9806-afc03b2e7204", "comment": "Malware payload (AgentTesla)", "value": "abb1a1416593de09d1959cc90481dc82", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809890, "uuid": "c1907111-33fb-4625-953e-bca14f06ffb8", "comment": "Malware payload (AgentTesla)", "value": "575cbafe1e3389a27b800403154594ff11237635bc01bc7989d76ef74ed62d52", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809890, "uuid": "ead65ec5-a5da-415e-b6f5-01f5823b6167", "comment": "Malware payload (AgentTesla)", "value": "3114df7e767b5c8c11f63ecfddb67996934a728a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809890, "uuid": "5d130917-cd13-4b56-83bd-c2af2d8252f5", "comment": "Malware payload (AgentTesla)", "value": "b437fbd00f277308c4a4ad35f2f244b4f183a16e292962d16db62d02d95f731bc0c6e7365e9deeadf108e5c52164a1e3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809890, "uuid": "efe944c5-875a-478a-af0a-1ac42984911e", "value": "T1C135AD1027E84A54F7BA9B345971061CCBF9BC1F9A23D61EED803CE91975B418AF1B32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809890, "uuid": "d1fc17df-ef52-4f0b-87c6-b4178f27b1ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809890, "uuid": "09fe3689-4ee5-4629-a6d6-877dbc85270a", "value": "24576:mz6lLoRymbJ8wgMh4C2t3HdvaHNjMMw80s:BajbOhMhj5D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809890, "uuid": "cef5cb58-8627-4963-b7e8-8cdc4d1c7a75", "value": 1090048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809890, "uuid": "ee7ccf3e-8873-41a7-9695-b4b4d6b4b671", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809890, "uuid": "4251b682-5de7-4b78-8bc7-9c1ed06c8a8c", "value": "575cbafe1e3389a27b800403154594ff11237635bc01bc7989d76ef74ed62d52", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d8ca0f8-196a-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772807897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807897, "uuid": "bc937378-0cfa-4f3a-a29c-c9f55b04b610", "comment": "Malware payload (GCleaner)", "value": "65276c11e7354f547182b6009c0798c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807897, "uuid": "f7149c23-5b31-4c97-9492-3cc72a8511c1", "comment": "Malware payload (GCleaner)", "value": "579754973ff76861cf89740fef0f0547cfa74bc605bcf8ab357f6cae60bc2192", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807897, "uuid": "4c604bcf-aa57-4a4c-86a4-81e123f2515d", "comment": "Malware payload (GCleaner)", "value": "512be83c503cea717913caf8674228057e4c8fcd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807897, "uuid": "8e162063-0bd6-4067-8511-74dc60724a00", "comment": "Malware payload (GCleaner)", "value": "00f67b5a0c681d15bcca6bb312e3115d6a7ee5fad635d296a54de60d713ad25f261bc75451de217efe2053822b9e2498", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807897, "uuid": "7d1218dd-e5a3-4d76-b55c-478cc78bcc05", "value": "T17E56D0E6F1ACC535C1D783FB089B29E6FFE5F620BD60168628A74ACC245704077695E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807897, "uuid": "0ce74eaf-5665-41a1-9b09-a9264f745d56", "value": "e5f32a93ddcf3aa9009cd70911b0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807897, "uuid": "1aea1f15-c240-46bb-8cbb-c86a4aa27732", "value": "98304:K9CexHFONXP41YkopOUcBYZ56uBVxEln+lFNDAsim7JeW2SAQ:KlMNXDF356iVOcnieV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807897, "uuid": "6177771f-0a7d-410f-abe5-43c02dbf4643", "value": 6469632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807897, "uuid": "b4cd80a6-074b-4601-a3d9-350e530906cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807897, "uuid": "999efdc6-0b9e-496b-8c10-a1474f2c2d25", "value": "579754973ff76861cf89740fef0f0547cfa74bc605bcf8ab357f6cae60bc2192", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a69dd1b-1982-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772818388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818388, "uuid": "dc54263c-0143-400d-9ea3-1009c2d8d413", "comment": "Malware payload (Mirai)", "value": "8b3754ee1f2c4d48f639e016f3f22a5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818388, "uuid": "3bc0e310-aa10-4842-95c6-c600e2790667", "comment": "Malware payload (Mirai)", "value": "57f782327e62a5946d10c7be5cc58b4806668bafbdf80ef2324e39100d9f37cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818388, "uuid": "478e806b-8c07-4e20-9220-90d66000c598", "comment": "Malware payload (Mirai)", "value": "8525e2e1eb0f9315b07450f901793f2ffac68dfc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818388, "uuid": "02fa7f1e-8195-4a12-94cf-a9652fd37e65", "comment": "Malware payload (Mirai)", "value": "b5e7ce35b1ca9e7c5b8bfcd0fc11f382155193eddd7ed121b99f18e6d46e8b6d64a20fa6fe40aeb201e469b2a9df8046", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818388, "uuid": "a694dbb9-d184-4fa3-86c7-bef48d666cb5", "value": "T1F5C33A06F58184FCC08AC2341B6FB63AA935F1DD1238F6E76BD0AF127D4AE614E1DA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818388, "uuid": "5bd05897-6783-4764-a269-a29df538dcc2", "value": "3072:pxv986gurREnQI8ysmTn645T1c4n2pPCZzFr0PGvmDxN4zQrPUAackTzSj0:DPgurREnQI8ysmT64J1c4n2pPaFe0ziN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772818388, "uuid": "791b4cc5-9195-4837-837b-2a5da79f81b0", "value": 126304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772818388, "uuid": "5af726a9-efab-4b51-be58-d31d2671c2da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818388, "uuid": "f651e322-8d8a-4183-a4c3-8392679933fa", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fc9edea-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810129, "uuid": "5024d15f-aaf5-4bd9-9094-8d3b20d3716b", "comment": "Malware payload (GCleaner)", "value": "70a17d1f2c775514c95e06239bec2a13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810129, "uuid": "e9f8af8f-368c-4314-9d8c-42929299180c", "comment": "Malware payload (GCleaner)", "value": "581eaf933ee712821990a334b20caf8358eeac5491818bc9b5fc7e075130b5e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810129, "uuid": "b81a6fb3-886c-49e7-99cb-5289c9c51f13", "comment": "Malware payload (GCleaner)", "value": "7f160e58134def47da3679dee0b84f5dcf976aa4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810129, "uuid": "7157eafb-05e4-4dfa-803b-84e7103a99b1", "comment": "Malware payload (GCleaner)", "value": "ab652302c8c3fa00892ca16ef1e31fc87dd20e2ffc8f1cab5713415bb3891d40acd70aa8cb72716d0d114d34292fa984", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810129, "uuid": "5f2e491b-6099-4f9d-be56-c91789ce223e", "value": "T14EF49E21E6A0B437D1725D38DF4B5E559A2BBD80EA2468C72BE41CCBDB3538D34252B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810129, "uuid": "e1b8333f-4dd1-4d70-a58b-48e221672fbf", "value": "c475b6e242f56325f64c2b76233f720b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810129, "uuid": "f64cb138-2cd6-4245-8f93-59efdb256ecc", "value": "12288:reM9gzhW/BsjB7V+bRO88pvnUUJc7qraqG8Dq0:qK3/q7gR8paqG6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810129, "uuid": "e43df862-689b-4754-9519-819cd4a482a4", "value": 784384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810129, "uuid": "18280c04-ff94-4365-900c-a30aafc015ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810129, "uuid": "1b632e37-fddc-4cfc-a1fd-23ba90d260a0", "value": "581eaf933ee712821990a334b20caf8358eeac5491818bc9b5fc7e075130b5e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d56e03d-1969-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807655, "uuid": "0fe1f6d2-df2c-4eaf-912a-a65c0ebae15f", "comment": "Malware payload", "value": "e6e9dbea9516c3aab1bcc21d47917efb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807655, "uuid": "79852424-13cd-4a5d-aef6-358612b779f3", "comment": "Malware payload", "value": "5833916a02b1d28873937098cb46a3c1730b3d1bf5876808dc4e7646a69ef4d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807655, "uuid": "b10fc4cb-074a-4795-8a1f-1191e895321b", "comment": "Malware payload", "value": "1632d9d4970d0d97b829f6a630ef590f392b4766", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807655, "uuid": "80c2ca05-d9cd-4996-addc-8df80e7e6d0c", "comment": "Malware payload", "value": "cc931dff2c4c4f8a576ce4d9b9dee930b7512dc41ae17128b432282272c6da285e98ecfdbd9e90821761260df774ffd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807655, "uuid": "bdacb0aa-d0a2-47a8-a895-d5ae257679ea", "value": "T1C50512A01B15644EE0634C74A9F57776FB98AE56336CC3823AC0B958BD3B3068F653C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807655, "uuid": "f0103e48-193f-427c-98ba-5ddc154701fd", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807655, "uuid": "ec5bc3a1-4e1d-4012-9723-a2b3c94ace6c", "value": "24576:PHO/MdQWsoAvKK2ZWdBz6kqd43jbz1HVkMIwSqLbBYNGC:PHO/uarOWdBGzKb0wSqp9C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807655, "uuid": "66de6ebc-bb3f-4786-8369-48f64fb7326a", "value": 864648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807655, "uuid": "689be342-4686-4752-89d1-ff41307f6c6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807655, "uuid": "2a9bcb94-e173-4861-b1f9-1750942ed3d7", "value": "5833916a02b1d28873937098cb46a3c1730b3d1bf5876808dc4e7646a69ef4d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaa9e1ee-1942-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772791062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772791062, "uuid": "a1539ad8-6896-47c1-af4e-f09da98ff8f8", "comment": "Malware payload (NetSupport)", "value": "e743c389ddf015302914044d35251afe", "object_relation": "md5", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "sonosnewbh-net", "colour": "#0DC82B", "exportable": true, "hide_tag": false }, { "name": "sonosnewfq-com", "colour": "#D8A565", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772791062, "uuid": "3ec9d7e1-d225-419e-b9f4-b5c830aaaab0", "comment": "Malware payload (NetSupport)", "value": "58671391dbd1dcf8819f151ada1cc31aaa3c77fff0a02dccecdf733793c6bf75", "object_relation": "sha256", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "sonosnewbh-net", "colour": "#0DC82B", "exportable": true, "hide_tag": false }, { "name": "sonosnewfq-com", "colour": "#D8A565", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772791062, "uuid": "4fd41e2f-034d-455e-8393-2c12af3801ef", "comment": "Malware payload (NetSupport)", "value": "82c68e8bd9d65ac2623e7ad4c573a3c7c05a14e2", "object_relation": "sha1", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "sonosnewbh-net", "colour": "#0DC82B", "exportable": true, "hide_tag": false }, { "name": "sonosnewfq-com", "colour": "#D8A565", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772791062, "uuid": "98f96975-3cb5-4328-8491-9a953ea265e7", "comment": "Malware payload (NetSupport)", "value": "195c4dc3860b3d81c0419df81eef8a50cbd927c3a3354cea80b7bcfaf740747a4dd4352285adf9f5522a10b492ff0ff1", "object_relation": "sha3-384", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "sonosnewbh-net", "colour": "#0DC82B", "exportable": true, "hide_tag": false }, { "name": "sonosnewfq-com", "colour": "#D8A565", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772791062, "uuid": "25f5c548-4a75-4d9f-9714-a2c155671d28", "value": "T16516339A6CEA1CCA45FCC84A8641E2B4D519E21744DFFCC1AD70E5919EF620CB7273E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772791062, "uuid": "41c4f46a-76df-4200-81ac-94220e07cb77", "value": "98304:9vOmeQn3+daz8qNEiYB0lJtphpZA6lM2I8zXbpO9ofMLeBRf0qHO:9vT/qQrNEiYBStphLA6lM76k9oUSBa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772791062, "uuid": "63691fbf-73e8-4afc-bb32-980bfcc04f24", "value": 4019526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772791062, "uuid": "02d08226-0689-47e3-b6c4-fae2bc5f3457", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772791062, "uuid": "e2625bcd-8ac9-4877-85ca-7db604eabf2c", "value": "58671391dbd1dcf8819f151ada1cc31aaa3c77fff0a02dccecdf733793c6bf75.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f88b3b96-1971-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772811271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811271, "uuid": "3ba3be52-7ca1-4210-b120-aee2ed73f7e4", "comment": "Malware payload (GCleaner)", "value": "2d0759cd0de2e232620c546d72daa2c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811271, "uuid": "a35174a2-1566-4c09-84aa-1aa300a7d81c", "comment": "Malware payload (GCleaner)", "value": "586febacf5342b1f3cf15099166a0eb9702154b8f46a504a0ddf2f28808da83c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811271, "uuid": "7bae5a90-5e3b-4bb3-9655-70c0af173d5b", "comment": "Malware payload (GCleaner)", "value": "8b3db75d0c2d0bf0b6386f92b85c4d298db3b889", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811271, "uuid": "a2a5d51e-0f28-4be7-beda-2ed9c5c49506", "comment": "Malware payload (GCleaner)", "value": "f3012322fb89c89b1dc771b10405e1fc57e3ac8c3407684f4c839cfc68aa2bc9f019803df424f7e9a4f0d053aeb4225e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811271, "uuid": "60b2ef85-1867-401b-a8e9-8e9bfc2e5227", "value": "T1E9F49E22B6D08433EF625938FD1B56B598E5BE912D2C58066BE85DCC9F37381382528F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811271, "uuid": "ded7df82-3a8c-4c23-aafa-29ffc853dbb6", "value": "ce7a1d07b14b49824555865592c3af45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811271, "uuid": "a4ffb489-5c50-412c-801c-5596098c6714", "value": "12288:8kAJdZJGY+5K/Lo9r7WTB+rPvXuicO3RIfENCAUh4b7PPLXf/Btg0:GXZJeK0Z0w+icsRHhcig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811271, "uuid": "5884a94f-ccdc-4be7-b042-b78c3ee6f49e", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811271, "uuid": "ea32085a-4c10-4668-87ef-b31760afae6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811271, "uuid": "b640d3c6-4c82-43c8-a0e1-9e5f62c2a4d2", "value": "586febacf5342b1f3cf15099166a0eb9702154b8f46a504a0ddf2f28808da83c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b1c8c71-196a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807947, "uuid": "8ba4b08f-0186-401e-9030-f7ee360ca20d", "comment": "Malware payload", "value": "6bb1084d9345a56425518d27bf2379d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807947, "uuid": "67a68f0d-0ae1-4943-abc8-98394f1ce042", "comment": "Malware payload", "value": "58d1598db1444d858f0bb38b9d9cb7f34b6067792c6de99dc1b61153921ef277", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807947, "uuid": "7e8f6e26-6080-4692-aa6e-b9283fa8ad95", "comment": "Malware payload", "value": "4d9ad334dc48ccd71a26c4fd8338ba20903a937d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807947, "uuid": "fb0233ab-9f9c-45f3-aded-daf082e0bd8d", "comment": "Malware payload", "value": "0b5aebff09075c69282b1c3a1c837ccaffb761396e21db0aa190f4adc08661886ade1394eb8e6314741571d24b041a07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807947, "uuid": "41f8f14a-a0a5-416a-af4e-6123ecda6b71", "value": "T1E736EABB8E384C89C6D7F1F69381D6700DE6AE67A4EAE0FA51D109401F437106F61EB9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807947, "uuid": "198d205f-e318-4a0f-9bbf-1fefc575423b", "value": "d512f74fd5e290f01bfc48029b75487a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807947, "uuid": "a30a293d-1d68-4704-9103-f9cbf3c6033b", "value": "24576:uAWrm6oG2WxgeP7Gbyhl2RYzPG9lz/VBNMVPKlBDoaMfMwTVqr/10RU+S0mhAf0E:HWawV5T5l2RQClz/VHMVG4R3IBo8xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807947, "uuid": "f8a841f0-7eff-41cd-9e63-34fb45a6ac4a", "value": 4965888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807947, "uuid": "62a619f5-8dfd-4735-b50c-51917d45dfd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807947, "uuid": "0e15d520-6263-4e5b-897e-3647d81aaecb", "value": "58d1598db1444d858f0bb38b9d9cb7f34b6067792c6de99dc1b61153921ef277", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57355942-1904-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772764185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764185, "uuid": "6a2f9c12-ad9c-4828-b302-ccfb4fce1a60", "comment": "Malware payload (Mirai)", "value": "10e6300783cac6a7fbbb1cb4e32f16da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764185, "uuid": "a88467a6-b8a1-43ab-ac00-f263c1600353", "comment": "Malware payload (Mirai)", "value": "58fbacdd6055f8f1672d64ec83dba0b46efd2acf4da846cf7fed28fd15042f96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764185, "uuid": "f74c8d5c-b85c-4767-b045-85650b64802d", "comment": "Malware payload (Mirai)", "value": "3185c4e3b1ee47527dbc52977b4f9b56241147a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764185, "uuid": "deb6852c-db70-45e9-aad1-ef9a67e31940", "comment": "Malware payload (Mirai)", "value": "6d6c80a24a3e960b4b638d031de919185680d6eddfa8a69f83a25ba7f133157ce171e4156041f7b0d316f20a1cac8ae9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772764185, "uuid": "f6624f06-2d94-4619-9497-156dd0677b4e", "value": "T15BD33B07B6D180FDC4D9C2744F9AF13AED33B1695238B16B2BC4AA171E89E309F5D614", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772764185, "uuid": "b17cab68-d963-4de0-9c07-1d2bd3d6409b", "value": "3072:+Kzk/bIs2eUkmx9nBYZPRZ9tIX5gDCCuD3pIE9fu8vB:+Kzk/bIs2eUkmfny6lZM8J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772764185, "uuid": "ebd56fda-a942-42f0-833d-a5f6c71420f5", "value": 141288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772764185, "uuid": "f63f8eb4-391c-45e1-9d0a-77809eade20e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772764185, "uuid": "57342232-3a05-4e47-a27e-386f123b82c1", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5757d573-1968-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772807135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807135, "uuid": "51342ecb-7097-4354-afae-a7cb7b188bb7", "comment": "Malware payload (Mirai)", "value": "02bf2ec7042c098a5a586b75e2a7363a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807135, "uuid": "3c5ac72f-b412-4f66-8143-1e1968ba10b6", "comment": "Malware payload (Mirai)", "value": "59769d49d37eabb1773f6bb1e98f870d821a27f1abe1fdcbb263cbc68e6ab435", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807135, "uuid": "78691fce-d354-45c2-82fe-de5c414af170", "comment": "Malware payload (Mirai)", "value": "506b8bc105f5525b377c81e37b708236b3479313", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807135, "uuid": "cb4907f0-a8ee-4058-acd0-10b39098a88c", "comment": "Malware payload (Mirai)", "value": "614da794edb9d9af1824aab1468d0e24e757d684b6e4153fd20609f4e9d2a46fe152431ff1df9bc2252ac4cc3e21b1d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807135, "uuid": "7e5f28b3-1a6c-4dff-9a58-a758322e6f8e", "value": "T1FAF3F742771D3E67D1D7EEF026F7E3F043EBA8011B936540F19EAE845276AB12409B89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807135, "uuid": "0f5d365c-ef87-4744-b168-029b791fb5fa", "value": "3072:+Z8xRSE/rVnKK4f1qw86uSxty6vd0vL+i41pl2mn3F8+:W8xRX/xKK21b86uSxty6vd0vL+i41pl7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807135, "uuid": "da0814ca-c582-4daf-9cfd-8bf20f000e0b", "value": 172646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807135, "uuid": "443827c0-242b-4db5-8861-c6f7516f9169", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807135, "uuid": "51e5b1d6-fc55-4ccf-957e-c3e4f2e63aac", "value": "a-r.m-7.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45441d77-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772810541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810541, "uuid": "fd546a2f-30da-4f7c-9c13-100eb8a4e784", "comment": "Malware payload (AgentTesla)", "value": "5b6dda54b85413742ecafb03839e52f0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810541, "uuid": "b84b9a1c-ce79-4a90-9c60-075d7003d510", "comment": "Malware payload (AgentTesla)", "value": "59c9635334a28526caf067643b3a5001ba392f025e3f651e75c0bb2bd85687ff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810541, "uuid": "d5567f21-1f0d-4679-9a8d-d3df633a1f4c", "comment": "Malware payload (AgentTesla)", "value": "8153be7348feaf3f1639b1c2402a2d9bf2f65da3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810541, "uuid": "7b2ea1b0-3e85-4717-8610-e7068c1a7801", "comment": "Malware payload (AgentTesla)", "value": "af1848a33660bd83a201371f92b35105e30a164461e4bd50fc17da6ed5f0fa4f49a0133fe81d7eb29703afe8608ee6a1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810541, "uuid": "eb836438-131c-43b8-aa88-6da1c1ee453d", "value": "T11715BE1123E85A69F5FFAB3898710528CBF5BC57DA32DA5D2A4940DE1931F40CE62B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810541, "uuid": "04371fb8-bfa6-4a70-9ff0-32d407d00703", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810541, "uuid": "c999e7fc-da1a-44bb-acdc-612dabd14421", "value": "12288:Yrn1VzXAdpr+8Esd4sEwRA8DjDx/l+POuHizHhVMQDBYmGSjyrNLR:Knb8dZ+8EsdfRA8DvaP3HizHIdnSjy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810541, "uuid": "e546e435-575a-4942-94d6-aee16c97d1da", "value": 922624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810541, "uuid": "76300f8e-3991-48b3-8dc4-f9858115f5b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810541, "uuid": "8320b891-175d-498a-98b6-e42f8baaca8b", "value": "59c9635334a28526caf067643b3a5001ba392f025e3f651e75c0bb2bd85687ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbe51ded-1983-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819008, "uuid": "0e6274ec-3018-481c-bea6-04ba3f4cd32b", "comment": "Malware payload (Mirai)", "value": "1608227629e15371c957db861068b292", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819008, "uuid": "0374baf0-97f3-40b5-b3e9-a56d09f70937", "comment": "Malware payload (Mirai)", "value": "5a07a6eeeef206e25a96c78aae7d6dc3a419cdee2202c955617506645d0384b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819008, "uuid": "61c7015f-6a2b-40b9-ac8f-f26c71ed44f1", "comment": "Malware payload (Mirai)", "value": "4062dc0dadabdf6b193ae04b385904f73c1a8f6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819008, "uuid": "3145991a-a00b-4336-b8c9-c084786e7c9d", "comment": "Malware payload (Mirai)", "value": "e986ff6d0d2f2b9c559ecc056ce53871a794f0ca0059790ae391970768d3473f406dd346e9f1c0537ee518c21abf1fcf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819008, "uuid": "23a2d486-f345-4209-ab58-57f447bbe0bf", "value": "T1AB435E92F892456AC6C117BA771B978A33A253A5C2CF7313CD080B6177C9A4F4E77E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819008, "uuid": "f0f439df-6098-4732-b4aa-2ed2b39dd4f4", "value": "768:TWcltKWWiXZ2/x7N8OMXLPtdjYocDCW7Y4CEIMfl2Fr0nMz:TBltFXYSOqPtdNcDCW7OWa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819008, "uuid": "00994047-9f87-4e3c-8ea5-81c9026bcd87", "value": 55452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819008, "uuid": "48a6f430-b64d-4900-a5f7-4796027f930e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819008, "uuid": "5c0a1bfa-bad2-4774-b60d-41fe5fbbad7d", "value": "jawirbot.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84e3deec-196f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810218, "uuid": "2f2b83f7-c8d0-403e-8074-74a0f258bd00", "comment": "Malware payload", "value": "430d34adb039c1f4a1574c25a31fbbad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810218, "uuid": "7aa2a6e9-c2ef-46a1-bd0d-150759b3d2ba", "comment": "Malware payload", "value": "5a9bec59f6368482d789e8e369b347a49d42e397133e1a90ebec71b16a58f4f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810218, "uuid": "62b57d27-504d-45f9-b92d-4bcbb86b528a", "comment": "Malware payload", "value": "476a65eba32b00fb76fcea9764e76525ce57e1c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810218, "uuid": "c08643ac-0e51-4541-8b36-8b60a7bf762d", "comment": "Malware payload", "value": "f977a347674c260b3250a2da7a2e934925014c0881334c371bdb0836b2eb0ab02e6f7d7354ef9180df36f87cf1bc6fbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810218, "uuid": "54c3f01d-5981-4447-a7ec-cc8a8e074183", "value": "T137652318124EED03D95B0BB05D71F2B427662EDDE4A2C2168EE5BEDF742A3F02D54362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810218, "uuid": "21405922-efad-47c6-a321-5a5c4e6ac54b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810218, "uuid": "5f5396c8-1d87-4823-9f46-21c290fb91f1", "value": "24576:J/onoxG5wMrGk4lNyxgUTckZ+Eh2MH9s0iRIS9e6gaggPwkrQ5VKK6F0+AxI89pM:J/pVk4fy/c++ilxi/98OxE36YJajWzXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810218, "uuid": "86fb6545-d51d-4c47-83b5-5af9fb0b7eff", "value": 1533440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810218, "uuid": "f7907d17-1ee6-40c3-99f5-17bc98485a82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810218, "uuid": "6078d103-4657-4306-ae27-21f111117439", "value": "5a9bec59f6368482d789e8e369b347a49d42e397133e1a90ebec71b16a58f4f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feec22a5-197a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772815147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815147, "uuid": "469f4fd8-071c-47d9-9441-9018b8287f31", "comment": "Malware payload (Mirai)", "value": "b469fc787accff44b058a90cbf69fe51", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815147, "uuid": "9ee5987b-5ca5-4a7d-9cdc-cfee6f31004c", "comment": "Malware payload (Mirai)", "value": "5aaf6f8c6459aecb6ec08b8e88e0f7f143dcff69e200e71b58e18e0535c77307", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815147, "uuid": "3cabb0eb-bb43-4e50-ad71-a9e4fe3e9d2b", "comment": "Malware payload (Mirai)", "value": "aac525ca543850d4ee8a48ff4c0ca4eeb7d314dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815147, "uuid": "5eb4d5a0-69fe-46af-b367-6236e8e6802c", "comment": "Malware payload (Mirai)", "value": "9bedabe7602bda57e65039b3c0d58748cbd5c11046faa91015762b9b58da5be9dd1433e338b43753f89f0895c06eee13", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815147, "uuid": "5ae9eb16-db97-42df-a044-e33872b51616", "value": "T1D8D32A05B30C0A47D1A32EB43A3F67E193EF9AC121E4F644255F9B8AA1B1D335586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815147, "uuid": "6aaf3174-d82f-4207-adfe-91b106dd7d2a", "value": "1536:FetnOCu/HhjAgESKxfitGtegk2eZ/wTLlYkJvAxhv7suWvnqvcOWvD:XpBjHESKxNtyjwPlWx/gD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772815147, "uuid": "01c3b2a5-679d-4ce7-a5a2-209606a73c45", "value": 138132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772815147, "uuid": "0ed6c667-6ed5-4dee-8f11-933c6c1a24b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815147, "uuid": "1428c6d2-f8c1-468a-ba17-b12d501e6ad2", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f85b7f36-1954-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772798815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798815, "uuid": "2ee0db55-46ee-43b5-a7e1-445b9a252c22", "comment": "Malware payload (Vidar)", "value": "6fdff05a839d16331d09803cf2bad974", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798815, "uuid": "af570287-3f80-4cc1-ae3b-8ed58a628549", "comment": "Malware payload (Vidar)", "value": "5ac53e312732078514a827b41e1b2cbc6e7161970f9d9ad91f382eede969ac39", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798815, "uuid": "f20e75ad-72c3-4def-a7e6-8aba52e86d8e", "comment": "Malware payload (Vidar)", "value": "60b01f2c3aa3ae76d87a6331fb1c48ec75f6905f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798815, "uuid": "80dbd6ca-e79e-4b9b-b469-aae3c031257f", "comment": "Malware payload (Vidar)", "value": "7e3d81d7e54e9bbefde3fcd1203e0d9b2d5df9462af95ae87ef8120e0c611c00c3ce84e6f6d1ca88f638bc44308f2f07", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798815, "uuid": "f386702f-e386-41e8-9f4f-bc9ccbe06943", "value": "T161241237CB1C8765F49A6031D4B2028B5BADDC7385B56A48880EABD7A91C7E440B376E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798815, "uuid": "7a22708d-0cee-46f1-a99a-5d75f962d8da", "value": "ee53c10aff1d01eafea53328179e33a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798815, "uuid": "2d3b615b-383a-459f-b137-244660e9e424", "value": "3072:F/TtjgJ4dnyJIheU9acZI/WLhevbfm3vIRJbs13b4m3z+YF+I3h0CPsnEF0t2m:lTxg+5WcBb8bfm3MJbIkm3z+YMI6ClQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772798815, "uuid": "cadbac87-12be-42e4-b629-0dfd527e41ed", "value": 219648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772798815, "uuid": "ed03c2b8-0df1-487f-a901-b3874ba40d5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798815, "uuid": "2cc6673b-818e-473c-a031-3314d3c4e948", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "638228e0-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772810162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810162, "uuid": "5cf8bdf2-7c79-4773-bf83-a4c3427e46b0", "comment": "Malware payload (Formbook)", "value": "ec533a32d31ec8bd1f1f6273c0882d56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810162, "uuid": "4285a617-eeca-4ad5-aff5-78b912da6a50", "comment": "Malware payload (Formbook)", "value": "5aed2949335f10e3dfe86b753c3525ec2ea22d24afe6e12b3220f1ce81b955db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810162, "uuid": "86ca89fc-fb87-4ab0-8d67-1273337aab5b", "comment": "Malware payload (Formbook)", "value": "4dcb129e46fcbf710501d0e4f134ac17642ce6fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810162, "uuid": "d7850565-8ac3-43c5-a177-330a942afd10", "comment": "Malware payload (Formbook)", "value": "bb417c2f73a57a307551b4e7511e708fa54f302c89ae31922a38677db358d9f65a48f089ef37539dc0813801ad2dd202", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810162, "uuid": "49463c5a-78de-4c70-aa74-9ca8a3eef5ed", "value": "T17645BE0273C1C062FFAB92734B56F6115BBC79260123A62F13981DB9BE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810162, "uuid": "a39d7d6f-018f-4ada-8d30-d7e3f9b4b199", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810162, "uuid": "e4f39424-1cd9-49b1-9acd-02393147df89", "value": "24576:C5EmXFtKaL4/oFe5T9yyXYfP1ijXdaT/vd5WpMLszIvL:CPVt/LZeJbInQRaT/vd50MYzI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810162, "uuid": "5b239bd9-aca8-4c94-9936-737496e548ae", "value": 1182208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810162, "uuid": "8c2e329f-7663-43b8-a975-0acdae9535b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810162, "uuid": "666d28ca-e98e-4478-805f-1db8198dc71a", "value": "5aed2949335f10e3dfe86b753c3525ec2ea22d24afe6e12b3220f1ce81b955db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b0a6c26-1951-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772797236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797236, "uuid": "e7811f10-2401-4093-96e4-1d38366546b0", "comment": "Malware payload", "value": "e760898856e6913a5afc4dd8fb3c5678", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797236, "uuid": "3b578396-4de0-4a19-affd-35230f01a05a", "comment": "Malware payload", "value": "5b081ebb7a5e17b31d750cccec654f0b075a7a405c51baf3a2329f54549b05c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797236, "uuid": "2f6a51c7-7e4b-4253-9fdc-3a271108d636", "comment": "Malware payload", "value": "d58a6b5f0d21009452c81fa94e532b4ee1714329", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797236, "uuid": "3fc4a980-ce90-4ab7-8583-4b9c8fe3d6ff", "comment": "Malware payload", "value": "9bcd67c70981850405598003d1be6c2f523adfb80bab2a2af00bb992a7cbc30720d8b6db794009029c203c49b34f9f78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797236, "uuid": "74d84d77-47e5-4dd2-9930-ed2cab83b1a3", "value": "T152D42BBDAC60E376F60CD0BAE286D3538F2139011236AAA319BD97241245473DB577FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797236, "uuid": "5f0889b6-3a8f-4b5d-9351-3113c138179e", "value": "e6a9ea00f059c8f148d2aaa9d51e3613", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797236, "uuid": "0fdf7d08-ec06-4a14-b092-37c2181901c9", "value": "12288:AEyurkSSu5EkPm8b7k4ao/CXjp4JgtU8F6CmSYw2g:AETrk5u5EkPb7jgjp4JS36UYw2g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772797236, "uuid": "17933246-7b2c-4422-b700-c4e368111324", "value": 629760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772797236, "uuid": "2156a922-d8f2-43cf-8e3d-2e9ad076b801", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797236, "uuid": "28f06cdd-067b-40df-bb7f-fc4c5f872971", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55b46047-192e-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1772782222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782222, "uuid": "456f477b-98a2-4c17-af64-1a27b3e3dd1a", "comment": "Malware payload (Gafgyt)", "value": "22a6c15ca9fc85e5f9155be3cba96ee3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782222, "uuid": "6b908363-f1fa-4797-8597-21d6926e267e", "comment": "Malware payload (Gafgyt)", "value": "5bdc31fa48b8e5c8ab2f2c603af63f454b4190dd73e0dc3c8fd65c7746fa29b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782222, "uuid": "8896119f-88fe-443b-8b90-6f5ded9189cd", "comment": "Malware payload (Gafgyt)", "value": "c03b7a1ac0d0add971840d553e8f228e0ab3cb45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782222, "uuid": "547907bb-02f6-4e0b-b412-c30c394f4ac9", "comment": "Malware payload (Gafgyt)", "value": "1204bb344e625874ec32a17a7fdd0fa406c5389d1955487ab766c35febab7e4bf947bb916cc1d5273b5f967ca9f69136", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782222, "uuid": "07c1f1d9-bb31-4fce-8ff4-060fe311af76", "value": "T188E34B0AB4C0D8FEC499C1744FAAF5369971F4195234F5AF27D8AF622E4EE201F5EA10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782222, "uuid": "8edfeb61-f93c-44fb-af6f-be3e9d79688b", "value": "3072:J0hKs/9ydD3XNzGYYTBCG+iaSPXra9ECxazy+oH1:uhbF+HYbN/r5oV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772782222, "uuid": "84eb589d-d50b-40ac-8ca4-095d23075592", "value": 155816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772782222, "uuid": "e09a4830-4a12-4458-b6b9-1405005dca66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782222, "uuid": "240a1e5f-edab-444b-a4c4-82c6564f0c39", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b72ec7cc-196a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808155, "uuid": "e61cd456-79f0-4fd1-b0de-1d6b26c03f6a", "comment": "Malware payload", "value": "da0793b39fee7504ab08840780fa2f0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808155, "uuid": "1d2233a0-fc22-4545-b0ef-8028255ad87f", "comment": "Malware payload", "value": "5bf369e08dd40e79be2e3f04095f2dfde751d92ad5212ce91c3e58ec02011cc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808155, "uuid": "d0916c66-0128-4231-b4c1-ff6d077344ac", "comment": "Malware payload", "value": "d355bd8c45545e4e9c0938e680abf6311b91076a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808155, "uuid": "25ee377f-990f-4b68-8369-c86d80d436ce", "comment": "Malware payload", "value": "195cf553da0ecb96a660648450826d0f18f50f060bf39367303b5804279911b718f74cfb230a99963cd1ca33b069c113", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808155, "uuid": "13508f06-fda9-4adc-8deb-3594659e727b", "value": "T16F35026467AFCE13C6A51B3380E1D23003B59F56A513D207AEEA3ED77E57BA71984203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808155, "uuid": "9fde05aa-0a92-4a75-8498-c79d9b79eaa6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808155, "uuid": "4ce9c607-74a2-4f9a-8611-7f5e048abffe", "value": "24576:qPkVzl/OdHu5f/5NHUIN0MxJtfndV0bfgR8t2ANpkguQlVict:skVR/hLHUe0MxJtPdKFdvuWQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808155, "uuid": "18404cfd-5d98-4708-9ca1-d0dd79e9b2fb", "value": 1111552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808155, "uuid": "8d0c82cd-3c44-4a98-b367-230e56e1d13d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808155, "uuid": "e5f14d3a-89f9-4568-9ffd-48feaaceb237", "value": "5bf369e08dd40e79be2e3f04095f2dfde751d92ad5212ce91c3e58ec02011cc5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "281669dc-193e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772789017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789017, "uuid": "d33509b1-73cb-4b24-b3a4-a273b6aba3f0", "comment": "Malware payload (Mirai)", "value": "f915b0f661de536ee19cbb959fb580c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789017, "uuid": "84115a64-eb12-452f-aaf2-1ae57c0b9ef0", "comment": "Malware payload (Mirai)", "value": "5c02327c0fbe632e5ce99eafc2170c9878af1b92277aa9f272db66d8acd9771a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789017, "uuid": "e4b9b5e0-2a93-4fe7-92ba-fe824674e8d9", "comment": "Malware payload (Mirai)", "value": "4017d3975a1417d27839dd2dfe0813ae957e4f82", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789017, "uuid": "90e1cc97-1c7b-4146-97c7-7d4d23f2311b", "comment": "Malware payload (Mirai)", "value": "daa266ea0c95084a776a6e39641f075520a3e49a0b7b7dd4320955e17ea3c76ab81901e1494757b6bff053c7b1d71c28", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789017, "uuid": "09f64e29-9fe3-4f2d-8943-07409690e354", "value": "T1CA230992FD928AAAC5D067B6B72F52893363A3A5C2CF3353D8184B1027C661F4D67F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789017, "uuid": "9efd95eb-10ae-4eea-8bc8-9e91b8a1d262", "value": "768:FrcoXKnc4VsC0jaH1pF+6/5d3mnbBFR1ffXvgKLNoY/MXRNeyF3gnZzX:FrD4Vd0jaVxd3mndFR1fHgKL95Ey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772789017, "uuid": "eb488ff8-8f2b-49e2-aa08-daf70f893605", "value": 47704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772789017, "uuid": "13572144-32ec-4f66-8ce8-399a34348873", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789017, "uuid": "4796eb00-90e3-40be-9211-b68191a20d1b", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ad026da-195c-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1772801987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801987, "uuid": "f3b1f39f-91bc-4c7b-8bfb-ca58bd384d78", "comment": "Malware payload (RustyStealer)", "value": "cea3656786c4db1b54d19110381145cb", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801987, "uuid": "2a0d2c1c-3333-4c46-a1e0-093de8854b6c", "comment": "Malware payload (RustyStealer)", "value": "5c839cefd688071e99846649af0f11fc080b3d5923df5ce0c229c4c96d7acb3f", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801987, "uuid": "c6d7b7f1-1c7f-4917-9687-61b8e8c2af9e", "comment": "Malware payload (RustyStealer)", "value": "1322df32d57dadfae0bcd4f9514ba19b761aff2b", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801987, "uuid": "b9a5d58c-6dfc-4720-8eb5-535f7490eebc", "comment": "Malware payload (RustyStealer)", "value": "5b05562e512bc2c8a2c1d979bcb08c9e8ce3e9109722f7b47f97b3414d918754f3ebc0c832b80ba238f21f0d00e5d901", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801987, "uuid": "4d90bf0e-3046-40cf-a7a0-f23b3b6ec4fe", "value": "T1E567332C60DB601985A7673C597F8B3B83FE19D6EEF848F7C6090947B0B219B3D46168", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801987, "uuid": "67c8ec94-cc60-4a14-8a61-824561adbe02", "value": "786432:YdaPlxnjYopdHc5jrZkxsJ0/iw+JOmXwDw:Yd6jYyHcJmKCaR0mXwDw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772801987, "uuid": "3d8a4d0c-a66a-4719-b968-e955628611a0", "value": 31603664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772801987, "uuid": "4c1c687c-bb32-41b3-8121-baf70ef55dc3", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801987, "uuid": "525413a3-6a26-4633-bd8f-b7e06f215f52", "value": "KeitaroCheats.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8595b7e5-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772809360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809360, "uuid": "162c6de4-7eb3-4a17-8a8d-68ce3828359c", "comment": "Malware payload (GCleaner)", "value": "82082efb24bd7e50f92bcabc9c7d0d5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809360, "uuid": "0ed2da28-4cd3-4019-9a1b-28283b13e6cb", "comment": "Malware payload (GCleaner)", "value": "5c950334e9f991442e8b2d750204d32606a7e81d768de67cd48045b09eb0b07e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809360, "uuid": "5f39b54d-984d-4b76-8a83-689e67fc1b3c", "comment": "Malware payload (GCleaner)", "value": "d78e76b10de4eb155d0f8058784cb33378eb58f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809360, "uuid": "41d38a1b-8fe9-4863-92f1-9177fc2d4fd8", "comment": "Malware payload (GCleaner)", "value": "fde18f71e3d1fd81358a2941c3599ccc88248856b715b0c456bee407558645fe12a3434468a9695f40771d73c22aa6ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809360, "uuid": "ab80632a-2600-476e-b071-b783439b6fa3", "value": "T17E36F1B4B09E44B9E0EA0C754E438EBDD525AEE6CC2E6439B6FB1BCC9F117521CC5806", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809360, "uuid": "d6c13658-f21a-4d41-b72a-fc5611bec3d6", "value": "345624d13ffc2b7f296b9d2972b1c0a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809360, "uuid": "62e77b3e-5fad-44d3-ba07-5f253062f629", "value": "98304:BiZGok1cmdHjhsIrAn+blgY2VW7RchUL+Xqytr:B191cmdPg+ZLSzXq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809360, "uuid": "1cd701d0-c60d-4756-8d3f-3bd9332c8a42", "value": 5302784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809360, "uuid": "bd1d0d8a-757e-48ec-9aca-7c264dae71e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809360, "uuid": "3e59a92c-1601-4438-af56-fc6891b15b93", "value": "5c950334e9f991442e8b2d750204d32606a7e81d768de67cd48045b09eb0b07e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "986d07f8-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1772808962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808962, "uuid": "5ccab87f-2662-4180-84bb-64309fd27805", "comment": "Malware payload (DarkTortilla)", "value": "0e635800cff06a9682866dea869bffe7", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808962, "uuid": "b640c036-b5e1-4117-a94f-a7adf52ac53b", "comment": "Malware payload (DarkTortilla)", "value": "5c9d3ace3f25c3decb1ef93b612b4b52732ad54c9531b9eaf1b5666b31c5ba47", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808962, "uuid": "7e1b474c-a432-4258-9a8e-6de1c76c3934", "comment": "Malware payload (DarkTortilla)", "value": "58518f3add2d54b02209bff7c73e74cf3cdb9ebb", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808962, "uuid": "6d63ff64-cbf2-4956-a99a-71c67710e4f0", "comment": "Malware payload (DarkTortilla)", "value": "a2184abf1f1aa67d39453d3ff84d85db67c2a6f50b76e2113450301e335c5abb4f0987b9744d60c6f792603ec0fe0513", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808962, "uuid": "a2ac12da-c9b4-44e8-9521-c1f293fa4306", "value": "T145F4F1325E426A24D9B90FB9C066109937F0C847625AEB7E6FFC00F4ADB3B49CD27561", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808962, "uuid": "0758acc6-1317-4d26-965b-ead45f589fd2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808962, "uuid": "e5daeecc-1fb2-45d1-861b-a5e05a4ee9d0", "value": "12288:T2CovtrGszIMjy1j89CFnLT/N0HPNI0iAxxrKXBxoo1C7eYzc1g8wbKJblNB1:MvtQhpLT/4PPH7caoc7ewc1gLKJblNB1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808962, "uuid": "37c0d759-b776-44d5-be29-017ac91ebb5c", "value": 775680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808962, "uuid": "131ea72d-e170-4c4b-bf0e-360f6ec625a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808962, "uuid": "2412411f-1762-47cd-bd4a-681af3f94e1c", "value": "5c9d3ace3f25c3decb1ef93b612b4b52732ad54c9531b9eaf1b5666b31c5ba47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd166a02-1972-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811601, "uuid": "43e9f031-3b4a-432b-aa3e-0327aadd8c20", "comment": "Malware payload", "value": "b5ffb48475d4bb5cfaaaba446546dd1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811601, "uuid": "1a2e92da-5b0a-4e4c-be26-fa76d65b1624", "comment": "Malware payload", "value": "5cbb8eb4846c4a900a1843a047d4fb07359be8a7d18a668aca2db0dc693d46a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811601, "uuid": "e1acbf09-460a-49b5-8a07-7406932cae6b", "comment": "Malware payload", "value": "94c69a3416896c52e742a5ea940e2ece8fba97e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811601, "uuid": "2d91dc1d-e3da-4bff-bc78-3906d17b82cd", "comment": "Malware payload", "value": "0da9511b9fe584c3887e4e2badb5b60d17e4b621d269c98986a8da37c1f6ddda1a9782f6ff38fe172efbe9a2ff1313be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811601, "uuid": "938a9170-6221-4f82-9fbb-33afb8afc5aa", "value": "T1ECF42301A9C0EDA0D554A731C8338D64823DB831DD1A666AC77EE65EB8303C2FE9779D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811601, "uuid": "5922b460-877a-4d63-ad25-89ff76c18e41", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811601, "uuid": "ef9df5bc-b85b-46c2-b29a-1ad30f314909", "value": "12288:1z7hU5I5yuNHIgzSFKxWltRohBfSTso93UXWknqHjiYpXkMDZC+7VTWQ2fvQub:1f+iN57Gtene3UBn54UMVC+Z4fTb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811601, "uuid": "445db719-9337-44a5-9567-1eae86e128e6", "value": 743936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811601, "uuid": "13f30cce-c546-4f00-a00a-0f40568b0d70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811601, "uuid": "fedc48e4-37c4-4940-baca-515811b52446", "value": "5cbb8eb4846c4a900a1843a047d4fb07359be8a7d18a668aca2db0dc693d46a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36fb6e71-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810517, "uuid": "4fa65223-c5ab-4c06-8bc9-0b28e03d8893", "comment": "Malware payload (GCleaner)", "value": "6f82b45fc00236c5b88edbc3803a8f42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810517, "uuid": "7bbe63e7-e550-4402-acc4-31501066541a", "comment": "Malware payload (GCleaner)", "value": "5ce75fc92e535c035ec90cb57dbb1286a0387fe3b6560bb31946097d05ce3177", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810517, "uuid": "f373abc9-cbf1-425c-87b7-d3233db5a65c", "comment": "Malware payload (GCleaner)", "value": "6bf4cdfbe5596eee93e2509081603f93ac654f15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810517, "uuid": "30515b5b-1e46-480d-9f2d-18d73d7ffe14", "comment": "Malware payload (GCleaner)", "value": "8b6ee8939f9cb6031aaa74c35c65d4fe8e9fb530e555587b071ee52c8ccb8ea5571d8ebd7af30bbc0bedcc854a14fdb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810517, "uuid": "23999d15-25a2-4b5c-b5f8-503fe325fea7", "value": "T16205AF32E6D0B433D1237A7CEDD7D6549B2ABE902F24584D6AD81FCD8B3D7822419293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810517, "uuid": "2fd986c0-ef71-4ef7-bffe-048c0e3fb096", "value": "ca01ec09235c3305d2c87228ffd6db40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810517, "uuid": "0e99ddb8-ee78-409e-9c38-0661d513507b", "value": "12288:glOUK2LDqP1ft//fwykZznp1m+fl0gPnkBRb6nKwgMJPVln:hR2A1ft//f98n/bn2eKwgMJdl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810517, "uuid": "2b22299c-935d-4f0b-a0f0-f0b3282159b6", "value": 801792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810517, "uuid": "9fe244ea-46bd-41f5-9648-f63b2a2a5c2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810517, "uuid": "6ff0f050-95b5-4004-ad0c-9a3adfab39db", "value": "5ce75fc92e535c035ec90cb57dbb1286a0387fe3b6560bb31946097d05ce3177", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44dea38e-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810970, "uuid": "ecc97879-6cec-4c2a-b50d-9b623f312a3c", "comment": "Malware payload", "value": "a35ed494c4a9122d7d5964b8cc1d4183", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810970, "uuid": "6df50767-8d74-4421-a7ba-04bf3e94163d", "comment": "Malware payload", "value": "5cf5afabaeeebbbe8b755bcdf16bb40421974a79c4f9bdd04e7d116fe3085595", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810970, "uuid": "89e408f6-fb91-46ee-8b8f-ee855b2c4741", "comment": "Malware payload", "value": "231adae7770ae5c1da21f09455edc4afa9dacdf0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810970, "uuid": "5a0011f6-1af3-4872-a7fb-4e728ee6952c", "comment": "Malware payload", "value": "b6f006a15b6a638cc2aed866d38ca700ec87b27c943faeabea8cdddfe7f3119aede18b19002340820f64273a46ce265d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810970, "uuid": "c38c9348-2dc7-466b-b66c-b81cbb9f1061", "value": "T17E0501586A26C803C5A9173685F2F6B427B84EDAE502E3175FDDBFDBBA13F650C40242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810970, "uuid": "b859481b-1bb8-4fcd-93ec-ec6f7f9ce0b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810970, "uuid": "aee3bcd1-7bcf-420f-b2f7-2759a25effea", "value": "24576:7jQdkqo2f0GoZpXljixKy5U8US36i4tB:7jA4rl+w+YSfE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810970, "uuid": "e92f6150-e7a0-4c38-9174-607474e00cd9", "value": 818688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810970, "uuid": "e4bed23c-945b-45ad-b945-5e7d2d8493f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810970, "uuid": "d44a1a3a-b17b-427f-bb29-1e854be1c431", "value": "5cf5afabaeeebbbe8b755bcdf16bb40421974a79c4f9bdd04e7d116fe3085595", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13e7806e-196d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809170, "uuid": "d341ce77-ac04-4039-af1c-b205239898ea", "comment": "Malware payload", "value": "5cf973d7cabe267b9a4827ee0820f3f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809170, "uuid": "da508cf8-f461-4209-a42e-87e6c27be5e5", "comment": "Malware payload", "value": "5d2f183a8bbbccf21a8a609873e68f83d2f94c3b2e34a34fa3d74ccb711ed43f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809170, "uuid": "8f01c069-a781-49d1-a39e-3fb970a8e6de", "comment": "Malware payload", "value": "5cd98a821f3b2194774de296c4e91ac98b80fb36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809170, "uuid": "fb6540a6-2574-459b-8cca-d760a4723845", "comment": "Malware payload", "value": "00fcc3111b4dcbb80cdb1dea4d02062cf995a955c9b6274ff2a2a52b546283c1351628dc662c26515517e35efd947fc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809170, "uuid": "6662b06e-7d7f-4d0b-b8cd-7780f7b313ae", "value": "T11D64025036EAC567E9604F715E7AEBF75EE9DD482960031B372029EEBA31201F90C397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809170, "uuid": "d69ad6af-0190-4e2c-a19d-be579d2543e2", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809170, "uuid": "ae19fad8-78ea-4174-8391-8cb8ee1cde25", "value": "6144:14t6LsyAWYRsw3HWstV+xSl5yQIhOygAtNSIJ/TjsuMal+CSWl3aGon4OqpuegnR:1kdW+TtV+5OygAtXlrFSq3ab4rm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809170, "uuid": "49bad0a9-9383-491d-9122-85a878b231de", "value": 334424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809170, "uuid": "ec08e951-7539-4b3d-8504-d609e5a72406", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809170, "uuid": "5d19cc79-0734-4a87-9655-dedcf720ab80", "value": "5d2f183a8bbbccf21a8a609873e68f83d2f94c3b2e34a34fa3d74ccb711ed43f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8cc7cdf-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810359, "uuid": "788f6735-0c00-4c94-93a0-cd0c9a2412ef", "comment": "Malware payload (GCleaner)", "value": "00ccfdbf8964e5e450aa5bd35391faa9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810359, "uuid": "3502b01b-af93-4380-8f83-8dd72e8899b2", "comment": "Malware payload (GCleaner)", "value": "5d9f23a172f47c41c57b189ed985f398b44e8f3bdf694c0b606fc4c500934ec9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810359, "uuid": "73cd3b57-5bdb-4f20-9bbd-dfb2a066e3d9", "comment": "Malware payload (GCleaner)", "value": "d08d8ffd18e67eff2a820cca4f6ead4e982465bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810359, "uuid": "eaee53a9-ec1f-411d-a123-18f78aa2b115", "comment": "Malware payload (GCleaner)", "value": "0cc5105a42758864c277279bd63e77ccdd0534556a4dcb5c1025cc31b2e2b87b9a01a67b5d18db89431145d453142793", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810359, "uuid": "b1280940-fc49-4eff-bb19-cd5e1807a137", "value": "T19A159D23A3E18737C1A72A7DAC5B9E5C9935BE111928584B2FD48DC84F3539337361A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810359, "uuid": "02b4f1b5-f1eb-4a89-93b9-21438945b035", "value": "fe4280c06246cc873fe89746dadec91e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810359, "uuid": "4c4ad9f7-1e0c-4042-95e3-d134909dd873", "value": "12288:MNnqG7tucDD94ypPY2VKHF7O4Cy4MOjE9taCb6CI9/wy1vBq3uBWPE1m9urv:MlluEBpPj6o4CPbE9taCbtIWEQDqm0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810359, "uuid": "cc2728f7-eddb-46f6-9f34-fe012af49e99", "value": 900096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810359, "uuid": "3ad498ef-960e-4e8d-a0e4-1c89b2bbeed3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810359, "uuid": "5708edb1-f77e-4277-8e8e-2f2f344e9540", "value": "5d9f23a172f47c41c57b189ed985f398b44e8f3bdf694c0b606fc4c500934ec9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c00a967-1970-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810686, "uuid": "fe3cd6a0-f434-48c2-9a61-4c5d6e280178", "comment": "Malware payload", "value": "4a93a863b6f9eec7fb9d8761bd7b083e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810686, "uuid": "127008ba-6a8f-468e-8887-0c95680e0833", "comment": "Malware payload", "value": "5dc7a70aa997eb386e557d6111949e9c0e4bfea2622b37f44ea686497378e1e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810686, "uuid": "47126e00-9987-4045-95fb-06189f2dc225", "comment": "Malware payload", "value": "113dda9080f8c1837baaa41a5547236f7c3f28fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810686, "uuid": "66890a44-7135-4c36-855d-2c4a6258f727", "comment": "Malware payload", "value": "f78e6dac01d80e6cd9d97818bd8f7cec02f0daa66ef793b347277d0c064a3c6e29d1994700f728df2f725f175a845792", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810686, "uuid": "0bd262c3-743c-4f21-b9af-fd1b36ce02ce", "value": "T123641A16E7607815F85349B03EB8A65629293C3A1680ED0BB78D9F4A3771AC3B4F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810686, "uuid": "e28cc657-3007-4eb8-afba-31f90595c93e", "value": "48910c907ae6315ad29ed318da26cdd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810686, "uuid": "b9f5e22d-2015-4b58-92e4-f5becbb55714", "value": "6144:aJ7qKOtsi9PGJKKU0GkfiFbfy1Hi/YFm3ijiwZ08GqOkVfi9BaEsyEyhUgH74vju:aJ7HOtsi4ffiFbfy1HidGVfi9BaEQyhW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810686, "uuid": "6f223ee1-53f9-4b9a-88a3-ed52f4353a7a", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810686, "uuid": "b217e893-3417-4d97-a7c5-ba89fe8d8b7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810686, "uuid": "277b1ce8-39a3-4ee0-8de0-a35a972e3a42", "value": "5dc7a70aa997eb386e557d6111949e9c0e4bfea2622b37f44ea686497378e1e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dbcbab5-1969-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807522, "uuid": "fe632b96-800f-4a30-9a74-a09fc5e3102c", "comment": "Malware payload", "value": "3e49375f26520e5b331d9cb8ae7acbde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807522, "uuid": "e6953588-3751-4154-a36b-357d8a2ec6bf", "comment": "Malware payload", "value": "5e4006ae43d56a61fd0796f56b99b93a1fd53ee9be7688f34d3a45d774d67677", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807522, "uuid": "ba3f7fd1-71e8-42a4-84bf-375623e1ab85", "comment": "Malware payload", "value": "9caadaf498cc4d8ad0559cfc5f817fe977c9037a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807522, "uuid": "bab697d8-8888-4fb6-b0eb-81783a079283", "comment": "Malware payload", "value": "5435cff3e973b4c6c7d1820262235d241fcf662a3fe1d97ab52d5e6644e8ad5f860cc1fb95feda495833bf500e62eef7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807522, "uuid": "efdce4f2-954e-4155-b7ab-3e5278d37528", "value": "T1CD0512550B52684EE093087469F27776FBA89E663768C7C277C0B2887E3B3458F253C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807522, "uuid": "daabc879-0eee-4329-b1d9-e0bc0d0ff5e7", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807522, "uuid": "3ba854e5-00ef-4609-a63a-e6cff194ee99", "value": "24576:IHO/MdQcpoOXcx7tWdBz6kqd43jbz1HVkMIwSqLbBYNG6:IHO/u9X+tWdBGzKb0wSqp96", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807522, "uuid": "95557e7b-7313-4c16-87b1-b1d394c8b62b", "value": 866320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807522, "uuid": "4628c8ab-787a-412b-a374-dc22c570357f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807522, "uuid": "d954ca8b-c410-4f26-ae80-399a3c745289", "value": "5e4006ae43d56a61fd0796f56b99b93a1fd53ee9be7688f34d3a45d774d67677", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcd63ba2-1971-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772811171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811171, "uuid": "1bac18e3-79b8-4c9e-9527-b2bb80db1b11", "comment": "Malware payload (GCleaner)", "value": "cce4b4e81074fff9a0991ac6cd3f0dbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811171, "uuid": "c1b7fc7a-4214-4f15-8940-0b7126985141", "comment": "Malware payload (GCleaner)", "value": "5e415efa26746b7fded56b109de4ad01c65e79e6f5523426cc6be05542a63ed0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811171, "uuid": "4d84c9cd-240f-4647-a772-d8e348695d0c", "comment": "Malware payload (GCleaner)", "value": "d8c63db151994560e359a5df7e04e313236904b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811171, "uuid": "189ddc78-d0a1-4eb5-8836-a67fbf531db2", "comment": "Malware payload (GCleaner)", "value": "a490f4ff4b0fb4df61242cad438f4673de1bb1203f1906965bca6db9546f008cbd566b22154fdd39a3b6bdc52b317c96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811171, "uuid": "4c8885d0-5926-4cbb-9c77-13cb1d5a3af2", "value": "T1BC25AEE2A2F08532D27216389D7B5E6FC9257E10ED2C98492BF41DCC8F3C7817535AA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811171, "uuid": "67717e49-e8f4-489e-b491-4fe6f132408f", "value": "1b5561a94cb01af2569d6f2ff45e087c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811171, "uuid": "3da9586b-f8c9-46be-b85e-dfe3c26519d3", "value": "12288:PXXYiviV8rqIPazxvzRNRhBydf6o2uzIrOG5kP+7l/oiA8fs08gp84zWJQxK:PFTPaZNNIN6ndG+7Kir8gp8RJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811171, "uuid": "74a9c859-3859-4065-85ab-1eae9cb06979", "value": 972288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811171, "uuid": "18a78b23-fa4d-44ce-b42a-a9a479d18e75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811171, "uuid": "24ab69f9-48cf-426b-9dfb-4014b836e7eb", "value": "5e415efa26746b7fded56b109de4ad01c65e79e6f5523426cc6be05542a63ed0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b460eb2-1982-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772818389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818389, "uuid": "b9fe5742-ed7f-40fb-b45e-d99d922a1bda", "comment": "Malware payload (Mirai)", "value": "42b4f0ed28be47e2ec801ef8ca3021f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818389, "uuid": "25919c06-c188-4489-88d6-13183963dc38", "comment": "Malware payload (Mirai)", "value": "5e753270b1a4906207487542b15d7e065a6640e9986af6db418b107e4677e018", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818389, "uuid": "86c00697-a775-4103-bcd1-57ab218de84a", "comment": "Malware payload (Mirai)", "value": "53fbd12066c22f163ab23d6e5282f5eaf35422b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818389, "uuid": "ac1ee511-ce3f-4cb9-a984-fc5fba32899b", "comment": "Malware payload (Mirai)", "value": "a89c85a6dbe1250c2c7eb80e6459def0877f2267a14a19fc71fabe0f441ee9fc98178bae36ffc0bd52e579be63ab86c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818389, "uuid": "66a179d4-c83d-4dcf-83b1-e637c6c064c9", "value": "T1E4B339C0EA47D4F5DD1642302277F73B9A32F17A1139DA93E3A89F327C52A41D90A29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818389, "uuid": "91b99f44-4a54-46c2-a40b-d382ae8c43ea", "value": "3072:XFmzGpEWmXBLFkpzjYS3Z/5+JcDEh6ohHw0pJbLv:XFmzY5mXBypzjYYZ/5+JnlHLv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772818389, "uuid": "ceebc91d-f348-4ae9-a679-ddc0e9358fc6", "value": 107824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772818389, "uuid": "740c4dd2-3586-412f-895f-4df66c4266a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818389, "uuid": "c43ba14e-03a4-46d6-85a4-e14716cb7376", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2af9f933-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772809208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809208, "uuid": "1dd0cd97-2aa5-4e0c-ad6e-a16a2fc233b1", "comment": "Malware payload (GCleaner)", "value": "8fc80117e9c35fa3ef16711692306d10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809208, "uuid": "3b7da981-d758-42c5-88e5-3e16392306b2", "comment": "Malware payload (GCleaner)", "value": "5eacc3c6d453ce49b1f8ebc66f457c060923046e4039b76bffee3f1e24be486a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809208, "uuid": "a082a07a-ca49-4cd5-bf16-5fb3eb5dd26b", "comment": "Malware payload (GCleaner)", "value": "d32bca4795cc843127d70d267ba30f70d6f6fcf8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809208, "uuid": "322471b3-7bc0-4d29-9fd5-6fa19a7eed45", "comment": "Malware payload (GCleaner)", "value": "54d917c4a237943e134051d16ae9eb6499580fe4715d9348c91cf301d70afa6b35e3b965fe4802fe2a09f1d40b51323d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809208, "uuid": "102332ca-99fe-4564-9d1d-b4e7d692e882", "value": "T18C06E0E2F2733151DD31F33CEDAAE21D1834B67E7C9409EB85469AC65B10A43E2C52E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809208, "uuid": "50c5e59c-adfa-4084-9c0f-ab1508b8dd32", "value": "234372fce9eaa047bc4c39047910954c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809208, "uuid": "07eda66f-19cf-4fea-9200-00acaa0d01aa", "value": "49152:SGQJMIn5Ld2f+SJRQgQ+Du2aZ3wUVDMxDHyQcLiBC1CyPLCLgCURGyljB:SBJMk5Ld2mSXQwtaSUVwMhCyPLCLLoG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809208, "uuid": "52b492f3-4684-4ffb-9998-25494a90c63f", "value": 3835392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809208, "uuid": "25bf4a96-85d0-4c76-9c83-0f5cfe422922", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809208, "uuid": "aa9df818-1a52-4946-bc2e-6e3cf63eca60", "value": "5eacc3c6d453ce49b1f8ebc66f457c060923046e4039b76bffee3f1e24be486a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c654d2b-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772810553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810553, "uuid": "68ced263-f064-4770-b97e-ea623a503af9", "comment": "Malware payload (Mirai)", "value": "3f9aef2bc3a3ece65412b8f499a26f6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810553, "uuid": "af617ebe-eece-4029-83ae-d9ff7b992cc9", "comment": "Malware payload (Mirai)", "value": "5f2a5ec8d40f23e0954024dcdb6b8f9e82e860c76d2af395a354a8e8592a2bd2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810553, "uuid": "c2d89a03-d2ce-45dd-9621-d069e644a2d0", "comment": "Malware payload (Mirai)", "value": "26ad1eac714759014de2c0e711b47161b0ca1fb1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810553, "uuid": "51cea2dc-0092-49f1-91ea-9f1bd60eae80", "comment": "Malware payload (Mirai)", "value": "9548f3672efd68d77e58971509a280729c1578ab32a8e185e1c9dbd6f689352db6526a6af22ec65f94d984043b202697", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810553, "uuid": "ad1708cf-1209-4bb3-bf1d-c94f4bd2642c", "value": "T19BF33969BA0F6C41F2C2D3F9DA8C87E13E1735E3C6778DA1790252EDDBA39D94980502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810553, "uuid": "7f266543-a27e-4ae4-86f8-f0c9e2aa5c91", "value": "1536:wdMiHrrc/qDHavM5Dtrg89RPA4b1X75rgmnX7Dy+IfMp3En5p5M/LW:i7vDtrnPTR71gmX7Dy7fMp3xq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810553, "uuid": "95f3a29d-42ec-443c-bcda-3c696ad67eaa", "value": 157544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810553, "uuid": "7bc50a0e-91dc-4b39-b7fa-0e5f94f57991", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810553, "uuid": "b316a1e6-b676-4cf6-8757-00adb20d2b26", "value": "iran.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "057ea81f-1964-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772805280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805280, "uuid": "7e21a8a5-0497-475d-894e-70d534e6974f", "comment": "Malware payload (AgentTesla)", "value": "1e5d40dc6ca64254f1f04ba1ae8f6b1b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805280, "uuid": "d2a532fc-d6fa-4f64-b0cc-0ee567068722", "comment": "Malware payload (AgentTesla)", "value": "5f47f9ec37932ce319cb40f451be31a9c62500dac31b79d16e5970d32612c094", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805280, "uuid": "dab428cf-980a-4515-b2bd-528234b849e2", "comment": "Malware payload (AgentTesla)", "value": "7e45fd1cc78ce76f28e51a0a2c2b57ac3a645a6b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805280, "uuid": "b18a8548-3342-4659-b69a-84dc1def6e8d", "comment": "Malware payload (AgentTesla)", "value": "06a595b0eff6786da18666c4fdf1c14b30dfa8936669bb5c9982fd278a25bf6f9885fe6a88d185dd60b22197dd7a3ecb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805280, "uuid": "47186b68-ab70-4e8f-a014-abb1dc5500dd", "value": "T1C53400027F88EB15E1A97E3782EF2C2453B2B4C71633C60BAF49AF5514516826C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805280, "uuid": "50dfea97-1417-4b40-b1fe-161bbde829e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805280, "uuid": "9c198a9a-4c64-42ee-9a87-eeb4fc8a6da7", "value": "3072:kKxZ6iyqa9PRn6sO+4YUTHo9rG8KaG5jnTh9qcufzz:X6iyqahhX+sq8KaWTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772805280, "uuid": "62d98a3c-4aa6-4e2c-9778-8626b8ad741b", "value": 245248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772805280, "uuid": "c2e570dc-46ca-4714-a3de-e9943a2d98e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805280, "uuid": "7ef3063d-8b7b-4790-841c-e249c22f4b42", "value": "5f47f9ec37932ce319cb40f451be31a9c62500dac31b79d16e5970d32612c094", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24cf6fea-1970-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810486, "uuid": "b12deec5-8a8d-444c-bc4b-1b0b2f030d22", "comment": "Malware payload", "value": "4d559ed18483c24c9b8bf9f981d681df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810486, "uuid": "e44e4de2-d7c5-41f6-a6e3-d320910c513f", "comment": "Malware payload", "value": "5f63df6ce6e6a01dc73e3120000ee6b8bbf18635a93125cf6ab91a1e636c0eab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810486, "uuid": "1b8e414e-6563-4c50-b8f1-1b108d5337f9", "comment": "Malware payload", "value": "934f30998cca07e8e2c6cc980765980134030101", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810486, "uuid": "202f30e6-49b4-4198-89c3-c5b8d454b672", "comment": "Malware payload", "value": "5a0144ad46d7717cc4421c7e4ceccb109f3f8198ca416c110fce63f098546cb2848ad7cf9b1e2ba584752705901a6436", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810486, "uuid": "9fb2c2f5-19f5-4102-9338-21d5534124ca", "value": "T1A43533C232D16A47E6D44F313A3727A81A36EEF51626424FB7486F4CF8079C6298FD12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810486, "uuid": "30f5b7e6-5698-44b2-912e-e02f67e52d2d", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810486, "uuid": "512706d2-a61c-41f8-ab78-1f599fd2a146", "value": "24576:cpkkAx2hVugNeT87RTSWOX8mCwqRnMzZsBllsZluZ3JsQb:wdAsLWokWOXU9RnMqBllelaJs2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810486, "uuid": "97b2d229-a0ef-4e09-9486-08fc1f0d02ca", "value": 1059968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810486, "uuid": "f1c055f6-0896-4188-81f0-be308d7b6210", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810486, "uuid": "4f5de89d-3862-4709-b970-e9284dc3d4d4", "value": "5f63df6ce6e6a01dc73e3120000ee6b8bbf18635a93125cf6ab91a1e636c0eab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "925e7582-194c-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1772795208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795208, "uuid": "cce3463a-25b5-4913-ac9c-f672f9244772", "comment": "Malware payload (PureLogsStealer)", "value": "488d3192c9bd94ccc2fb2e793165f983", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795208, "uuid": "d7ee7b20-defa-44f1-97ce-3282e725b4f4", "comment": "Malware payload (PureLogsStealer)", "value": "5f7e3dd13957b17da8fc4d42f97a5b07b99775ab716885b38a186e14229927c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795208, "uuid": "e210722d-5e2e-4659-ac27-e7d2d9e1789e", "comment": "Malware payload (PureLogsStealer)", "value": "4abeca97750fa7763c82da6745665090bf3dc9bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795208, "uuid": "b38c7472-49d7-4cbc-bfe8-96d06677e180", "comment": "Malware payload (PureLogsStealer)", "value": "8473048a613b9cf94db05cb34cb336c66fc6ab673ea89af3a22939f0644f3ac6a593b1394841b8be6f35272aeb5bb7d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795208, "uuid": "38592a1d-a0ca-497b-ace8-5bb0a0edcfb0", "value": "T119E6333494BDBA49C84C3430AF289F9F4DD5BA309F55534E784B99FAA431A0AF35BE10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795208, "uuid": "9d3a3c38-12f1-4a0d-9558-ad2256165b6c", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795208, "uuid": "78a6d46c-ac06-4e38-a950-82d8a12e51b1", "value": "393216:vzMsY7coi2dTbBjI+5kINnGdBzOZjiH5Sb:vzFYrB7HNnGdBzOd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772795208, "uuid": "1976af3d-9045-4dea-bf78-0ad766c11de6", "value": 15034880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772795208, "uuid": "5f8d3c25-af16-4054-b383-157316a6b6f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795208, "uuid": "383bdbf5-264a-471d-9e96-b638c89e3ae0", "value": "Installer_v6723_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23c38a6f-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772811344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811344, "uuid": "e0ea9547-fa65-46ec-976a-f132a5182448", "comment": "Malware payload (PhantomStealer)", "value": "47fddf718295946a2d1ab53f01ccd334", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811344, "uuid": "7d9fb9e0-2272-4682-aa7a-e395f3af62fa", "comment": "Malware payload (PhantomStealer)", "value": "5f7f0c5c9aef6352a28e58882f571f249dfb451daf00a0261d7a7bbb9e551d74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811344, "uuid": "658c636d-0bc9-4d49-87e9-9bf5c4e37790", "comment": "Malware payload (PhantomStealer)", "value": "3979e67d752a6c927415a6989657050121491a3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811344, "uuid": "a25a37e0-f424-4ce1-b764-56d6db4ed7b4", "comment": "Malware payload (PhantomStealer)", "value": "bee23ceb8e69080edcc214b2ee762b8d7a788c4d317a6280f44beae6291e6ea2917327e60ca8958f2b8fb8b14b77bbfd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811344, "uuid": "c06381ce-5646-4753-af50-4d08c9757be8", "value": "T1B67522682651C913C556573816B2F2B917788EEEB921E3139FDCBEFB7C22B551C08283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811344, "uuid": "23331a71-825b-4f37-a61b-8964ffbd3df2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811344, "uuid": "00614f55-3635-4350-91da-305c386b593d", "value": "24576:CI8oz/XaMQCmGUAlk5tMCxSXXWnNldPLvxYs6VmGxEcQ3JcG/2j:IoWvCmZAlk5t5xS2NljGzxEDcGuj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811344, "uuid": "c15ccd1d-570f-43a1-82c1-d1303d52b001", "value": 1597440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811344, "uuid": "8fbe2c40-a381-4618-8718-2d15cfbaa5aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811344, "uuid": "c7da2b0b-1fdd-4996-a946-f106623ca79c", "value": "5f7f0c5c9aef6352a28e58882f571f249dfb451daf00a0261d7a7bbb9e551d74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "987d7d79-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772809822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809822, "uuid": "1024c300-4032-41ce-b8e6-68da51559062", "comment": "Malware payload (GCleaner)", "value": "13b53a712e5cabae2e00c652fb849e73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809822, "uuid": "1b06b62d-1dc2-4e3a-aa28-b9c25df70efd", "comment": "Malware payload (GCleaner)", "value": "5f8b481b077b35e6e69cda8fede9d8b810357fd96d62575857249fc7ee24ace7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809822, "uuid": "79898926-db8e-441e-a17f-7cd684f03b5b", "comment": "Malware payload (GCleaner)", "value": "21496e9e61bf8b428466a8262ab9528be62ef95f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809822, "uuid": "ff7eed3d-0e2a-45d2-ad88-35b14952e2f2", "comment": "Malware payload (GCleaner)", "value": "939e0275ba8df5957a7f7ad7c8efd6280e4c6c8b8da587ef8f180858812afc43940d8c08732ec67c58aedbd384f339ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809822, "uuid": "4d994d59-f88e-4591-88a9-6c13c3b6ad31", "value": "T15FD47D65E6D08C36FD636F78DD0B52A5582DBE80692858CA3FF81C489F28381E735397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809822, "uuid": "4293beb0-e188-418b-91b4-4395414b9e6b", "value": "c475b6e242f56325f64c2b76233f720b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809822, "uuid": "dc0798f4-76a8-49eb-9a42-53c79f760b16", "value": "12288:1Q8mJu5T0Ns+MD77lUjVMSokIR3y3Jdn2tSIIIvs:WJFNhu7lK5okIxy7noBv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809822, "uuid": "77687b18-0479-4072-8275-5093fc067742", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809822, "uuid": "c9cf45ce-60b0-4277-a363-912c79284eb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809822, "uuid": "5f5da312-1955-46f0-9ed6-9736b9a28b63", "value": "5f8b481b077b35e6e69cda8fede9d8b810357fd96d62575857249fc7ee24ace7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60a84fed-1972-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811446, "uuid": "a6c3c576-935a-4256-8145-6f90f8f98bcc", "comment": "Malware payload", "value": "0d318ef1757ef664eec86e6e895f7a12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811446, "uuid": "c1b21f1a-87cc-4b5b-bb38-4d6626b80472", "comment": "Malware payload", "value": "5fb162b52b2a301a0b614f287b05301de027a43287c11e21f85949105f0db35a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811446, "uuid": "29a73b7b-fdf0-498e-953e-514ac0edb475", "comment": "Malware payload", "value": "edb46ba9fe43b08d73f74f1d10a6f873dbf3b05c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811446, "uuid": "837a065b-b212-4ca5-8d4a-77d89b718e3b", "comment": "Malware payload", "value": "b164606c38ea5a6501abfcc563991eed4fe5c4bcba109513b9d5a5c83da61c18520aaf60e99d9705e3b5952c9fd7647f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811446, "uuid": "ce2a32dd-2543-4c88-aea6-e1db738b01e4", "value": "T11FE6E00AE7AE41E4C276C03C9522632BF6B17C598734DBD76AC02F52DB933D0997A781", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811446, "uuid": "164ddccd-7c2c-4323-aadb-debc61713303", "value": "c87bab6b83ec10488c6e5237d9cb78ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811446, "uuid": "86c4de67-a30e-4a1c-acb5-eeeda4922984", "value": "196608:uZ0ETECmrKLSVvvS7LcMJkJaWqt/7dXMESyjlw4QRk7dXMESyjlw4QR2lP:00ETECmrKLSVvK7LIit/7dbjo27dbjoI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811446, "uuid": "7ce6e56c-4f67-4300-b415-ab7c480cbf06", "value": 14294528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811446, "uuid": "6c50fed4-7149-4f9c-ba06-275076613599", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811446, "uuid": "cb0d5d7b-3bfe-4679-b019-d3a4d7ed13b8", "value": "5fb162b52b2a301a0b614f287b05301de027a43287c11e21f85949105f0db35a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "027005ca-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772809999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809999, "uuid": "8d6d4ee4-dd0b-4706-8ba4-fda7f95ed190", "comment": "Malware payload (GCleaner)", "value": "48ad7b5268ef8ef20c6e57fcafc95690", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809999, "uuid": "4a5a512c-676e-4fc6-ae3d-713c01682ae1", "comment": "Malware payload (GCleaner)", "value": "5fe08d47873d9c36ce7a392fefa8ee07bb64616cc93db3356648d507f2eb5c0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809999, "uuid": "ef476f8b-b34e-4f54-b28a-96ccc529c67d", "comment": "Malware payload (GCleaner)", "value": "f1760ca7e2c973ee74e986138cdc7f8ad91fabc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809999, "uuid": "54355c72-1b36-4156-87c7-0fd74e3a00a4", "comment": "Malware payload (GCleaner)", "value": "fa686776b9f5b709db25bf9e93c74d4d00f970c247e800fd6da78a1828df0590079ad5a195e7fbf74affa1c680ec39c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809999, "uuid": "39d0bd11-0490-44ac-bc12-010ec8a7fae6", "value": "T1EFD48F21B2D08F3FD922D938DC5B56E5B836FD8029185846EBE8DC689F25B913437273", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809999, "uuid": "37de2eaf-dfab-4679-a318-ffdb3693ae5b", "value": "c475b6e242f56325f64c2b76233f720b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809999, "uuid": "99b65b54-e409-4a92-9338-555fd8ba3dc3", "value": "12288:nQ8mJu5T0Ns+MD77lUjVMMokCfMWJylPLxLxK:QJFNhu7lKvokCfMWJytxLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809999, "uuid": "efe5334d-dc06-408c-a440-0d24341b8d72", "value": 629248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809999, "uuid": "6dffbbec-3b36-47ab-bce7-2f5cba05a62f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809999, "uuid": "d7adf0f1-8e23-4c5f-aa3b-d2e88eb8a4df", "value": "5fe08d47873d9c36ce7a392fefa8ee07bb64616cc93db3356648d507f2eb5c0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0d38fdc-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772811607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811607, "uuid": "d15b19c5-fefb-40e1-a82a-e75912517a67", "comment": "Malware payload (Formbook)", "value": "5edbc15373c3406d8d94a780b3be8288", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811607, "uuid": "3345aa1c-bd9a-4a78-83ab-08f8234f1b05", "comment": "Malware payload (Formbook)", "value": "6001ce5f808cda3ca7ab33a6cb598a106a05c811607e3c7c631a6a67b2e913bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811607, "uuid": "3829448d-47e4-48ea-9810-4efdf2f51d5d", "comment": "Malware payload (Formbook)", "value": "dd75351cd50816eecfbadc0c22a7d62561f2f1ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811607, "uuid": "f70e2c86-7947-4953-8f9f-9e0ed592802a", "comment": "Malware payload (Formbook)", "value": "d1b04b1164c950a13000be74c13e93d6f0be3323960252d6b2237627e9574e49e2fe47eb01b0aea590b290a9790c48df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811607, "uuid": "1f9fd270-e3d5-4b32-ba06-8b08f52f1e9a", "value": "T1FFB4E00A775964FED41BC578C6834612AD327C8A4B71AEEF4B944E766E226F05F3E300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811607, "uuid": "f2733787-0354-4418-83b4-e5bf792cca72", "value": "c71d9111a77fb9217f1e372fa1b6214e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811607, "uuid": "9ea0a65d-e4b1-429a-b8ba-4526c3dc8232", "value": "12288:twO/jk3vRC7KJlTcv2WrwqGCNinQdIC4wNURv:twialo+OwCNdVI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811607, "uuid": "655890ba-9543-498f-b97f-846c1a0333c2", "value": 495648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811607, "uuid": "e6487ced-c436-4eec-a42e-42ea41dceeb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811607, "uuid": "8420a8c3-789d-4f14-84de-fa54f6406bdb", "value": "6001ce5f808cda3ca7ab33a6cb598a106a05c811607e3c7c631a6a67b2e913bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed2982bc-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772809534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809534, "uuid": "8b42c01b-10e2-4ecf-bf87-37a65503106d", "comment": "Malware payload (Formbook)", "value": "3985bb3638e50458db07d15b08fe5ca7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809534, "uuid": "bc25c621-490c-49db-9e1c-8c9ff8a868c5", "comment": "Malware payload (Formbook)", "value": "601b6b1a2e8c908aa336cebc2d10913c89e8ed44f7f80eb8687a8dc7be78f576", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809534, "uuid": "68f4cb53-f6f9-42a9-b41b-7f9074676328", "comment": "Malware payload (Formbook)", "value": "6c39ffd79ca0671bd91865e100ac392944e39115", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809534, "uuid": "b0128c7b-3200-4d79-a75a-f733ccc2f043", "comment": "Malware payload (Formbook)", "value": "0f7aa8f561a1b57a0fd0fa91e0b68f75fd7b17b00f2cbf7abd3ed2b5eae52d8d37b06dfff35e10a17885597af5e974c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809534, "uuid": "f01bbb01-1f56-447c-a1bd-682ab56d61ba", "value": "T16B45CF0273D1D062FFAB92334B5AF6115BBC79260123AA1F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809534, "uuid": "31309e56-bcf6-41c2-bb91-a86c53fccd10", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809534, "uuid": "4dd359c0-56a7-4271-8f8e-9dbf01cdd310", "value": "24576:w5EmXFtKaL4/oFe5T9yyXYfP1ijXdaUus8x1sDbPNX1GrILqVt2NSL:wPVt/LZeJbInQRaU/8MPqqqVkN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809534, "uuid": "d25657f5-23a6-4008-8ab9-db5825ce865f", "value": 1253888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809534, "uuid": "85877d0b-a1b0-488d-8a23-72415037777a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809534, "uuid": "7062955b-af43-4a59-bbf0-2e97f8316570", "value": "601b6b1a2e8c908aa336cebc2d10913c89e8ed44f7f80eb8687a8dc7be78f576", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f59a0a6-196d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809323, "uuid": "5a25fadd-1239-40ba-ad88-83155edbb89f", "comment": "Malware payload", "value": "9a45c849e8f745c161460019a5238532", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809323, "uuid": "da8bc2ad-9a81-45ac-9f0a-b090bc1035d5", "comment": "Malware payload", "value": "6030d27ec9229c5211dfa3ebb91981cee067c00f3a53d42c9f9dcf86c335cab7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809323, "uuid": "18c1cbf3-d785-4594-99b0-74dd3b885a79", "comment": "Malware payload", "value": "61ee5f40c1732f9673cf1fed0597c1585a567aca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809323, "uuid": "0de7f5f1-76da-4923-8504-6a96a06c264b", "comment": "Malware payload", "value": "4c55d2646c40f3220aaaf717291569739dd4f5c441e14dc232ab0ca74a790e25c87f262a29d1a274893711aee7b1ff0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809323, "uuid": "5a7356f1-1684-49d9-b7cc-110cd84eca4c", "value": "T17CE48F23E5D2C432E1226938DD1B57A5D837BEC12F285846EBE71CCD9F293827835297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809323, "uuid": "5f1a48fa-b461-4866-9b1b-331fe34ab27a", "value": "c475b6e242f56325f64c2b76233f720b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809323, "uuid": "64aaed3a-6e25-48a7-b72b-0cda72410c78", "value": "12288:MQ8mJu5T0Ns+MD77lUjVMCokGuthnqScbN2tGlv6d:tJFNhu7lKZokz+SMcMlC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809323, "uuid": "146964bc-ddb0-4c1e-bd9e-e00b210fa70c", "value": 674816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809323, "uuid": "19f442e7-aeb1-4743-a28a-7addd6cc20f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809323, "uuid": "2ec45a4a-faeb-46e9-932d-af0f2915c2f2", "value": "6030d27ec9229c5211dfa3ebb91981cee067c00f3a53d42c9f9dcf86c335cab7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94b6e076-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810674, "uuid": "5a0f5705-29ed-4186-802e-831f3a01b4df", "comment": "Malware payload (GCleaner)", "value": "c6b264b0cb2bf21642293bf5d1efe2a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810674, "uuid": "2c601896-e3eb-4dbe-8097-ac77bf7900db", "comment": "Malware payload (GCleaner)", "value": "6032a1c8dd74b15aadfb3314d5295719237d40b29600930666ced58f43d63f2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810674, "uuid": "3b7e1965-833e-4f70-b64d-d8509abf89cd", "comment": "Malware payload (GCleaner)", "value": "4ad8ea589849c79e5cc1efb5012ff03ab0d022df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810674, "uuid": "bdacbdee-cbf9-423f-83e6-97002fa253a4", "comment": "Malware payload (GCleaner)", "value": "2d8ba51dc8f364b894daf8a085936986c2c5aa66920d057af0700979fe487649d9163d53632642b6fa2a9dc3d8d42f21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810674, "uuid": "9d0dce78-3766-4099-bd2f-d2b837f7f77e", "value": "T101058D66F6E08437D1622EFF9C1BD2549829BEB02D3854457EEC2DCD8F293912D3A253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810674, "uuid": "0b71fd68-6ed3-4734-8ec5-2e56c2413feb", "value": "ca01ec09235c3305d2c87228ffd6db40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810674, "uuid": "0061cacc-1b34-4c38-beff-b6d8a3bc048e", "value": "12288:ulOUK2LDqP1ft//fwykZznp1m+fn0gPUxZOqLFqItpQdtsD:HR2A1ft//f98n/FUzVhqIDQ3s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810674, "uuid": "747e7c7f-a583-459b-a616-b808937edf96", "value": 821248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810674, "uuid": "ac9a6fd0-fe2d-4428-8d11-64c877f82d5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810674, "uuid": "ab6173fa-72de-4b36-a550-2ee74c3153bf", "value": "6032a1c8dd74b15aadfb3314d5295719237d40b29600930666ced58f43d63f2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd8ce421-1933-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772784570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772784570, "uuid": "e1bdbe3e-5b95-4f14-ae21-b692b8edd7c7", "comment": "Malware payload", "value": "34063a1cbba69f8e9a2271f334234f3d", "object_relation": "md5", "Tag": [ { "name": "app-64-7zp-dll", "colour": "#80A805", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772784570, "uuid": "9e8305e5-2d8b-4114-9148-0f236a9ab7ac", "comment": "Malware payload", "value": "6057b8ad8bd5f236767e4c6225db33e3afa79378b9b1264f6e22febf4841682e", "object_relation": "sha256", "Tag": [ { "name": "app-64-7zp-dll", "colour": "#80A805", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772784570, "uuid": "9b884598-e5c2-45d3-871d-086c10fed3e1", "comment": "Malware payload", "value": "0cef9e27b737c8d32c5cf406e614c95d2fddabe7", "object_relation": "sha1", "Tag": [ { "name": "app-64-7zp-dll", "colour": "#80A805", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772784570, "uuid": "99bd2eac-8bd0-45f3-bb7d-924316798324", "comment": "Malware payload", "value": "1d4d1ba6bbe73cfd49606b2b95a9cc1419c9d0a52466bd8e305d1c10dd59e60f52a182a7271113fbf3817e6701729455", "object_relation": "sha3-384", "Tag": [ { "name": "app-64-7zp-dll", "colour": "#80A805", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772784570, "uuid": "f25e934e-d2b9-47f3-beb5-e16606601cdf", "value": "T1AD183322B7E4C07AF0FB1B3294F2A7150A7A7FD51A35D21B3348924E5D71680EA38767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772784570, "uuid": "9c0c8f9a-b435-4042-8813-f68b22976e97", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772784570, "uuid": "549fa507-2ea7-4de8-ac4e-1824dc6506f6", "value": "1572864:K+e4h7TL9BHCLLjt2DLwCXmaBcSrufGanp7GgtcQ3AsERuqWF:be4N6jQPwCWaBcSruZkUEhK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772784570, "uuid": "d2bd76d4-4aeb-413d-b837-397095bcd0d0", "value": 88515062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772784570, "uuid": "e326ee17-c9b8-44dc-a316-93087fa7a557", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772784570, "uuid": "2970ed2e-a3f0-4024-a7b2-388338f55586", "value": "6057b8ad8bd5f236767e4c6225db33e3afa79378b9b1264f6e22febf4841682e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6ef22f0-196a-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808235, "uuid": "102e5e76-25ae-4185-8352-daa6abcc6927", "comment": "Malware payload (GCleaner)", "value": "b1bdcc580a8471f8c9a16dfededd6abd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808235, "uuid": "b0898251-2a06-46db-beb6-a7e95f4146be", "comment": "Malware payload (GCleaner)", "value": "607c0ebb43ae647bee2e66bfc794b15b334736e5e1b9887fce80cf3cd18cd2cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808235, "uuid": "2c0bbc74-31fe-4860-a6d4-17f3bacec4fa", "comment": "Malware payload (GCleaner)", "value": "2883f417b6866dfa69301a2fb34972b7eb9bd201", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808235, "uuid": "f793430c-7f8d-477b-882f-2c9286526495", "comment": "Malware payload (GCleaner)", "value": "f6a96c3fab4849d49b08fef3ea44f7ad1ac20fb4b6ce31910221c26d3e09570de2791d5a96d0c602184a28dfa3b23164", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808235, "uuid": "2c250f28-e939-4a53-94c8-6fabbbc09ea3", "value": "T11146CF0922A11BB2DB6592755D1F432CE736AE001524FF0772A46BCC0E75748EBED2AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808235, "uuid": "67109e35-a8ae-46a1-8d5b-c871bebe348f", "value": "336c69b6e8562d1c5231f219b62d7473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808235, "uuid": "a9f69e1a-34a9-48ce-94af-797711942644", "value": "98304:p9zuA3YV2ka/351pVHwh6aTYYzi+zfh4:pPTLVHSJ7fO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808235, "uuid": "9035a156-3c1f-44dc-a4d6-bca625ef4388", "value": 5537792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808235, "uuid": "4402506b-4fab-46ac-bf47-0e398373465b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808235, "uuid": "ae85590e-c9ac-4d07-acab-8e167f715232", "value": "607c0ebb43ae647bee2e66bfc794b15b334736e5e1b9887fce80cf3cd18cd2cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb729691-193d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772788942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788942, "uuid": "2f67f3a6-926c-4e91-862e-ce437882f689", "comment": "Malware payload (Mirai)", "value": "9708bfd0d68836f1719b1b07faacd218", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788942, "uuid": "6ec66cb3-2c83-431b-8620-c2556738cbfd", "comment": "Malware payload (Mirai)", "value": "608ee847563381ead73c06adb4e39b93dfffa5bb1604a7557800c6c2c2be3f7b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788942, "uuid": "e896cdd4-e6ce-4bc5-b8ac-0844ce5bd043", "comment": "Malware payload (Mirai)", "value": "a02e70ea4a3b83d7de1c3d6aec1ca944cfe056a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788942, "uuid": "88001789-9d54-4a6f-b000-73e00ed76fef", "comment": "Malware payload (Mirai)", "value": "58adb24cd87b7f54ef9b553098a05cf81595e4084bb9f7365e6ce38c771ce1c7ff79f1c2ddb6ad4016c8c66e0ead5808", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788942, "uuid": "72ef1043-68df-47f3-b6ec-ece8b11cce89", "value": "T1B903F25526A74D8BFE4CD1F6C17F23AF8D24D070D44888B9A361B07E6424FE82B761B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788942, "uuid": "61cd5017-37d7-49bc-a42b-872b155a6a43", "value": "768:W7kCXLzAmwMq8Rj1ilR7BaV8uYhat+sLcXYkyB3sUMgucKbnbcuyD7UHQRji:W7DbzCgwlXuSacsgXKHtAnouy8Hy2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772788942, "uuid": "6c9ada35-b1b0-4601-bd6c-c8751ab4bece", "value": 40244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772788942, "uuid": "8a986cc1-ec5f-4d52-be6a-bbc82910e2a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788942, "uuid": "e3a2d0bc-93f5-4219-bc4d-ff4e827f70b8", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a13065e7-196a-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808118, "uuid": "2a7d0675-3cff-4b36-afc6-8577e51dfb7a", "comment": "Malware payload (GCleaner)", "value": "1ebe3ee83bf170af5cc26e8fc662615f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808118, "uuid": "4fed1fbe-df78-4ebd-a7f8-beb06802d77a", "comment": "Malware payload (GCleaner)", "value": "6099aa532671e2e2a4da977650539a05497db072a89ad1dc20568e6f37d58796", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808118, "uuid": "58141bc5-fe20-45c2-b786-4e7b24407e56", "comment": "Malware payload (GCleaner)", "value": "81b5f6141041f65a81c40c1fe6c31a7f66d484ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808118, "uuid": "a2897444-276d-4be1-be62-09be05845b0d", "comment": "Malware payload (GCleaner)", "value": "fd8049e7f31111018331bb2c4bb67b3ca6c89d19887e09a936dd56760b37633a73b786cc0bc18acb9510bec45059de81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808118, "uuid": "3bc7fcb4-d56d-424d-abd5-ed4ba0736a26", "value": "T16736CF3252D884B7E33D117DC925CC98ACA3B93539939C0A5BED18CED61DBC41C266AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808118, "uuid": "8dc0d622-0639-4a4a-9201-d2ab05bc7e09", "value": "e5f32a93ddcf3aa9009cd70911b0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808118, "uuid": "e34eebe6-6e2e-49b4-aaea-f95ec6e46303", "value": "49152:G9CiLxuF/Fm+pQJRKOC+BkuXNbRRGqfuUL909ZecZB0D75wAAZxLC57:G9CexeFBQRjCuNbRQUcQKO5wxU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808118, "uuid": "dbe85af0-b91b-494b-8691-fd6373ea3e1f", "value": 5182464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808118, "uuid": "35ee6bd4-4fe0-4e50-a169-5cdc55594e32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808118, "uuid": "d488f32b-3276-45b6-a6c3-aff24717c613", "value": "6099aa532671e2e2a4da977650539a05497db072a89ad1dc20568e6f37d58796", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ace18cf7-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1772808567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808567, "uuid": "9c6c67b6-8e67-43a4-8439-832bd12bf7bd", "comment": "Malware payload (GuLoader)", "value": "b78b3c73f51db7529a22fe41cdeb5b2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808567, "uuid": "05dbbd94-dd06-485c-95eb-73c40b775011", "comment": "Malware payload (GuLoader)", "value": "610094ae9885f10f3019b8fa38d3ed756f2f2e5c019861ea00275b3e0e55852c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808567, "uuid": "325b0f8f-0880-4817-b6e7-7f537847682d", "comment": "Malware payload (GuLoader)", "value": "adfa25d63a61fe0527a3c32817746919c5fd96af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808567, "uuid": "f8abb59b-bccb-4c9e-a50e-a8fad860cf4f", "comment": "Malware payload (GuLoader)", "value": "c221842eb45f619abc9eef8dde6289506fd37f1c2a5f2182552059baee48e99ee16bb19f906cef7ff3e03c2d88036e3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808567, "uuid": "d14b8df1-c786-4a95-bb9c-504198f864cc", "value": "T11484F147EB1BA851C2858873C9F488FBE7B09D62A456083E3352BF1A59355CFCD0927E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808567, "uuid": "1ddab93a-0ba6-4633-bac2-5d3590bdf5b0", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808567, "uuid": "b5aca63d-84e3-4ddc-9563-a7161afe3760", "value": "6144:ZNDlOLZLClTgENcFAlyqR+7xrFC45/XNeftQC3jgG34CL6pSg0TevpX:Zk8TgENct++7FFNXNitxjg06wJSvx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808567, "uuid": "d2aaba81-07b1-4ba2-bba9-6c9bc14b53f1", "value": 384552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808567, "uuid": "7b5ea930-2fa3-4fb6-b35b-d14fdba4c6b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808567, "uuid": "1b9a5ad5-199a-4025-8d82-973a78b53599", "value": "610094ae9885f10f3019b8fa38d3ed756f2f2e5c019861ea00275b3e0e55852c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a0cc007-1974-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772812213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812213, "uuid": "749e4901-514d-42ef-af56-41e7a0a29754", "comment": "Malware payload (Mirai)", "value": "bd186ce3a4c51af66ecba71f9397f2be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812213, "uuid": "4f7f6642-bf3f-440d-9c56-b29eecfeb777", "comment": "Malware payload (Mirai)", "value": "6150972857b45f29dd37d503a1f90a5c833e4e0419a10ecbf2342931677d0231", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812213, "uuid": "6244a926-5425-447f-971c-26e1beda2edf", "comment": "Malware payload (Mirai)", "value": "e95625de086d574591fd4bd56972456e68cb36db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812213, "uuid": "927c095e-0e93-461f-8423-c5dfcf5047c0", "comment": "Malware payload (Mirai)", "value": "12c52c12f9daa8c67338da037261ce5cab026abf155b35a0b296613c87b5e62c67ea0af39a629d35507b7ed121af109a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812213, "uuid": "9168d1a5-3fe1-4f74-bae5-84f28dbb50a7", "value": "T113E3F845F8418F17C6C612BBFB5D428D372A17E9D2EA71039D216F203B8BD6B0E36586", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812213, "uuid": "ad19ce7d-175d-472e-b1b6-cf65ac30d4ae", "value": "3072:J/RfCNaL2tGeQaZdSvfleF3pc2k7X2SwfjrugMhAD:FInZQ+SvfUpc2k2SQMhAD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772812213, "uuid": "361ae648-fd1f-4163-b2ce-1d4a71c160e0", "value": 145448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772812213, "uuid": "dbe6adac-6b12-48ce-8ca6-e3bdb6fea3c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812213, "uuid": "690120e9-13fe-4d83-8f15-b580e0686104", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "034a27c0-196a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807853, "uuid": "6aa1b016-0e82-4f83-b364-2f430935fac8", "comment": "Malware payload", "value": "ba59f84eba753360edfece2df6e161de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807853, "uuid": "23316da4-2568-48a6-b0b9-6989c969050e", "comment": "Malware payload", "value": "618577e56628367433a296514db3ecb93d736b74a7366a964774355010f664e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807853, "uuid": "328604b9-da1c-4c04-9df0-eb6e123a8036", "comment": "Malware payload", "value": "8f15e2f7155c5ebe128a3b2ed5022e84827b95e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807853, "uuid": "ee4d7e73-c7a0-4d81-b87e-a744d12beddd", "comment": "Malware payload", "value": "74154dbd00c5281ab0bb20a3084d8595cfbf2c4f1052d49baf1989f3746193ae2ba64f4d7433bcab95d8df234127dc26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807853, "uuid": "cda7d051-0bab-4b5e-ae8b-2863483d4411", "value": "T156151202B750C42FC4570B714A76F2B96772DD446E521B4B27C4BF6B3C723A2DA0A39A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807853, "uuid": "5413f774-e0b4-4622-932a-9ad7db068ab9", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807853, "uuid": "80112f38-4dec-491d-82e2-85f5e23c776f", "value": "12288:1RpmoFy2cDVMbBvbvCD+2Xpq2NRF7+CHSy7+8892YTQ/Ue1Txon6dB9mf0+5CtMB:1z5y2cDVMJbvC6m7yQ89PMUmTz1+5Vv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807853, "uuid": "a1760762-062c-468b-94f4-d6d7978ba956", "value": 949536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807853, "uuid": "d5c03e76-8c88-455a-befe-92d3a565d473", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807853, "uuid": "3233d874-488b-4282-9b30-0c03f955ca17", "value": "618577e56628367433a296514db3ecb93d736b74a7366a964774355010f664e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72305723-1985-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772819636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819636, "uuid": "1f60e5e0-8aa2-4b71-8626-314b2130aed9", "comment": "Malware payload", "value": "1dce663ce3b420e25d6de86102388c57", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819636, "uuid": "b50a8b3a-3a14-4177-95e5-7ccfeba90bae", "comment": "Malware payload", "value": "618975cfc8db362cb387777103e9721a2e809f301cf8308eb4ec39d80e3fcc03", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819636, "uuid": "587d7b00-ff94-4c1d-bee1-7fabe1b50b23", "comment": "Malware payload", "value": "e0afc71146e1dcb3c67279f43b91e53cf52d987f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819636, "uuid": "839be042-7792-4d1e-83f0-adf19d33a894", "comment": "Malware payload", "value": "4abf964c099d42c3858e9038637083c23b0ea1e2a55c09657ece479f4f37cd2acade9aea1ddc2797a303b8415baca873", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819636, "uuid": "06f5b42b-da27-4299-a8b9-df666dace10f", "value": "T14B1198CD3505495EC976EF387F6187B29248E2C7B8C0173569D8AC27186463878AF93E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819636, "uuid": "19fa82f9-0b20-4e4f-bf3a-a4d9e25228d2", "value": "24:tdo6oOo3oOomoFoaoK8o7ocQq7yFxdhIqr:zbFMZLy/YYbfOFxnr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819636, "uuid": "154db233-0f83-4bd5-ae02-d4fbe10f193e", "value": 921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819636, "uuid": "0dabc537-449d-4821-9d43-201f5f896db9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819636, "uuid": "57a085be-4f8f-45d4-8c60-16be967058c5", "value": "milan.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "773c27b7-196a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808048, "uuid": "d8ed6c71-048f-4808-8c03-5762e475f789", "comment": "Malware payload", "value": "a64e5eb64d2980b7817627262e6e0b79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808048, "uuid": "607f87ae-e228-491e-af5f-eead292f304a", "comment": "Malware payload", "value": "61a6dd82d55d890c38d6d6649962549f634340275d4838ccac38df5d60cd6641", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808048, "uuid": "f93b598c-e0c3-4a8d-8bc6-3af904967cfa", "comment": "Malware payload", "value": "eaa4ae882f5360fd740f2132e65f6975b959036c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808048, "uuid": "b6e3541f-d346-4dfe-afc6-96ed076add2b", "comment": "Malware payload", "value": "d34c7731d17d5aaa4db9e8c7927e64dd83eaea4c00f71188a831ba3a59510f2b37267e09d4bfe04716ba1d35fd9dad0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808048, "uuid": "6907849b-096a-4cb6-b4aa-9c32a056b2e7", "value": "T1FD94E516EA60B0A5F49349702D78A25A392D3D3A2640EC0BB78DDF463B7199374F931F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808048, "uuid": "1ec09fe4-6ccd-4dff-a6da-294fcdf68689", "value": "c70c44f51c21e1f8732ed26038d85562", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808048, "uuid": "9dc5f4a9-8308-4c8f-b135-894c8f8c5fc7", "value": "6144:8XNqXmDfXyrEyY/AJtW76NiEE3SzW0EXbVB0c/hwb8RBGp/CraguQ1IvjlLbiQ+w:8XFXy6t76NiEE3SzWltWmM/CrS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808048, "uuid": "0c715a7a-8dbd-47bb-8cd2-957a85476d8f", "value": 409600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808048, "uuid": "6fc5ad51-986f-4fd1-a753-933cdb636abd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808048, "uuid": "646b03c8-c062-4e75-b19e-a8850410877c", "value": "61a6dd82d55d890c38d6d6649962549f634340275d4838ccac38df5d60cd6641", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eb883cf-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772810181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810181, "uuid": "4d5a2f3c-67bd-4f9c-a311-e52fed1d0ec4", "comment": "Malware payload (Smoke Loader)", "value": "bfef3bf8c26ee66cab64cc9a997ad94c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810181, "uuid": "70fdd02a-d00a-460c-9303-15813461de2b", "comment": "Malware payload (Smoke Loader)", "value": "61bf4833dc24be291e3a21803a8b47a397fbd8d706267e64ac0b7aa24a5d5fad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810181, "uuid": "75220032-a58f-497a-9ce0-8cf75bf7c425", "comment": "Malware payload (Smoke Loader)", "value": "e1efd876b02d8cf86e11cf7ca8eb976ca53a3367", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810181, "uuid": "a2b131c8-ca31-418a-baba-65607b4e80e3", "comment": "Malware payload (Smoke Loader)", "value": "0ae3a8a075699de25e5e349ad08879ad4f97168557560559aa0f2e01bad3efded19023aedaa4a2dd4ff7cdc5189b0fc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810181, "uuid": "372e3a9d-6df9-43a0-a883-babba45fc1ff", "value": "T153B539537C819074D5EAF238A9B01256B3B0B848473037E37F967AB95D767CC1A3A398", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810181, "uuid": "3c5e986a-6b62-4e66-b3b9-bc8579c16b33", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810181, "uuid": "7298cd04-7f28-4afc-8ad3-259d85c30e3c", "value": "24576:XVzLWmva3oT/T33lGOUXZEpou2oISgnDOvK1I01G:XV3Wmva4T/T9ouWSgnyvK1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810181, "uuid": "95906de6-4af6-4560-8bfc-9a3960996b96", "value": 2296832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810181, "uuid": "99be79e8-b5f3-491b-85d8-e638bca9d2f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810181, "uuid": "d9be6d8b-884e-4d87-9fd9-7d60e5239593", "value": "61bf4833dc24be291e3a21803a8b47a397fbd8d706267e64ac0b7aa24a5d5fad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3267b372-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1772808362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808362, "uuid": "a5bc4a0a-08e3-4c70-ba45-3d172069daa5", "comment": "Malware payload (DarkTortilla)", "value": "13f0f52cb6b7dec59cfb027295bf74af", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808362, "uuid": "4fb45a36-0b6c-4e74-a854-3597850bb574", "comment": "Malware payload (DarkTortilla)", "value": "627377ca652feeb00041406f9db5a9489c8b4ad07e798762a1394e907feaa959", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808362, "uuid": "4a8914bd-1b47-41f3-860f-cb2705845fc4", "comment": "Malware payload (DarkTortilla)", "value": "a2deaade79362297c05bb21a6895c6509b4a3aa1", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808362, "uuid": "f43425c6-6880-423d-b649-1fe5907a0654", "comment": "Malware payload (DarkTortilla)", "value": "57c8b1b88788b66625299d02079fe4f5fc6d192856f0bbe41bead36c14806ca00647f6388c61a0f38e53eba585a0c2b3", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808362, "uuid": "3d59f5d4-5532-4e40-995e-0164c80b5972", "value": "T1B655E10B27C04A64E5FC8B75D3B900E543FBB71B5722E75E680A11F78D22756AE01BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808362, "uuid": "cc81dea2-8240-42eb-b75c-ad18427cf5c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808362, "uuid": "ec4c5f12-cf1a-44fa-b456-d7eeb8b114e8", "value": "24576:6sfZNC8ZHKJCX0fI8mVS7GSLCFKwWd2KezQuwwsvRjS:tZWWgI8mcCSLHwk2RMBJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808362, "uuid": "1eacab16-8507-41e8-be32-244797c58c4b", "value": 1386496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808362, "uuid": "a86ade45-d0ff-4a16-9fa9-ecca6bb3d89a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808362, "uuid": "ec3f698c-8a4f-47a0-afe4-0be13ba1eca5", "value": "627377ca652feeb00041406f9db5a9489c8b4ad07e798762a1394e907feaa959", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f4fc6fd-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772811309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811309, "uuid": "9b46c88d-c047-4dea-bcd0-378afcd61771", "comment": "Malware payload (Vidar)", "value": "133e519a95fe4e613a1abe54081587cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811309, "uuid": "cc64e4cc-9ef6-4dca-9256-fa9f24aa57bb", "comment": "Malware payload (Vidar)", "value": "62a5e40ce8684d549b48540e07559b3fa2a00354cb30ad352101f2b12e29780f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811309, "uuid": "cbb94f8e-16ed-4983-b7b9-109901416dd9", "comment": "Malware payload (Vidar)", "value": "8793ba264867f45771feebf6da8c908477349771", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811309, "uuid": "283d2aec-c03c-4b56-86f8-a1d0cc42965d", "comment": "Malware payload (Vidar)", "value": "6d8752d3e71a1d276e394ddbae69f505f25223ef9f0263e328068b583ec5e757bc0331adce16ba8da781c9d1a68e174b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811309, "uuid": "904362e7-eb4d-4cfc-9784-5b9c53248521", "value": "T149C539AF9D9219E9C4699371C8B6C1D2663BF869073E63D31E407A301E726D44CBFB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811309, "uuid": "9741bf91-32ee-49c3-a6d9-466ccdc3fa79", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811309, "uuid": "cb3c5d71-31b1-4d05-93b5-d28eb6adcc23", "value": "24576:b89c4QLYCkmAeijpHDlltSRm3Z25PpFWIc/ZMaoD1rtPobI+/Tisi:b89cxLYCkTeiRlW5PvOK1sBh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811309, "uuid": "856e64c8-e000-40ad-b92a-27152d14367c", "value": 2534400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811309, "uuid": "1b581eae-5c80-4ede-bb4a-fe0ac4d6007b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811309, "uuid": "01b55d97-3875-42c5-9753-20acdc80106c", "value": "62a5e40ce8684d549b48540e07559b3fa2a00354cb30ad352101f2b12e29780f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29b093e7-1977-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772813501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772813501, "uuid": "b23ba5a0-435d-4be8-9d42-fbcf301ad045", "comment": "Malware payload", "value": "3024c175054363148639e437d815f5f7", "object_relation": "md5", "Tag": [ { "name": "pw-ryos", "colour": "#D57FE9", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772813501, "uuid": "8d7cf200-70cb-4573-a1f7-003f1bd81b8f", "comment": "Malware payload", "value": "62b0303d06a6c3be5cef2d8205d93f79d991ae7823a6d6a458bee1a095847f3b", "object_relation": "sha256", "Tag": [ { "name": "pw-ryos", "colour": "#D57FE9", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772813501, "uuid": "b870dd20-2d35-43ca-bd8a-95fa608537c7", "comment": "Malware payload", "value": "8ff330dfdd54a72bcfe613905463a04612d326f5", "object_relation": "sha1", "Tag": [ { "name": "pw-ryos", "colour": "#D57FE9", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772813501, "uuid": "1a10aeb8-34e6-432b-81e8-4fb541a22d01", "comment": "Malware payload", "value": "89eee9984f971eeecfc4840fd27e5f98462d7e2b6b52c51b124cc944e06211767c66b39c162ae5f1a58dbc19a3b1921a", "object_relation": "sha3-384", "Tag": [ { "name": "pw-ryos", "colour": "#D57FE9", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772813501, "uuid": "dedd1233-20e5-4ad1-8c29-14e5d2e52ccf", "value": "T1D716331D910E3B28EB304A3671F2A9629ABF7F40E0502103539D5B81E145FEDFEE5E69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772813501, "uuid": "e6233845-d4e4-45f7-ab2d-81b02f78cfe7", "value": "98304:dW3NYhG/29XQrzoSr81sjIEP+zbbSop873Hbdo9i:Aetw81C+zU7Xboi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772813501, "uuid": "b32aa2c2-834f-4dd1-87c3-8df0aff9b773", "value": 4326297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772813501, "uuid": "d6ccbcd5-444c-4d1b-a3b7-11be7e92fcab", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772813501, "uuid": "ccdb5eec-7776-4c0c-80d7-a06f77320bd8", "value": "Bootstrappper-9.991.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0af83e93-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772808296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808296, "uuid": "2e085c1f-7cc8-4a14-9fae-2e30510df4df", "comment": "Malware payload (Formbook)", "value": "4e472ff0280677a49773831908e4ad2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808296, "uuid": "babf36b0-817a-4ba7-8f66-b01558fefa0d", "comment": "Malware payload (Formbook)", "value": "6349ffe959c00ab04329bf59e7bc1cefaca892bd112077d6ec4abdb0891d3b1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808296, "uuid": "ab7c91be-36c4-4fad-b25e-d4a90565acc1", "comment": "Malware payload (Formbook)", "value": "173ade348797fcd596a41db973a568dc01aee11d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808296, "uuid": "cac98ce4-5a36-4a63-99b4-beb088c151de", "comment": "Malware payload (Formbook)", "value": "fae410e01816a5e5d042eb18ed354fd79bc7697e34792cc32b77dced26b739336e5c8794989ce5cfe04ed5a680e966ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808296, "uuid": "aa9732eb-4273-46ca-a581-2f553ad11e32", "value": "T1F635235162CCCD47E89903F58A72E33053B8DD9D7921F3528ECE9EEBB8977818848356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808296, "uuid": "c5c4327b-296d-4d3f-a950-265b5990375d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808296, "uuid": "3af1a411-4fbf-41d6-a718-6d2ffa382095", "value": "24576:psjguQlVictCgnLKYnM4ts2i9F8H33X4M2OCn5/o4ZrFty5X+ka:pssuWQcngbjWHoRhnJo4Jy9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808296, "uuid": "6c2ab6bd-9a87-4787-a9e1-1d2cf93559ad", "value": 1093632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808296, "uuid": "892af168-7c03-4289-928f-d6b821d081c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808296, "uuid": "750def61-141d-429e-86fe-b2cee1ddc2a6", "value": "6349ffe959c00ab04329bf59e7bc1cefaca892bd112077d6ec4abdb0891d3b1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8c80b8c-198c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772822734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772822734, "uuid": "2f615c06-19eb-415b-9986-d86b29fc2b8b", "comment": "Malware payload", "value": "b7a3fe9d4782920be951f343b01cd3e2", "object_relation": "md5", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772822734, "uuid": "0ebb1824-21e2-41ef-9565-f9e9bf4cd650", "comment": "Malware payload", "value": "6371f599f652fe2126886c487718173008a14bf830d1a1f707201cfcc2e7f552", "object_relation": "sha256", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772822734, "uuid": "068c965e-e246-457f-8dcf-f3e0feac2cd7", "comment": "Malware payload", "value": "ef3bc448f27824d905d8826e6a5dd5cb339c782e", "object_relation": "sha1", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772822734, "uuid": "002a9858-4211-4343-960a-dfcadc63a6a1", "comment": "Malware payload", "value": "cf78653c0488c0b90eb2fbf80726ed8584efedce658ebaf3f14b8e7b36a50fa93176c0a7e1f322084f54f67b8e728a78", "object_relation": "sha3-384", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772822734, "uuid": "e7f8b135-a53f-42e7-bf3c-4e9d5b124b7d", "value": "T16393C09073EA4E04F6754B38853B66A08A9BBA49DF32DF4D0264D5090CA1754DD98F27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772822734, "uuid": "d5c5a483-bef4-440f-bead-867b3320acc7", "value": "24:95Ks/9l5lck0YTef10gdiio2Ae6rxlcsnPcYXFD1:919l5qYSfMBe6d1PcU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772822734, "uuid": "ddb56eab-0c1c-4c65-b654-5a4613be1517", "value": 93947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772822734, "uuid": "51aad5bb-363a-4caa-b547-a51bdb3ef840", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772822734, "uuid": "8fb64107-7b4d-47ee-86c7-5c86159ce30e", "value": "Odinokie_Zvezdy_Svetlano_Gorsch.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf46a5f3-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772810746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810746, "uuid": "8cf4a4b4-4285-418d-8b88-4809dc602918", "comment": "Malware payload (Formbook)", "value": "4b5d3c9bb87910786673ca1701a68abe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810746, "uuid": "2517d1fb-f482-4733-8e9d-bb5c2a822942", "comment": "Malware payload (Formbook)", "value": "638d7f2a954d485a5a85f3b010dfc6505f8677a05f69cce79d482dde618f71a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810746, "uuid": "45aea7b3-90c2-4c9b-b342-de63c6543709", "comment": "Malware payload (Formbook)", "value": "fce1b4873196dd80c9b451f02cd2404ccb925e5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810746, "uuid": "1d6b5cd0-0d5b-42b5-b9c5-1b3f23f1df93", "comment": "Malware payload (Formbook)", "value": "d83be69d0797e5a9d4a9f5de5977702338b51e6177becdfa37fedc895fc6ce6e717c62ea2def035f08745b6cdd1f219e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810746, "uuid": "30ddb1af-d976-4dc9-a213-e0daec73ef4a", "value": "T1C6641216375AE827D5D402709DB266F6D9AB9FB8042853432F103FAF7DB13B18A1A317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810746, "uuid": "264b3a99-8959-4d53-a7cf-9b97ea3d42fa", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810746, "uuid": "510065ea-b3ab-486e-8716-8c9d946e8e2a", "value": "6144:IR+xXxGYvlSHBdWjF3e30X1XtibgaBR9VKmrElOxqlNdG2t4SpQyjH/McLoYE:AcG0gBEVIg1Xog89VJrElHlNdG2thQya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810746, "uuid": "ed1d3142-4ac1-455d-8c2c-ac7f44d82c12", "value": 327480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810746, "uuid": "a111aea9-7f10-40ef-9d20-5b8a7b42fb98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810746, "uuid": "1fd3b97e-7278-446f-8d85-9dffaf054b45", "value": "638d7f2a954d485a5a85f3b010dfc6505f8677a05f69cce79d482dde618f71a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "102ae1a8-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810881, "uuid": "2e2b7f49-6f73-4961-8bb7-6b515eec3814", "comment": "Malware payload", "value": "de5fd5655f7a8a651ae8b4345fead359", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810881, "uuid": "306a2150-3903-4555-a849-18961a5319c5", "comment": "Malware payload", "value": "63e15f73bcfaab46aa55adaefd8117ebd0be1cb29713d3a9074e1a91c78d82fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810881, "uuid": "f488e6de-76dd-4cb3-8185-c79540f6efd6", "comment": "Malware payload", "value": "392d363f079cf4c80498c6b98c3b7399e661d7e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810881, "uuid": "8a2dd05e-2249-40aa-a0e7-b27698ccb2d8", "comment": "Malware payload", "value": "1f369870512aeac465cef7e50f32436379a70d20ba5baf5f9ac1f0238cf95c2d571bb0751381bc99a4599ce224b51112", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810881, "uuid": "a493e436-1570-4bb4-8464-b356108b42da", "value": "T11AB4236973E8C923E96A5E36CAFE1A5ADEADE4035024630FDB20DF2C3C2775015993D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810881, "uuid": "856ca270-9ac0-4a08-a8d3-6edf8337e5cf", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810881, "uuid": "31b8b3a3-5bab-4791-bc6b-13fcb6276f90", "value": "12288:Q1yDJzhz/8dNXPTvMPng+7qgYNjulSzcqYO:Q1yDJzhz8XrvmnX7QNylSKO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810881, "uuid": "5ca4eb10-c9d7-4c94-8f82-42df19d89bcc", "value": 535592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810881, "uuid": "7271071c-b7ff-4c10-9c0a-4b6e8223f402", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810881, "uuid": "1c3fc49e-9332-47a3-9f35-458a385573eb", "value": "63e15f73bcfaab46aa55adaefd8117ebd0be1cb29713d3a9074e1a91c78d82fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17e16285-1972-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811324, "uuid": "6cb69c54-b08a-4a87-b83c-d9e4b9075870", "comment": "Malware payload", "value": "d78fec4f96713d609e12936554ee3308", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811324, "uuid": "30ca8e40-f089-4ffa-b7e8-6b698879c660", "comment": "Malware payload", "value": "63e6fd867484bf1421ad7b525bff9630ff6a0bf042ffbd388dd2d5a5716358ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811324, "uuid": "7a98350a-0944-40be-b13b-9e891d8024bb", "comment": "Malware payload", "value": "8018f028f697c3d2c3916a19ff66783ba3c2dbaa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811324, "uuid": "5110caef-001f-4ede-83b2-4ed07a1dbf17", "comment": "Malware payload", "value": "20f37122de774d8fbcbb24079611b48b0f8cee32cbde4bd56578e50901d62238bc1ecae66c0f0326863ced154152c200", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811324, "uuid": "31edcc85-d1f4-47b2-98d1-8055205cf37c", "value": "T10C9412063DA6D05AC98314710DB2A9BBC974ED6DA418871337B13F0E7A71245BE4E3E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811324, "uuid": "0deff5f8-fb53-4127-8ee6-f8fce2c0f566", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811324, "uuid": "3741f739-1428-4132-a48b-1f689b300bea", "value": "6144:nwq3NpGrARtjLMJMIk9UAPFBQwIWXAELpTagWDKslQKGuSzfz7q7:nzSiG1k9dtBRI3EttWDLQ33y7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811324, "uuid": "8e32f49b-1da4-417a-a034-134e8b0bdfee", "value": 408353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811324, "uuid": "939ef1b4-959d-43f6-bd06-288f44da1b11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811324, "uuid": "5f131734-e854-468d-a33d-a25dce667788", "value": "63e6fd867484bf1421ad7b525bff9630ff6a0bf042ffbd388dd2d5a5716358ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd607dbd-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1772809561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809561, "uuid": "d772e2b9-eb3e-4e7a-9e3a-2274548df341", "comment": "Malware payload (GuLoader)", "value": "6bd61fa1cc45c7721a34123449a5442f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809561, "uuid": "e7f28be0-394c-4335-9990-0645db7d79e9", "comment": "Malware payload (GuLoader)", "value": "64aaa3dc6c606a2c1b6015db31526762f465ce9b347d06e2cef0420cb6199a5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809561, "uuid": "f50f8c3d-0e34-4b33-b2ad-2a48fb33cb75", "comment": "Malware payload (GuLoader)", "value": "9499b25d10eb98dc58282f5e26c799d056cb71b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809561, "uuid": "a5854600-e79c-4dc0-8810-71cc9db4c979", "comment": "Malware payload (GuLoader)", "value": "4293d83c56fbbd421922083f3bb880ceb9cca61ada8563ad097a5f2e2aeacc81c9c194afbc382230ee16b27c7566f020", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809561, "uuid": "1418e6a2-abb8-4013-ac98-d9f508b7dff2", "value": "T1FD44120672D1C1F3E5734B748D3B9A3BE6D5CB122191960B3B753E6F7CB2306092A162", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809561, "uuid": "bf679a97-2db9-4474-ac98-258f679b0a0e", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809561, "uuid": "3b7802d4-7b3d-4151-a23e-3bfab37c3f45", "value": "6144:0cBvWb0e4vcCmotxJNIKduziH6+2Rk+VzpA1vqloiE0QO5Gq127:dO0e4UCZ/Jp9a+GtAVyoZoLW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809561, "uuid": "39f3cf7a-832c-4239-b943-808ebbca12a7", "value": 258680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809561, "uuid": "2fd61cf2-f7e1-4a14-b814-51e1b47a6744", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809561, "uuid": "7d906542-6cd4-4478-bdbe-7fd732c2d1a3", "value": "64aaa3dc6c606a2c1b6015db31526762f465ce9b347d06e2cef0420cb6199a5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a7c79b1-1972-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811409, "uuid": "c85bfb44-1655-4d46-bd80-8d75938c099d", "comment": "Malware payload", "value": "f1b572df273d3b3661a494bcaa01f59b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811409, "uuid": "b3b5d3a5-8622-4ea5-9aac-9b9223511703", "comment": "Malware payload", "value": "64b46908a7d14db0bc2f7dca5bf479e7570dbb60fcf6d01ec2c8627912918cf5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811409, "uuid": "c170d000-2607-4767-a54a-f23ad6c496ac", "comment": "Malware payload", "value": "7a160fab8d34fcdc585aa4c63215af04050e112a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811409, "uuid": "3287884f-8bd0-4cd0-bd3d-322b9af1bfbe", "comment": "Malware payload", "value": "a069665026c5c9b0fda14718741fd5d16b264617f9f4eeb9df7d10fd778bb626dcc79bff2b490c2410148a59748fbecd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811409, "uuid": "9568a70f-5c6f-419d-bfea-5d15ebf399ae", "value": "T1B735233B03C3A663E894E77099BE06980DA4390F5DF9B6C9131DC73C3905DD2DA6D261", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811409, "uuid": "efd09195-2b14-46b7-9829-da9a4f369f02", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811409, "uuid": "c2d3cc88-9de9-4536-ae3e-1ebb855ceeba", "value": "12288:og5xD+s6owgJzgQOekDU+MKemqc1Ptnq6WwPSroVjvprHI4oFzSYKVP8L40lc2qi:ogJ+kLHdKDqcVWwPYkjteS7mE+39Xyfq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811409, "uuid": "a74f1a8a-71e1-487b-8eee-a019ca2f1256", "value": 1081224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811409, "uuid": "dd38c258-ca33-4afa-98ec-96c9c1ece656", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811409, "uuid": "8f8c0068-b212-40b8-a4fd-6d52e903f748", "value": "64b46908a7d14db0bc2f7dca5bf479e7570dbb60fcf6d01ec2c8627912918cf5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddd3afb2-1969-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807790, "uuid": "c18ea50d-357d-4ba8-8a8c-ac13dbfc5484", "comment": "Malware payload", "value": "e2bf458a4d70197f6814b604b6ab7f7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807790, "uuid": "0c59185b-b1ad-4a3f-8367-806bb10c3f7c", "comment": "Malware payload", "value": "64d9d1874ea3494861adaf7f6799fb693e5cfa0b2f7b35f0fe12b1c55ea34f0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807790, "uuid": "9692a352-49d1-4d2e-8602-ee38ae357390", "comment": "Malware payload", "value": "42d6654b066ac70f68137192892c0f3ba332da53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807790, "uuid": "d4e2e76e-f502-4765-aa69-09e01b6daba4", "comment": "Malware payload", "value": "1db04599e7ee4fc85920b4f1200f9148c5dd1ec7a28a4183bf41308a9d2c3eb4232097ae4541d73044756c0dcbeb1bda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807790, "uuid": "6d3a5e2b-542d-4bfd-8e00-02faadfd38cd", "value": "T1380512601741689EE0634874ACF27375F7A89E66376CC3827A90F598BD3B7464F243C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807790, "uuid": "b2453d30-8ffa-4616-9cee-605453c86abe", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807790, "uuid": "e352aa74-d7b3-4d09-b831-6b21c27fb24e", "value": "24576:mHO/MdQm3oOS0yqUWBhPaWdBz6kqd43jbz1HVkMIwSqLbBYNGQ:mHO/uHyqraWdBGzKb0wSqp9Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807790, "uuid": "25d25fbb-69ac-402e-b65b-4a7a200e5f03", "value": 856305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807790, "uuid": "c01f2c4f-e4ce-474e-abdf-52269e3cb436", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807790, "uuid": "f815f38e-3a23-4fbe-a492-7e49c190f568", "value": "64d9d1874ea3494861adaf7f6799fb693e5cfa0b2f7b35f0fe12b1c55ea34f0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4319b10-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811237, "uuid": "3fc3d8ba-6612-4f3f-a2dc-feebc9e5a65d", "comment": "Malware payload", "value": "f1d724264a17b14f2f0286aa20a84cb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811237, "uuid": "bff5399b-3868-407c-8f60-08e3757102c4", "comment": "Malware payload", "value": "6537d9909f868f54149f91a607b180ac6f6797c9859ead899a6445dabdeb6bd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811237, "uuid": "788717f7-09e0-43f5-b357-93df03bd4cdb", "comment": "Malware payload", "value": "bcd87b79b5cca83a6558531713cfb73343a5eed7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811237, "uuid": "2a5ea853-9f99-4b41-8390-5c144c218a22", "comment": "Malware payload", "value": "c9493cc3b90a16a8622da72eba0ccddba496bc363bfaded8818d73a22b08504d85166454dffd7f019d5fe7b811c2b31e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811237, "uuid": "28523f1d-dc6b-4edd-aafd-b9d873c9a2d2", "value": "T13494222016B9DCA7C5E205709A7BABF9DBAB8C942541438B9F683F573C732B6811D343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811237, "uuid": "5872f384-c7e1-47e0-b520-5cc7e15df382", "value": "9a16e282eba7cc710070c0586c947693", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811237, "uuid": "549c45a1-084c-4fa1-826c-9ba8b6719b3b", "value": "6144:lfYBQx6zVFxj7XWiDjL9NsDiTJ7m5nYJFqOsKkeahz6VmNF/Z1Wjstep:KQxst7XWiDfsI2nYJMx6cqsYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811237, "uuid": "59f6f8a4-2bce-43e2-b07f-31bbb906514b", "value": 421664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811237, "uuid": "98cadb3b-cf2c-4b2f-8b03-856deef770f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811237, "uuid": "97b0cf58-a836-4e8d-bfbf-0bce2a7d0a02", "value": "6537d9909f868f54149f91a607b180ac6f6797c9859ead899a6445dabdeb6bd6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4094b91f-1982-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772818264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818264, "uuid": "a8473628-a252-4bba-b368-4ef76c9fe371", "comment": "Malware payload (Mirai)", "value": "cebc862c8b21de091c79c37a60183f09", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818264, "uuid": "b3f73c61-2db7-4dfd-81f0-3d79ac48f4e3", "comment": "Malware payload (Mirai)", "value": "659fc80e372398501e9875260e870e8394c61546d5842fa15a3ca2a36141125e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818264, "uuid": "c1b9466b-1400-4324-a5b3-4b5c54c8a898", "comment": "Malware payload (Mirai)", "value": "3c2c704550f5c85db47eabeaf058a09c86b1d317", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818264, "uuid": "59912dfb-b3f7-473b-b513-d5792b3330c4", "comment": "Malware payload (Mirai)", "value": "af5eac4080faba17a2be60b3eb0956f6b7194165217faf0aed450afa7756b880505f0d6abe3943b92251031bc39c2e63", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818264, "uuid": "c3cd858c-878c-4ce7-81a2-28b3aedd47a8", "value": "T164344B45FA418A13C4D117BAF9AF414A3332A795D3DB730699286FB43B837AF0D67602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818264, "uuid": "7b651c8c-9048-4b9a-be15-223286d58240", "value": "6144:W8tTPA7OBzabKacEK1dAnJd7pLfdfM/9hWfAU:W8RAqBzabKacE62J7p0/yJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772818264, "uuid": "84bc637a-fabf-4042-965b-8c6a44283241", "value": 231680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772818264, "uuid": "754d6ede-e3d7-4f92-b5ad-ee6519d68452", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818264, "uuid": "fee66397-b6e5-4351-a13d-023c102cfdf1", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03228519-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819020, "uuid": "4de9147e-5bca-47f5-a738-04099c9d4ac0", "comment": "Malware payload (Mirai)", "value": "d3f71db2624bb69ba15cb9d39a5cae31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819020, "uuid": "eef88c25-9791-4fb4-9fa7-c8650318d8fa", "comment": "Malware payload (Mirai)", "value": "65b84650ff8480e82f6398afdf33f51679f31cf57e4a451d78f2c7ccea25c7d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819020, "uuid": "785faeaa-2b7b-45b4-8726-203147801494", "comment": "Malware payload (Mirai)", "value": "6c0abedc04911ed56a6385482da53145146dfbed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819020, "uuid": "5f413b1c-2d0c-4506-9b3a-13ae0901ffb9", "comment": "Malware payload (Mirai)", "value": "8d77b082f352c4bf5941f9bbb763c310997c1c7909aa33b72bb126c6b9d0aecb9d1fd19f34c6f5fa56c96faed9bee2c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819020, "uuid": "d9ca18df-ee4a-4065-9dc7-ccacdbc2ff9d", "value": "T1AD434D92F892456AC6C117B6771B978A33A363A5C2CF7313CC080B6176C9A4F4E77E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819020, "uuid": "7402308d-e501-4c81-9bfa-bf7367f68c83", "value": "768:IsWcltKWWi3Z2/x7N8OMXLPtdjYocDC27Y4CEIMfl2Fr0nMz:IsBltF3YSOqPtdNcDC27OWa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819020, "uuid": "aab85b91-ecba-4a31-9ebe-8cdf4a1552b6", "value": 55452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819020, "uuid": "606c730a-9fd6-46e2-b242-6dcdb0bbcd61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819020, "uuid": "2c20a760-8f89-42c2-b0a7-fe02b32b3309", "value": "jawirbot.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "770df688-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819214, "uuid": "a0f0e227-c2c2-496b-a800-0c5dfd3f669d", "comment": "Malware payload (Mirai)", "value": "38aaca50eeb0fd5cb343895095a91f95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819214, "uuid": "a1a225e5-f28a-4799-bedc-e11be1e0dcb4", "comment": "Malware payload (Mirai)", "value": "66f39e8528c9e95baa503cf100376315656869b69b9c4e785de5fefc6abace0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819214, "uuid": "d1ef7c37-dd5d-447a-a223-1b7c0d332a19", "comment": "Malware payload (Mirai)", "value": "ed5b9d14fc1254a36b1808d17fac43f1c1df639b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819214, "uuid": "a4d781cd-20ea-435a-852c-4ba0a61b952a", "comment": "Malware payload (Mirai)", "value": "18fa41e879a98493d548af84ad3a8f4ba6ddf55d7f8da6abd6c5af4101022774e62a61758a316ab08408ac5964fc9cf6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819214, "uuid": "675adc25-2f32-49cd-865b-b6b159dc963a", "value": "T123930A45B9819F12D4D621BAFBAE418933136FB8E3FE7111D920AF5023C69DB0E77612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819214, "uuid": "871f8fc0-9517-488a-94db-8476eb6ecc09", "value": "1536:5Tnul1UvUXZiKyoFYpra1j3/pMfbhxf9lK/igCgBO797ZVYHyLs/x1HUL:AGvUh9FYpra1j3/pMfqxCgBO797PZu1O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819214, "uuid": "b4eb9776-a774-4781-8239-e5b9cd92a141", "value": 97560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819214, "uuid": "6a578245-1732-4fc7-9853-9fb59a1cf8eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819214, "uuid": "65475000-cd79-43a3-b351-956261f587ea", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28bef78d-19a0-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkVisionRAT)", "timestamp": 1772831109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772831109, "uuid": "09ace6e5-f50f-415c-9c54-17d555292670", "comment": "Malware payload (DarkVisionRAT)", "value": "54dd9cd36da312f6c89d0a2cb0ac00aa", "object_relation": "md5", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772831109, "uuid": "6a835d94-bdd9-4c77-9a6c-324855e59eb6", "comment": "Malware payload (DarkVisionRAT)", "value": "6700075bf252fbc09453df6f543d36bbd7f7a011ed2b5bf7fc86df1c4b634c8d", "object_relation": "sha256", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772831109, "uuid": "323914d4-f423-463d-bc24-41d8e233f319", "comment": "Malware payload (DarkVisionRAT)", "value": "a0aa2bea7ad211680d850e3c0a4079de9e6ca600", "object_relation": "sha1", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772831109, "uuid": "d852daf3-958c-4726-b639-cae1820960d8", "comment": "Malware payload (DarkVisionRAT)", "value": "b863ca47f46f49f52d221c3404df9bf9e500a80aea27dba944671a274a13d11f514af4d81fb8f01bd026c82b93e51d98", "object_relation": "sha3-384", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772831109, "uuid": "80de476d-44fb-4a0f-8f88-05c7c98e3246", "value": "T1D2E40222FE4995BCC406C078C30156767B76B4CA1B32AAFF0295263C3F59AE56F38B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772831109, "uuid": "f3a30e4f-3062-4e23-8d81-4aea7c5b80e4", "value": "59a9ef17b48ce0b3e398d1c5c81c194b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772831109, "uuid": "92d11116-fcf3-49f2-935a-247214af7dc7", "value": "12288:viM7rr3MzfOwaZSHsR3d3QIS1zPA1QCaGpA+DBNWg7dilMu/KNYj/gCazB9sM7/u:viMf7QOcsdtQIzFaGxD7Wg7da/AYjk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772831109, "uuid": "5bb48430-d11d-404d-8dae-ca21541b5d48", "value": 719872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772831109, "uuid": "10449267-e2e1-4a6f-9a17-58d285d60cdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772831109, "uuid": "82b5f4a0-c868-4dbf-9231-54809940bd1b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17eef78b-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772809606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809606, "uuid": "32ecb226-68d9-4a20-9848-43f05918a8e7", "comment": "Malware payload (GCleaner)", "value": "52e1cfc321c86da8f7c64946125caa27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809606, "uuid": "23e3808d-1f49-439c-ad63-3df48a285c81", "comment": "Malware payload (GCleaner)", "value": "674748de99a3341518d5a418851c3d31ad3e9087cad4c1795c2495dcb4951fca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809606, "uuid": "9a12528b-4378-49e9-a8d2-a0c476df29ed", "comment": "Malware payload (GCleaner)", "value": "b0bb252217d8631ace955dce230cc88dfcabb2c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809606, "uuid": "e7f66291-263c-428a-9994-939037b68bce", "comment": "Malware payload (GCleaner)", "value": "2774b7a196f6db59c4e858ea59ac9c88db58cee1dcd0f8823543ded3ab58762ac8b5134852e2a332435124f66c4c1b92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809606, "uuid": "578c2769-71e1-4584-9153-258deb39e100", "value": "T1C336DF1B9EBFC13BDD6CB8BE680058CFB0B38A5451EC6B30625895DCCE5F2C9246255E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809606, "uuid": "6630e813-d6d1-4e69-86f9-93ed0b63ab72", "value": "345624d13ffc2b7f296b9d2972b1c0a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809606, "uuid": "436b1983-0dbf-4a62-91a5-9bd51db51150", "value": "98304:QiZvok/3ZM4ArVbmhmBF4lgnQqBPfeLa5bOl2xkMXgAdVXA+zwMAmc:Qo9fZM4obmAmgnQqBPNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809606, "uuid": "138c80f9-7760-4ffd-a15d-1ac95d5d8e25", "value": 5029376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809606, "uuid": "83d3403a-3e80-4a70-8d0a-845ff6191306", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809606, "uuid": "1def9c0e-4216-44fa-8972-6f422480d82b", "value": "674748de99a3341518d5a418851c3d31ad3e9087cad4c1795c2495dcb4951fca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cafd3a8d-196b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808618, "uuid": "89061758-0c06-47c1-8416-7e1b884341d0", "comment": "Malware payload", "value": "52203769e93071995ed90115a56533cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808618, "uuid": "ece7bb2e-8d92-4c9d-89a3-739c8a2cb5d1", "comment": "Malware payload", "value": "67fe04b760067e121b3a5ff191b6a59caf265b66972774075df5fe0e60bf6ac3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808618, "uuid": "742fc10d-8d9d-440a-91dd-f3baeef767ec", "comment": "Malware payload", "value": "ecae632c599aee72a91704957fd60c59677245dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808618, "uuid": "05ab7869-4a56-4186-a497-13bff4b8463d", "comment": "Malware payload", "value": "76d5e24e21fcbdbdb2ca51ba3f22fc3f1f1ff60855f8fdd46d47ee578447eeb9b2b516e56873599d7ee7c6625102e6f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808618, "uuid": "4f98e188-7273-4d00-8b25-18f9c1f2dbfa", "value": "T12545BF027391D062FFAB92334F5AF6115BBC79260123A61F13A81D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808618, "uuid": "58befb1f-6811-4210-a72b-02ee185a3e34", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808618, "uuid": "5da25e2d-1d86-412f-ac42-90f0ebf3a613", "value": "24576:j5EmXFtKaL4/oFe5T9yyXYfP1ijXdaxPQbaWxpKcgOfH:jPVt/LZeJbInQRaxPQb7H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808618, "uuid": "328aa0ad-5bf3-46d4-9349-81c3d31b75c3", "value": 1247744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808618, "uuid": "6ccb395e-d229-4c45-b11c-ace784609635", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808618, "uuid": "2d1b211a-0be8-4f34-8168-1258db405682", "value": "67fe04b760067e121b3a5ff191b6a59caf265b66972774075df5fe0e60bf6ac3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d143271-1968-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772807011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807011, "uuid": "d4500e91-acda-4419-ace7-9d5449124aa4", "comment": "Malware payload (Mirai)", "value": "37a4366a29004b2dd9c6083523c20b5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807011, "uuid": "3700620e-bbe1-42ed-87ce-68eb5efd4871", "comment": "Malware payload (Mirai)", "value": "68eed2b97161c75322106029922d3ec7eb8272add423bc18d58ee3bcc4656d4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807011, "uuid": "4919836c-49f0-4c54-a046-8454e36cb42a", "comment": "Malware payload (Mirai)", "value": "96ddc8c68e4091bd73c295e3ba0331e7f78fc61e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807011, "uuid": "60109f8b-8679-4cc9-85dd-847c12658111", "comment": "Malware payload (Mirai)", "value": "d562a8f9711d8f164ffc931126a2304922ca71c240b679cbb930a5c789f8dc8578b68bb2bdde326d4b5571d0eb896409", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807011, "uuid": "3544a7e8-84eb-4004-bbfb-55f7be3ea351", "value": "T1D623F1F6D39BE07CC8B0A6B7025EB1C6946664029721370E43E232DDFD7B5986D02783", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807011, "uuid": "54870040-cd2b-4aac-9093-b85f60c38101", "value": "768:RdGwNYm3GJyOvAZhON6YONKVLQi0jytVwLRZ+v84GZ2S0Jz1b8HuR4x:2wkgI6YONsLsjwVwimoLzxTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807011, "uuid": "60e5f25b-5f55-4790-b259-3e0f16c5b34b", "value": 47768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807011, "uuid": "695e6d02-a104-4e1d-ad30-6fc2abcfc831", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807011, "uuid": "71fef915-e1e7-4402-8b3c-ba4d97d87282", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "315820d0-1971-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1772810937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810937, "uuid": "ab6bef63-487e-4888-a6ba-23584c3b9bd6", "comment": "Malware payload (SnakeKeylogger)", "value": "d5fc549db0f0c4d5c87c17a8dfe5f8d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810937, "uuid": "95381635-06e8-40a2-a79f-487a5dbec553", "comment": "Malware payload (SnakeKeylogger)", "value": "696cad6dec39d460faa61e4cf11cb5fc7f554b4e5584cab27f1e189c0cf935f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810937, "uuid": "3c4fff3c-7699-4861-b42c-04a9d36ecb2a", "comment": "Malware payload (SnakeKeylogger)", "value": "6f1a9214029c1698e04c5dd86837c3ebca2559cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810937, "uuid": "0b668f93-c18c-4474-aace-b37b1f296660", "comment": "Malware payload (SnakeKeylogger)", "value": "b06517ecffd80d089f01402b42d939706cee004ab65ceb9dc0e26ab5ea895d5f848c2aa5f5cac134a50570539b0c525d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810937, "uuid": "79ffd658-f57f-4cd5-88c3-0b8a813941dc", "value": "T11545BF0273C1D062FFAB92734B5AF6115BBC79260123E62F13981D79BA701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810937, "uuid": "166868f2-8b3b-4f14-8660-1975186b4a8b", "value": "c1ce208b1192bfcf652c179f34f034d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810937, "uuid": "fa2deb86-c7ce-478a-a6b5-3507e8b82ad8", "value": "24576:y5EmXFtKaL4/oFe5T9yyXYfP1MAXDzcqzjT5VYplm1O:yPVt/LZeJbInGizcKT5V6lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810937, "uuid": "fbe2d8fb-08a7-47b7-afa3-460d46177814", "value": 1257472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810937, "uuid": "91536a84-47f6-42a5-a442-192b074835ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810937, "uuid": "0436c2e0-df6e-4e9f-8eb9-6372ba9eb726", "value": "a1eac05b425841350c27d46607b35627c810d1454fe6037458f5b31739885c74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13a7f4ec-1968-11f1-a769-42010a9c0008", "comment": "Malware payload (Kaiji)", "timestamp": 1772807022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807022, "uuid": "c515e146-a2a2-4498-a82c-7929560ea9c2", "comment": "Malware payload (Kaiji)", "value": "fe4617f616fc3aa1ad7222f9ef434046", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807022, "uuid": "00bf5a6e-ffde-4634-986b-9cd9bd3e8cab", "comment": "Malware payload (Kaiji)", "value": "697e5f7231245db67804794309ecbc55d403c20f9efdda785eaef08ebe02dd63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807022, "uuid": "2e659fcc-3275-41c5-83a2-330944d5d0c5", "comment": "Malware payload (Kaiji)", "value": "78f5f55a20e53123fd4cb03f759f9010a7d6c014", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807022, "uuid": "270eb9e5-8f99-457a-8033-d0fd9525e94f", "comment": "Malware payload (Kaiji)", "value": "79c50d1831c1736fc3767d61bdf049e2046ebb8c405d8700d514204cc9b57f751c37b3e27824d0d394d31c7d942e5e95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807022, "uuid": "8c666503-dc95-4056-b7fb-e54d6544639d", "value": "T196A5330C7059913814D49B99EBCBB4E805023A28BEAE2E0F47176BD6305F9FD49617BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807022, "uuid": "cdce18fb-d4ed-472f-8e1c-a15b926cc5e2", "value": "49152:zVU8xqZzWitdN7MIqZxl4CNrRVuSt48wwnSwKp:zVq5WiT4xHlfBnw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807022, "uuid": "196bc1b9-24da-4e15-8dbf-e3abc2bba4a3", "value": 2067688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807022, "uuid": "c1ecd23a-ef3f-45b4-9875-f05fed9fa00a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807022, "uuid": "68bedb33-85de-4598-8cb4-1984f216f6ea", "value": "linux_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9f5c52f-1939-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772787114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772787114, "uuid": "72ce9419-6e4f-4c21-bef6-ca343cfdb012", "comment": "Malware payload (Mirai)", "value": "979998b15cd5be3c394801b8742440da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772787114, "uuid": "dcc8b84d-01a7-42d7-94ba-0592f4128d5a", "comment": "Malware payload (Mirai)", "value": "699b40606a134fdef5dd5ff6a5ee1de6ac351d2bb36dd4e731fbe7e53d0ccb87", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772787114, "uuid": "58a4eecb-a4c7-48dc-861f-03a5abd71b91", "comment": "Malware payload (Mirai)", "value": "5e2bc58fea713d84708a4ce1eb06b628044ddaa7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772787114, "uuid": "6a84d525-11ba-4e4b-9bec-57999638b027", "comment": "Malware payload (Mirai)", "value": "b47ae6df53e7e6864e66da3d8cbf452db5d5a9553134017a0b61eff9fdb1385827a832395e95f3cd19c304c1785a69b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772787114, "uuid": "8ac54850-81da-401d-a13f-e5c95c573477", "value": "T19BF31795BC519B16C6C616BBFF5E428D372A1758E3EE7203CD256F20339B85B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772787114, "uuid": "8724c3bd-c1cc-4e42-aa01-5cfd485d25f1", "value": "3072:9/GP143xpXFi2ibsip8xI2V9jDs/4+OBWg+LwemLaGMW:9uP143xpXFi2izp8xI2V9jA/4+CWg+Lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772787114, "uuid": "70f590ad-03de-4933-8b3b-dc8c9f693c39", "value": 161080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772787114, "uuid": "4dfd1d72-d1ea-4ba9-8073-51d28e21b76d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772787114, "uuid": "a815a177-6b47-4cb2-8c4e-d3702dacf06a", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "519de767-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772809273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809273, "uuid": "981ed64d-e047-481d-8128-97aadf78c558", "comment": "Malware payload (AgentTesla)", "value": "909e7aa7deef2c9ddaee711f556dde2a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809273, "uuid": "869d112d-69ac-455a-8eaa-03d80cc95b7f", "comment": "Malware payload (AgentTesla)", "value": "69d0dc781e1674538b7ff6d180dc117c5fbcd154745b5642a26acd5dae2a2c4a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809273, "uuid": "1509b27c-449d-4470-89f4-1a2f1c0e6311", "comment": "Malware payload (AgentTesla)", "value": "400eb5b76e238c8f95156f127aac8b1d30dbffa9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809273, "uuid": "edbcf66e-313f-4144-86e6-1f1283fec538", "comment": "Malware payload (AgentTesla)", "value": "abe1fe89d04771212ce68689ec05541ac8601792a8abfce7bd8eed34a5bbf2caabd5ab85b39c110554b70627f56c671f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809273, "uuid": "5a8c4993-f586-4449-8112-0f231f3efd5e", "value": "T1D484124979A5C06BD9758FB11D2ABAB36BF2EE013460531B33603EDE6D32795980D383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809273, "uuid": "56140019-7e65-49ee-b006-3cfa06088779", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809273, "uuid": "bdde4cf2-e292-43c7-aa4f-46c1e998c647", "value": "6144:w4t6LsyAWYRsw3HWstVvCq4XINGtIn8inuMcyu0+CajkTVki8ojtMjE:wkdW+Tt5Cq4XING2bnrk0+CqzTs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809273, "uuid": "ed711275-8693-4c78-85e0-e9c15fddc43b", "value": 371716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809273, "uuid": "971e22ac-96e2-4a21-bb9d-41a4f7e252d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809273, "uuid": "40293b10-1a50-4213-ae98-c05e31ce6c82", "value": "69d0dc781e1674538b7ff6d180dc117c5fbcd154745b5642a26acd5dae2a2c4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9091b2eb-196d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809379, "uuid": "48ff5efb-ccf5-46d1-b76c-e50b4887d73b", "comment": "Malware payload", "value": "4874a0bf9c3555441a1c4fe3f954205d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809379, "uuid": "8a4d8b12-bbe8-4c89-8814-892e8e7ac1e7", "comment": "Malware payload", "value": "6b189b16ba675952d19d5ed0f1098220ba7a2defa6068b70edfa35e6dd464ec1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809379, "uuid": "68451af6-cdb2-4242-9d89-87d71c7428ba", "comment": "Malware payload", "value": "93e6549f6e08f47750ab107e4ef803d55f563065", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809379, "uuid": "41658307-e910-48ac-9554-50d42900c162", "comment": "Malware payload", "value": "1cc8c007c5017ec0ace5bbc771b3ff2eab04c2181638b5695fbddb2b45cd9f0f912d0da9fa830c32e9f519a5715f7ce5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809379, "uuid": "2bd7a6be-ef2c-430b-a140-c42672d4f30c", "value": "T14584CF80E2849C97C8077271BD3ED935252FBE5F6334491A372ABE297A732935067D0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809379, "uuid": "97af970c-bcad-452a-a9a2-a31427ce72b7", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809379, "uuid": "eb270d09-4c58-4b1b-9aec-dac2ec6e4aa2", "value": "6144:V5lz/9GpewMCuSgepLjXWi4WnrIBWAWtPfMf8twbyx1pePSub:nHzYUepfGiGItXMf8tw+zpBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809379, "uuid": "cd73494e-9a67-4ce8-8924-ee32448c7152", "value": 370976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809379, "uuid": "5fba4a42-c070-490b-8cb1-65972f6e7a16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809379, "uuid": "8be4c7ab-72cf-42d4-827c-3db8dc2a24db", "value": "6b189b16ba675952d19d5ed0f1098220ba7a2defa6068b70edfa35e6dd464ec1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20f9eff0-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810051, "uuid": "9f3abb31-3fc9-46dd-9375-c1fd3820ab27", "comment": "Malware payload (GCleaner)", "value": "8b3cbdcb88ba6841fb3f11c118b3c125", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810051, "uuid": "83bd0319-c40c-484d-96c8-38b7bf0a5047", "comment": "Malware payload (GCleaner)", "value": "6b512fcb41d3fe531ea52b8e24cecb39320bc7d5ecc8cbe774f6ed77f2774f4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810051, "uuid": "91bb879a-78de-4b34-a3ee-f58a07c8c0ab", "comment": "Malware payload (GCleaner)", "value": "6b6adbe397fbb7f47a744173219ec9e17f0fbb21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810051, "uuid": "06cfe204-2eb0-4d46-84ed-e3d9703e11c8", "comment": "Malware payload (GCleaner)", "value": "aca405335ce645834ca2e09fcdc42d77aeb596240fe3d04efb6bbe439ad97e0691b53294024ed22f56630b46da64704c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810051, "uuid": "d926b200-50ff-4dfe-9c5e-98408a1f2231", "value": "T18505AF2EF1A08436D1727DF8DC0BA254942FBE90ED24698A2BF81DC89F35F81752525F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810051, "uuid": "723f0cc9-ab74-4b89-8bbd-44a054b1b8d5", "value": "c475b6e242f56325f64c2b76233f720b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810051, "uuid": "bdc018f3-b215-4d81-96a0-e0259e2aabd7", "value": "12288:deM9gzhW/BsjB7V+bRO88pvnDU3+a9EJSyHtVndNEGh/54:MK3/q7gR8Na9EJFHtVnvvP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810051, "uuid": "f257c1d0-4eca-40aa-8e7e-d56e242e9681", "value": 799744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810051, "uuid": "4588be7d-1df4-49b0-8767-11456cb72d97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810051, "uuid": "86fb4bd4-3e0e-457e-94ac-81005c516e58", "value": "6b512fcb41d3fe531ea52b8e24cecb39320bc7d5ecc8cbe774f6ed77f2774f4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f98b4d8-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819229, "uuid": "b829ff33-1d30-4239-80e0-9bf6d2ddd2d9", "comment": "Malware payload (Mirai)", "value": "61f59d380c0c781bc36d4674f47819ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819229, "uuid": "2745d03b-113e-4842-930c-c458081bf470", "comment": "Malware payload (Mirai)", "value": "6b53cd3f41fe89d3291dc4663629df9242030cdf369accc2cc50ce126e6bebf0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819229, "uuid": "8700eed2-fa23-408c-9243-2b6a1645b8f2", "comment": "Malware payload (Mirai)", "value": "a5d6a84ed3229a12c5bcb36404706c60b8852426", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819229, "uuid": "daa2ae0c-5732-405c-b90d-b9c88c0bf58e", "comment": "Malware payload (Mirai)", "value": "bb9667b4ab9cf1a3940f3bc68c67ee7b9bca020944e9dcb658c0813d27a817978619ae1f21b7907edeb38299767931dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819229, "uuid": "0a29eb9b-a4c3-45a0-a040-72fc2d878dfb", "value": "T1E7E34A55B8828A26C9D513BFF92E118E331327A8D2DF7213DD205F2477C6A2B0D77A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819229, "uuid": "dd937f27-1aff-47a8-b17e-be5057f1eae6", "value": "3072:ZXR8mzV2+p+rHEIV6nm56jbK0pz1aua8YarnECFnHsh0i:zV/MEIYq6jlzUuagpFne0i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819229, "uuid": "b22d290e-7400-48a5-a9c0-6c0d7fa12736", "value": 150172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819229, "uuid": "e828dd66-bb08-425f-ae40-2c8387ecf6be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819229, "uuid": "cc384ea9-8f3b-4a12-8869-4810b42f376e", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c78c007-196a-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772807922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807922, "uuid": "254eec0e-c351-4603-a409-c759fd3f7178", "comment": "Malware payload (GCleaner)", "value": "a28acd3a3ec70cf3bf72a09460263a4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807922, "uuid": "2815a81a-e99c-4c47-859f-fa65873df3ab", "comment": "Malware payload (GCleaner)", "value": "6c3d3f29a0a806449d723ebf789ae7e76175bbcc03d2cee68d5deb296c0ac8d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807922, "uuid": "7c82255b-53ed-49e0-a6bd-6718d7079458", "comment": "Malware payload (GCleaner)", "value": "a2ec781c3b05de168226f57b700cfef7e7ef9aa3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807922, "uuid": "2cfe5390-aab1-4982-9e39-af10c8647435", "comment": "Malware payload (GCleaner)", "value": "dd9408ac8f4b7cd59e1576138edebe837e24649254c79c11382ee51042a67774625e03a34f3a7682f7182b067baf4d05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807922, "uuid": "d8740a18-9748-4959-843e-2a1f7e9ba95e", "value": "T1DC26D0D2E1D49E76F05ACAFC683D5D0CA4D7AC1DBA98525A6AE104C910DD34CB32E2F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807922, "uuid": "a059c4f8-e99b-42ea-89d3-99028a40a89f", "value": "e5f32a93ddcf3aa9009cd70911b0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807922, "uuid": "dd31f414-3f20-4bd9-a9ca-994cc3bbebca", "value": "98304:+9CexrsWJKhorCGi3X0I7f/wuBhYVQDeMzm:+NYwCnpj/28", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807922, "uuid": "f1302aac-9255-461b-8cc3-8d5875696174", "value": 4747776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807922, "uuid": "78207f9b-d796-4330-8212-6c20298473fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807922, "uuid": "8680f1eb-acf3-42cd-a5c9-15c9eab08c86", "value": "6c3d3f29a0a806449d723ebf789ae7e76175bbcc03d2cee68d5deb296c0ac8d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4143a8e1-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810964, "uuid": "830e55b4-1f1b-4c3d-aac5-232cb2963585", "comment": "Malware payload", "value": "5d15c1980ebc9021bff3de5231754192", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810964, "uuid": "962cd27d-d803-44c3-b45e-af370f509f5a", "comment": "Malware payload", "value": "6c8473e2d1457be392d3e95b0b06611e83a32264348528f52e1071003f77b0fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810964, "uuid": "366d4a10-c589-4bf8-936c-3e18db9af010", "comment": "Malware payload", "value": "8d7a6c9b859917468e0a07b734433dca9e366d0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810964, "uuid": "3e2b0f85-994e-40d6-8405-fbd82adc9cdc", "comment": "Malware payload", "value": "e9da5df26e39a448a74cc83f5faba2bcd11879952080621f175f527864ac088c7428603bd7968aae6cd202c920094172", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810964, "uuid": "5cc8aede-d426-45f7-b2ec-f66981e12837", "value": "T1C0E49EA7B2628E21D1492337D1DB8A4097F49745B5A3F74F768413D228423EEDE4B2E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810964, "uuid": "580489c6-e174-4342-97ff-e038ff2acaa0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810964, "uuid": "c831db6b-a343-4a03-8d62-4af9d6ad91a2", "value": "12288:ABTN/Q0Rn+mjxQF/8TPuvdAqliHgO87WOGjfoLJvLp:ABTN/V+mj+h8TPuvP0AO0baQ5l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810964, "uuid": "e91b3889-3288-4000-82b5-09a49aae9de4", "value": 671232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810964, "uuid": "096fe5a1-ee93-413e-96e9-dd3880d288fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810964, "uuid": "77b7b1df-96b8-409f-8d37-41d7d44d72a2", "value": "6c8473e2d1457be392d3e95b0b06611e83a32264348528f52e1071003f77b0fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e02cb0b1-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772808653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808653, "uuid": "fd6c99d6-6a82-4dec-a7a3-26759d5cddde", "comment": "Malware payload (PhantomStealer)", "value": "4eba7ee04d8a1019644190084621b428", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808653, "uuid": "71eac510-41b6-487e-84d7-1aa49aa39039", "comment": "Malware payload (PhantomStealer)", "value": "6c8ee2c0b378ad189bb22cdf465ec277b05b3e9818379242a91afd50c4d49079", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808653, "uuid": "7ea7ce56-5073-4aab-9f88-d77accb51ad3", "comment": "Malware payload (PhantomStealer)", "value": "521c881d17c8790c08c441261006f1ab9ffadba7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808653, "uuid": "e776d723-1aa5-4a93-8755-d5e40f1eeb67", "comment": "Malware payload (PhantomStealer)", "value": "405ae103b934706850a3996ef2392dd3d83e100d2007d69ae5e16f6dd29f0f35aed5aea8b108ee61dae3b42f319f6d35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808653, "uuid": "edb13f78-dafb-4c84-9d7d-81ed35297585", "value": "T1EA6512482725DA03C8EA0FF40A73D3B157F91E66A511D3538EFABDDBF429B4069442A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808653, "uuid": "fdeecbd0-0402-47fd-81ee-94c73f9e4bc2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808653, "uuid": "fe05706c-0e4c-48d1-9031-f6b93a41f5fc", "value": "24576:bqu2Vfkm9OWv5b3G0AN7CMAC0FYkxjU7+9MQ3GbCh5u2yl0Xo:beVHRbbAN7FMPxYK9NujC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808653, "uuid": "41b84b68-69e2-4e6e-a507-5db9e969571c", "value": 1511424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808653, "uuid": "5cb76283-1b3a-42e4-8bfc-4c7f46b1dc78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808653, "uuid": "6e35ac0f-47f3-4592-9a5d-0ed567d1350f", "value": "6c8ee2c0b378ad189bb22cdf465ec277b05b3e9818379242a91afd50c4d49079", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d406e543-1983-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772818941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818941, "uuid": "ff8a19ea-dca6-443d-bd83-5d5d2e008709", "comment": "Malware payload", "value": "2f3943e23f9419178d65db6e9d494d53", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818941, "uuid": "1d0b1e35-1c27-4925-a75a-edff6c082289", "comment": "Malware payload", "value": "6c9a6fcfdee9cdabc2e9e63ebae13c8d3cd452cea9b721d040a393d6acafaf07", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818941, "uuid": "dcb38419-a712-4db5-8890-2be83db00332", "comment": "Malware payload", "value": "b5d8c657507803e940b394a2472a92b0c1e32a7d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772818941, "uuid": "abbdb390-8b5e-47cb-baf7-9f9e92248151", "comment": "Malware payload", "value": "4e3911faf10c77471e0fa9b9341707d946b898866075c444b54eba6f2ed9ccb33d030428a142110d801b222adf34011d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818941, "uuid": "2ef281b3-5f44-4357-b89a-d477b35e8be9", "value": "T1832833C35765DD18D2D3FE3A5250A8E3223D02873B44C0AD9DD271924AFC679AFED922", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818941, "uuid": "9ee1786f-b3c1-44b7-a1e1-dffedf88437c", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818941, "uuid": "87a40b36-29af-4595-bbd5-aafaf43a595c", "value": "1572864:AYxc1AY7ZHGRhbZFKT4foTuwwwXYPDwmjA8d+5ZW1e/W5JGxHR7:DeTHSB/KkoAPxkIIaJGxx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772818941, "uuid": "4b86a368-167b-41e3-9474-c8fbe1edabaa", "value": 100908891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772818941, "uuid": "ed5690cc-1f95-468b-af9b-dfc17b1364f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772818941, "uuid": "14e3fe71-a52c-4b3c-a031-1d20db0e0515", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26efdcc8-1974-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772812208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812208, "uuid": "86d240c7-d312-4ca5-ba8b-f5386f1804f8", "comment": "Malware payload (Mirai)", "value": "8a91234dc92176f46f586dc0cdc5de47", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812208, "uuid": "ce8e308c-64e2-4b6a-808a-5617f852ddc6", "comment": "Malware payload (Mirai)", "value": "6d0aee6ceeb84d69a7098c5c531971ea7715f1ebb820612564ed39fe3c1f9c8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812208, "uuid": "b6c66802-8960-45ce-9e4e-69d8a8778676", "comment": "Malware payload (Mirai)", "value": "1dc5675c63cce5b2d82d7ef32ed8409786bda97d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812208, "uuid": "5d026cc9-69a2-4d02-9f89-bcded6dac16a", "comment": "Malware payload (Mirai)", "value": "9e5620c0edbc315b3d08cc46d15884a3093a6204a417b39794cb599748e9ea60d956ceae9c1bd06271fd50db53a50d32", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812208, "uuid": "5b24a722-7997-4d60-a1d8-a1b2753cac80", "value": "T1E5935B13B9C480FCC889C13087AFB536D963F17E1279B19B73D4EA167E8DE511E6A680", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812208, "uuid": "2c5f861d-a47b-404e-ac45-3c4ad6581466", "value": "1536:Ac50J45j1WS60TrxMQQ+8TW4yxAw/1h1ss6fuftHnRlGJHaBs:Rf5j1W0Trxh8fyx91h1ss6feHnvGQ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772812208, "uuid": "aa158d3e-36e6-41e8-8d85-34f676ce5b19", "value": 88928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772812208, "uuid": "7c3d638a-87d7-4f97-9fe6-efb4ceb64c8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812208, "uuid": "a28c6607-c176-4e48-8290-a6863cb7c5c4", "value": "titanjr.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9ba4d92-199e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772830601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772830601, "uuid": "b7705cee-348a-4fd5-8ce0-c7a84edfd44a", "comment": "Malware payload (Mirai)", "value": "fa4868de155ef0a56fa965c67ce33c82", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772830601, "uuid": "7eece960-5faf-4a07-9c57-9ccfda7b77ad", "comment": "Malware payload (Mirai)", "value": "6d1721fff5c74d2dcaefd3b378d7c70a4ea87afec74fcd506ed3019532719bd1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772830601, "uuid": "55493d39-5916-4d19-bc12-a32061191ac7", "comment": "Malware payload (Mirai)", "value": "f307d6fc3573974e5619978b402ec4c2b91d7035", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772830601, "uuid": "d8d7eb66-dadf-4814-9b27-503ee2d68455", "comment": "Malware payload (Mirai)", "value": "6d50bf73a7afd940ddcf1d3e1bef36d364f7b2e1d988aa240dc6374cfc1163d1049624264f9862423f48355e8075c712", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772830601, "uuid": "085b54c7-bb38-47ff-80f2-525b83e6dac3", "value": "T1F801CB5A42511C342ED9802FB9EED1E0706D14AF26C29C3874DCBDA77F2CE086E109AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772830601, "uuid": "452579a5-2e47-4a04-98d4-77e072ed5dec", "value": "12:dzCuMtdX+J+828z/KUoub/YDnY2+jrfZFt+jrjgyufiMPZIxy/0w9nG:dzCtOJ/XouTY5+P7t+zgyuBIxy8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772830601, "uuid": "9e8264bf-85d1-429b-b5b6-56b83b9fcf79", "value": 709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772830601, "uuid": "9981ae7c-1cfb-45a4-ad9f-aaee3d0f97ce", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772830601, "uuid": "215f319f-05d9-441d-9135-da79e17fb877", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc6dbafb-1972-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811627, "uuid": "8a194fbb-7daf-48a9-a678-44133789e45b", "comment": "Malware payload", "value": "c9c6d28c90d95a1c2a9143c712d4429e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811627, "uuid": "ce9cac69-01f7-43ee-b498-85f7d55d07e6", "comment": "Malware payload", "value": "6d436d4ba44921dfa6d5672f9efb42ac7d94639ce56dbe2ef8896620821a59f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811627, "uuid": "c9b9a58b-007d-405e-9081-357206fd902e", "comment": "Malware payload", "value": "18a69444378fb5d79ed37367c9e4e428abea2e28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811627, "uuid": "e2e7a052-1efd-4bd2-89c1-d22dd1d1e1ec", "comment": "Malware payload", "value": "befcacc08d5fe1248deca0745e853f710408feb82248e59bdf8d86e8990b6c786995612a5f9e19d9692843ca2ecdf41d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811627, "uuid": "1b7a3c55-99ec-4138-bcc3-a3ef96d5d53e", "value": "T13494C466EB10B4A5F89745703D7AA257782D3D392581EC4BB7898F4A3670A83B0F431F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811627, "uuid": "70b8fb94-ca16-4ac5-9d59-c58cd2450272", "value": "e5da4da466e83dcb6ae28e193bb0cae6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811627, "uuid": "59739dd6-8242-4bac-9dc9-cf94342a087c", "value": "12288:X6GWK3PfHB3S5mQA4yn/iDQnstUJo1eUU5dS2l8SqZqoCveNGfK+6b3+jHFNH:UAfZzstOP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811627, "uuid": "2d06c037-fc84-47bd-9763-43a4ffe2b65e", "value": 434176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811627, "uuid": "760218ef-3133-42db-8a82-eaa34c58d7c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811627, "uuid": "c464fceb-58aa-4be7-8c3a-cb8139dfc70e", "value": "6d436d4ba44921dfa6d5672f9efb42ac7d94639ce56dbe2ef8896620821a59f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6174843-1971-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772811213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811213, "uuid": "fb5aba73-05b3-4aa5-b4d4-d70cd5f9a111", "comment": "Malware payload (RemcosRAT)", "value": "8422a58a2a94670547dd37df0fab8e90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811213, "uuid": "f364a87d-20d4-49d8-a7ab-2226c55d4611", "comment": "Malware payload (RemcosRAT)", "value": "6da676db8e7ca7727cc19b92aa9e4beebbc82e41bb0ebf04e022edbaf090e333", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811213, "uuid": "abd863ba-c051-4e7e-a0a7-b5d1ceb17718", "comment": "Malware payload (RemcosRAT)", "value": "5cc48ec82ef3de69b43358000716067fa278686e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811213, "uuid": "35773acc-dad2-442d-a640-2784cad1b1f9", "comment": "Malware payload (RemcosRAT)", "value": "3a1df373ff784c42c96f14cee1c21263c149c91933a7e3efe0b7a747c03033f1eb9cb7c9646e50993037d0b2fb8750cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811213, "uuid": "b0c4b37c-c5f6-45e6-b82b-d3239d672484", "value": "T1BB1502985605CA03D96A473406F2F2B52B7C5DEFE912E3179FD8ADEB7DA2B510C04283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811213, "uuid": "2dd1c4f6-9747-42ee-a865-7efc587495db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811213, "uuid": "42aa528d-33a5-4796-a3d5-f341ccc76b4c", "value": "12288:MjNiMwP29Vh3jyg2QPvbx1yKw33JUG6KELwDLDQNcmZxEojmKIE5T2Xzuwo0IXdC:Noj711/0JYmAx772XZxua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811213, "uuid": "f16f410a-282a-480a-bcd9-1b2adf97f639", "value": 918536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811213, "uuid": "667098ed-f196-4567-94da-55a9a90301ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811213, "uuid": "71aba52e-1b98-433c-a70b-e227eebbe3a1", "value": "6da676db8e7ca7727cc19b92aa9e4beebbc82e41bb0ebf04e022edbaf090e333", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce19d26e-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772810771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810771, "uuid": "d0b80779-fd7a-4635-8c61-aaf7796d99dd", "comment": "Malware payload (Formbook)", "value": "5e4656f45923d02fadc9aa4199b003cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810771, "uuid": "58cefd33-9d16-49a6-8920-be4c5cfb71bd", "comment": "Malware payload (Formbook)", "value": "6db9660f6fe86e0bf80e93f67a903f81ad700ddbfed057d51ba0b3b89983161b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810771, "uuid": "feeaab94-e62a-48d3-904d-301d564f1060", "comment": "Malware payload (Formbook)", "value": "b733c715b752dd3cff5ca85eba898e21b828f1d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810771, "uuid": "fb1ea623-4f46-4572-aa5e-26e97b869332", "comment": "Malware payload (Formbook)", "value": "ce0b524ac94ce8e46475504003c0e3ae4c1ca6055eb61248518a4be3e043ff795c078aac6ebbce369c3418a152352a20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810771, "uuid": "9aab8493-89e5-47cd-92c8-fd70d99d61eb", "value": "T1582502683616CA13C952C7B84A71F678077D1EEEB911E34B9FD5BDEBB962F124900083", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810771, "uuid": "fb89a94a-df74-4805-92ad-059c2d850a5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810771, "uuid": "2878f484-5774-4af4-a62f-3ce8a6ce75ed", "value": "24576:arMbSWzmQk34iF6s8ZIujyPd2xRZeudQFPxXuMfnVNNc4xrEpj:jbhaQi4W6s8ww7aBVpTNej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810771, "uuid": "0cae24fb-b364-4c82-966f-246e3f80f76a", "value": 1021952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810771, "uuid": "3ef4696a-4ca0-43e2-ad5d-fac8b6093e6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810771, "uuid": "5d030273-3f9b-4fa9-9de1-7f67f3caf78e", "value": "6db9660f6fe86e0bf80e93f67a903f81ad700ddbfed057d51ba0b3b89983161b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8e7e554-192d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772781986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781986, "uuid": "badf7766-f259-4fdc-84e7-ee5165d8b7df", "comment": "Malware payload", "value": "4f4d6721337cf7823ada6748fe01bc04", "object_relation": "md5", "Tag": [ { "name": "api-devx-help", "colour": "#8AD189", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781986, "uuid": "2eae5d07-f58b-4af3-b06f-5cf46abd0169", "comment": "Malware payload", "value": "6e06fa1686b71a3679533277086026cbcbf352ba9232fd1441bd7482abd470bb", "object_relation": "sha256", "Tag": [ { "name": "api-devx-help", "colour": "#8AD189", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781986, "uuid": "6754cbe7-2b25-4a53-b43d-2e754ea9158d", "comment": "Malware payload", "value": "7380b9bc2edd2805f313000e90c333302d80b60f", "object_relation": "sha1", "Tag": [ { "name": "api-devx-help", "colour": "#8AD189", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781986, "uuid": "fc4d4c9b-f8cf-4c8b-a4c0-f28049c59caf", "comment": "Malware payload", "value": "914ac15c1ca6976d5b17df44376d433ee1a220be8729b41129b15bf73cb209ce6dffeee10f27df5c6c0185d6fa50508c", "object_relation": "sha3-384", "Tag": [ { "name": "api-devx-help", "colour": "#8AD189", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772781986, "uuid": "b0c36fe0-13ea-4ee8-ac9d-6235f8f2939b", "value": "T1CB648E15F6A814BDE17BC578C9634942EBB2BC560360E6DF13A049962F33FE0963EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772781986, "uuid": "38f7195c-7280-4936-8b33-667ed0d93e7e", "value": "eeaf882830fde45ace5035bb9c4e5338", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772781986, "uuid": "0cbcd167-8376-4bd3-b701-5f44aba4c1c3", "value": "6144:TiSNqb8kYDPTIPdPPKKfvW9k+ak9tgD5F7z:FNqb8kYrTo5K/S+ak9aN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772781986, "uuid": "7f2d8328-c86a-412e-917d-e90022781c54", "value": 330752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772781986, "uuid": "26f7231b-49ab-4fb4-b01b-0f27c085605a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772781986, "uuid": "b94666d0-cfe2-47d3-96ef-e45c1bbcd31d", "value": "6e06fa1686b71a3679533277086026cbcbf352ba9232fd1441bd7482abd470bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd2627f8-193d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772788945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788945, "uuid": "6b694b34-417d-4fd1-913b-c2688a5d6eca", "comment": "Malware payload (Mirai)", "value": "25b8353d2cde33a6841d69f5c528799d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788945, "uuid": "b67d19e6-2c84-4fca-a1f4-9869133d7230", "comment": "Malware payload (Mirai)", "value": "6e6a3f89988d8cc017e706a5c41348cb404dfb145b95942d808e6752f844dd9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788945, "uuid": "f459cc9a-7f92-401d-9cd3-6a183c2da475", "comment": "Malware payload (Mirai)", "value": "27da203aa7c773057c104f5a00a170da4365058b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788945, "uuid": "b7c7b5b6-335a-4280-bec0-700581abfea3", "comment": "Malware payload (Mirai)", "value": "d40e6f1e74e5301ab809a460e86eb3627cc3a1274caa20294b5cd7813e1828dc9d6b52926f4da1a4f9f27e0faefee1d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788945, "uuid": "9c1ccf9d-fa96-4c12-b4e7-3ff2302ee9a0", "value": "T19E03F160C4EF920DE43D627944AFF20A0B45D41B5468A7F7FBD831B69CE2AAC099CF54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788945, "uuid": "fe2e60e0-1ce0-4577-8b13-28a0f6077bbd", "value": "768:6rDE1uLV+u1Q/bG0MYdoVkB48WZ9zzewpEHKBHjkPBnbcuyD7UHQRji:6rY1uL4u1Q/KqqVq79qBHjWnouy8HyO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772788945, "uuid": "01aaf50d-5526-408d-83f7-60ab38f96e82", "value": 38960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772788945, "uuid": "5e507ea4-9f9f-4254-8335-e5cc303550ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788945, "uuid": "1a792ec0-019b-403d-9e06-e61e962b3165", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4da6c2f-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1772809091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809091, "uuid": "aa80f1ff-a777-440c-9e99-933725eb69d8", "comment": "Malware payload (GuLoader)", "value": "cbb37204f99e4b34dd1f06e1e9ef6c22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809091, "uuid": "973c8e75-2961-4c61-926c-c75d5df64015", "comment": "Malware payload (GuLoader)", "value": "6e75030c0166aac5d9b66e92d603721dc0bf38e5a1a2aaee31f589ab3e9edc72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809091, "uuid": "18dd9196-5f70-4b57-b7ed-a706cc98351a", "comment": "Malware payload (GuLoader)", "value": "4da8d8bb6d25c098adb5d1ca4a84e982f04f8cf3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809091, "uuid": "6d319109-5373-4959-9ef4-8c9a92772a16", "comment": "Malware payload (GuLoader)", "value": "b6e3260fee9aae530ed6fb5a34e034bf7b4bf13107411161e56470b4dd9839f132cf7612c2e6af32e251def06d36ce2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809091, "uuid": "a0aa4ec4-1d1d-4849-9d50-c49bf8c9a2a9", "value": "T16274BFD0E285DC9AC80772717D3EEA21246FBE5F53344616372ABE1A3673283546BD0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809091, "uuid": "71fcea07-da05-4083-8513-7f4a4fb46438", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809091, "uuid": "d71017f4-c037-4047-91ee-4b5cedf0db02", "value": "6144:b5lz/9GpewMCuSgermPq8y0Tvvt2oVcWUGH6f1kezuxKkds:lHzYUerEq8bliVf1kezuxKkds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809091, "uuid": "9dd52c27-ddcc-48f6-8cb8-a908de2dc4bf", "value": 365040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809091, "uuid": "89105da1-54a3-4a1e-90e2-2ac409eb5561", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809091, "uuid": "db7b7a0b-28e8-4c17-afde-5d19295e66c4", "value": "6e75030c0166aac5d9b66e92d603721dc0bf38e5a1a2aaee31f589ab3e9edc72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d607d2c-196a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808112, "uuid": "feb2f971-1324-4197-904e-64ce59a76ef4", "comment": "Malware payload", "value": "33fb5fb9afed06629978b8faa59d4242", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808112, "uuid": "f736392d-3d73-4d1e-b638-7ad107c0a4d9", "comment": "Malware payload", "value": "6e7ea9e48a4f77b25af4f002bf9ea34fc9f9265fe2c44cd21c205e21e47454c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808112, "uuid": "04d68961-2b6e-45d6-a002-65fec7b32c59", "comment": "Malware payload", "value": "ff973ef1fa012c98e256f44471fadd010f5a06cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808112, "uuid": "c73b39a1-e2ce-4453-bf2d-f20614f37689", "comment": "Malware payload", "value": "67bed5cf02c44a113ca01687cc4ca6dcdde3f5b50a28073abb7ad94f71ee5195884c1a5b75222a118be0d54d5acfff41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808112, "uuid": "085b08a3-36a4-4419-946d-70bb7139f8d0", "value": "T11D35D00723D44E68E9BD9B7A856654D143FFB746AB36DB0DBD0A50EB0C22B41DF01B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808112, "uuid": "9ff2eac2-807f-401f-bee3-25fe372b270f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808112, "uuid": "02663ba6-aebf-4063-bc5d-acd6fa46a9b7", "value": "24576:nOfZNC8ZHKJCX0fI8mVS7N73O/WoGYdvqx2Fa:sZWWgI8mcJ7uWvYdc2F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808112, "uuid": "cb37297d-15fe-4057-af61-84e978e06ee8", "value": 1069568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808112, "uuid": "f5827ca0-0cd1-4274-815f-90abd54570b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808112, "uuid": "574f5712-66b8-4a3a-a492-a43ab30dbc17", "value": "6e7ea9e48a4f77b25af4f002bf9ea34fc9f9265fe2c44cd21c205e21e47454c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5b97a8f-192d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772782034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782034, "uuid": "ed735616-3957-4427-be79-a084605d1d4c", "comment": "Malware payload", "value": "4d7c9a1de72f208533f1a50a110a3c0a", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782034, "uuid": "ced21e8b-36a7-4c87-904d-62d9dd999a1d", "comment": "Malware payload", "value": "6ec2aec3151feaf7b4c6c7934e7ad601cca984266f0604b93676ae698ffed738", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782034, "uuid": "848cbc7e-14e8-47e9-9c00-36d9d39c851e", "comment": "Malware payload", "value": "8145f0f242a09daad7f429e002e240761ccdee47", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782034, "uuid": "afa8d2d8-8148-40ff-95e0-45317d0a92be", "comment": "Malware payload", "value": "e1e5e9551dbc1b3cd1e1d8bbbb3eb08468c1367e32dc4f79d8ed0402742635c9b193b7f25db28be3f7b79c9542680816", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782034, "uuid": "5af8a175-03f8-49c4-8e93-0d0e1e2e922c", "value": "T1535601C5BB88E92BC077543286A997B651474D0B8E83DF43A914360C2DBBAD44F1EFC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782034, "uuid": "69cd0108-28eb-4c75-954f-9583faef85cd", "value": "98304:l75bLNrZ3oXuk5KRPp1nNZw2fHZr3a7zpuKXc7eRDYH2TKBV5hH1uJSzf9a:l7JoXX09LRR3U/s7e5ISKBVfVuJSzf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772782034, "uuid": "4a4458bc-57ee-468a-88d1-0e54e1c6ce63", "value": 6221164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772782034, "uuid": "9a5672b1-e60e-4cec-b6c7-5d8ba7c58969", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782034, "uuid": "357ca64d-da08-464e-a047-d5583a69af20", "value": "iApp\u624b\u518c_1.0.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d4c81e9-1951-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772797321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797321, "uuid": "68afd070-6990-4036-b1ae-76d3b00e438d", "comment": "Malware payload", "value": "5805fbdfe3b47a684d1209b532ec474e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797321, "uuid": "e6611882-d27c-496e-ac2f-ed63cb8762b7", "comment": "Malware payload", "value": "6eecfb2434b394751e7297e063c24d5ed0d40175aee5f93293ce9cf27b1492e8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797321, "uuid": "26af6d99-8253-4741-8525-8980278d93c3", "comment": "Malware payload", "value": "c2caffaebe4c614107921a486224f8141e48ba84", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797321, "uuid": "17bd2f2e-cb74-4cf6-88da-a6eb2a6b4487", "comment": "Malware payload", "value": "b3f41041f08bfcf628634efe6f3ad75673940b0ea8485fbdfc6f2afbec3ad85147433784d125037ba86a529c76054d1b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797321, "uuid": "bb37fe15-971b-41ba-9d3f-ee1da59f5ab1", "value": "T19F41A85B27FA397A5A9614A7442E9406D6794F510C068C10BA8D0E07685E6CC3FF9F38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797321, "uuid": "dc27b8f1-e3dd-4e95-85f1-a1313c50daa5", "value": "48:7jOgo7b5jag3L8GbE4+EvPbjrXecbtlaw6QRnpoQp8Owg/Rf6Wc9bE1vSnL:7jqjHG4PPrXecbuNQFKSRf69g+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772797321, "uuid": "d741a42b-3716-494c-9c43-c3fb24781765", "value": 2218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772797321, "uuid": "0f4fc5e5-8bc0-4646-9a81-81a5fbd92e42", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797321, "uuid": "7d1669db-fc0d-4c9d-a446-a020a267c1dd", "value": "6eecfb2434b394751e7297e063c24d5ed0d40175aee5f93293ce9cf27b1492e8.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af304913-195c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772802129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772802129, "uuid": "a9ce4e35-2720-4841-bc95-41db514c03ba", "comment": "Malware payload", "value": "d4ae86179acf0f243311f9da3c5329f7", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772802129, "uuid": "2880e73e-a4f0-4ff0-ac6f-fdc4528702c6", "comment": "Malware payload", "value": "6ef32b6c01b2199a6be9339006b58f6af5ec288d9249ebf649ef6e2eb7a34d57", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772802129, "uuid": "1f5df80e-378a-415e-9ece-f8c9fc1832a7", "comment": "Malware payload", "value": "4caaf3a2a4e59e75d4f3ccdfe6ab5fff4bb8862c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772802129, "uuid": "a426b641-7bba-4725-9fc6-7ae589974c5d", "comment": "Malware payload", "value": "e0b5a8964565e2c652f4fa00144ac52a31c9f70ce36e98f7e1487837a518314b26e954db8cb2ba3f26e023e4b94e4411", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772802129, "uuid": "4068267d-25ec-4859-837f-0107cb76294a", "value": "T1BBA633ABA5574FA0F7B081BE4986FC0DAD6DE52AC389AC063D7605B6010FF6047AF117", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772802129, "uuid": "bf4260ab-0c17-4f5e-bd37-f00d1de6943c", "value": "196608:1gFgz8EtXWxjlORgw3gtq9dF1wmh5pPCu96LcabKDYQTHwCl6VeFvHwot0n:1g3eGxROmw3gMLwmxCqUQ1Fvc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772802129, "uuid": "1525b364-1c8a-4627-9ff6-e63b0230ce30", "value": 9698801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772802129, "uuid": "ba8173ee-fdc9-47c2-8535-af53d7056ed6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772802129, "uuid": "bfef3410-38bd-4aa0-ae93-65761ea37c78", "value": "src_2.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc995e4a-1983-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819009, "uuid": "12240460-b385-4a8b-8769-d6aed9d65126", "comment": "Malware payload (Mirai)", "value": "38ea4d206fe17ad4889d0cfe43f5bd0f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819009, "uuid": "1e2a0cda-e8e0-44f9-8b73-86a9b549264a", "comment": "Malware payload (Mirai)", "value": "6ef8d8dc61e0f8b67932d5c3a086892c7b4b710f463acff061ebb6a633a6956a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819009, "uuid": "22211e3b-7f30-4b17-a417-aa3ecdf11e51", "comment": "Malware payload (Mirai)", "value": "952b155d019efc1acfaec7bbc33398183c755990", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819009, "uuid": "e9206222-95bb-4d23-a9c5-769a1f0e7870", "comment": "Malware payload (Mirai)", "value": "08faa50df9f39dd029cd3f305e878e0e9c02e6455d7fba62b5081e97e39a47bbdfacaec799a8985c60e8572193edc1a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819009, "uuid": "4d94f9e7-8766-4a8c-892e-662235d264ba", "value": "T1A6C3F80AAB610EFBE86FCD3706ED070525CC651722B87B767574D828F64A24B0AE3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819009, "uuid": "7673b053-bc72-4160-852b-bb3ec9962992", "value": "3072:ln6MWtgOKvr7B+6d2pIWvgdqt9au1Afb:ln6MWtgOmH86d2pIKkqt9m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819009, "uuid": "f094b50f-2819-40fe-84c4-647b0862f6f7", "value": 122496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819009, "uuid": "6a5a071a-7502-4331-9652-8430a23ace2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819009, "uuid": "7bec1259-f7bf-4664-a9b5-ca05abcf81fb", "value": "jawirbot.mipsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "018076a7-197b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772815152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815152, "uuid": "a454cca8-6e6e-4089-8bc6-876420dc0f6f", "comment": "Malware payload (Mirai)", "value": "57a5a0a348debd5d17e4fb35e71f6bfb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815152, "uuid": "dface75b-9214-40fd-82d4-45a2a7c8de37", "comment": "Malware payload (Mirai)", "value": "6f0ca1a298424961cca17b6052e52e935c95529049c69410f0478cd02ba6fb67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815152, "uuid": "bd1ea6b3-e55b-4abf-ba7b-e8276544131b", "comment": "Malware payload (Mirai)", "value": "9979d54c822ec0cfc5fc997a0f7ee1e71de33759", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815152, "uuid": "8b66b807-177e-4051-bb3e-97894a5f4e00", "comment": "Malware payload (Mirai)", "value": "713a7dc3126700e5a967964b7f420ada17509e4a2711072dd4009a3f53572636e7a95582d2d859bc8dd8b266fb2148a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815152, "uuid": "34f05bf4-e8ec-42ad-b391-4fb987b71013", "value": "T10E8328C1BA4BC0F5D90748304067F33FCB32D6394061D66EEFAADE65EA73642522629D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815152, "uuid": "39d26fd1-ba67-4e24-9ad3-e3fdb957409c", "value": "1536:8l8IhK59kLMSbBv7zTWAcanWC8f4TxdgoXF6hK8l9:8/hU9ktbhTWnfgTxddXml9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772815152, "uuid": "57a2e0b4-09c1-4ed4-890d-b668599fbbe2", "value": 87696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772815152, "uuid": "689abf93-a40c-48a2-8584-5ae0b5e9633c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815152, "uuid": "e43be93a-2c0d-47d6-99d3-97f50bdafe81", "value": "titanjr.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f1b94a-1963-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772805086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805086, "uuid": "05b41aa8-07c0-4497-8c41-00630547eea4", "comment": "Malware payload", "value": "f7c99599084eb2ee56dff574d5acb64f", "object_relation": "md5", "Tag": [ { "name": "abcknIe", "colour": "#31F8E7", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805086, "uuid": "de1aba8c-2691-4d3a-be75-672e8a8a96cf", "comment": "Malware payload", "value": "6f24eb5ee228dd098a9fe277ee1ab8c716e4f10696f44301d3e9d5b878f02f5e", "object_relation": "sha256", "Tag": [ { "name": "abcknIe", "colour": "#31F8E7", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805086, "uuid": "2c3b843f-4e0f-4de8-bfef-657df350f8fa", "comment": "Malware payload", "value": "2844ced9602e281b34377579c40ca3afb96e6a15", "object_relation": "sha1", "Tag": [ { "name": "abcknIe", "colour": "#31F8E7", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805086, "uuid": "0db3166b-f3c8-4f7a-9c33-b1c507569060", "comment": "Malware payload", "value": "4ad3aceff261dfa66e6ef2b211f797a941a6b58d1dd1d2586ab98b8ea0e97804f1e999d1d3362e21ca0d2e35033a8335", "object_relation": "sha3-384", "Tag": [ { "name": "abcknIe", "colour": "#31F8E7", "exportable": true, "hide_tag": false }, { "name": "ftp-corwineagles-com", "colour": "#A167D8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805086, "uuid": "b880b8da-55c4-42b6-9308-53e4c5c732c7", "value": "T13C6465F96076ED8AC7370E80E1043F179C299ECF667847F8B78815D1C19CA8C99E65B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805086, "uuid": "dfd2b78e-c44a-45ee-a647-f3852b6f12de", "value": "6144:1rKXd+mSf0sT0PepqepDDTLKtHws0Gw540HlEijWjYN2B+C:1WXd+1csRFlEijWjYN2Bb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772805086, "uuid": "f4ffbd25-2a34-4df0-a81e-77edc46adb18", "value": 327046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772805086, "uuid": "9d17ebd3-5202-41e5-8290-3e9326fc10cd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805086, "uuid": "d89df8e5-1245-431d-997e-ab988a53b8a9", "value": "abcknIe.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9140d64-1983-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819003, "uuid": "79b7089b-478e-4487-9dca-7a61d887ca02", "comment": "Malware payload (Mirai)", "value": "92e2bd3338014921e94f457cdf82d7d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819003, "uuid": "d2edddee-8145-4bd4-ba0d-1e90e85f6184", "comment": "Malware payload (Mirai)", "value": "6f547cbfc9fffff13a85cdc1e28519789925341bcc8e8b6b92314a39354dfeee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819003, "uuid": "01d94e3f-7907-4d46-8e5b-30130625729f", "comment": "Malware payload (Mirai)", "value": "a037ba58cc3b136a9ff78610570617f313fb03b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819003, "uuid": "92de1959-9cf4-4cda-8edd-d8a85a0123b8", "comment": "Malware payload (Mirai)", "value": "45c0485b48f3c58e8f4b6ac96c20d6e856674924efde8637585d7d2d200c75d274a55856e13db0e2f30d787ddd413182", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819003, "uuid": "4407f75a-a4c0-4903-8882-91ca9ab0b667", "value": "T18FA33B02F6F68DEDD8A1D174459BB126F430F43E5138F213A7E4F9129E9DF20992AB90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819003, "uuid": "a9395ae6-083f-4f74-945a-f365a736670b", "value": "3072:2T5ten0CcKoXPj2E60QBkJYzd1A7uhK0PQWyQOhRT:7z31riqK+yQOhRT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819003, "uuid": "caafbbee-1696-47dd-9d03-41de3f0e0898", "value": 107104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819003, "uuid": "b72aea22-c910-4ff4-aafd-54f40932d3f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819003, "uuid": "863771fb-bf51-4947-95e6-db5bfca7db00", "value": "debug.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e40ec3a7-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772808660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808660, "uuid": "4e753b51-b5b7-4bd7-9b3b-f6ce674ad4de", "comment": "Malware payload (PhantomStealer)", "value": "17e7538e56207ade239f702f6dbe700c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808660, "uuid": "8dba29d4-8b55-4cb3-91b5-7a6502fbaf5a", "comment": "Malware payload (PhantomStealer)", "value": "6fb6fdf5aecf2e7fb457a7d4a5d6b2c6cbdb211c40b88ae7acfa7ffe43a4139c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808660, "uuid": "b924aa4c-b3c4-47bc-86e0-2823d295e2e2", "comment": "Malware payload (PhantomStealer)", "value": "7a9381ff907d145fdf9dc0ee68041f46ddc6ef20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808660, "uuid": "fca57ae3-f291-4ed9-9d02-ef031f734b6d", "comment": "Malware payload (PhantomStealer)", "value": "e0885f0f687648a6a61dcc09513f90b81dbf48a0a98d02ee1111715213aae5096956c37313fe15b440e1df4f73e78c06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808660, "uuid": "a8eba5ce-1cd2-428a-b9bc-715375cef0f2", "value": "T1F26512582A18DE06D0AA0BF40A71D3B14BF85E9DA511D3538FE7BDEBB53A7012D412E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808660, "uuid": "e5f8a311-0b81-432c-bce6-b29f0dd78003", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808660, "uuid": "fe92e9e6-b0f2-49fd-b58b-393794ea6658", "value": "24576:Jqu2VUUK9v4m6Q6qXDBH6J0ACTGltGf6kFmdvA/Nvtq5dTp4SDUBOG:JeVUUQvn6QbDYJsuSxFMvUNl4O7B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808660, "uuid": "f25374a5-9e24-4eb1-b3c6-bbed17d44bf5", "value": 1510400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808660, "uuid": "a5004315-ca17-4e14-801d-1d4aa687e40e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808660, "uuid": "575f39b9-b428-43c9-b7c5-c22d510ea4d4", "value": "6fb6fdf5aecf2e7fb457a7d4a5d6b2c6cbdb211c40b88ae7acfa7ffe43a4139c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90e0389b-1984-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772819258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819258, "uuid": "49389fb2-e4e1-4319-803e-09d279f7c317", "comment": "Malware payload", "value": "f757c2ee0df5c6bc235e27e16ce06060", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819258, "uuid": "b3044b8a-fb78-4cbe-9e7f-195d330fd763", "comment": "Malware payload", "value": "6fef7da8d72d18a9f3ff9a0c16cfb54bd079e1bed0dc1b165562128e17527ece", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819258, "uuid": "74cffadc-1801-4809-b83b-48d5d4ee3c0e", "comment": "Malware payload", "value": "20bdd446928854de5bbc9d3e4c4990f9d96ec89b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819258, "uuid": "421da8a0-c11c-4e22-b948-8fea8825804a", "comment": "Malware payload", "value": "8d3790b7d56755a7adc56ba9be3d10d682d9041162c384fdf8cb9c97349e57fba974967a44a5f1fdd0b7ddcff5bc9b98", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819258, "uuid": "46dcde39-44e0-4ae7-bd2e-efdb56ffdc73", "value": "T1EF23F7881FB2644289B39A7D5FCF8412D269612303945C54FD6DE3E42FBB1B1E0F6DA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819258, "uuid": "3d8f2f91-dcda-4f8b-875d-dc645fc25fcd", "value": "768:hfNw0NMZOeP3RajpCBRmaDDLRBUokjbEDhhHK1LmbSoNbNXdYCF:hx23Zz/SEDhhHQLm3NbNh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819258, "uuid": "ef5b138a-5757-44bd-b2c9-af408d7354f2", "value": 46716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819258, "uuid": "b6c9af58-58af-40ee-b7a1-81c7ffb1333e", "value": "text/x-c", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819258, "uuid": "527f4db9-b028-4084-8a98-ccf276e93296", "value": "bot_utils.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2292b9d6-1971-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772810912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810912, "uuid": "16a4611b-a184-4f1e-b1ac-dece7167173d", "comment": "Malware payload (Formbook)", "value": "a5f537ed5649896d6192de2e0035ad27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810912, "uuid": "83692597-d2d3-4604-aaed-97a661f29174", "comment": "Malware payload (Formbook)", "value": "7005c47490258d2a3a4094aa32131e35559890228b695163fc85e2aabef7666b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810912, "uuid": "b13db411-9546-4888-a04e-e1c5d5e68a27", "comment": "Malware payload (Formbook)", "value": "1d011454a639f20575e48f147238f1e4d5f0d241", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810912, "uuid": "e8ad3956-f302-4e80-8725-2ee64491a232", "comment": "Malware payload (Formbook)", "value": "b2c74595e8d4a0c6373a2a49d499f9c4631d7f019ee5388d7922f8f3414f5a9d89d962dd8ce24be6af6ce006d3d19c13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810912, "uuid": "097e4263-bec4-445a-a204-d51be51e35fe", "value": "T18045CF0273D1C062FFAB92734B5AF6115BBC79260123A62F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810912, "uuid": "f7225537-0fde-4d51-8c78-c30fd435b38c", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810912, "uuid": "4c3d5e8d-d6db-4df5-81ff-3a55fa9a1bd2", "value": "24576:y5EmXFtKaL4/oFe5T9yyXYfP1ijXdahId8wE1H0NZrYlJS:yPVt/LZeJbInQRahId3jE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810912, "uuid": "aea10a4f-0970-42f8-af29-4f35f5a3eb3f", "value": 1275904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810912, "uuid": "52739b51-0699-499a-aa64-17877ea80546", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810912, "uuid": "09c7599b-9b2e-4b67-9667-7a57b42d59c2", "value": "7005c47490258d2a3a4094aa32131e35559890228b695163fc85e2aabef7666b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5643c36d-191a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772773633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772773633, "uuid": "925749c6-dfd1-405e-ae9f-0af99fce1dd6", "comment": "Malware payload", "value": "a33a8261eb76c717275012f0b04577d1", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772773633, "uuid": "535f677e-6395-4759-9e3f-3216445c0ff6", "comment": "Malware payload", "value": "7039b8402a2bb7dbe9c93c2e11e78220b027f45fba89b504ddac87ffbc6cd929", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772773633, "uuid": "ea6c2a05-12b2-4804-a755-ee0ee7ba4096", "comment": "Malware payload", "value": "dce1f757824e27b6020677daace6fb1c02298da0", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772773633, "uuid": "ef093cd9-a082-4d07-b881-a34ace32b5f6", "comment": "Malware payload", "value": "e742c4a3bbd0078951af684f163887497dc76fc899ee43814ca3f44b9df0850d13195aa2f94b629d06b0fc56a2546b25", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772773633, "uuid": "9ad6b1b4-ae3a-46c1-b482-c44dba76b148", "value": "T1554507C9D3668CBDD7109298CD3F27D2DEA9848F250A66BFB04984EFE55E2345730CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772773633, "uuid": "3a4b2f13-fbb6-4097-9728-29e05f2589b8", "value": "96:kwumhSrBdv66xsEPv9FC4Vykw4ft7CQcrhJPNMft7cQBEdzHaHHi2e1we6wLsiSt:krjkA1NfcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772773633, "uuid": "8ea7d013-6f01-43a7-a191-80516ce1a1b2", "value": 1263569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772773633, "uuid": "52044b06-a6ba-4989-bfa1-6b0ac8b4e4cd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772773633, "uuid": "0b101447-a81c-420c-8842-2ba66d10c4dc", "value": "cossro.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b7c82b5-194d-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772795573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795573, "uuid": "1558afdf-612b-4976-8311-357114eab345", "comment": "Malware payload (Smoke Loader)", "value": "881685494b9997cf7cb3e40ff066e479", "object_relation": "md5", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "chalx-live", "colour": "#DA62FF", "exportable": true, "hide_tag": false }, { "name": "coox-live", "colour": "#1A79DD", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "zadno-run", "colour": "#BE50B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795573, "uuid": "852a6c61-2c24-4c1f-b6e7-4672cb6712a2", "comment": "Malware payload (Smoke Loader)", "value": "7046e174e0f51284f119a0061ad816e066a5f5b24c775f8cfcd613240c4a6912", "object_relation": "sha256", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "chalx-live", "colour": "#DA62FF", "exportable": true, "hide_tag": false }, { "name": "coox-live", "colour": "#1A79DD", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "zadno-run", "colour": "#BE50B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795573, "uuid": "45a47683-fdef-4afb-84ed-3cb809c71d44", "comment": "Malware payload (Smoke Loader)", "value": "98441a3afc50f2e9b88babeadedd074d3cc8a7e2", "object_relation": "sha1", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "chalx-live", "colour": "#DA62FF", "exportable": true, "hide_tag": false }, { "name": "coox-live", "colour": "#1A79DD", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "zadno-run", "colour": "#BE50B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795573, "uuid": "f159d0cb-1426-497c-a3d1-2407bbed8dc2", "comment": "Malware payload (Smoke Loader)", "value": "f62a5b571b331dad5645ea74e62ae2d36b1fb8b3e35e3c986b57135cb38e2e7db9622fd20084cb9194fed1e79b19b7df", "object_relation": "sha3-384", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "chalx-live", "colour": "#DA62FF", "exportable": true, "hide_tag": false }, { "name": "coox-live", "colour": "#1A79DD", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "zadno-run", "colour": "#BE50B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795573, "uuid": "dbe1fd56-71f9-4dc9-9531-72a8a6df816a", "value": "T19D96AE067EE840E5D0BA923489BB5252FB75BC150B31A3CB2690B67D2F73BD05E3A711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795573, "uuid": "0eea254c-5024-4444-8a84-3152bbc7f36c", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795573, "uuid": "2c3de022-806b-4a19-b835-f6e6c43aeb0f", "value": "98304:r/nsPSK9GZw2TjfnpKhBnpbCqOMMEJ+O96GKIBezvvSXbSgv:reL9X8pOBnpOboJ+ObKIBezSXO+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772795573, "uuid": "6889f071-b5c5-4e3b-bf41-7c8894507481", "value": 9177088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772795573, "uuid": "9ec08584-f17a-4270-a741-aba7792281c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795573, "uuid": "2ad11326-daf1-412c-835f-342a06c84846", "value": "recuva_professional__technician_(2024)_full_espa\u00f1ol_[mega]_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ed9ef00-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772809698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809698, "uuid": "b362028a-8a66-49b4-bea4-4cd6fbf4519e", "comment": "Malware payload (PhantomStealer)", "value": "471ef5ae5168d846eede11b57555e076", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809698, "uuid": "801f48c6-7dae-44d9-a903-808dfb7b4be0", "comment": "Malware payload (PhantomStealer)", "value": "7058f96bcc11886647b2b264535255fe6422555b0cf878ddd2bec4c4a9e1d126", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809698, "uuid": "afc44a7f-718d-44af-b944-4c47c1e9a01d", "comment": "Malware payload (PhantomStealer)", "value": "ef1bdb8bbe29f927146178be51952ccec3ef584b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809698, "uuid": "816dc971-f309-4d5e-baac-0b4557ee97a0", "comment": "Malware payload (PhantomStealer)", "value": "db0e8f3749fd766bb1cec3d50e758e262c8ebd502c9928ff6b46d717716264bc72a8d719c284d75ef1ca89c687d3e252", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809698, "uuid": "71295205-88d2-425a-bd30-8179bb3099f7", "value": "T15265230832EADD0BD4C75FB44B70E27A67791DD9A416D2064FD67CEBB8393E12980287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809698, "uuid": "e329d2f9-f79d-4fcc-b7db-e4852adae8d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809698, "uuid": "45dbd210-727d-460d-8db3-3d8510c2e323", "value": "24576:G/Qkx1oXk2oqi3oHZNpT5QyVMmIMExcnwf1oTAss2hwaT5nLEze8iN9l3N9ZVrTe:G/Qkx1o7HdZ1KxuwfYAohrTBz8iNBTV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809698, "uuid": "4581c52a-bfc1-4810-a64f-0927eff8904b", "value": 1536000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809698, "uuid": "07dfd427-aa40-4da1-b437-f46947826328", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809698, "uuid": "0d0565ed-6e18-43fe-8f6d-94a56d38b36a", "value": "7058f96bcc11886647b2b264535255fe6422555b0cf878ddd2bec4c4a9e1d126", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb72f9b1-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1772810820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810820, "uuid": "1d332cca-9db4-45dc-b4da-db3a22c5c652", "comment": "Malware payload (DarkTortilla)", "value": "03dd7349f692dd0a8c2723809ad21faa", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810820, "uuid": "c414f467-4b04-4ed0-a241-fabfe8886edb", "comment": "Malware payload (DarkTortilla)", "value": "7157165f0ec7acf431db00aed0a0afbf01a2314396797399194ef0e80f6b2f54", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810820, "uuid": "f0baa57e-47bb-4978-9c7a-03c43c51492f", "comment": "Malware payload (DarkTortilla)", "value": "b943fb9bfdfb2d40918d7da656b3ee82cb04e566", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810820, "uuid": "a02cb36f-e850-4d29-8667-a1edafbfbd8a", "comment": "Malware payload (DarkTortilla)", "value": "9a8b6e9e43447290684f54308f1b96a75b6d734edf6683080d71dcf7736dc1a43a5e2f22247e49cbe0fdf7bea645bd12", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810820, "uuid": "818a732b-37f4-45cf-ab83-92fd2903c8c9", "value": "T12335F1125E832B68D2690F7CC06708AC37F0E1679227D71E1EEC41FA9FA2FD5C926915", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810820, "uuid": "ad068721-5359-438f-b4ae-6e2f73b6205e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810820, "uuid": "449cec71-7cb1-47c6-8e97-a0c506c980fd", "value": "12288:urAkpfxeYVaXAdpr+8Esd4sEwRA8DV08T9i3gzAxcJivnlCypWNecZLmxii:urAE7dZ+8EsdfRA8DKKAxoivntWRu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810820, "uuid": "41bc95c5-f53d-4646-aa1f-2ffa56c40de3", "value": 1113088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810820, "uuid": "d969b017-357d-47a9-89dd-aded451c7554", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810820, "uuid": "2e4ecad7-18ef-4410-a58f-4f9c2377b450", "value": "7157165f0ec7acf431db00aed0a0afbf01a2314396797399194ef0e80f6b2f54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3d3db29-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1772809921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809921, "uuid": "df31d50b-a960-4ac1-b09f-b7c02a5c1044", "comment": "Malware payload (CoinMiner)", "value": "19bb0e2e2affaaa53bdaf27998d292eb", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809921, "uuid": "843b6e55-26a7-48e6-b76b-c6bb7a3c017a", "comment": "Malware payload (CoinMiner)", "value": "71a61ac678e6f0c98fa9a44639e9c0d3769d05a1e6a5a65f8b7247ee72357bb5", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809921, "uuid": "9d44c1de-e06c-4e48-a468-236c979310f5", "comment": "Malware payload (CoinMiner)", "value": "20600092e55f83bef39c783072e925b397c3064a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809921, "uuid": "1e8c5b25-9150-4464-bf2b-080943e1a364", "comment": "Malware payload (CoinMiner)", "value": "a7384634b4de763b0db77db3828d21510199656661b6dcda5b19f55d6ee631a7c718da2076c70391001c4991430fd729", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809921, "uuid": "6507bea4-30b6-413b-96ba-cd9b2f01bd19", "value": "T15F3633167BD297B0E21129B08E643FB106F1EF682F79929718E0775F5C707A1863D2CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809921, "uuid": "3c5312b2-5ed7-42ea-873c-ef265364f22b", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809921, "uuid": "acd741ed-a37d-4b72-9919-321cb661df15", "value": "98304:MH5OV+mPOPF5mL4+3paqGfibiVybtotnqwNUCcUg0NG:MHUVLJLxZaPKGVybtoAwNUCFgeG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809921, "uuid": "c5487368-37b9-4521-9af3-46cad9fb688d", "value": 4900424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809921, "uuid": "31bd3534-42c5-41f4-9bd2-1ff379809535", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809921, "uuid": "dbc2c3b6-2746-436f-9651-e5f7568abc98", "value": "71a61ac678e6f0c98fa9a44639e9c0d3769d05a1e6a5a65f8b7247ee72357bb5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b11157c8-1942-11f1-a769-42010a9c0008", "comment": "Malware payload (PupyRAT)", "timestamp": 1772790965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772790965, "uuid": "752d1925-bd87-44f3-82eb-a27daf807895", "comment": "Malware payload (PupyRAT)", "value": "807d93694cc6a6830530e5f0b0e698dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "PupyRAT", "colour": "#E000C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772790965, "uuid": "71c9d5f7-2e8e-47b2-bb07-0a94a333a716", "comment": "Malware payload (PupyRAT)", "value": "71f77bca1b9dcc9aa16ddcc58d185a9f5d31ecce1fd9154f29c50343d00ca193", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "PupyRAT", "colour": "#E000C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772790965, "uuid": "64ba4a91-efdd-435d-9632-d4431b087e83", "comment": "Malware payload (PupyRAT)", "value": "d905e1eb88a647046a8e15d84b9df0c0e56f3e24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "PupyRAT", "colour": "#E000C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772790965, "uuid": "21c209e5-4e69-4a5a-940c-8d70e907af3f", "comment": "Malware payload (PupyRAT)", "value": "7590c6f335f09c0d3d42f425fc0dca7f0fba56ae2580bd44a349ee5a7bd3e956d544c8172b413c78eb80149d36d51a35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "PupyRAT", "colour": "#E000C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772790965, "uuid": "d88fd7b8-3d00-4d48-ab8d-55c3fff4f90a", "value": "T155F53321F8459F3EC8B24A70984352F7C5353A1BDEBFB76F372440181A66A2B485FB94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772790965, "uuid": "0b567b47-cce4-429f-9781-61fc47508797", "value": "98304:MBGNlg8xkJVM+sdRsEoQqgOsAslwrvJIx/f:zNDbH4QzOs5wr6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772790965, "uuid": "c1d22207-6481-495a-9827-0c22a548fd2f", "value": 3414160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772790965, "uuid": "a4f21d52-605b-4c37-bcd1-63e1843dcaa5", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772790965, "uuid": "7c0a6315-fd9d-42f5-8358-29774c810711", "value": "systemd-adf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "297b4e00-193e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772789019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789019, "uuid": "ab986701-43a4-46d5-9acd-20ddb8f5ebf6", "comment": "Malware payload (Mirai)", "value": "793d3fc7c96a3dcec6ae3cbe0ba59c84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789019, "uuid": "6713e1f5-b7d6-4011-8dbb-26b2620df981", "comment": "Malware payload (Mirai)", "value": "7222546863d729c20a91b4e641f244f398669b72d00dea9936da7a7411dcc706", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789019, "uuid": "87dbfaf3-2904-47ba-a2a1-46df8e41fb63", "comment": "Malware payload (Mirai)", "value": "761879ee3c8e1fcbf7475bb8e335ff2eba1fd286", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789019, "uuid": "1e45dd75-0177-461d-99f0-deee78a34e21", "comment": "Malware payload (Mirai)", "value": "f10b1edcddf7b422cd6311013576baa9074e3ad78d288545456947c2f892f0ae3b0159a2cc734b8943c7b7008bf5801d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789019, "uuid": "9ad1cdec-831f-42f2-b99a-91c0670e2cb8", "value": "T1267339C1BA4BC0F6D81748704127F33FCB32E5798065C29EDF6ADE26DE276426216399", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789019, "uuid": "544f6cb6-f6b7-4c20-97e7-d886fc514d18", "value": "1536:EqI7PU5XRoGf/GIsJPvP7KLWqIdVV0ZpAtzery2w9:IWoGfav73XdVVgStZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772789019, "uuid": "e6aed483-eaa0-4940-8223-84ad7a8df92c", "value": 76304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772789019, "uuid": "abf0b499-8112-4ad9-9e61-96d0c7c116b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789019, "uuid": "7482402d-cea3-44b8-bca7-dbbd731c4d3d", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b979239-196e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809612, "uuid": "c0e79bb0-be4e-49ec-bc09-22ae9306a2d1", "comment": "Malware payload", "value": "af69f4800ddd8cf7c57ad985c26f2fd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809612, "uuid": "410d2148-fdc1-4eb3-b104-4a1431d80c4a", "comment": "Malware payload", "value": "72432d3b5897e1bef0687404130d51b5d95ff1ae5d0b5fe13f1938ebd96d1446", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809612, "uuid": "d1121a9f-2483-403a-b24e-f96a5eea4c92", "comment": "Malware payload", "value": "91495e63b9555dc5910cbc833110bb3e43ec4db6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809612, "uuid": "e13a2dee-e11f-4d56-ab7c-e7809ddcf511", "comment": "Malware payload", "value": "bc7c767a02a6800c7adb1c67e3e043b42f3c34693faa41663084c19bf5c002360876d8dac2ba1c74ee9008b3fcec7152", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809612, "uuid": "f17a3d58-193d-4d5c-b259-d52f0c9eb2db", "value": "T18145BF027381C062FFAB96334F5AF6115BBC7A260127A62F13981D79BD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809612, "uuid": "bac70863-efe7-4293-b39d-f946881b7289", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809612, "uuid": "245c5f0f-4c62-44a7-b0bf-6ffa88d50548", "value": "24576:L5EmXFtKaL4/oFe5T9yyXYfP1ijXda0dBbrnVUsXGl:LPVt/LZeJbInQRa0LnVUc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809612, "uuid": "db7b3c19-6a44-4c5e-ab7b-67a08de2fce3", "value": 1255424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809612, "uuid": "8e404011-3de4-4229-aa4f-cfa678f3b632", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809612, "uuid": "7e646b05-0ce5-44c4-89c6-d920cf5bfb31", "value": "72432d3b5897e1bef0687404130d51b5d95ff1ae5d0b5fe13f1938ebd96d1446", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03d9a575-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819021, "uuid": "896daae1-a912-4b28-b9e0-91f3f12cc600", "comment": "Malware payload (Mirai)", "value": "eda2f567c168832cdb87b146e990a59a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819021, "uuid": "30021a58-e5d0-4f3f-8e52-3337c0efe3bd", "comment": "Malware payload (Mirai)", "value": "7259f636b271375cfd8125378ed9cc436dbbfd80ed937dc0a790df378ec5946a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819021, "uuid": "ca31780a-4a90-474c-9620-e2096c2afd13", "comment": "Malware payload (Mirai)", "value": "8cffb4c3a51ddbda5127870e40b71213b2a8c22b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819021, "uuid": "5053df9a-58ab-4952-8816-8233b62b6d58", "comment": "Malware payload (Mirai)", "value": "a21ad62941f81dbffb8b203c5ddc30195196ef03f775ba349fae0bc60bc9c34ec3cee58c9f61c17313a8e64ef0e5abbe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819021, "uuid": "0289a745-3d90-4709-836f-93cbd6141809", "value": "T156334B0299BC2A2BC4E0A77711A74372F1FB2B954194E64FBD660C4FEF583501A7B6E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819021, "uuid": "7ab49ff3-8630-4d6b-aad9-93bdea7fb637", "value": "768:Y5erW8odLUY5tPktaTt0syt7SJxg2ZZqSwfUtlohjzR4zVkGMIZgTydwM:uK1ILhtaaKsyt7KyaZqSASohh4mQdwM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819021, "uuid": "d86edb37-0304-4fb0-926e-9980a6ce5ea7", "value": 53884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819021, "uuid": "3212f095-b0f6-4cb6-ba71-83404ce459a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819021, "uuid": "ef982110-f654-4ee8-9822-1469b0d0f643", "value": "jawirbot.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a135ba57-1960-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772803823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772803823, "uuid": "3de6d29f-ee57-4cba-a69b-2177600bdd5d", "comment": "Malware payload (Formbook)", "value": "8308412c49013ec7a23a6748cafd6ec2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772803823, "uuid": "fabbd189-14c7-46c3-9bf7-adcaf6890e30", "comment": "Malware payload (Formbook)", "value": "72653dab5599f11197a85e5ea526af71192dd8bfef42d1b626698baafc48585a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772803823, "uuid": "9c62e18a-a39b-44f8-998c-8cd5db8247c6", "comment": "Malware payload (Formbook)", "value": "73f801292b9f2fa417a7b1042a2f358ef989de6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772803823, "uuid": "9e351694-c169-4253-add2-7ed192409751", "comment": "Malware payload (Formbook)", "value": "42ab8f70d3b117a90b3bffb5c70f17c1bebf5a6e2b024ff3007daf897e7841343dcb82eac457b9c72457bc9cdfe10863", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772803823, "uuid": "cc3a9d35-b1e4-421a-a39e-f7ef3ff71548", "value": "T12B45CF027391D062FFAB91734F5AF2115BBC6A260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772803823, "uuid": "f7a6d190-a360-4993-8a9b-add697c63372", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772803823, "uuid": "cffc6ec3-446c-475f-aba3-42778d41ac06", "value": "24576:Y5EmXFtKaL4/oFe5T9yyXYfP1ijXdamJSC2/6KAoQo0TK:YPVt/LZeJbInQRamJL2CZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772803823, "uuid": "748c2f31-98a8-4b2f-9bfc-618c2d118418", "value": 1244160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772803823, "uuid": "b21257e0-3f38-4b19-bee3-217c204eb1f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772803823, "uuid": "b2921408-3617-49a9-b854-fea96208b0b0", "value": "72653dab5599f11197a85e5ea526af71192dd8bfef42d1b626698baafc48585a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da90d8ff-194a-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772794471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794471, "uuid": "c4258bfa-91e3-4004-a028-5636b0540f7b", "comment": "Malware payload (Vidar)", "value": "498295ab887d8c5ab07b8ec06328b20c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794471, "uuid": "4c628308-ed27-4f14-af59-f326fe1fd737", "comment": "Malware payload (Vidar)", "value": "726d59fa03667955293d626677e326018bbc3763197f3adbdfb80e65364677a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794471, "uuid": "c51e6036-1a16-49af-af60-541e53168440", "comment": "Malware payload (Vidar)", "value": "78f015a06c03e3a9f7a543ac75e27d2091ed8064", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794471, "uuid": "90266b7f-7b1a-4075-b827-a71bd1b2dc46", "comment": "Malware payload (Vidar)", "value": "ce1a139509d0ee6aec31fe068a39a473016d98b555586af310d27e6703c44b32240718ef1a5d7152ff3f095bbd9a701e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772794471, "uuid": "d569cf5d-4bcb-4e82-86bf-e6a05b16f8f5", "value": "T149959C43BCD024B5E5A9D2328AB112A17B31F85A0B303BC72F55A7B92F7A7D41E35394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772794471, "uuid": "78ccfe0c-c51f-4f2e-be55-29064576d525", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772794471, "uuid": "bc0c88c3-9e5a-4bff-9426-008fc4eac599", "value": "24576:qb370KFUxLUQfcSPIozJ12RBFiC5OkEvDuR0CqW3ma68ZzOcsYgtbPAURK1O:qD70KFKLT38Dgd/vDuCI3msMYgtXRK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772794471, "uuid": "3a2ee5c4-ad3d-43dd-a1ef-1a06ff630fc8", "value": 2011136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772794471, "uuid": "2ff8015a-f22c-4b51-b09b-fae1595c3842", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772794471, "uuid": "cf0becc4-0bb6-4c92-b75c-1a07a542c408", "value": "498295ab887d8c5ab07b8ec06328b20c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca91227-1957-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772800111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772800111, "uuid": "82c2fd07-b2f3-4bc5-8c48-14430487b4d3", "comment": "Malware payload", "value": "c0e4398459345ee5afa2ae477a733574", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772800111, "uuid": "de48e2c6-7af5-4c77-990a-f73be91c6033", "comment": "Malware payload", "value": "730e9e0bd0a41438d7d7af227f1441b4f9d8a54988e0add3a2e0fbd7312cc163", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772800111, "uuid": "0dc2118f-38ff-40ce-bb9c-60edeb1b2527", "comment": "Malware payload", "value": "50c52f69c6ec64aafaf093bf708452a8ef6c0615", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772800111, "uuid": "c251e265-e0b8-46e8-9592-f82c8a9ec3bc", "comment": "Malware payload", "value": "27ef47e799e0bc20812fec701bd65b80800c716a0faf67f5aa86edabcb211fe754710b5d3f224126ce53624c7d8425b2", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772800111, "uuid": "80c1736a-68cc-4f74-af3f-93617b6efbe5", "value": "T12B642351EC9C307BD9234DF3AD1F99CF5E6D7AE52D68D85CC214EC0AE2B992ABC60500", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772800111, "uuid": "2e23acb8-2b2d-47c9-a1d9-d0033fba40d8", "value": "c72d40c71bcbf3442320a9ed25ba079c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772800111, "uuid": "a54e5188-d0e3-45a9-9f75-df0bd788404d", "value": "6144:G+R1G8O0NiIPoLt21g1Mauj/zlcQAcDLjoiOlDcXPcIQLwT:G+R1VOkRPgtb1yTzlcQfXjof5acNS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772800111, "uuid": "a3144971-422e-4a08-b0a6-aba0ba01daa8", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772800111, "uuid": "824eab7b-dad4-412b-915b-29b15111b39d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772800111, "uuid": "aa5a10c9-9b48-4942-9e1c-94deed981d1f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cff13459-1934-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772785004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772785004, "uuid": "b558cf02-66d4-4d61-867b-bf0e3a727925", "comment": "Malware payload (Mirai)", "value": "ca71961966f17f85f9690eaa7257c2fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772785004, "uuid": "8d234006-4e37-4800-8436-6207a1de9c2b", "comment": "Malware payload (Mirai)", "value": "731f3adadeaa4d1f6991f85ee37ad082219c5f2fab61d70491a8054dc1c85e4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772785004, "uuid": "c1fcf6bd-92f0-492d-b34c-594ed47b51ca", "comment": "Malware payload (Mirai)", "value": "73d423002b5cd4f7dfab5432e60eaeac76e13bfd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772785004, "uuid": "9509098c-e705-4806-b97d-77476f0cbd5a", "comment": "Malware payload (Mirai)", "value": "bfaf3f9660b6700c644625b95704849fb307afb658aadcb11104593be133b1f6a61570946f2f4d72a09eef6efc63b96b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772785004, "uuid": "6ebf70c7-1e40-4094-ab4c-34fac5d58606", "value": "T12AC3F705A9429F11D4D731FAFB9F429933536FA8D7F97102D9209F6023CA99B0FB2612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772785004, "uuid": "9d018cfb-00c5-45f5-b29a-81ea1b9f5e2e", "value": "3072:Q9dIRpVxelpK2I4bTAaGSRpuHTrh5OAtFZuSP+:QgRQK2hHAaGSRpuHPeAluSP+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772785004, "uuid": "def890b2-b7fb-420d-8bc5-744edb9bcfc8", "value": 126760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772785004, "uuid": "15fe4e84-63e1-4e4b-8da8-885fa1eeb270", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772785004, "uuid": "4fb86cb0-e4a5-4006-9109-c57084e2bff7", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdcd9ac2-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810341, "uuid": "aba6c4c6-d2b2-411e-b608-129db0cd6493", "comment": "Malware payload (GCleaner)", "value": "a20bf2eb2895a773f0e86cba43dafd09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810341, "uuid": "89978136-1429-4a74-bbc0-8a530d99ef6c", "comment": "Malware payload (GCleaner)", "value": "73a42370876f7d34ac575a433d828aceb4215bebcdcf95f24ace7bfdeed1c89f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810341, "uuid": "ced5bd3a-cd85-492b-91c6-4680e33ea6bb", "comment": "Malware payload (GCleaner)", "value": "9d28132ea933c54fc04155f0a2762ad26ea7270f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810341, "uuid": "d4edf019-8814-4233-85ca-752b65ce4016", "comment": "Malware payload (GCleaner)", "value": "8ef2d13f2a474d237f28d0a3c8c3a4c56d1b14296a2897afd8bf0f63a76364d4f783331a140903b05d6468df17de790b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810341, "uuid": "6a505ebe-0afa-420f-a253-a87312a47bd8", "value": "T19B05AF22F2E14537C12B3A7DAC5B7E9CB939BE1129385C462FE91D8C4F3674938251A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810341, "uuid": "9ff30ad6-2dda-488e-b0e6-6a1f2dd1e582", "value": "fe4280c06246cc873fe89746dadec91e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810341, "uuid": "2063d141-1341-4eea-b67a-13ca2d9e3596", "value": "24576:2lluEBpPj6o4CPbE9taCbWIW4JCnUPdoJwr:2lwa1Vy4hwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810341, "uuid": "69f70964-2adb-4abf-b6d3-c2c5c5aa8a7c", "value": 812032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810341, "uuid": "1e0b5cd6-d4ce-45b8-ba22-538bd457e0f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810341, "uuid": "60400424-f9ee-482f-b3c0-06fc1ac62e1f", "value": "73a42370876f7d34ac575a433d828aceb4215bebcdcf95f24ace7bfdeed1c89f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf4c3b3b-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1772808625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808625, "uuid": "044fb88c-cd13-4e73-9475-364070e18439", "comment": "Malware payload (njrat)", "value": "e6e7cbc85d0fa559ebb3b867b44a2581", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808625, "uuid": "923d8c5d-c981-47f6-aedf-94385ca4ffa9", "comment": "Malware payload (njrat)", "value": "73c8d621dc10c0b3041ffa4b7621e7cda88b6de5dd65e62545fe036c88f3c4f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808625, "uuid": "d775e7a4-00d4-4984-a180-3f6eaf55e169", "comment": "Malware payload (njrat)", "value": "259389a5e1e602f0e67ecb968a0e22544b8737b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808625, "uuid": "b646ca0a-690e-40b6-b9ad-4bd48ed9eb2e", "comment": "Malware payload (njrat)", "value": "dbe8f3e45f1148df41b03902269756ed5b2729913ab8dd9da092de2c31d0d2459b9e5e30a176d76b99e365d9c8e9ff96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808625, "uuid": "25521ff6-5d02-41ae-8d7c-7f3e600fc559", "value": "T12A25CFE52705C801D8A75AB44836E7B76673AE5E9C24C20E6EE2FFDB7D32342140758B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808625, "uuid": "49aa6404-3af6-4b96-a348-cc4e1d58b7da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808625, "uuid": "1694b8bc-7d6a-411d-905d-21d16747d33d", "value": "24576:Mqu2VsZjLRbT4f/3/taEMQdGYE7CZqiP9Sz5A/:MeVSbk/Fa8dpE7CZqi05A/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808625, "uuid": "40e380ab-bc7d-4025-a7e1-f1a69fcdf552", "value": 963080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808625, "uuid": "74c46f23-45ea-4e5c-82b3-8edb4c231bd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808625, "uuid": "b4e7c3b4-e3cc-445b-887b-fc936bda0fac", "value": "73c8d621dc10c0b3041ffa4b7621e7cda88b6de5dd65e62545fe036c88f3c4f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e694389-1972-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811523, "uuid": "443d3670-028f-4616-8e58-bf7604b550cf", "comment": "Malware payload", "value": "8f0fa30247dfc24549c180e82a95c4e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811523, "uuid": "d154e5d9-1a51-4e44-97cf-232aa28ab69f", "comment": "Malware payload", "value": "7420fe4f02d903f52391f022a113aac16af8e814dd30b813c6a46e10dd4587ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811523, "uuid": "6e6fee84-6641-4c00-8361-40c6ff8063ff", "comment": "Malware payload", "value": "75d0c14f637f9de546cf4143176b79a55526b3f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811523, "uuid": "9513eb85-bb8e-40ad-a483-d3b94e2954ef", "comment": "Malware payload", "value": "294e1be394ab630c7f547077b293f2ef46de7cc82fc47a77e9387a5f5f69cf0e663dd84a39451edbda64a09ae9799bdb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811523, "uuid": "d267887a-cf7b-4f1a-a348-20fd964eea1a", "value": "T1A238338477EC18DBE41652379152DA0EEB49F00E52D7C68B93E015370C97BE9EDBAE20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811523, "uuid": "b73d8e05-0e45-42dc-9492-3691ce432782", "value": "c990338f8145dc29c6f38fb73cf05c77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811523, "uuid": "c8d13c91-4ed3-4e2d-ad94-78d23cbb9952", "value": "3145728:QTRTIgYRPSC++6y9UBr/dKUfslsHmjekOeSqjZId:a1IxaC4y9Uh/QUgxePlA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811523, "uuid": "1ca826ed-500f-4d04-8052-4d49a4f9567e", "value": 104456403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811523, "uuid": "5790349b-c908-4417-a0ca-624d5abc732a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811523, "uuid": "331f0e31-a6f7-40d8-8437-795558e653e2", "value": "7420fe4f02d903f52391f022a113aac16af8e814dd30b813c6a46e10dd4587ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a17277f-1961-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772804187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772804187, "uuid": "55fe48c5-755b-4e60-b7c3-1e5cc181d0a5", "comment": "Malware payload", "value": "bf9a800e1453da4dc0312913a4a559db", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772804187, "uuid": "4989f301-e736-48a6-b7c7-e6e5b501af19", "comment": "Malware payload", "value": "744e8a3df80d94db5aaec3b7bdf630d680068dab28d65c07386bc82b44078bb9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772804187, "uuid": "e55966ee-be3b-402d-91e8-0c4c0bd9478e", "comment": "Malware payload", "value": "ac7d25f2d3d7d38b248ba46a4e3527cea3a019c2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772804187, "uuid": "d9324c68-c29c-47b1-b91b-745b45d5edc5", "comment": "Malware payload", "value": "7d010b7e9aef33518cb9742027b509a2523a5d1eccfd0de5a21eaafa07a635d9354a55d70024b13fecb40f68699163cd", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772804187, "uuid": "60a501a3-48a1-4cc0-b895-a1a47bde85dc", "value": "T1F8E33A5EFB424A54C64C4A7FC663414886B5CBA6B027FBBB28D85DF17DE3CA84E4B050", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772804187, "uuid": "2fa92b7e-d9b8-4776-aa7a-c7673e6aeae6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772804187, "uuid": "c7fe6b94-a5cc-4645-bd9b-547bb94a0c98", "value": "3072:PgNsOFSqxaUKCM7MIfBRH6KCYt/vazOeAyhEqv7/bcNN+cegEA6IIL:Pm8U0Z6BYazgyhEqj/bcOcQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772804187, "uuid": "98235222-e135-4a22-ba14-120f9fc6b82d", "value": 153600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772804187, "uuid": "27c4371c-4086-40a8-abf5-664825f0bf0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772804187, "uuid": "038ebda9-47b9-46e9-bf22-9c987b56968e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "487d523c-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810976, "uuid": "a67e2c85-76b1-4c51-904b-ed4784100c51", "comment": "Malware payload", "value": "1c89198647c009a3d5e821357b7063ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810976, "uuid": "57b39181-be4c-43cc-ab62-6329f6a90571", "comment": "Malware payload", "value": "748235adce984e855dd6888c4774b1944bfad24ce5022f2c2600dd113c3d1ef7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810976, "uuid": "1922398e-20c2-42a3-9e13-2af17ce6dea6", "comment": "Malware payload", "value": "d6bc0bdc95005bb5c2e375cda7dd008e67c0c935", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810976, "uuid": "f3c33ca3-f246-4407-8be1-acc4be107146", "comment": "Malware payload", "value": "2df7b124e93e766225eb0f281749843b34acad838572dc7d87230a63937c0090478788a6fd4815343b554aee68d552fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810976, "uuid": "f9f779bd-592f-4915-91bb-7076f049e3c3", "value": "T149C4220533E1CD9BCA622C3A5AAF5807FEF4C4937474120B23689A5C3E723A76944B92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810976, "uuid": "07fff9ee-d24c-4628-9408-a9f687e6999d", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810976, "uuid": "e5521f50-67b6-4394-a7a8-e5ee2938474f", "value": "12288:C1yDJU0VKlW6aXPCNeUxW6lmmnxwxDsZjL:C1yDJUzHafCNeUx19xw5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810976, "uuid": "916aa953-2c05-4fb9-8197-b852e11fb23b", "value": 557952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810976, "uuid": "88349ff2-f7ab-4b52-b834-a292930641ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810976, "uuid": "3f330b5d-d963-4440-a8e8-6e932c00e023", "value": "748235adce984e855dd6888c4774b1944bfad24ce5022f2c2600dd113c3d1ef7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "483042c1-1986-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772819995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819995, "uuid": "e28e8078-f8cb-4448-bba1-0968b8f3e51f", "comment": "Malware payload", "value": "41ccbd80c43d4d54d5511c297235e4e9", "object_relation": "md5", "Tag": [ { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819995, "uuid": "1a43af47-3761-4714-ac53-ea25ed65a433", "comment": "Malware payload", "value": "74aadf8374a2b3be8c275179a68d9cb2e4623197d87b3a7b61da1d4a0511adad", "object_relation": "sha256", "Tag": [ { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819995, "uuid": "daade911-1a79-47c8-9f26-082495eb0644", "comment": "Malware payload", "value": "fdbae94d1b3ed27c02214aa42a044d3e2469d633", "object_relation": "sha1", "Tag": [ { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819995, "uuid": "79ed40ce-57c3-4dc1-93f2-2606f5154932", "comment": "Malware payload", "value": "6313be06f87c5d39c93ea7919f35c07ce59632a3cd6a5663f123e5c99505353f16e2072579ccd9370383e01bda908d72", "object_relation": "sha3-384", "Tag": [ { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819995, "uuid": "d9ed8f9d-9723-4a6c-8141-98a44805e8b1", "value": "T1C8757B03BCC064B5D5E9D23289B512A17B30F85A0B3177C32E65A7B92FBA3D45E35398", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819995, "uuid": "ebe135d6-c0b0-46a5-8bde-da5162cf568d", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819995, "uuid": "5c93f729-7870-401d-bbdd-dee15c4b0159", "value": "49152:M+o3zeEfP+GmbXmAa8AdR/PSiEMYgtLcK1:OOGQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819995, "uuid": "1e05b973-d5bd-4284-9775-b924ceb7f715", "value": 1665024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819995, "uuid": "c0d7a74b-3708-4ee8-98c9-f032a367f2b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819995, "uuid": "abca4147-ceae-47ea-8dae-ef1691f89995", "value": "Pro Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec107ba8-192d-11f1-a769-42010a9c0008", "comment": "Malware payload (AISURU)", "timestamp": 1772782044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782044, "uuid": "44405fa6-871e-47a4-a0ad-5a92c51d351a", "comment": "Malware payload (AISURU)", "value": "97335ec368b037969046950c823e3061", "object_relation": "md5", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782044, "uuid": "3b887b44-6cb4-4283-87d1-79246b802a74", "comment": "Malware payload (AISURU)", "value": "7500925a26cecd84ebed2914855cdf0812a18661e1bb6f3c91dede36f34bd7f3", "object_relation": "sha256", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782044, "uuid": "f576d342-c777-4168-a868-5ec69d7c8bda", "comment": "Malware payload (AISURU)", "value": "ae12dc40fd94ec5adc1dfc36743f0d8621d86e91", "object_relation": "sha1", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782044, "uuid": "ec0f9328-1cfc-4923-b8c2-d066cb11985d", "comment": "Malware payload (AISURU)", "value": "f9859da60148f7411b09ba305c56c6f560bff24d6c506b511ca4cc575103bdf750f3f8ca1b0b9af0a7fdd3529c511f0f", "object_relation": "sha3-384", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782044, "uuid": "ffc8d411-1b53-487e-bb06-77e865273a7a", "value": "T110C30859BD819B15D5D626BEFE0E528D33131B6CE3EE7212DE145F2027CAA5B0E7B002", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782044, "uuid": "12f8910a-9f4a-4d9b-b8dc-aa7c5de1586b", "value": "3072:jv/Itvfw1nYsSSIr+Chk/qLtGkaXQkgJn7cZ5gKuxU4pMY:zItv6nYsSxr+r/m4kaXQkgJn7Q5gBU+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772782044, "uuid": "c86e0283-8834-49c0-b509-002299a8ca40", "value": 126076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772782044, "uuid": "9c316915-e918-4321-9554-e83a1a9bb226", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782044, "uuid": "5b788bf4-924d-441e-96bd-7c98bd6d19cc", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3c1f4d6-1966-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772806404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806404, "uuid": "b21d3372-5ac2-4be3-9d0d-f63379d7d1c1", "comment": "Malware payload (Mirai)", "value": "bee43e7ecd9b50619e66ddd6e6eb9679", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806404, "uuid": "17fd2a9c-be7d-4765-b23c-307d4c3ca5a1", "comment": "Malware payload (Mirai)", "value": "75093b62b12a21069b8276a6ffee3e5b21da5335d56133f0a32177f48f4bbbf5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806404, "uuid": "5f6f1ca3-894b-4e29-9135-ca29c8dc412c", "comment": "Malware payload (Mirai)", "value": "10bd1e88f64c6ed433cb2523487e762e8a3ba417", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806404, "uuid": "58340e8e-0b52-460e-b44f-1b5aae7e7fbb", "comment": "Malware payload (Mirai)", "value": "eb58276f6f04b3a05fb561991a541f88c70f4849169dfade61672fdfd2aca4d80f40f08e4f84bed2aa93b00c3aae78bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806404, "uuid": "07d7ecb3-e0ad-490d-aa5b-c8c721cba6d9", "value": "T1D0E3F7C399267EB7C2C6EBB566E7DA7007D3EC151B430A49B1AAD9F40507DCCB809368", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806404, "uuid": "ceaead4d-9b6a-4797-888a-3f2596b2f4aa", "value": "3072:4Jpg4+qQgbxVjFFWytTffwqvhGvaCvLTi4eVlOmn3IkK:4Y4+qRlwyhfwmovaCvLTi4eVlOmn3IkK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772806404, "uuid": "d7beef44-8be1-4069-90cf-c7874df927a6", "value": 156503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772806404, "uuid": "d1e76dee-f3d0-4c25-ad9e-01acfd961321", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806404, "uuid": "50e4ef70-ee06-4051-bbbf-bae08b5ada5b", "value": "s-h.4-.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c682a1e-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819197, "uuid": "0e5736d1-e8d8-4c9d-afe1-0adf9f706181", "comment": "Malware payload (Mirai)", "value": "f0e43a721d05a73028a7dbf558ec24a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819197, "uuid": "3a34f715-2a69-4d94-a619-57273ce5e9e7", "comment": "Malware payload (Mirai)", "value": "751d3ac1d15ed058359245ef1dbbae79f528d0d7a1a66abaf2c0daf013ac38e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819197, "uuid": "0df76d70-7d4d-47b8-a1f8-237cb2599839", "comment": "Malware payload (Mirai)", "value": "a97304b64a5f8441b15e13c94cc539b6b57b6048", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819197, "uuid": "62571355-aaa6-45bf-a1b6-6c12c9c518d8", "comment": "Malware payload (Mirai)", "value": "210ee10f0b48bab51a6716ec0ae350372e381ecf6301e3ca8ca417ea2a837a453c6d78379f622fefa21179b2831c4d3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819197, "uuid": "2c92b804-bc05-4ddc-a23a-cfeac1ef2fb7", "value": "T10073090277080F43D06329F0267B1BE097AAFDA518E5B684752EFEC59271DF22186FD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819197, "uuid": "0540b1f0-863e-4c6e-8a09-861a0b4a00ca", "value": "1536:SpC0cTUCVdEX9X6A01wvVfATaN4Idfa+4aQWlOC3sus/Br:StVXcJyWT64IM+9par", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819197, "uuid": "bbbf1ca7-7486-4d8a-a5a6-a96fa48fb609", "value": 74984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819197, "uuid": "ab15a751-1745-4c1c-a908-cd6f47d30f3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819197, "uuid": "84a2ed63-d92d-4681-a5cb-0b7f7d41be03", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f204221-194c-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1772795176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795176, "uuid": "411f3f7a-873e-4598-9792-296c60305392", "comment": "Malware payload (PureLogsStealer)", "value": "11fe7cf6ed5ccf962279868b9d5b4cf5", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795176, "uuid": "461e4cbd-a88d-446b-b500-855aa247a8a3", "comment": "Malware payload (PureLogsStealer)", "value": "7576a22aada711e4a6bb71be740e31a2b303fbae1882af1be2fe2a5e4582e0d7", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795176, "uuid": "a6a5cb40-bdbe-4bef-9b4c-ba0004383449", "comment": "Malware payload (PureLogsStealer)", "value": "bbecfceb3a8140aac98f08ee435321c932aba0cb", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795176, "uuid": "7a4f6f66-b614-4faa-8ce5-5a4b682010d4", "comment": "Malware payload (PureLogsStealer)", "value": "b73f8ecf6c947cd2e4a83d082f3723766b7d2aa3b02d5e2c2435094f8c5e9c606f261c7589ef09da10ea6c5120301178", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795176, "uuid": "2b47eb7d-4bdd-46a1-995c-daf59d5a13da", "value": "T1CEE6333494B9BA45C84C3430AF289F9F4DD2BA309F55534E784F95F9A632A0AF35BE10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795176, "uuid": "4b15e46d-ac48-4b91-8f9d-2406eece44b5", "value": "393216:BzMsY7coi2dTbBjI+5kINnGdBzOZjiH5Sb:BzFYrB7HNnGdBzOd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772795176, "uuid": "ac4914b7-b5f9-4004-a782-17bd75fcb571", "value": 15089664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772795176, "uuid": "15490a73-0377-4666-8472-ae70dbee9c51", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795176, "uuid": "7792ebb5-a30f-49c9-8f58-0d687572ac76", "value": "Installer.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dc8348d-196a-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772807978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807978, "uuid": "351cff7b-fe8f-425d-8ae9-a61c9d6b0442", "comment": "Malware payload (GCleaner)", "value": "87add7207c89c9631f942f8a079cfbfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807978, "uuid": "94148752-af3b-4442-ae71-1c61bcabe251", "comment": "Malware payload (GCleaner)", "value": "75d535f099446c4802b40ab1309cde32045fa3de81a498be0336fe65b342c1bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807978, "uuid": "b1306e9b-7214-4db6-8c8b-841454ba9aa7", "comment": "Malware payload (GCleaner)", "value": "dd5f1d20ea384007649e44f9392eadb76318b8f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807978, "uuid": "2ff97032-b1a4-486a-bad2-4f4b72eeee11", "comment": "Malware payload (GCleaner)", "value": "dae2b3d8ea3b9c2584129b7fa835ced2d617fb777f2ac7792f5c92bf385469f00e4e952bda5414f3eaf5ee04590d56cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807978, "uuid": "c49ae92e-1c50-43ed-94fe-93158c56809b", "value": "T11136E0FDA1B2C62DC021E4FD9C3586C750751E60693DF4A8A3780DC6BB1657638BC2AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807978, "uuid": "36a7355f-41eb-4cf1-9cc9-a237148606db", "value": "e5f32a93ddcf3aa9009cd70911b0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807978, "uuid": "ca93858a-7798-41b0-9332-58a73b0ba2e0", "value": "98304:99CexzfMnLAFiJKdK5tEvV2PhCoQuS/JvB4:9RX2uK5trY04", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807978, "uuid": "a7ef2843-c013-4479-bfdb-ad7641e37332", "value": 5019136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807978, "uuid": "c330b7a3-75eb-48f1-a825-8b0eaa00247f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807978, "uuid": "9fde7ed1-01eb-4b54-beca-ee1afb81b703", "value": "75d535f099446c4802b40ab1309cde32045fa3de81a498be0336fe65b342c1bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88941640-196f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810224, "uuid": "c4d0b1af-f3a3-45fb-acf0-03b19e36137f", "comment": "Malware payload", "value": "624fd30610dd77a351433335cc7b4074", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810224, "uuid": "659224b6-db53-4ec4-8416-5b8f01992a3e", "comment": "Malware payload", "value": "76913282eeb9e5e008feb01ec78efbc11e396275bb9aedaf08f6070e7675633a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810224, "uuid": "b5c859dc-2084-4209-84f4-829d07a3230c", "comment": "Malware payload", "value": "7cc379c734940db3cb03ce943ea8fd300c7567cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810224, "uuid": "6a2cf22c-7a6f-41d7-917c-fa95c402161e", "comment": "Malware payload", "value": "34964bc565d8c1d354321ba1f63a6ecbfa428793e65d4ee96a186101ee499ceab2c200b8c091b2a650d5a0759427cd62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810224, "uuid": "337a0926-691d-4ac7-8e9e-2d16f82efb02", "value": "T13494E516E650B4A5F89309713D39A256782D3C3A2680ED4BB38D9F663771A83B0F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810224, "uuid": "e4e6acce-73f6-490c-ba4c-45c3623aa417", "value": "7da084ed8a1375364beb941624e30357", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810224, "uuid": "f272f56e-a062-4458-bba6-4a4647d12f52", "value": "12288:xxL2aACLfKZTESyJ+A5P9rlGOixO7VBrkg:HXH+A51xscN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810224, "uuid": "b95260ed-13d8-4c57-a14e-582601fbaf09", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810224, "uuid": "a6851d68-3f44-4036-8e17-64a7fc42eea3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810224, "uuid": "d68899a0-987b-48ad-bdda-678013c34be0", "value": "76913282eeb9e5e008feb01ec78efbc11e396275bb9aedaf08f6070e7675633a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8ca4290-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772809527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809527, "uuid": "2b45822b-8c34-4297-aa41-6fb278e9a3e3", "comment": "Malware payload (GCleaner)", "value": "d596c81e1a942d067f630b9ce156c229", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809527, "uuid": "bbd4611b-5d00-4dd7-a4cc-1f3823e64f33", "comment": "Malware payload (GCleaner)", "value": "76a0805eaa63accbec2603d0bf273b46cbcc0d0781aad29a7e4cd4492b275279", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809527, "uuid": "862c4eb6-2a72-4ad1-835b-42aaeae1a661", "comment": "Malware payload (GCleaner)", "value": "1247641ff74053506e57e6e3c4cbe44bf879c201", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809527, "uuid": "2c656be9-0d35-409f-9899-dcbd2514d0ae", "comment": "Malware payload (GCleaner)", "value": "79811df25c6162af1986a484a5ac412fde5a401b4cb801813df9a1b00fde541402c4caa31fe8c62f0a77b281c49481e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809527, "uuid": "a7ff430a-ca2f-4ff8-bf85-6252c585746b", "value": "T12946D04997A4CD20DFF045B98D9A60D49817A860B80CFFFD2AD6F1D9CC1572110AFAEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809527, "uuid": "9b051740-e5b5-4bd0-b251-25ff39b944af", "value": "345624d13ffc2b7f296b9d2972b1c0a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809527, "uuid": "392f02ce-641a-46b7-809c-e541ead6072e", "value": "98304:xiZfokiUogoPlnj/kagyBuApgBn7VWwSxuXLA:xw9ClnjMS/gJl6u7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809527, "uuid": "8375b9ed-513d-4c14-90f5-95ef094045cf", "value": 5843968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809527, "uuid": "8111b1b8-93b9-4321-89cb-dea43ed7b8bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809527, "uuid": "7e48d60c-ee72-41d9-b0bf-275af7c4499c", "value": "76a0805eaa63accbec2603d0bf273b46cbcc0d0781aad29a7e4cd4492b275279", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b3146ae-196e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809746, "uuid": "01bc3689-c182-4e27-8ea8-9dbc1ee2358e", "comment": "Malware payload", "value": "f26ad026754a3778c5ba39955295be09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809746, "uuid": "dd8e4395-894a-4d04-9c69-24f59b907865", "comment": "Malware payload", "value": "7745d6448da651735512324f972dd104355f940b0c758a9d7c386e3c559ff621", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809746, "uuid": "45075602-cfce-4ad2-a59d-7870814bebfa", "comment": "Malware payload", "value": "7a70706a9bbbd9c0e67db5b44955bb201df758c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809746, "uuid": "55505df4-0bde-4f4f-9656-ea4681a4b096", "comment": "Malware payload", "value": "e42a5d2a7984dcf6f1f7f495c4365fb2b7b8454c4628bdd70bc30908b1cb7694bbb790dda995e7846beb252335936182", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809746, "uuid": "da010ee4-7836-49d4-885c-b359730cf771", "value": "T170F49E23B1B15733D262DE789D5AD25C9826FD01E92898457BE41FCB7E3834D382A393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809746, "uuid": "9d433b0a-9460-485b-ac9a-8e1d41d6e7ef", "value": "5343399a39928268750ade4858cbd1d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809746, "uuid": "0a3e1a5a-9e87-448d-8cbe-2263d7c58df4", "value": "12288:Z2d0/V6Chk61Wd0Mv6jE/h/AkW4hpH/oAi2wuzakbtS0TijUz:86N31WB6YJDl/zwud0mi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809746, "uuid": "6e36ad3b-9659-48b1-8349-56a921f905ef", "value": 783872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809746, "uuid": "2574eec9-e870-4b65-a162-dc77cb3e907a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809746, "uuid": "279ae16f-6b98-468a-bf50-c1d799f7a7ad", "value": "7745d6448da651735512324f972dd104355f940b0c758a9d7c386e3c559ff621", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ace1d1c8-1950-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772796971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796971, "uuid": "5b187168-cbfb-4ca9-84fe-1b9852490da0", "comment": "Malware payload (Smoke Loader)", "value": "4a986f0d8f67b8e3f493af67da28ba70", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796971, "uuid": "0bbb5373-88e5-414f-a2db-04d5efea3b4e", "comment": "Malware payload (Smoke Loader)", "value": "778664b87ac10a5e543c2cda87aab48917a21162109131360845b9c10e2f826b", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796971, "uuid": "35adf9c7-245d-443d-bcce-749e09b48102", "comment": "Malware payload (Smoke Loader)", "value": "0174442a4676ec63185af18c9ed4b5fffb23ee86", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796971, "uuid": "4dc13582-7aef-4925-a6c4-4b91ec7175f6", "comment": "Malware payload (Smoke Loader)", "value": "128b992d61cab202b5d8edd6704d1f150793f9ef52778e0bf3921ff614b77ddba8619b21d1aac675eb26731e2b1bdbc5", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796971, "uuid": "86a9eff5-db83-472d-bf2a-29074dc95697", "value": "T144C501DB2001E8A9ED791A71A68CC53111B77DC21E14029B62E1FE973FB2947297FB07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796971, "uuid": "b9260b96-72b3-45bf-9d74-42fabddc533c", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796971, "uuid": "a761bc72-2fc7-4d9e-8589-ce55b929acc9", "value": "49152:iUzJy37Ps3OJPpAcL3uBtS3XhMXA8bq9fI0oaVRVACsrr6KU:A37oO3LsAMgjVzwr6KU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772796971, "uuid": "de2aad8d-e49d-4038-bc76-804d5d340ef9", "value": 2742784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772796971, "uuid": "c91fe165-2f93-4076-beca-8d8da752143a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796971, "uuid": "fe6b7a73-9f53-4ce2-9e35-9c3a1710cc3f", "value": "4a986f0d8f67b8e3f493af67da28ba70.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90e586e1-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772808950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808950, "uuid": "4f450b94-e61b-4de3-ade8-7ae82e7eda86", "comment": "Malware payload (AgentTesla)", "value": "01f027885ef7d70cf68573e62bcc75df", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808950, "uuid": "d38399de-0646-4057-b56d-837cba3e079e", "comment": "Malware payload (AgentTesla)", "value": "7816da1a3bd1ea03e6607b8dd6b7eae59f4fb9a907a760e5b43b27f1dc3a6d32", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808950, "uuid": "95852ad2-b091-4f74-97b5-6022aa3f3624", "comment": "Malware payload (AgentTesla)", "value": "79ed58a2df81477d19e5fe2886b04d9c6a599831", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808950, "uuid": "4800f493-c99b-44b4-8a6f-35e98dedfd4a", "comment": "Malware payload (AgentTesla)", "value": "1ac17a4f8c4a3cd734d097b8d76957e11040d645d1adf2844e0112bf15eaffb50b1db1290e05a106c04eaec272d0f8fd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808950, "uuid": "befa5ea0-b864-4abd-baf1-b97f728bde6f", "value": "T13184F1D034A090A7EABB6473D57A5D3207A36E2E76D8130F33A4732D69A3152471FE1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808950, "uuid": "413300e2-33d4-4e8c-ae7d-0657a12eddba", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808950, "uuid": "6387dce1-1875-4414-b70a-501156c8e110", "value": "12288:1wyaXgD8Wq7BQ4hWfrvXUXKqkHV26d5UDh4:1XaXgDjqjMZqkHnAW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808950, "uuid": "14b4ec8a-7301-4dae-9b2a-26b0ddf655b1", "value": 403157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808950, "uuid": "fc01dbf0-474d-4006-aa3b-99a1eac0c679", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808950, "uuid": "04071296-03dc-43ef-a9e2-a9c8d031c5f0", "value": "7816da1a3bd1ea03e6607b8dd6b7eae59f4fb9a907a760e5b43b27f1dc3a6d32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71a4c587-196a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808038, "uuid": "d1c46885-6f99-4305-a298-63135b8d1e3e", "comment": "Malware payload", "value": "54d726e453d1d5e53447d5ec6c5cb877", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808038, "uuid": "6baba935-670e-40f5-9616-3b458a0c2e07", "comment": "Malware payload", "value": "7851d886d5bb344e86893e2d924d0abf86250f18bc559a39da81658098036150", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808038, "uuid": "bf8c42bb-fd11-4dd9-a11d-7d389e1fb373", "comment": "Malware payload", "value": "ec83c8f57a3b020310e34154a5127b9e1af56ffb", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808038, "uuid": "273eeb3e-0046-4fa9-b455-e1ab521c764a", "comment": "Malware payload", "value": "d48cb8528a46ff5e50783b8d3334c674265806bb2cab10c3deea1078851f9c9e25c8efee42fb6303a8dc9d3ab1d26126", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808038, "uuid": "34084818-d276-46fa-b534-a05f899ebf8c", "value": "T100922A3DDCB8F9E086BF70C1E9E72A6250847B128FB25CB8D40A1C6807687D6DF2611D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808038, "uuid": "34bf1cd6-e7cf-4fe1-82ed-46f80bfbead1", "value": "384:wc2KqBczrhoFxhxtBYs8bJgDOtRVAYN5M3XUI/kXKMlNJTXlXf8YmKz9OIqscKcb:bVdW7BYsEJkOtRS1/QltXf8JKzFdc1ga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808038, "uuid": "d6c6c4bd-cc96-480b-a927-e99f5492067a", "value": 20638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808038, "uuid": "f2110b44-ce9f-413c-acaa-a65eaae05d47", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808038, "uuid": "9c05c753-92bb-413f-a398-c42c7625fdbc", "value": "Participants-2026.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8c343d0-1928-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772779891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772779891, "uuid": "6818c535-50c9-47af-a5ea-3e6d308f44b7", "comment": "Malware payload", "value": "07b113ed8039481d36f611c55c24f6e8", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772779891, "uuid": "740b2cd0-7fc3-4aa8-b432-5c1935e299d7", "comment": "Malware payload", "value": "78570320045cf05f9297839bac1378d953155ca5fddc0cd53ce2844edaca29c5", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772779891, "uuid": "b113ac3c-06a1-4e59-af1b-22e097962cbc", "comment": "Malware payload", "value": "4c91fc7406eaaca1ffbb4cd709edad7979cf00fd", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772779891, "uuid": "b0930ffb-2250-441e-9a50-0db9b576bd82", "comment": "Malware payload", "value": "52b381c88d88f3945144587e55d17918f75af8636ca8abbcbfebb46713fbbcb8956d87b48cd080ca2d19131b9e877f8f", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772779891, "uuid": "d2c750fb-0842-4cbd-9d42-def609c3398e", "value": "T10414BE142CDFE0158AF48511FDBDC561ABE7711BC9202C0339BE64F21F6B764AA21E9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772779891, "uuid": "383e6ec1-4d8e-45d6-88c9-86c706fd4e6f", "value": "3072:x4YKKPYg9ZWR7cDXfV4KpQlEuE30mMVdS8IUy5PSJa7teInvjIww/:xbKWfWR7c2KpQy3FKMbQInvjIww/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772779891, "uuid": "034eded0-6698-48c6-9e86-adad966b7cb5", "value": 200358, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772779891, "uuid": "24e6527a-f3f4-44b4-a32d-7776e2fbee37", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772779891, "uuid": "737819ec-027d-47ec-a93a-c134dea2cd88", "value": "Protected.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5432ae60-1968-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807130, "uuid": "4467c34d-46c7-4375-95ba-d2c4653c72f5", "comment": "Malware payload", "value": "25e0e6d9017bc2fec0ea67d61fd1a1e2", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807130, "uuid": "f9901206-a311-4ace-8f5a-e9d3ecd7ba3f", "comment": "Malware payload", "value": "78a21ccf48427922d139518c553cc922a5ab446ee5f58a9e22f8789be5bb4751", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807130, "uuid": "52c67097-bcf3-4c92-bdd9-eac8e332dbb3", "comment": "Malware payload", "value": "264e6e7220925a33fd900f5571cfb28319b96fbf", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807130, "uuid": "82cab325-1331-4513-9985-815a4c1d4fee", "comment": "Malware payload", "value": "340aabab16ea0196778b6a673caae84ed9adfe97a332dd6eee345706b3fd38c2eae2b35ca5aa5af31c28f5c85693f330", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807130, "uuid": "87299d5d-5971-48a7-b5be-26ff810cd941", "value": "T1F3763332E15D0AC2E43EC27B90B1178587AA121EE193D07A91427FC5B2E3BCF54DD99B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807130, "uuid": "0585e96d-8341-4459-9ae0-67fb1826814c", "value": "196608:F5bUuU+HB/OGUElHaXU8Y4FCPjSLjmHXUPZftY:F9LU+h/PUElUU8Y4F+SfmEPBq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807130, "uuid": "6cb5cea6-7879-469b-b41a-b4310683f08f", "value": 7829662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807130, "uuid": "d64b2570-bdff-4963-b662-ff7186233b2f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807130, "uuid": "3b3fafbd-a07d-48f4-b189-6b2172441c83", "value": "78a21ccf48427922d139518c553cc922a5ab446ee5f58a9e22f8789be5bb4751.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5da6e75-1969-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807777, "uuid": "2982019b-44c9-4146-bc1e-3fcdd901c382", "comment": "Malware payload", "value": "f8ca4b89700bca149f19efb1dbb8b4e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807777, "uuid": "edd957e1-c3ca-4017-96c5-5fe42c7b228f", "comment": "Malware payload", "value": "78b44149af6b83074d2af8162554e076c02790dedf81391b5d3441d4d368bec0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807777, "uuid": "7142cb41-b443-4b23-a03f-093985a7f61a", "comment": "Malware payload", "value": "0896def747bef94379b9cf55f016cc81c5e52b05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807777, "uuid": "fd8b62e0-875c-4b36-9529-ba938b81afde", "comment": "Malware payload", "value": "1a753c8ef709af56a20b29c23c77087811faecd1662bd0c8c8dce087a63620319c99cd46ef012f00b99c73051fbc43f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807777, "uuid": "6c2c9e6f-258c-4f63-9b76-30d2afb15b45", "value": "T18335120DB756EE92CF184B7BE953110441F3C566D522F3A7EACE2CF20E6A719844EA43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807777, "uuid": "12089f16-ae1b-4a96-a540-657f4613dd1b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807777, "uuid": "52e0a5af-03af-4ca8-823e-15a325c9511a", "value": "24576:Og91FIoroFozje+Ir0elo+oEDhAnajxFgdzgO8zt+1D9KZ9RGAa:OgRzroFoz6wQDhmajxwgOm+yE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807777, "uuid": "9ea5c1ea-24a1-4271-9134-61a0a02b97d7", "value": 1093632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807777, "uuid": "40ecb229-bf4e-4bf8-aa79-a3c1d01906cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807777, "uuid": "a3400316-bb15-411b-bb5a-ffd3aa73f367", "value": "78b44149af6b83074d2af8162554e076c02790dedf81391b5d3441d4d368bec0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad0f1ffc-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810286, "uuid": "8c6a23dd-2cfd-4d75-aa47-f382e5490bce", "comment": "Malware payload (GCleaner)", "value": "e6798a0c4bf9ee03aae21b9125d47c7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810286, "uuid": "0f090886-f124-4039-8647-4e25b4f9fa21", "comment": "Malware payload (GCleaner)", "value": "797f74d4251722972b3c15bd670ea5058569d922404791357826379d13a7ace6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810286, "uuid": "1dad8da9-5d84-467c-82b1-82c839d2f09c", "comment": "Malware payload (GCleaner)", "value": "985044d6e9294b8f98d950b704e098a8da90e4f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810286, "uuid": "7e448eff-049a-4b88-a678-230a4bca3712", "comment": "Malware payload (GCleaner)", "value": "8af1273ec9d371c7240dbe2a78b3426b939f8b8f0ebb31976f2aa1816c06d7228a87f98a7cd9d15e5b008293f5bc8ae0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810286, "uuid": "69fc8976-0735-4f88-a5b3-18654d84d9f6", "value": "T17B558D22B6934433C17216399D3767D86C2BFE132E38984A6FE91DCC5E6CB4178253A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810286, "uuid": "6673d63a-d7a6-4062-8358-487bbab09d1f", "value": "0eefadf8e9087d6d95cc4aedf30a5018", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810286, "uuid": "868acc0c-7ba9-4013-b93f-b18fb9ac4006", "value": "12288:QVLMD7V2wGymFSmu4eDCQi0628ZhcPaGfEdERlSdpgdICRgi9HwmQ3OjmlSy8aRR:QVwXV4HSmYq7MPPfEd+epghSaiV8UD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810286, "uuid": "167b0aed-f286-4c06-8622-6f3210747d5e", "value": 1280512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810286, "uuid": "29405990-7ef9-4e1f-a76b-b2b43eaf6d98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810286, "uuid": "0ddc57fc-6e10-4513-a95e-51585c0f6037", "value": "797f74d4251722972b3c15bd670ea5058569d922404791357826379d13a7ace6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c85e369-1969-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807600, "uuid": "21883b85-3c81-4790-af29-7c427642f36f", "comment": "Malware payload", "value": "237f28025897e43c55e3c9542079c3e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807600, "uuid": "2fbb249e-0867-4591-b65c-99e632177b09", "comment": "Malware payload", "value": "79c1faf5182ef6f6bdc54c60d7f44a46b9153d88ea921919b6e1b9262b7a7628", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807600, "uuid": "20a4d519-3dbe-49ef-976a-b5750d46c5af", "comment": "Malware payload", "value": "75ed7b4bdbb49e048a9e898754c861f397d296cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807600, "uuid": "5f15249e-d7d3-49da-bb16-aae8d6dc63fb", "comment": "Malware payload", "value": "15987d0faf91d325cb420461818a7b69a2ea8a0f6d15961c0b60088de89ca1b1d7994a0e00e7669af77025efcc4e9c2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807600, "uuid": "0c6b4c45-9235-4af2-8552-a9c4519f1bc7", "value": "T12FB4E1113988EC82CD121C30197DE6B6773BFEA56D2B8A07318DBB9F18B365E5A47704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807600, "uuid": "94d7eb97-e585-425b-a278-1706e1a44cea", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807600, "uuid": "5d7a3d87-9482-4228-9fe1-70dfe3761ee1", "value": "12288:i0vCWhX9kSkMfYirIn0X/xSL1C7BdHlBWaexPT:sWhRkRmIn0X/xoo9pLe1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807600, "uuid": "ac7f8c32-b428-40d3-903f-e4e77330e70f", "value": 500960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807600, "uuid": "cad96b28-efed-47d8-bc8d-ed5609d4a7db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807600, "uuid": "ec759bc1-973e-4f6d-a203-d3755ebb2faa", "value": "79c1faf5182ef6f6bdc54c60d7f44a46b9153d88ea921919b6e1b9262b7a7628", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8109ca9-196f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810304, "uuid": "f9784d58-b240-4989-9e1d-018b52139099", "comment": "Malware payload", "value": "78a9b2794da45cc3d274de2de371ad2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810304, "uuid": "4e59bae5-4f00-43b4-a81b-04e01680086a", "comment": "Malware payload", "value": "7a24bda55309e3e626df6071adc29350dd9482e8dbf6550b368a9134495a2a01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810304, "uuid": "a86b8f12-ba32-45f7-9856-60caf18d6510", "comment": "Malware payload", "value": "90312cc1581b49a8f134eef97e765f58a22812d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810304, "uuid": "ed9cd57c-6e3f-4fd7-83a5-6ac846039b34", "comment": "Malware payload", "value": "c303d79120d9cf58cad9b396329d666aaa3b396c4297856418944179de544a11533594c297fbee3860ad0b2928574659", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810304, "uuid": "0724659a-f67d-4175-9c62-5e153f578a2f", "value": "T15925F0145F872B99D62A4FB8C1B210A473F0C6A79307EB6B6EFC00F55F62B89C907165", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810304, "uuid": "19784228-62f6-4650-a897-08c12dd4f0f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810304, "uuid": "fe70b1f5-1b1a-4fbc-8417-121344984664", "value": "24576:NJ6kP7MjfgJ0IGkmI92eDKLXng07ehN3:NJWj7k79G7gGehN3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810304, "uuid": "b51e129a-229e-45fb-b5c6-0b951417cb3f", "value": 984064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810304, "uuid": "0f506968-0db8-49ac-bd5a-146eb8c32274", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810304, "uuid": "44ae0d88-70c5-44fd-aec1-c96157f040b6", "value": "7a24bda55309e3e626df6071adc29350dd9482e8dbf6550b368a9134495a2a01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0a249bb-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811177, "uuid": "15649a62-1636-4540-a987-1d08f60c7a71", "comment": "Malware payload", "value": "8b51594391c3475d1b05feba8fa6b917", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811177, "uuid": "8c092653-ee13-4679-b77c-3143d10ccd03", "comment": "Malware payload", "value": "7a2aac7994b92265b807dc01378eea1cfd8247e4fcb5b800b26cc75a056443a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811177, "uuid": "88ee55a8-a9ac-484a-8cbe-f2169e7efab0", "comment": "Malware payload", "value": "9a8f80bf5ba2997b1ebf8046bb9d6031d51a20c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811177, "uuid": "aa2cc535-dd7f-42d2-b85a-ac42d6e2034b", "comment": "Malware payload", "value": "fb8fb24eabb27afa48cf33472cfbd1cf69bbb125c311abb5c219d9a74bf04ae502de36137955e401694caf31e21aa73f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811177, "uuid": "ee2a96db-c422-4f6f-8c4f-cd1e70bf3b7a", "value": "T10136D9BB8E384C89C6C7F1F69381D6700DEAAE66A4E6E0FE51D109401F437506F61EB9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811177, "uuid": "c78de23f-7acb-4357-afbf-659fd0fee93f", "value": "d512f74fd5e290f01bfc48029b75487a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811177, "uuid": "11c5a883-35cc-4fd2-83be-f557247f808e", "value": "49152:DKJTSeUPUuw42rhDjVZXyBBOAZm+KHqZNjDo8xw:DZGNd+KKZC8xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811177, "uuid": "f6530648-da64-4b06-a3a2-21eda1dff53a", "value": 5225472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811177, "uuid": "9573ceee-3102-4408-bd0b-ff2f0ac0e95d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811177, "uuid": "abbeaa56-4187-4919-ab08-d996bbd8e77e", "value": "7a2aac7994b92265b807dc01378eea1cfd8247e4fcb5b800b26cc75a056443a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35f61472-1969-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807509, "uuid": "c4811bd6-4d89-43e0-b506-6466c37ae2f8", "comment": "Malware payload", "value": "cca3f083dba3cfae9b45f243c10adad0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807509, "uuid": "a3ffa654-afe6-42f0-9ed0-04d7b5f59c0d", "comment": "Malware payload", "value": "7a6e204bd9e3f075c2a12d1803a0422c62183d981e8dd70028b9fb4fbd5cc0a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807509, "uuid": "5bda6e64-a8bc-48d2-9c38-f56cc19c4f8e", "comment": "Malware payload", "value": "272a4db69f34e42e5e5d4f1dfa1c505f70a78c40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807509, "uuid": "d1606ec7-950f-447e-9f85-af7e1e91c28c", "comment": "Malware payload", "value": "2b44a1c7950e634650267e1b0c3e3c5f821e23c6138e7cce058599885006eaae7b329a37d598e715893c99e2cd9c1e9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807509, "uuid": "30dccae8-9315-4d6a-af75-a01b1e1056e7", "value": "T1E4A328A3CC762F58C628D5B4B0B18F796B93AA6081475FBE1567C27480C3D8DF6063B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807509, "uuid": "eefdb55a-28ae-4184-999a-d3af416d5468", "value": "1536:7NufPeqU2CVKCsNV7lsLPC9z+NzWuBx/3RhyXAQ:YbU2RC4kPCtSzWu3/3L1Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807509, "uuid": "e81051f3-33a6-49ca-9e74-c924e42eb9ef", "value": 105056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807509, "uuid": "95d61bd8-7f11-4f72-9968-746eb214dcb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807509, "uuid": "376911b0-5b51-4d61-8ce1-78d935b03cb3", "value": "iran.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8afd51a1-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811087, "uuid": "6ea8b724-668f-4929-a7ea-5b05b5e4d25d", "comment": "Malware payload", "value": "fa67261e67db3f9ad51e1af6dd1ed2b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811087, "uuid": "1560e449-861e-4254-b385-561cf5af5f6a", "comment": "Malware payload", "value": "7b058239412690f2e0342b9fe0ae2d2c3d714d53910f11c1fd63fa19a2400467", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811087, "uuid": "3977bcd5-a64f-436f-aaa1-acf09f74fe6b", "comment": "Malware payload", "value": "340f2e88965fb0590889c31a76abd91dbd687141", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811087, "uuid": "f3ac8e79-c8d4-4966-9daa-ee0c7452f777", "comment": "Malware payload", "value": "d974969fa32cf66be332c3139d3b45dafba03c7ef417c8506efe8db8246382698e35a93194c7f1745b6884e184300ad2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811087, "uuid": "0d471fb0-4992-4193-8095-093864d82322", "value": "T181C423082BC4D933CAA51D3556A785DBF9F9DE613029420B2730CE3DFDA7BA1A94D381", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811087, "uuid": "3d03519c-af28-4158-bfac-a58c6a70ec5d", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811087, "uuid": "175f8fa3-d4b0-4d66-bea7-44ba428d3aaf", "value": "12288:R1yDJwVJ2ieB0msm8EJygtMDoGbAzlTfYz2+:R1yDJwVA/Bom8pgtMDBEzlTfYzz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811087, "uuid": "c3c4911c-ab22-4d28-b8a6-1f87bfdd3091", "value": 573768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811087, "uuid": "7533ce25-0933-4700-9bc7-ebc24797367b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811087, "uuid": "1c59131d-4303-4ea2-8ae6-7b6fa1b710a7", "value": "7b058239412690f2e0342b9fe0ae2d2c3d714d53910f11c1fd63fa19a2400467", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5db2dd33-1969-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772807575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807575, "uuid": "854b7ef7-129d-4ec6-8e0d-575776358f76", "comment": "Malware payload (AgentTesla)", "value": "58a5510031e3fa7be13b79460906c39c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807575, "uuid": "6d75eb19-fd8b-49c3-8a28-5ac6ef040081", "comment": "Malware payload (AgentTesla)", "value": "7b57e193677da69c6ac93c7d2e2dfdafab85037ab0272c74fc4d22b0014ff893", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807575, "uuid": "39e2d3bc-9d45-46ac-b84f-d56aa61e5b2f", "comment": "Malware payload (AgentTesla)", "value": "438ca85adc491210b27d9f28b10d0d76436a0687", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807575, "uuid": "281ee484-d122-44b1-9827-302cd09309db", "comment": "Malware payload (AgentTesla)", "value": "2c699f5c02d2cd1833462d19f84c1b88c6086dee3a4ad9d14d3c3e597d518c52a614e0c057dfb86cb9e5f18920af7abe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807575, "uuid": "590196a7-b803-46a5-b87e-aff2756da4ee", "value": "T1DC35020DBEB6AA51C19C5B77D413610C89E78027F2A2F29B4DDD39F04E64789C84EAD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807575, "uuid": "a759de2b-2ca8-40e2-9508-8ebf180dfa0f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807575, "uuid": "77b423c0-fb32-4c4c-9c6c-48328975cd3b", "value": "24576:E6hCuiZIY29onXop5Y104jnnCW9c3SR7akFbSDvTr:xhvifVnXop5Y10Wc3Q7DGHr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807575, "uuid": "5109113a-430c-4728-8be4-fe4fde15b72f", "value": 1068032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807575, "uuid": "0a58f320-5e70-4c07-a85e-efee26c385bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807575, "uuid": "3e9f82a1-b4fc-4e2c-8aaa-2ed5b0fb83f6", "value": "7b57e193677da69c6ac93c7d2e2dfdafab85037ab0272c74fc4d22b0014ff893", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69940c2e-194f-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772796428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796428, "uuid": "43ebcdcf-aa57-4908-9dc6-44a85e48d693", "comment": "Malware payload (NetSupport)", "value": "b9043f6a14295f52de2956a99efce107", "object_relation": "md5", "Tag": [ { "name": "94-158-245-153", "colour": "#0E67A3", "exportable": true, "hide_tag": false }, { "name": "cdn-westford-computing6-net", "colour": "#460872", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ink-approval-com", "colour": "#8059F3", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "westford-systems-icu", "colour": "#A494F3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796428, "uuid": "9eb3b7f0-b1d7-4b89-bb0e-44e7be81d8bd", "comment": "Malware payload (NetSupport)", "value": "7b7f9471d21d46c28456eb336ea96686e7206e4bc0951efffcf259ea54cdb831", "object_relation": "sha256", "Tag": [ { "name": "94-158-245-153", "colour": "#0E67A3", "exportable": true, "hide_tag": false }, { "name": "cdn-westford-computing6-net", "colour": "#460872", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ink-approval-com", "colour": "#8059F3", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "westford-systems-icu", "colour": "#A494F3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796428, "uuid": "ea650fc5-5c32-4144-a768-2e6ec80712bf", "comment": "Malware payload (NetSupport)", "value": "27498fa7b7ea30c934f86139313bd2c396953942", "object_relation": "sha1", "Tag": [ { "name": "94-158-245-153", "colour": "#0E67A3", "exportable": true, "hide_tag": false }, { "name": "cdn-westford-computing6-net", "colour": "#460872", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ink-approval-com", "colour": "#8059F3", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "westford-systems-icu", "colour": "#A494F3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796428, "uuid": "e38e210e-28ad-4f41-b244-0466c8bb9804", "comment": "Malware payload (NetSupport)", "value": "5b688659dd4fccbee81c9b4c7950ebc69dab5e0fe2861e8c2c3360f49879654d9ef75a77309a673fca5620a72676965a", "object_relation": "sha3-384", "Tag": [ { "name": "94-158-245-153", "colour": "#0E67A3", "exportable": true, "hide_tag": false }, { "name": "cdn-westford-computing6-net", "colour": "#460872", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ink-approval-com", "colour": "#8059F3", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "westford-systems-icu", "colour": "#A494F3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796428, "uuid": "625e494e-f93f-44f1-89b1-6c8135885d95", "value": "T168B5331654162888C421A1702E2BEFDA0336F4BD5D468519F21B5EBD43B3AEE9CE3F1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796428, "uuid": "907cbf2f-df8d-4d25-be6f-8533ed249728", "value": "49152:pjJebOxvR9jVnaXQL4ZWKbYomh8eQAfFwaY0kgo86FPbSRM75q5Kqr2YyNgvn:ntR9jVAY4xORfaaJkweH5+5yNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772796428, "uuid": "a6b7c5a5-53b8-4179-b513-a95a491092af", "value": 2365431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772796428, "uuid": "491c9569-5790-46be-8200-751bb7131455", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796428, "uuid": "c706d84c-314d-4f07-b8e3-e15beb8966b9", "value": "Giggleliftguess.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae986cab-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772811577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811577, "uuid": "bdd60a77-d89a-4cde-83b1-f08eef32253f", "comment": "Malware payload (Formbook)", "value": "4d9beef9d221dce889942776a9b69bfc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811577, "uuid": "223fac77-9752-4528-acf1-134120a7c1b5", "comment": "Malware payload (Formbook)", "value": "7b98cf43bee8fdd9576f0441ef5710b91bd3a05cca78066c9e4f0e3a07d3c411", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811577, "uuid": "a9584c2c-5844-478a-949f-81d8a183e020", "comment": "Malware payload (Formbook)", "value": "d8d426b74f57561be188e9de2ce4509757eab9a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811577, "uuid": "3696aa19-b1b6-4d7c-affb-d4cf597b0e71", "comment": "Malware payload (Formbook)", "value": "9b5954ab4084b55eddff6957fb4688c4594c16843916c4a81b14b6f8bbfe3ed523c1de4eb57b9134c96782ceb6689adc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811577, "uuid": "b2b60389-a129-480a-ad40-dcd7cc01030b", "value": "T1EBB4E009B349A4FED51AC578C6831912FA723CC64B71AEEF0B944A796E226F45F3D700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811577, "uuid": "09c82e96-505b-4246-8048-52a991eddb45", "value": "c71d9111a77fb9217f1e372fa1b6214e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811577, "uuid": "e2aea582-65f0-4ba7-8df7-3c2700c86e95", "value": "12288:twO/jk3vsBSzpRwUu0XWewn+h/A2zet8MztBY:twuBSdqlFAetnY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811577, "uuid": "f406a62b-54bd-4a1c-8102-2be444420a85", "value": 499304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811577, "uuid": "3b0c57b0-b4e1-40f5-8f55-d4f47bdf4871", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811577, "uuid": "807f46d7-510f-49e1-bbac-09f91317af6e", "value": "7b98cf43bee8fdd9576f0441ef5710b91bd3a05cca78066c9e4f0e3a07d3c411", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94066243-18fe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772761710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772761710, "uuid": "86d8bc50-54f8-46b0-9d88-62cf51e2408e", "comment": "Malware payload (Mirai)", "value": "e91dccd6d2a98519cffd0143d8111a54", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772761710, "uuid": "dc18a16e-720d-4938-8b90-13c241842555", "comment": "Malware payload (Mirai)", "value": "7b9ba082df5fd5dbcba73175f3bba57ddccef25fce1512c0708367bbd0fb3859", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772761710, "uuid": "b369a710-371e-4b16-b8ca-c49a07c1cbba", "comment": "Malware payload (Mirai)", "value": "ce55c60fcd0bf51daea58c29498919a4fed11403", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772761710, "uuid": "cdeb8e48-2fef-4008-b844-a337d254214d", "comment": "Malware payload (Mirai)", "value": "c16422ccc915757c68358fbf942fa0e8fd02c2f693eda3082b81033db65fb962ceef44d1d76c92bd111b62a8457ed77e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772761710, "uuid": "95b23b53-122c-4003-86a2-2f26e356e7d2", "value": "T1B3041905BF110EFBD89BCC3B45F9270529CC581A62EA6B36B934C858B54B25F1AE3D70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772761710, "uuid": "23ee9734-ccee-4d9f-b5b4-f82a71942d62", "value": "3072:t60NrtUpT/5dltGgXGGP9M4S8lrXwU2wonacrI40fCtZ1SD39rsJj/s9fx49SY2Z:t3nEr5dfHPq7UToac8uF9X0V6B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772761710, "uuid": "10a1f15a-3d4a-4eea-902e-0462d1026e95", "value": 179916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772761710, "uuid": "10721917-e12e-40ab-82d9-398ea17a013b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772761710, "uuid": "a1fd3fcf-2fe5-4167-8818-e626b6806ba0", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ef94df0-196d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809215, "uuid": "6d77fade-74c6-4071-8b83-ed58a98dded2", "comment": "Malware payload", "value": "8f0cad4337137fc9434f1f4fce278ef1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809215, "uuid": "d95b0b1e-11c5-47f4-9f36-13b661b5da96", "comment": "Malware payload", "value": "7ba7a9f45087733f3fa825456a4feb4b6c79710ee2c9dd65c54d8455c5bd0c0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809215, "uuid": "11e50c53-1bea-46fd-8296-34a3d65519c0", "comment": "Malware payload", "value": "f1a58437c382cbfaa5ab5e087aad242e675ebb85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809215, "uuid": "205e5499-9c67-445c-b4e4-9f2a619a0ce2", "comment": "Malware payload", "value": "ba5443cf0579fd746bb59605202d60281bd47e8434fa369eee216a005e1d5bc939b986daa92d853023468caa81f37d35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809215, "uuid": "ab564362-40b8-4846-9461-60f83b250780", "value": "T14245BF027391D062FFAB92334B5AF6115BBC79260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809215, "uuid": "b8737c45-32de-418d-a218-ac7552c1bae6", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809215, "uuid": "3a8a6d18-c7f7-448b-b14d-be001950aaf9", "value": "24576:05EmXFtKaL4/oFe5T9yyXYfP1ijXdaMjPRTmmMoCej8:0PVt/LZeJbInQRaMNT/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809215, "uuid": "09ab0f4f-7492-4f04-bf4e-8231c25b9899", "value": 1170944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809215, "uuid": "f9988c6f-423f-4c14-9a53-af216aeaffa8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809215, "uuid": "2e3bb937-f2d4-4441-a7a0-f89807042730", "value": "7ba7a9f45087733f3fa825456a4feb4b6c79710ee2c9dd65c54d8455c5bd0c0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95c25c0b-196c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808958, "uuid": "23938b5e-52f8-48f5-8536-ad863565de23", "comment": "Malware payload", "value": "c135b9255bbadcdb9caf4d2effa0ff9c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808958, "uuid": "1309e2c3-b943-40a1-8cfb-5be13a81eeb2", "comment": "Malware payload", "value": "7c0d1a9f2480add073c0ec9d8ee3de476e226a87bf92106c256dcc8fdd94cf4e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808958, "uuid": "b3ae4d18-0722-4b27-8214-3d1d07c5e86e", "comment": "Malware payload", "value": "082019a036d2d1d64842113a0bbb8864678d867b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808958, "uuid": "a6ff54f7-814f-4ffe-b8e8-d09de5726bc2", "comment": "Malware payload", "value": "42bd9d976f9ef8b52c6f87dffef8cfd589313ae2fae80d51b7018f95d5ff7ddcdde95e76871e84e37bcc48c0f6eeaf2a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808958, "uuid": "13545aa4-6852-4e52-b864-6fdb6660ddfd", "value": "T1E305D02ABA5D18FDE026C471D25106679631B8C60B107AFF81D42A353FAAFF11F3A749", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808958, "uuid": "47e0500e-4dc0-4576-a952-cd1e336bc1cb", "value": "a76586583a0e36ae93bb6cccae05bb45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808958, "uuid": "e12c15e0-0784-4254-9b4f-ec2ab7871898", "value": "12288:0ovf7cvH5VHhuNojggxCnSrn09+DUwTQ1szDU8SM8f:0ovzcP5TsIggxCngn09SP2szTSM8f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808958, "uuid": "289e99f1-5f62-469e-9e67-6e7ccb8ae627", "value": 811832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808958, "uuid": "de6e1070-080d-4a89-92c9-579adeb8fd8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808958, "uuid": "6f5d6745-4aaa-4e4f-988e-492f541d3eb1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4106734-1970-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810807, "uuid": "2c979bd3-86a0-4327-a217-8a7f2886e390", "comment": "Malware payload", "value": "b7ea77e6a6e4e4812564b7d321714d25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810807, "uuid": "f04144a6-c984-4b33-88db-b371baab9019", "comment": "Malware payload", "value": "7c24bb9ac305a9f23287f62c4267c107dea42b420bef11219e22ff288c077bd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810807, "uuid": "38d22042-d611-4a5f-9d05-e2c03d601c5d", "comment": "Malware payload", "value": "92747292d0ae89d867ad14def8a7f0521370f2ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810807, "uuid": "4510f065-75b3-4a9e-8b07-b910bb02955a", "comment": "Malware payload", "value": "8710362a6058c5fa5577754d99d42a38f0e869e07082930ced7e0af07870591774b68e3491eaa563d9f2434841c24afe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810807, "uuid": "e87553af-64ee-46ab-a512-5f101799d9a6", "value": "T132C4230122E1DA7FC8630EB14BF72DABF6F4952320389797B3524A8C7D63351B509395", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810807, "uuid": "fafca544-4697-46f1-886c-e67bb642863c", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810807, "uuid": "b38d4de3-d9c8-4955-8553-2b09739a920c", "value": "12288:O1yDJy0Yz3/MEZPclMS/nxwhrbG1ppCq4aDyt:O1yDJEznyPxabsnCRXt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810807, "uuid": "49f57c32-322f-48a4-ad21-f882b60b0092", "value": 562336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810807, "uuid": "399bf676-34d5-422f-9dc3-fb7d4cd256a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810807, "uuid": "caaf8e53-8b8c-4cf8-9740-08afdd6e2716", "value": "7c24bb9ac305a9f23287f62c4267c107dea42b420bef11219e22ff288c077bd8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0044be92-193e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772788950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788950, "uuid": "ce87f298-6dd7-4b77-a473-348699187d86", "comment": "Malware payload (Mirai)", "value": "96145ee6dcb8648c2f4ad1469c90313b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788950, "uuid": "d9626816-52ef-4648-b6c4-ae739b1e51d1", "comment": "Malware payload (Mirai)", "value": "7c42fb189cc6b9d2c4fb1ff06af42b540b0c195ea135c0d57f21c6641611425b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788950, "uuid": "e78d7de4-23d8-4de3-8f9c-e5bf41a3af2f", "comment": "Malware payload (Mirai)", "value": "cee8872e243f03884e408ec2e2e03906b5d8f298", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788950, "uuid": "3eb653c1-c323-4159-a2cd-193addee13e6", "comment": "Malware payload (Mirai)", "value": "8fcdc1871e3cfd2aaa6e52b11b66e68eaeb05f0ae47d3e55052de1c8a55051b4bd519f05eae8eec8e51ab6ed4149c0c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788950, "uuid": "41216c16-4a3b-4268-9db4-0a493045a623", "value": "T1EA03F15BCA56DD4B8BA4E830B86C64CA66D322B8E17E7967381A1278F6427040D71B89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788950, "uuid": "de987749-7dee-456c-9027-553fb5e2b6ca", "value": "768:+G5CGcO/u4yEVLgSAWLax+xn/VV34uThJhmS8SOd3dXonqwNEcs3Uoz1s:jkGc+TK37Ex/VV3r6S8SeX/waZz1s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772788950, "uuid": "f88ab894-2768-4f0a-82d6-8506fbca7a11", "value": 40036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772788950, "uuid": "7a84fe93-f569-43ff-9503-dd5a5be36a9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788950, "uuid": "1d9b2c59-ed68-41d8-a6a5-27e35aff8fea", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82be880a-196a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808067, "uuid": "97059c9f-c5f2-4fe4-a7df-4ea4e9f62f86", "comment": "Malware payload", "value": "c969c30f8e92eeb81e16aeba75f06933", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808067, "uuid": "8fea8ff8-687a-476a-a0b5-cf114b65288c", "comment": "Malware payload", "value": "7c5e075a5861f56e6fdeab4aecc37d2d2d0d19c384464a406a67000ff2b27737", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808067, "uuid": "d1e8d8e9-24b0-4a57-ae1e-81e912bbd11e", "comment": "Malware payload", "value": "1df79ee08d3d7e4773f75eddcba403c7d6f47373", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808067, "uuid": "2f44b280-51a3-4849-be1a-bffb7ac4de0a", "comment": "Malware payload", "value": "a8730d0b568765c990327cba92219bb020574778789fee8a5a966eac8b0506186c2f0cab82ee3043d562f5890d36c682", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808067, "uuid": "1ff922a2-1f55-438a-896c-763f77fd8e71", "value": "T1B435E00723D44A68E5BD977991BA04E113FFBB479732EB1CAC0A51EB0D22B41DE41B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808067, "uuid": "d2d289cf-fe7f-40ce-b95b-4d838509efa3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808067, "uuid": "1f9e2ed3-5361-453c-9340-48b7b5fd35cb", "value": "24576:5mfZNC8ZHKJCX0fI8mVS7ZXng07ehlmqR7Y:GZWWgI8mclgGehH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808067, "uuid": "2171b742-0958-4d12-b0b5-b28e44f441b0", "value": 1139712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808067, "uuid": "388797c4-53d7-43c5-b355-1445abaada5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808067, "uuid": "460415d5-d2e1-4109-84a1-c5578bbc63b1", "value": "7c5e075a5861f56e6fdeab4aecc37d2d2d0d19c384464a406a67000ff2b27737", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2c47286-194d-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772795692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795692, "uuid": "1061ef65-4f55-4729-86ca-be48c9ec6f2c", "comment": "Malware payload (Smoke Loader)", "value": "8985e6332c78355fd49efcd46700fe37", "object_relation": "md5", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795692, "uuid": "590b1bf2-4023-4d54-b343-0bdc617e4f21", "comment": "Malware payload (Smoke Loader)", "value": "7c90cf45e068bd9b227b648cda33de1bc0e5bcaa4c3a0ff74147851458f13d32", "object_relation": "sha256", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795692, "uuid": "1107df90-5bb9-488c-9725-fb99b078489e", "comment": "Malware payload (Smoke Loader)", "value": "fcdeac22ea222c3ce1247d30d1caa77da94b8b6d", "object_relation": "sha1", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795692, "uuid": "d8dc2c06-7943-4d4f-bf5f-e47b256bce8e", "comment": "Malware payload (Smoke Loader)", "value": "aa94a2aa4c0fcec119fdc29351e2232a5b54528e3f4f919351a1feebc2871ddccea9ad1b66e540e495f4c5a3e9b304fb", "object_relation": "sha3-384", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795692, "uuid": "7b5c2c7d-208b-4567-9788-5fb855ea6cb9", "value": "T1E777CE17B7D840A5D0BB8234897B9716E771BC110B3196CF2254BA6D2F73BD05E3AB22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795692, "uuid": "c908b211-240c-454b-ae53-f55629f1e228", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795692, "uuid": "3e1390dd-8d47-4f83-a3a0-f80fb04a8898", "value": "786432:VyYdZwvM+6TNHZkOMghYglCnBSDf/1g0755f:ldxPNGOlh7tg03", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772795692, "uuid": "96a4cd74-d33a-45f5-9eb2-ef554f2efc74", "value": 34123776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772795692, "uuid": "894c0ec9-b9df-477c-960c-d504fb6d7c6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795692, "uuid": "96cc4f0a-47b3-4436-8592-740e31c93fde", "value": "source code of carbanak backdoor discovered_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61649e7d-1969-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1772807582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807582, "uuid": "1b7b4ee2-05eb-40a0-8283-4e3bea7182e5", "comment": "Malware payload (SnakeKeylogger)", "value": "1627f9b4673de692a3f3aace72627a8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807582, "uuid": "a1e76e5c-3973-4f26-be45-6ea3b14334be", "comment": "Malware payload (SnakeKeylogger)", "value": "7d1576c37e098589686ce1a2757ea442f06776417caf6371847f5e41ea76fef5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807582, "uuid": "fa180cdd-7831-4b74-849f-6bcefc95d473", "comment": "Malware payload (SnakeKeylogger)", "value": "324b045fd04c8ce11d4b51691bb8e19f2ae77055", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807582, "uuid": "3e5fc441-c66b-4fbd-9bb1-734a854bee32", "comment": "Malware payload (SnakeKeylogger)", "value": "b841530671867532254c25f32d4dc85dc68d6a0014b878bb1df5eaf2674a57c2f4326607dc1092dc2b9c34c90b7655d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807582, "uuid": "667bf577-4b8a-4d7c-bcb8-3a20d1c7b277", "value": "T1A4552262239EDE86C6A507F51E36E33213B04E6DF512E3169ECA7DFB34C63824918607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807582, "uuid": "51635a57-f0c1-441d-bd88-a9f96f2a0246", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807582, "uuid": "df0ed162-57ca-41e4-bad8-782d501afe34", "value": "24576:7guQWjsbaBsOe68s8rufH0lkv9Nyf3O+kgDUgMSuZC1QYPzgPrc2VFpm1b5FVicv:Eu7YX6l8CflvoeIcSuZ7YPzgzlHpa5F9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807582, "uuid": "d1bb2103-b273-47d9-a2c9-9ba2983f1bcc", "value": 1336328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807582, "uuid": "94a71e6d-f8bf-49d9-a66d-919562222887", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807582, "uuid": "9c7e85b7-c3b4-42d7-b6f2-1376aa3eb4f7", "value": "7d1576c37e098589686ce1a2757ea442f06776417caf6371847f5e41ea76fef5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aa9c1df-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811006, "uuid": "fea4194e-02f0-405f-889d-0d440a137770", "comment": "Malware payload", "value": "4632d6acaf7b075b2a65c5a09b9914ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811006, "uuid": "6859bd86-04c8-4652-8324-71f4ddd4e565", "comment": "Malware payload", "value": "7d5fd8a7a997230c9c0cc1213b72b0e38b4f041e907da3bb24158fa200bcc5c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811006, "uuid": "fe6f9425-5d16-4bee-a655-d0965e5bebf7", "comment": "Malware payload", "value": "6ebf42bff0a6a8be1590a122ef8670dcef61d3ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811006, "uuid": "fb8918b1-638e-41bd-a152-360bc591b952", "comment": "Malware payload", "value": "5e225d3405da6f24cc70e0bdcd79f99b96805ab8cdefe3b1fd257adafde042b360e611469a5bec2e2de6c63bba65e08b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811006, "uuid": "cd855301-c823-4b63-9795-a3936cd41353", "value": "T1EA352313B276E413D19ADB39F638A9F989EABD54E0327B0F430C3F6878B95811135E85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811006, "uuid": "90e44608-e54f-47e2-bee4-3a368e581cf4", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811006, "uuid": "bfe322ef-721f-4990-bf3b-01f7ff3d56d0", "value": "24576:uAcCMAMWE7Eakp7GAfojvhwZc5drzQDG5/3WVd3ij1:lPMAMp70iAgjvV5d4G0VdyZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811006, "uuid": "b0b9daae-d3da-4059-8f89-953c09e236fb", "value": 1159080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811006, "uuid": "73831496-7bc7-41a9-a2e2-ab5cff7370f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811006, "uuid": "34c80e5b-be66-4c76-98a6-ae8eb592bcec", "value": "7d5fd8a7a997230c9c0cc1213b72b0e38b4f041e907da3bb24158fa200bcc5c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfd976e1-1927-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772779420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772779420, "uuid": "47cfc646-6424-45c0-8564-0f161553ca47", "comment": "Malware payload", "value": "3bce9bb391b088517cabc9307a45dd45", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772779420, "uuid": "d3be925c-2a5e-41c8-927d-b98367bf2c81", "comment": "Malware payload", "value": "7d68ff23ba4173e1cfe98e2b1e43c96ade9ebc3a960a72a09b52f3e3c25f309e", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772779420, "uuid": "1b95efd7-2dfb-4086-b562-6aa7fd017641", "comment": "Malware payload", "value": "f0c205846cbbd5a976911ea295b0773fb02e3ad2", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772779420, "uuid": "1f5324c0-480b-4cd2-a01f-28792613641c", "comment": "Malware payload", "value": "cd122da55c18a93b0bd61155ae653a9ad8748b00b4d77fa577b292660403dcf646efd6c51643a1284b3522fe8157d367", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772779420, "uuid": "6bec0e30-60c7-4c4f-a0c1-171c7885bd53", "value": "T1F171C30A2E9CD88FC50B1177146082C6F735428E0A4DEF2FA69922208DE19072B46FEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772779420, "uuid": "701df790-efed-43ac-9bc4-ff14bc724dd3", "value": "96:si+sSpkkEZw9P7FUbxqtSLgjuWfWtX2RzoWKMiAJm:RkEZkFQm2l2RzoWKMlJm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772779420, "uuid": "9356811f-4d88-473f-9294-8203e6e8037f", "value": 3545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772779420, "uuid": "5bc2d362-2119-49ac-85ce-4bc3a41e4d3d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772779420, "uuid": "3eb7faa2-aa4e-413c-9bfa-fc73794d5e34", "value": "7d68ff23ba4173e1cfe98e2b1e43c96ade9ebc3a960a72a09b52f3e3c25f309e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf2e5082-196b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808598, "uuid": "23ad8804-b544-4c19-aeae-28d880c2f104", "comment": "Malware payload", "value": "1f3581497b6b7b23ef55794372456240", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808598, "uuid": "00ee9916-2cc6-4101-ab71-f57d19744657", "comment": "Malware payload", "value": "7d86697c7aced31c8871e4b317107f030eec350b3c851bfb3eb68046bc67d257", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808598, "uuid": "12fab582-fb2c-4055-977b-ef0a6b593795", "comment": "Malware payload", "value": "abad24464bf4ccc588165f635215e0a93aba1bbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808598, "uuid": "970ac070-f76d-4f93-8042-c6b3cbfecb50", "comment": "Malware payload", "value": "93e3285f15ebd17f609a8a9b2715da8f585e18a4510b6b7c4d5400e47bb602740ef0f74c7abd756b143ce609934f0a17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808598, "uuid": "4718cf85-ecf2-4ba5-b0ce-8aca884eaacb", "value": "T12394D516EA60B0A5F89345702D78A257392D3D392680ED4BB38D9F5A37B1993B0F530F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808598, "uuid": "ace6a0b4-ab28-446a-84a0-8ace7ce12cf0", "value": "6fd1d641f42fe17f68ee62ef7da6689c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808598, "uuid": "21e53d8b-790d-4ebf-9916-01fdbdba135d", "value": "6144:PHs8Y5usJW/Vbas90xTvmpbx5CIVREsz2COkEQuvELrvJCv/vB1YjVPhQ2f1HXgI:fsV51Wkc0xTvmpbx5CIVO6+dx6SasYA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808598, "uuid": "99b1f70f-6e1e-451a-b674-6512015d0eba", "value": 417792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808598, "uuid": "79a3657a-b419-401b-83e0-6beb88dd7cd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808598, "uuid": "f0bcd125-43cd-4e32-9434-62f8fda1f9a4", "value": "7d86697c7aced31c8871e4b317107f030eec350b3c851bfb3eb68046bc67d257", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1a3ffe1-195b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772801676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801676, "uuid": "02bf8b9d-eaaf-41c4-a992-42ff970967f7", "comment": "Malware payload", "value": "8f4e621d8a5dbaac3f4d027a19c9511b", "object_relation": "md5", "Tag": [ { "name": "FrostStealer", "colour": "#039E85", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801676, "uuid": "a0858675-c705-444f-aaac-511bcf04be32", "comment": "Malware payload", "value": "7dd04ac73feb0bc13f2840a7df23a65a775c5394fc2b037cfb486eb6e4c0628d", "object_relation": "sha256", "Tag": [ { "name": "FrostStealer", "colour": "#039E85", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801676, "uuid": "7e9e48c4-345d-408c-a677-cfd51a7cd5df", "comment": "Malware payload", "value": "476cd2c06d6171c65ee51fcfc9b04d5e6bd56914", "object_relation": "sha1", "Tag": [ { "name": "FrostStealer", "colour": "#039E85", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801676, "uuid": "907afd01-fa22-4279-a44e-e017c60382a8", "comment": "Malware payload", "value": "b3d132c7d24517f0dd72a782068e05de17fa7f23cf7ee122c01745f02aa7b18aa569ad590583b17597756b1aa1163a0d", "object_relation": "sha3-384", "Tag": [ { "name": "FrostStealer", "colour": "#039E85", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801676, "uuid": "3e77f2cb-34bc-43f5-a2f5-3068dacc2e99", "value": "T1E5A7334C31F987AEC39E60B24526592F8E0D381B1186B6EDCEDDE3D3F2D15426E7A052", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801676, "uuid": "307376a7-e466-4877-be41-da6c228d86e5", "value": "786432:zUsrYh04u22PfKJ/Y2Uq7GdUu0roJLXIptvMaPEiLJfq08z9ymo+sbWz:RrYhFKP0U8AU25XIptvMwEit+9G+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772801676, "uuid": "9fe81dfb-b9fb-48ed-85f9-c586257b5923", "value": 46024614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772801676, "uuid": "634a83c8-97f1-4d2a-a033-90a9c5d6331c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801676, "uuid": "d4f5387a-0143-4c4c-a2b7-30249ea5f07e", "value": "dist.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a9bba7e-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808537, "uuid": "b1c1982f-3d49-4215-8070-9efce4871165", "comment": "Malware payload (GCleaner)", "value": "1f614aa03b71784c17f7918423c4a61e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808537, "uuid": "a295c04b-b913-4bfe-84ec-00dc4a940759", "comment": "Malware payload (GCleaner)", "value": "7e10356e1973aa9a143df94e849d2e4a15a700ebb47f2e6177b6e527e5c9acaa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808537, "uuid": "81c63cbf-4e42-4e6f-a5dd-bfed6d00bc88", "comment": "Malware payload (GCleaner)", "value": "589ab7fe8e415f41249cba695df8b8d19b2397cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808537, "uuid": "e4662d35-3b1d-4d77-906f-356ad94e5677", "comment": "Malware payload (GCleaner)", "value": "b15389de5ea994e4a55fe632b46dd825e6077bdcc56a5e090f09ab454176c04614cbb57ec0625ae4fbdce5988008d436", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808537, "uuid": "72e4afaf-75c0-4a9c-93c8-a5edcbe7dc5b", "value": "T13116E0E170E35167DC756A3CC54EF5C44A0A39648F30E8AC9FE6CBEDCA69C84587A132", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808537, "uuid": "5c0a3473-63b2-451f-9b7e-239307e1389c", "value": "099b2b7fa2a0044e2ca25418be2f8a70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808537, "uuid": "fd1bfc3a-2b6d-43f5-a659-d2aa52339064", "value": "98304:2teTbNm2o5CBE2kiB9DkiC73qkIrPVnXmXTDehV7:2wm2oeE7O4qrOT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808537, "uuid": "2091acf0-c24a-4719-b1c8-c8d6b3ae3791", "value": 4345856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808537, "uuid": "e1794436-7753-465b-a512-00a39873dcb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808537, "uuid": "dd4e2e60-007c-468c-8d26-9d1b29d99139", "value": "7e10356e1973aa9a143df94e849d2e4a15a700ebb47f2e6177b6e527e5c9acaa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bad3668a-196a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808161, "uuid": "1dfb4717-8c9a-4566-a7ef-2b1b76f4d9e1", "comment": "Malware payload", "value": "ddf006aac9d4a7ee3d492c85a152b789", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808161, "uuid": "d6a6ac10-d9cb-4fae-a81a-070b3f7b00e8", "comment": "Malware payload", "value": "7e52b86d3a300523af18b87223dd50d104d76b1e32a664910cda4d90917e495d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808161, "uuid": "c54ad47d-2932-4294-b123-fa33008becb2", "comment": "Malware payload", "value": "383121e031e95dc9b544a8401f9414164a24c129", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808161, "uuid": "f3dacdab-8de9-4b8a-815c-17e223b97507", "comment": "Malware payload", "value": "1fe7bda9ad6e5d57eeada28ff5c3fc8d27cd118e2e25aa59f66bfd6220de73405c08d74abc18e62dec8d29ab09070cbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808161, "uuid": "fb6b9e13-6566-4794-9436-37b7ee8c22a0", "value": "T1BEB4D847EBB550F4C8B6C0388AA26237F971785D5334ABD787548E171F22BE0A93EB05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808161, "uuid": "8523269f-4879-4d42-a2b3-3791d7847800", "value": "0a8241508ebbe65c17ae6ec3be86cdff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808161, "uuid": "b991f69f-3405-4bff-87d1-6e424122e6ad", "value": "6144:xnLdxFsMwu9hQ6n4hsc10pUDZq36TutqTASyACfts3Ehto5Ro:xnLf6HCcepIZqqWa3Mtg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808161, "uuid": "cef5c131-90a0-4523-a13e-8bddb2c2dda6", "value": 537088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808161, "uuid": "094c04b4-6bbb-4923-9c61-c9e5b517353b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808161, "uuid": "1df70946-0e5d-4984-8839-6655160258b5", "value": "7e52b86d3a300523af18b87223dd50d104d76b1e32a664910cda4d90917e495d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc1f1737-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1772811707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811707, "uuid": "29511006-34d5-4013-b29d-25e54704a7b5", "comment": "Malware payload (GuLoader)", "value": "51bbd1b8f4012bfea73c4a2743ff5d26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811707, "uuid": "94c26c2a-f057-499b-9dbb-e325025e00bb", "comment": "Malware payload (GuLoader)", "value": "7e72540284e2469fd10a11a46338a02fc1a25f7e681211248f95dbf01c9a6d8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811707, "uuid": "62c8946a-d009-46bc-8bfd-a648bcf3c88b", "comment": "Malware payload (GuLoader)", "value": "4faafe20f920ed4a008bf6b36afdb3581c473da4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811707, "uuid": "317abfb6-83b1-46b8-8432-27e747d70b77", "comment": "Malware payload (GuLoader)", "value": "1313e6c55bb703eb48c7f604dd45db660504339a98d329399dc46703b567223954180c09ec3689f7ee78f4d3ff98b89c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811707, "uuid": "b1bb1029-5049-4215-85d6-9a2525f2e525", "value": "T177B4E091F696DCE6E8360372993B5E352763BE7E89700B0F269C72196DB33920027D47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811707, "uuid": "985c37fa-ba6e-404d-8761-b8bf2e17108c", "value": "5f0c714c36e6cc016b3a1f4bc86559e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811707, "uuid": "91e28a82-f91a-408e-b26b-46329b9572c7", "value": "12288:jnqpyMcdbTjzibDzCDXPV/s92G8vEE/FEC4VP4:jnqpydj8voP+UvE4CP4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811707, "uuid": "1fc89c8d-5d11-4d57-b563-4f1c0de7223e", "value": 513576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811707, "uuid": "41cd4eb1-d397-45b2-b501-befb1b7671d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811707, "uuid": "55a5a914-6887-4e07-84ac-f098f39bb21c", "value": "7e72540284e2469fd10a11a46338a02fc1a25f7e681211248f95dbf01c9a6d8a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25d257a7-1953-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772798033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798033, "uuid": "961eea6d-df0b-4246-832e-83b05ff6a8ef", "comment": "Malware payload", "value": "727585c3c84c23aa20d7c7d75d285ac1", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798033, "uuid": "bd404c9f-326b-4eb2-990b-c1f6e725bc93", "comment": "Malware payload", "value": "7ea5dbbd329ee4655116152a123120a56a343309be1b360ec36e36c76553094e", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798033, "uuid": "ef1768cb-6d6a-4323-8665-11e5b57fdfee", "comment": "Malware payload", "value": "c00fc0289869bf584931fc137fff3c527e92e739", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798033, "uuid": "6b5f1d46-93d1-46d0-b76f-252955ee80e5", "comment": "Malware payload", "value": "ffd5af2bc7c2de3312075cb890595499112d5d76e91365eed7777d8fe2a0d80548297afa8f83a3cf6a452cd409d3683f", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798033, "uuid": "8e89bcb9-7590-40f9-ae56-0ded3e55d935", "value": "T11CF21B90B9FA11C9F1D2395DE874E0643D1EFF0E06F59D1C63EA6A8E8D0336C59099E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798033, "uuid": "1d642e8a-154a-4f75-937b-dcf75fbe0482", "value": "192:sQUtiwhbuC52Zb3QDc3N+dbTPadmj8CwD5BqFY594HDYJORtNlFh:sQCTIp3Nc/PMD0tnFh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772798033, "uuid": "6a163f96-8059-4010-94ee-5f8e8c063bed", "value": 35845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772798033, "uuid": "0c988e92-77db-4a5b-bf8a-654a4b2e693b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798033, "uuid": "54fbc7d3-240f-4c94-bdf3-1faa0fe3d9d3", "value": "727585c3c84c23aa20d7c7d75d285ac1.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9cf5ade-193d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772788940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788940, "uuid": "742d4e9d-5aab-4bdc-87b2-f1d0f0bbd3c4", "comment": "Malware payload (Mirai)", "value": "785188c7a47372fd697ecfe16eb04fc5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788940, "uuid": "3e6cb8c4-5265-4cd1-90f6-f1d4aa93d51c", "comment": "Malware payload (Mirai)", "value": "7ee8d200e82863efdce56d079e13ca7069e3d955b7930d13d0b8652189cf5244", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788940, "uuid": "19a299d1-c77f-4fa3-b342-4948c881cb8f", "comment": "Malware payload (Mirai)", "value": "d6067e620b34dbc401e0ea5d49e13b96c26c7d8b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772788940, "uuid": "e5dd8a48-f108-4b31-b433-dfd225fe0d16", "comment": "Malware payload (Mirai)", "value": "0a65f7dc8831c5bf17e7ba15aa93585de719de2423d176aec1deed8add82580b2faa7f024e6b1ed1fd6d3967f19c4666", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788940, "uuid": "e6c034f9-be8c-400e-b387-f87be2ba9470", "value": "T1A313F1292306DA65CF64A8381DBF0940DFA90F79C1263E36A518D83D91B055FB3BEC89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788940, "uuid": "71181184-41f7-4e0e-9095-0dbc5eef29ad", "value": "768:ZfG9274mM6q1eHs92/Z/3aYbgd/MCDmdxoDJA+9TIDvkTyhkU9q3UEL5W:Z+9Y496qkHsgB/3T80jouRDcyhkLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772788940, "uuid": "a9c74344-32b1-4d0c-bb5e-9d00c1d18cfc", "value": 43876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772788940, "uuid": "9cb0463a-0457-4bd8-8e10-909cda362821", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772788940, "uuid": "b2c9cd48-2dc6-4283-9364-b153945d77c2", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4704854e-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772810114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810114, "uuid": "d74cc783-f91a-41e1-ad4f-b7d594f5d020", "comment": "Malware payload (PhantomStealer)", "value": "49cb8b82e670dd3abffafd3c4ff52e58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810114, "uuid": "de4fd2ad-911f-4e90-9926-60cdc4fb6de9", "comment": "Malware payload (PhantomStealer)", "value": "7eed819bc0cbdfa57b6cdb37b8fb475ce77ec098dfe640b3cbc52d66edb6e3e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810114, "uuid": "3bcaa746-eb4b-49fa-bbf9-53ef22ffa639", "comment": "Malware payload (PhantomStealer)", "value": "bb0f02ff294e4043e51bb2b85347f0055600c4c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810114, "uuid": "aec05dac-08d9-43d6-abfa-7b2a886e57c8", "comment": "Malware payload (PhantomStealer)", "value": "1ff94331ecaa296d273b45a56356e5e03efa6fd9a7a8fa16c12f03254b2d9d20f8cac8ab353f7db6892b4121fc4c8891", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810114, "uuid": "561dfacd-e604-48b2-9d54-c9386a206aa2", "value": "T1B4652354224ADE03D5A70BF41A61F1B447B92DDCB831D25B9FEABCEBB53A7801900397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810114, "uuid": "00ab00be-4ad5-4cd7-9fde-109a480290dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810114, "uuid": "1b82c2c9-7e0c-4984-975f-ff77c6da6407", "value": "24576:Q/xzYQhBrNPrkVfw/3g/NDvjzZegX0p23LER/bU6QXcxBWAjcZI6q2kEd4DDDDDi:Q/xDbVh/S9vjzMgXil/bUMLLAd4DDDDu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810114, "uuid": "ddf25722-b637-4786-b415-4ea324550613", "value": 1534464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810114, "uuid": "9ead8114-3fda-4cd6-b5a7-729ada6f1366", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810114, "uuid": "a31398ed-fc07-453d-a694-564e70c7a164", "value": "7eed819bc0cbdfa57b6cdb37b8fb475ce77ec098dfe640b3cbc52d66edb6e3e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29d8f001-1953-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772798040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798040, "uuid": "041b13ad-c726-4af2-b935-a39c6e482ee8", "comment": "Malware payload", "value": "a9459870c3f29c5c093085169903e499", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798040, "uuid": "4c1d7754-1ad2-4292-a894-f78a394f192d", "comment": "Malware payload", "value": "7f9f9dac738ce6b64f9acf0df6720eeffaf8ee9f864d94a0bbad2d340e6f9ff7", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798040, "uuid": "ea592982-59fb-4f0c-8254-416924c73d3c", "comment": "Malware payload", "value": "548ed60f54a9ff07e996e14b74f2c4d10c73cc4e", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798040, "uuid": "fa7d54b6-c9df-40d6-bc88-16d13b5b905e", "comment": "Malware payload", "value": "75216e66b0c88e059d88c071301eb5528b4efad608778f9a9a4c0e71c2217abf0526941d56bef4e4ac43970d44524a69", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798040, "uuid": "4ebb4fda-a7bd-424a-8881-caf544f2cd01", "value": "T1515583ADE87C7A26A5C14A3E0A0F62749D8AD827361477362C9F11F71731C299BF4DB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798040, "uuid": "9f50840f-fae2-4224-9d5d-ca807eea0667", "value": "384:IEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEY:z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772798040, "uuid": "a6719e81-e2a8-4311-b7fe-7d2ff3c77b2f", "value": 1315052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772798040, "uuid": "ceb8fa71-93d4-4fa0-8f7b-8ed2826576b8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798040, "uuid": "d83623ca-65eb-4157-9c37-95830dbfd9de", "value": "a9459870c3f29c5c093085169903e499.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "924b079a-1984-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772819260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819260, "uuid": "9045bd64-b1b7-4610-b558-ec01b59e1ffa", "comment": "Malware payload", "value": "54062239612bfe1227ce93f8a030a732", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819260, "uuid": "ebea67f3-d74e-408d-a07d-121f77f9e874", "comment": "Malware payload", "value": "7f9ff654238fffe330750d60d8060b55eb3ff699e3de31f2536e3d10d78ee166", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819260, "uuid": "745bdaca-488c-4951-9d76-0827cee63810", "comment": "Malware payload", "value": "ad89d728d1fb179c779b86ad5ed49013ef735623", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819260, "uuid": "b0d88893-70df-4581-ba18-ae08aff53b0b", "comment": "Malware payload", "value": "6cca43d5d1631b07187993202644902549656812718f494f2bbb4284d44026041ec7fd7e3a612206adb4c4731ab25c1e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819260, "uuid": "e9d07b85-92ee-42a0-a419-2729f8bdc3e9", "value": "T179513A85F35105317FF26E9675B4D404B188A0A2AFC25E25E4EC78F98A8FF0A24D1E63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819260, "uuid": "ecac93b2-57c8-4af4-be9f-5b3224d39378", "value": "24:vuOS1aIOSvOSpOSHOS4TdkaUoOS5oOSXOSSfOShOSJOS5aDg9OS6OScmOl:vuRxRvRpRHRMPR5oRXRgRhRJRgcR6Rde", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819260, "uuid": "a855abe3-bfa1-400a-9b08-d96ae32182f9", "value": 2583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819260, "uuid": "4ec03db9-15e9-4f2c-b87d-29b848e14e23", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819260, "uuid": "6e7f84c2-67c2-44f8-af82-5ff98f14d7d1", "value": "sora.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ea400c6-190b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772767097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772767097, "uuid": "6c05e683-88dc-41a3-8d65-f438fd954092", "comment": "Malware payload (Mirai)", "value": "389b35caf751497f377103983eb27268", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772767097, "uuid": "0660dd1c-8326-41ee-9196-2ccdc8dbff1b", "comment": "Malware payload (Mirai)", "value": "7fc132b9b986683ae456c4d31b98427008584d9b0ff05684804419c7bb5ae585", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772767097, "uuid": "95b8f8eb-3501-4ac5-8dc1-0d4fefd4dbdc", "comment": "Malware payload (Mirai)", "value": "fd388e6d3d88dd8b295e2baa35b9804a32aabe5b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772767097, "uuid": "a04ecf9d-12cd-4d45-848a-d6f9ef1631b2", "comment": "Malware payload (Mirai)", "value": "ffc7e1e39de37a1a841c2f0d30a441693afd854149c5ecc93a8b68f6e2a155a78e0b57528d8be7758be8a9bc17d32dfd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772767097, "uuid": "aed2d550-ff33-4aa2-a9f1-78314108970a", "value": "T146C32902F98584FCC0CAC1340B6FB63AA976F1DD1238B2EB67D4AB123D4EE615E1D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772767097, "uuid": "becc134f-e777-4a8e-aa62-feaca007a929", "value": "3072:e483TghM/1weZbcnITO1yosFAIxnJdhgpDb7BeyPBupmzQUAdojgaR/XN:eH3TghM/1weZbcnITeyosFAIxnJdhgJZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772767097, "uuid": "718ac02f-739f-4c23-aef9-6928a5608372", "value": 125472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772767097, "uuid": "2536cf3b-7b93-44c7-b14d-1378a7e483f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772767097, "uuid": "998e7a40-bf93-4bb0-8485-7c947000968e", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7489ccd-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810383, "uuid": "11df6ad4-576a-47d3-8189-06ef02918ab4", "comment": "Malware payload (GCleaner)", "value": "0375c2ea4975cbdfc11682ffaf38d6fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810383, "uuid": "7cec3a2f-611a-4e20-83eb-511366a9d307", "comment": "Malware payload (GCleaner)", "value": "7fd9978668f7ded87449a05a15803da67c6ea46f8cd0c7b310db0baf34b2044e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810383, "uuid": "b4f0a06d-f274-4684-b25c-55fc37d97b86", "comment": "Malware payload (GCleaner)", "value": "659f36cd2d8a82b4354eca994b076966a0a269ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810383, "uuid": "66d51c63-90a6-4aad-9bf8-6dfc2b6d605e", "comment": "Malware payload (GCleaner)", "value": "7fefc4f2bc15f8994163bafcf11b89dffbed749db2e45946f2418d9793bedb999c7ea99dce25551028e769a64744b6a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810383, "uuid": "8415483a-af80-4007-8309-456950bc5aa1", "value": "T1DE059F22E1A1453FD1EF263DAC17965CB4257E102A28E8762BD4DCC84FFE695FC121A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810383, "uuid": "e723ea93-4c7f-48c9-b515-9358b97bdfbc", "value": "fe4280c06246cc873fe89746dadec91e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810383, "uuid": "f0c2b4cb-2648-4847-8d79-40b4f215de63", "value": "24576:SlluEBpPj6o4CPbE9taCbJIWO4h6UYECZx6R7:Slwa1VnWB3CZxy7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810383, "uuid": "1e8f4094-d086-429e-89e4-f57eb551ac50", "value": 829952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810383, "uuid": "832e3b54-7361-420a-a749-0a8f367c14b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810383, "uuid": "8a23c41f-a036-42e3-9c3d-670c3922ca1b", "value": "7fd9978668f7ded87449a05a15803da67c6ea46f8cd0c7b310db0baf34b2044e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69b6e72c-1969-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807596, "uuid": "e4c4c401-b17c-4b1b-a2c6-d3abace9cf50", "comment": "Malware payload", "value": "6e149f4fd5dfe9a843fe101ae93fc170", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807596, "uuid": "41679788-2243-4833-b217-6b3b394385b5", "comment": "Malware payload", "value": "7fee635fdba1b376944aa5096888578773c21061f62c9c8478e5e9316ef3557e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807596, "uuid": "37ead002-e850-4db3-9735-daca7daca994", "comment": "Malware payload", "value": "74359de21dd026fac6835aa4b554008b68b43906", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807596, "uuid": "f3665a1e-628d-44f2-b919-b7049f35d61d", "comment": "Malware payload", "value": "84cd8cc2f3001f0b5cc514f5f98e53d1df79fc59ba3c4e7efe1cef1a6465b8e89186157cc37d3136872a8b1106f546c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807596, "uuid": "a1a992cd-b147-4965-b495-f681de22ec92", "value": "T1A7D3F8C7F900D9FAFC0AE7374853080AB230BBA545925A372257357FED7A1990477E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807596, "uuid": "afa84adf-7b3b-4617-b7ff-20fdfcb1b8af", "value": "3072:qNbul4MGHJLqHy5Fut5K/cwpifdDounVoQV1jbiGLD3rQtJ:HHy5ct8/cyiWuVosLD4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807596, "uuid": "bf15600a-3873-4cae-9c1d-3cebbf1b7207", "value": 140064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807596, "uuid": "ef3823e9-f9ad-4009-92de-ffa00178eec1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807596, "uuid": "d6873479-8284-43de-9be7-8c10f193f6da", "value": "iran.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3204537b-1968-11f1-a769-42010a9c0008", "comment": "Malware payload (Kaiji)", "timestamp": 1772807073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807073, "uuid": "341169ea-7f9d-4d68-a2d6-286d030c1d5e", "comment": "Malware payload (Kaiji)", "value": "6c529490f5d61b5983dea7f6769f3ec8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807073, "uuid": "bca65cac-d324-454a-ace8-c29652580e2f", "comment": "Malware payload (Kaiji)", "value": "801805c8171e354e001039ae6639c35ecf3c1ab72de936c6f21f77d87a36e9e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807073, "uuid": "58b4cb16-9460-468b-961f-90f3982e3f40", "comment": "Malware payload (Kaiji)", "value": "f45677fb0113c91513cb5b21d93d9ba40e8b13a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807073, "uuid": "7685f9dd-4cd1-42a1-b808-9ae074e336de", "comment": "Malware payload (Kaiji)", "value": "5c9c2c7e1ad7cd272b5f6e0a768a931f44543900979b4db1ff1f5319724a285c4148cc1c018278d8bbe0dd8c46b4ef4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807073, "uuid": "80b74970-c3c1-4d85-b550-d2c4aabd4be3", "value": "T1E5365B65BD5EE462E6C833783B7193D4323EBC489F4192235610FFAE99F67688F12112", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807073, "uuid": "2c1db404-a376-415d-8826-7d8f0f98000f", "value": "49152:7H+5dH9Zq/34LCFNoUAFKVCs55EN2q3OY2NXxB1:r+5dH+/34LCFNoUTVCsvEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807073, "uuid": "a74205c6-7e2e-4e19-b002-e0f7c10e9ec3", "value": 5177344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807073, "uuid": "f621f247-7f81-47f6-b2fb-e2a7956ac249", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807073, "uuid": "2a19fa85-3e2b-4a16-a55e-e03df973254d", "value": "linux_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea3bbd87-192d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772782041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782041, "uuid": "056e3a07-3a4b-4b0d-a55f-0a640f3fea66", "comment": "Malware payload (Mirai)", "value": "ebbd361c3e6943eabcb322bba5da8197", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782041, "uuid": "5dfee0c1-be2e-47e4-89d6-96644ac206d3", "comment": "Malware payload (Mirai)", "value": "8033721d48f43261486b402afc26f22e0de686f21d94ad46f2f11ebda780defd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782041, "uuid": "dc436aaf-6b3f-45ef-809d-7e8667695deb", "comment": "Malware payload (Mirai)", "value": "08c01264b7a871b3ac5d55700030334d4e8ef22c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782041, "uuid": "d8138826-aeca-4fb9-9892-6a849734e37b", "comment": "Malware payload (Mirai)", "value": "0e448a4d6ce512d7445f83c7c6039e9d89e5791236fd3d37228db34f7aff454a35d225d49913dc3561f5fe88f6e09a5b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782041, "uuid": "c8e6019d-caa3-430a-b301-4f0495fbe907", "value": "T1CFE0CD7EF4175428B55A5D48F919D4409D43DD130320BD68AED7CD72F1485987033BA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782041, "uuid": "e57947a1-116c-4061-9e6f-123385a0fcd8", "value": "6:zXeVfgkOYPeDywuMFXWR+XdI3gHd0LSflbhgkh5ty:zOSJaf6/XdI3g97fldgWS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772782041, "uuid": "debdf27d-618e-43a7-8a6a-67c5bb8a843a", "value": 298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772782041, "uuid": "c22ec72a-6de1-4d1e-9815-f4cf892d209e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782041, "uuid": "c68c7a6e-0132-4ffc-b6b4-b19f4e063d09", "value": "v.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68373066-1967-11f1-a769-42010a9c0008", "comment": "Malware payload (Adware.Techsnab)", "timestamp": 1772806734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806734, "uuid": "fb3ef845-5cf6-4993-9589-c6a5d36d7d7e", "comment": "Malware payload (Adware.Techsnab)", "value": "58d1832d01c32e7876626de2d4941c63", "object_relation": "md5", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "wiosyrondaty-com", "colour": "#68F1E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806734, "uuid": "ee89a4bd-4f2a-49c2-b0c0-56e8a5e2d825", "comment": "Malware payload (Adware.Techsnab)", "value": "80624d79d9e9324b175135fecee698ec50e09d537343301a9e62868f0ab3946f", "object_relation": "sha256", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "wiosyrondaty-com", "colour": "#68F1E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806734, "uuid": "0d0fcad1-75dd-4be5-a833-0e5a8b917978", "comment": "Malware payload (Adware.Techsnab)", "value": "9135ef9b946ee2f9de295bbe4247b658ca5db693", "object_relation": "sha1", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "wiosyrondaty-com", "colour": "#68F1E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806734, "uuid": "ffba6900-1952-4d2d-b848-10b3ebab7cdc", "comment": "Malware payload (Adware.Techsnab)", "value": "50cbc2224c0366027e1141babb6b60b91fc80eb09c5a8c42145a831e238986fbe82e9262187f32393ad5f08bf99f1848", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "wiosyrondaty-com", "colour": "#68F1E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806734, "uuid": "974da276-4a86-4303-945f-0754d051495d", "value": "T1E53364F77622F5FED2B55749788E7014BB32846DA75A178880A4FA3C9031693391CCBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806734, "uuid": "740c1c31-fe38-401a-b9b2-19131bdaa8b7", "value": "768:TY1/yeV3sa5qOUet1A/p/H460XSZ7493tYi9+DXwjlKr7GVpS89YGOSPvIoN2:k1/lNqOUppwSZ0aCZcrKzSsYG5IoN2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772806734, "uuid": "5c789c69-9466-4742-8cce-294302e3cab7", "value": 53921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772806734, "uuid": "6c768778-e3c9-442e-8ce6-045761e2c5ac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806734, "uuid": "4812e176-8d7d-4145-a874-e763bc0c50e5", "value": "80624d79d9e9324b175135fecee698ec50e09d537343301a9e62868f0ab3946f.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66a1e77d-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819187, "uuid": "d87adb7c-8213-4abb-a9e6-f16f28d062e5", "comment": "Malware payload (Mirai)", "value": "47cb98cd4bafa8eda0ed121d94881e4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819187, "uuid": "fbab78e9-84d3-4684-979e-ddee685b80ca", "comment": "Malware payload (Mirai)", "value": "808503d28a98dfe8dc3de3ba47444c60fc95315ba63d1f44d2848533cfd320e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819187, "uuid": "66762c7c-0f02-4f2b-b0e1-a169b0c428de", "comment": "Malware payload (Mirai)", "value": "bc34787514432191fc320cad1b3553ed1e66945c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819187, "uuid": "e463cfcb-129c-4407-b9f3-8902769523eb", "comment": "Malware payload (Mirai)", "value": "1c1d1eaf55da99d80782e5e2467c6983e71aec38456ac6a363c5a34eff3389efa0b5886a4becaf0853fed8096dda61ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819187, "uuid": "f0423d06-eeed-44c3-9641-d73800da89ea", "value": "T1995319C67A43DEB7E95311F002F3AB325A31FC3A092AD9C6E775FCA269115D0A50636C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819187, "uuid": "5fec0af6-67a8-405a-9970-943f1a32e2eb", "value": "1536:Bfm2PcWZeMAqkNo966o2pELGvTaDC+OfHlU8NRc8juBCKSfXbU:BfmMjZeMj9R9p9sdOC8DRjPU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819187, "uuid": "88f5b277-97d2-4abe-be13-b0681348a3d6", "value": 63580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819187, "uuid": "11170dea-29cc-4626-8975-3d36719278fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819187, "uuid": "28b91150-9346-4972-8018-07531ee71927", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fabc777-1971-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1772811068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811068, "uuid": "8d055c9d-a065-4138-8365-655317eb2503", "comment": "Malware payload (GuLoader)", "value": "bda5cc053c4d9eb09f6dd1c45892fb4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811068, "uuid": "223c87be-732d-4974-9185-ace059b1ec9e", "comment": "Malware payload (GuLoader)", "value": "8086b646c055109fed8ab642f07fd97920a86e2bef8b5eef34d7e2323add328e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811068, "uuid": "2e8d7ccf-ea16-4658-8628-283b3310ae82", "comment": "Malware payload (GuLoader)", "value": "0d262ec7663f8900d7cc8f7f75147166b3b57ba9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811068, "uuid": "df1a2952-f690-4b51-bca0-1f7a682f2280", "comment": "Malware payload (GuLoader)", "value": "3aec19965ae1f82e5d50980f4828f8bbc848427209cc06ce5a6e8f01316a4f5b3f77eed441fc8bb67456c6504ac7c158", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811068, "uuid": "60523eb7-ebf6-45a0-a7b0-201d9d67d0a1", "value": "T10B352312F372D813C596EA74E63659FBC6EA7E64D0226B1F470C3F6470B89C21136E98", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811068, "uuid": "03e7b8e8-2be1-49b4-aa96-b897cfa4e92a", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811068, "uuid": "d233344b-b272-4402-8bb1-6b6a6bb1bcbd", "value": "24576:sAcCMAMW4iMsxnl2cV7GAfojvhwZc5drzQDG5/3WVd3i:7PMAME/ViAgjvV5d4G0Vdy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811068, "uuid": "c79fcab0-a412-482b-bfd9-17a1923ba576", "value": 1139816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811068, "uuid": "83d4867d-113d-480e-a342-b0c9b9fc3ab9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811068, "uuid": "8de2a9b6-b587-44b1-8b02-ff6f069a3d09", "value": "8086b646c055109fed8ab642f07fd97920a86e2bef8b5eef34d7e2323add328e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39039ccb-1951-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772797206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797206, "uuid": "b09e6104-4313-463c-b53f-61482ae02c81", "comment": "Malware payload", "value": "c948a8ed521b9aca99af99902cc77e00", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797206, "uuid": "632f679f-8ab2-4f47-bfa0-05e903ed7e22", "comment": "Malware payload", "value": "8166a1653ba8463930ce5649e8daf25c40f992e45b56e3e4c9aadc84ae043a6a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797206, "uuid": "f98521c3-0a09-49ec-b86b-2e1f762a2683", "comment": "Malware payload", "value": "183b756dfa942eff3b194905bacd9e4108747441", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797206, "uuid": "ce602fbb-af25-4211-8702-14c428a8b57f", "comment": "Malware payload", "value": "1c5c8e96dfdb3d2cf82bbee33d87b0bff42b4042fa55325c4b8e795528b4d6b4caefc5d7dccf34ac75c986e3566b7c5c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797206, "uuid": "6d27bf06-7b93-4f38-b9f0-c982dbc937e0", "value": "T185356BD16EFE5AA9E5AE0FBFE52E631F671853500B00CEC390705D5F9CA25C250BC8A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797206, "uuid": "41f3cc80-5d92-4fa3-abf3-e216fa2613bf", "value": "5ee244f813571fb94ac91f129319c18b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797206, "uuid": "f0fd2f53-e6ce-4c8c-b246-e70005b5d2b1", "value": "12288:ks+QJNZQsOPAXFaiv4iGjAkyL8gbeGLcCGwwTYdQrdtFpk3Up4:kkJvQ9AQiXGA86pcCGwwTYdatzk3Up4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772797206, "uuid": "a3a1303d-803d-4630-bb6e-0c02cddf05a4", "value": 1129096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772797206, "uuid": "383667c4-78d1-48f6-be91-5c23fbb6dccf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797206, "uuid": "4c3a1ade-786c-440c-b7e5-c9cc47721c02", "value": "SecuriteInfo.com.Win32.MalwareX-gen.57671255", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a61044f-1943-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772791142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772791142, "uuid": "f3751934-15de-41a5-a61c-044766bbc93c", "comment": "Malware payload", "value": "72821546e363315c5419a4c3f9836361", "object_relation": "md5", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "gologpoint-com", "colour": "#C1A767", "exportable": true, "hide_tag": false }, { "name": "josehpjon-com", "colour": "#BC3BB6", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "quicrob-com", "colour": "#CC0988", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772791142, "uuid": "e59e6534-bf21-4988-8299-e26ba0953ac8", "comment": "Malware payload", "value": "81b397f8cb62f501ed5192aee4f989e925c8c55f1f87ca152e33a31ce89910eb", "object_relation": "sha256", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "gologpoint-com", "colour": "#C1A767", "exportable": true, "hide_tag": false }, { "name": "josehpjon-com", "colour": "#BC3BB6", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "quicrob-com", "colour": "#CC0988", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772791142, "uuid": "0e96629a-c594-46f7-be93-8bd6ac490b0d", "comment": "Malware payload", "value": "334919e95e7e6be57a5cf678eaaf42fc7825dd9d", "object_relation": "sha1", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "gologpoint-com", "colour": "#C1A767", "exportable": true, "hide_tag": false }, { "name": "josehpjon-com", "colour": "#BC3BB6", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "quicrob-com", "colour": "#CC0988", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772791142, "uuid": "400d737a-c97f-4433-89cd-f4c7fa2b8325", "comment": "Malware payload", "value": "0f1ce49804cfc29f4a88fcbd5a71bbf666874fe72a6aa3babbfd90f8a695b9bf0b2b339c064bddd001896594c8655158", "object_relation": "sha3-384", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "gologpoint-com", "colour": "#C1A767", "exportable": true, "hide_tag": false }, { "name": "josehpjon-com", "colour": "#BC3BB6", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "quicrob-com", "colour": "#CC0988", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772791142, "uuid": "3ca35f21-78cf-424b-a96b-8d99efd32fe7", "value": "T15F512508B5A38C3041475B9EDCFF5808A1AB44CB410A1D65F89DCAB91F33B388B7B65A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772791142, "uuid": "a98b4457-86f9-4850-b0c5-770e43bb6291", "value": "96:0RTQUhNQ8eCrOJLn9NQDvZg8YRaxKiUTzgqxaybAlR2ooInF5z:09Q8eCrOTNQzZg8Ycsi+z1cybY2ooQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772791142, "uuid": "cffe2847-2156-4b7c-941e-03d54527af02", "value": 3165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772791142, "uuid": "6de3289e-8d4a-47c3-9b5f-f83977eb4753", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772791142, "uuid": "64154a5b-c170-4081-a1dd-dc04d10f9589", "value": "81b397f8cb62f501ed5192aee4f989e925c8c55f1f87ca152e33a31ce89910eb.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33a9b849-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772810082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810082, "uuid": "54ec5327-f5a7-4dc5-a3e0-18f79d6df879", "comment": "Malware payload (Vidar)", "value": "8fc5d2f4cc1fbfc5157cd90d3fb9a0ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810082, "uuid": "5acc1410-ce5e-4dd4-be14-b481ad170aea", "comment": "Malware payload (Vidar)", "value": "81c2df0f2ad75cd87e2197d64e0d4e2bb7f8040e9fbd53210fd09efdf17819ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810082, "uuid": "b87bccb1-0ea6-4e73-a18a-6f5437ebbf3d", "comment": "Malware payload (Vidar)", "value": "abc1c44e438743013d0305c2e1cf91dd8bdb6ede", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810082, "uuid": "90f84745-7ec0-4485-b9fb-08e8cc71268a", "comment": "Malware payload (Vidar)", "value": "2b6b6741d968c350e84d0c38939bfcc0a1ade98f7dd90bf450e9b775027a260a0fd351f5aa9d24460786151ed8daf006", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810082, "uuid": "218f73d0-7949-42e8-ba64-65d01d60ca0b", "value": "T18D241203406DF35FE24A757E1FA7BBC222B2C7384B4F03D63855C8D6922E56885927A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810082, "uuid": "0dd20040-8608-43cb-b24f-92fc87c7c131", "value": "ee53c10aff1d01eafea53328179e33a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810082, "uuid": "d3fb5eba-c559-474d-ae57-d86b2e13f790", "value": "3072:7nipVcxzhGwxvWeGJgwU3PrsKw6wYQyKBWJrZ0zBTAUZpjvE33WlwzYMO:rU4hGwNQJZU/AKw6EBWf0zCWu75O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810082, "uuid": "ff4f63f8-a642-46de-910a-f1aaddf5d0a8", "value": 217088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810082, "uuid": "cf2d0903-ffb8-46b0-960e-3fee1fe34387", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810082, "uuid": "881436a6-5518-4d5f-8852-281bab91056a", "value": "81c2df0f2ad75cd87e2197d64e0d4e2bb7f8040e9fbd53210fd09efdf17819ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2d44ad9-1970-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810832, "uuid": "91afb3c3-0017-40ae-9f5f-d6d1f312743f", "comment": "Malware payload", "value": "115e06509f5f993a77755f3d7b0e04cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810832, "uuid": "aa47a3ab-7b89-425c-893c-ca0a7a0a8bcd", "comment": "Malware payload", "value": "820d22ce2b5b492ff35f337f0833fd23eccee622592467acedf80726b01110e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810832, "uuid": "1ea3fe38-0621-4da1-a35c-b5b43e76ad15", "comment": "Malware payload", "value": "faf908487f75dbc117abde86a8e950adc22344b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810832, "uuid": "03eb1a63-afe4-4afe-ae47-372b5a5e36a8", "comment": "Malware payload", "value": "f70634355ba63baed28dd93cfa897bddf39e29b785fd1d828c7696a8a9f2c468f291f07bddcb2662504da2e498c91820", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810832, "uuid": "52b0774d-c788-46cb-b79f-4ef551490b7d", "value": "T174353307B376EC13D086E9B9E73999F6CAE6BD60E561AB0F430C3F1874B96C10522C95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810832, "uuid": "fe25be83-d19e-4eab-b7c1-467764ca4180", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810832, "uuid": "5cff1732-cfc2-4399-8615-712317260cfe", "value": "24576:XAcCMAMWUiJyO4N967GAfojvhwZc5drzQDG5/3WVd3i2:wPMAMuJyOpiAgjvV5d4G0Vdy2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810832, "uuid": "61bb3fb0-c72f-4550-8b1c-6779c9eb43fb", "value": 1150456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810832, "uuid": "16483e58-8e66-495b-942f-273d4f154bc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810832, "uuid": "12e133ec-ff59-4746-8d93-2f66f51be4ba", "value": "820d22ce2b5b492ff35f337f0833fd23eccee622592467acedf80726b01110e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ca8d5f9-1972-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811439, "uuid": "c9dfe32e-3266-4cb8-9abb-8f59e4df38b8", "comment": "Malware payload", "value": "dd9d763147ad72f4d465e08e0c9bc01c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811439, "uuid": "163da7eb-7fb4-41af-a94a-a6b5bb9c2e3f", "comment": "Malware payload", "value": "826e5886e0c3288e29cfdc539058da95711b1ecadb8ce0901308b2672d79c70f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811439, "uuid": "81aa9e76-baad-4f80-8e5b-8bd156239b28", "comment": "Malware payload", "value": "0c9e07342824066c306831e046c711a9ca4db9ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811439, "uuid": "b6ab465c-4368-4d40-9ee6-7d9207e5813f", "comment": "Malware payload", "value": "04137a56e784819a12c8aece27377b190acf7175ab922a74d5de5af200338a97adaf3bd6b96897d46cfe8811697f09c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811439, "uuid": "c9e5e0b5-66c8-4517-bf4d-567453ec9e77", "value": "T14B35F12417A5DC07C36E4B3658A0F57897758ED6B011D25ABEDD7DEB7B2AF000A82343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811439, "uuid": "4ccfefc9-92c9-43b2-bb29-671049af335c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811439, "uuid": "99a9ef46-8e2e-414d-9d55-fa151ce6c439", "value": "24576:/5ZbuZOrq7IQq5N3hhzPL+h9CAroEE8oEcI5aO:hZbrq701h7LS9rpfoIU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811439, "uuid": "5bd6f29d-3959-4a3d-aea6-4259cbb3ee6c", "value": 1152000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811439, "uuid": "279e84cb-6632-4807-bf68-1e549ca30216", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811439, "uuid": "aa14cb5d-239a-4470-af7c-c93049e18158", "value": "826e5886e0c3288e29cfdc539058da95711b1ecadb8ce0901308b2672d79c70f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82299cd5-1969-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807637, "uuid": "d569f30a-0267-46ef-a49f-953fb1c10f4b", "comment": "Malware payload", "value": "8f6e2152deec84c001500443a17b2818", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807637, "uuid": "c6e758a5-8ca4-492e-81c5-aed683c5eed4", "comment": "Malware payload", "value": "82856be3de7d1e41e0541975c9c67547d5d5b35f8c07f22f7c4e6bef4b17916e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807637, "uuid": "ff52b0fb-b0ad-4546-beeb-ea227d18a643", "comment": "Malware payload", "value": "87d7d4c372263a873034b6538f14684c92ea87ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807637, "uuid": "5ae4afac-c48f-4bc2-8979-606879940461", "comment": "Malware payload", "value": "e6717231796a4073330d06ba6e77e405b8e618de78e0bde5994ff2a0f94bf968592319a9c26ed6744c03680bdfb4f3bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807637, "uuid": "49842509-731a-4102-aef5-65b4dcf13ad1", "value": "T14D94E612E650B066F89709702D79A596782D3C3A2D40EC1BB78D9F5A3B71A83B0F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807637, "uuid": "54370156-ddf4-4587-b62f-6f61f2740a4c", "value": "a7ddde1cd2a07b46f901483ce887cb69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807637, "uuid": "e1c54148-e228-43bd-aa09-c522979000bc", "value": "12288:Yg6OnycF8sD0irj+muWeGOdFNF9VQiBFnYIFeTHP3EzYEcPqLa+Lsk/A9eiZPbu8:ZVnrDx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807637, "uuid": "1dce5d9a-8758-46a6-a278-b19c3cfe93d4", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807637, "uuid": "49a7ba44-b527-4378-b6d3-acd2287fb00c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807637, "uuid": "6d9a2760-bfb6-4671-8707-649f7520000b", "value": "82856be3de7d1e41e0541975c9c67547d5d5b35f8c07f22f7c4e6bef4b17916e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc5af4bb-196f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772810365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810365, "uuid": "1df790ee-cb30-4736-bf3a-a11cd7565d62", "comment": "Malware payload", "value": "1399404c315a16d9d6f6ed14bda916e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810365, "uuid": "56ec475b-4a8f-46ec-82af-ee0ab60d543d", "comment": "Malware payload", "value": "828a2d50d08bbaf068cf4ebf7997abf928b83f5ddc7f5136b4a53f2f1cc00a3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810365, "uuid": "afd84ec4-e62e-46dd-bbf8-414fde5952bf", "comment": "Malware payload", "value": "1fb86d7c98531ae5dc4d99dd7c5e6435ada145a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810365, "uuid": "244afb02-c238-4802-a375-da85e32ae6f6", "comment": "Malware payload", "value": "91c35b4e3ef60728d360213ef716f83b407161552284d9c84f598ce6e60d8b83d8643d38c0c1699b7da9f23bfa107733", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810365, "uuid": "ac91d57f-4dba-4af2-95a5-a3a66659724c", "value": "T151D42BBDAC60E362F60DD0BAE286E7535F5178010236AA9309BED72412058739F577FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810365, "uuid": "7277bc20-2fce-44a5-bb57-9d5246817496", "value": "33ae1da8e7325d3e73d4a52bada9dc7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810365, "uuid": "0cc2dd20-43bc-4954-930f-19592d578da3", "value": "12288:71Z9H0I0Lqf0h0ewjUKlg8SIt14y0qSXWdH3ROr:71bH0IlJXgBIt14y0qNdH34r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810365, "uuid": "b4441b1b-7c00-45b1-967a-55cf48c701a8", "value": 615424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810365, "uuid": "cd31a255-2997-43e0-afa7-d5adbe976422", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810365, "uuid": "01deb123-06f3-44d0-9f27-a9bea08a69d6", "value": "81c2df0f2ad75cd87e2197d64e0d4e2bb7f8040e9fbd53210fd09efdf17819ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfe062f0-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772809914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809914, "uuid": "c6eb07ff-8ebc-4adc-bd49-f6ad2e2b7a4e", "comment": "Malware payload (AgentTesla)", "value": "de7ba41f5efa4567e88354cb10e14ca6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809914, "uuid": "6a6ae67f-2679-40a4-aba1-525089596096", "comment": "Malware payload (AgentTesla)", "value": "829928d9278b1af0adecac6cb2dacad68d68495f9b3a25cd38c481b935a026b3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809914, "uuid": "4c223444-621e-40a4-a216-41bb5c6c236b", "comment": "Malware payload (AgentTesla)", "value": "863a909418a77e32e7177ba15fa3ee0da1df0a71", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809914, "uuid": "9ac3394b-97ee-4a43-bf0d-ceb8477c587a", "comment": "Malware payload (AgentTesla)", "value": "9a8f9bc07c55da248b29863121ba40ae9c3ac8ad659c00a2d32101aced2251ed991dca1888e77f3ac71bce5075a1f1b9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809914, "uuid": "c064463f-2de2-4822-9abc-b6a6cac5f53f", "value": "T15F84D042F3C0ECE6E46554B3E82ED7101957EF9AC0AA431B325576166CA33C3259BEC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809914, "uuid": "d270bef0-5fcb-4e1f-8080-2ada4eb76860", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809914, "uuid": "c91b83ab-eda3-42b7-a6db-541986fd8c1b", "value": "6144:ygORaJ1dhZ3qeD2SPzPRqPkV07SBnsHa/RUJXW+plcxHOK4e7Hq:ygd6k5Z5TCV/ckKW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809914, "uuid": "9526fd1c-0b4c-489e-bd8d-12837290f3fa", "value": 379616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809914, "uuid": "fe4a21b0-75f7-4987-be7c-9e87b71e42a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809914, "uuid": "8fc3206c-11af-4d73-953d-052efa5bd018", "value": "829928d9278b1af0adecac6cb2dacad68d68495f9b3a25cd38c481b935a026b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca2e5b2e-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772810334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810334, "uuid": "d79cf6a9-7c98-43de-8eb8-0c0d8b25bc97", "comment": "Malware payload (AgentTesla)", "value": "578bc83a14505641d9924050ad1e72b3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810334, "uuid": "338a07c3-16a0-438c-8e8c-c6317df5e84b", "comment": "Malware payload (AgentTesla)", "value": "82cf55fa23c0c2493080bf0cbf52165ee502a58c782f8d85cfbbb5e601f8b6b3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810334, "uuid": "9006b847-1f95-4019-a69d-9e339a2f94c4", "comment": "Malware payload (AgentTesla)", "value": "50f959dff85cfbb7b59676b5b99689d3941b8123", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810334, "uuid": "0e4bbe2d-2778-49fc-9de3-efaa91dd62ca", "comment": "Malware payload (AgentTesla)", "value": "2044355f19f1b234840c6c7b453e3f86b2e96fa47ae09692feb9b8fbc95307874e29c49a01643c410be63c05c2af3144", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810334, "uuid": "05dc2ca2-0fed-4f42-b0da-149cb3748845", "value": "T19B15CE1123E85A69F4FF9B3898754528CBB5BC27DA32DB5D2A4540EE1931F40CE62B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810334, "uuid": "6ace784c-ba12-48cf-af1f-362b24968458", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810334, "uuid": "51dd39ec-c395-49dd-a522-dd1ec4ad0f2e", "value": "24576:m9J8dZ+8EsdfRA8DHaP3HizHXdnfbFGP:RBDAuHRrpDo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810334, "uuid": "f52c6065-4de4-4acf-bc7b-3c2a6881c9be", "value": 922624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810334, "uuid": "8e625e3e-95b8-4edd-9cba-aa8c33181031", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810334, "uuid": "8133f789-50b0-4788-8907-e8ba4d6f4bf4", "value": "82cf55fa23c0c2493080bf0cbf52165ee502a58c782f8d85cfbbb5e601f8b6b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4fbebb8-196a-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808125, "uuid": "e9105135-4ad6-43da-94df-9ec46e3d8cf9", "comment": "Malware payload (GCleaner)", "value": "d18328d3e087fa157f7f304980fa0aba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808125, "uuid": "3377c48f-7d28-472e-83b0-6417bbf055b2", "comment": "Malware payload (GCleaner)", "value": "82f4605af6c1753438732ad64b73b42ac32129fe307440045bf45d1a77c67551", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808125, "uuid": "87feedc7-21cb-49d7-a11d-7a25bff63770", "comment": "Malware payload (GCleaner)", "value": "1e4e184487ae91d8b76bbb7272de2d57df363564", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808125, "uuid": "b3bacfa7-e826-4709-9020-dfbe5710c97c", "comment": "Malware payload (GCleaner)", "value": "c655b2c4b3a24cc4daf75febd039dbd9538271e55d029b274a9e96ff8c8daf77599465742f428707bb18829cc4f581d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808125, "uuid": "227eb78f-7f79-4d1a-a9af-f900b052f175", "value": "T1AF06E0D171E360E7E0A853FBBBEDE675080AA8C0B92F595CBB524EDC4D1400BAE54367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808125, "uuid": "d6ad2990-a8b0-40d2-9baf-9e1b35e27c98", "value": "e5f32a93ddcf3aa9009cd70911b0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808125, "uuid": "8ce34bb1-44dc-4712-9626-02247866f3b7", "value": "98304:39Cexbej6bN9JuarYOga6UB5+fkLzyvTI8jB:3Z1bTIarYwB5+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808125, "uuid": "385a823d-9f1b-4042-adbb-df7786226bde", "value": 3887104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808125, "uuid": "fb01d94f-b6e7-4369-96d1-d0ceb5d37ada", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808125, "uuid": "8e167f42-c7ac-4a06-aa45-40e56240a56e", "value": "82f4605af6c1753438732ad64b73b42ac32129fe307440045bf45d1a77c67551", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ea72039-193e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772789028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789028, "uuid": "ab5db5d6-5566-4fb9-88d2-8dfc365d084d", "comment": "Malware payload (Mirai)", "value": "2fdaca6e5291bb3a2229138573ce9612", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789028, "uuid": "067523e5-946b-49e7-bff2-6ee6490f7d58", "comment": "Malware payload (Mirai)", "value": "83112cfe7bb572362e7796e142d89de2205f32af9f2d27e4ce851b60b00045e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789028, "uuid": "9f0ff2b6-58bb-4990-ae9e-971f240e1352", "comment": "Malware payload (Mirai)", "value": "928d356fbc46ee11fbdbf856589f257d67de8ad5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772789028, "uuid": "15164cd9-8c7f-4be0-8d09-60cd6b929066", "comment": "Malware payload (Mirai)", "value": "e22c79b9007514ec9ee6b660079e6452e8954c4bbf67b22a946758815c31425e7302b7658447bd97bfb605feabc41cd7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789028, "uuid": "3c7e770e-d5dd-488b-ac67-d9d5e93d30dd", "value": "T1EA833945FD814A12CAC116B7FB2F428D372617A8E2DE7203DD296F21378B91B0E7B951", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789028, "uuid": "d035b37e-5f89-4869-bbc3-914c5cb84d32", "value": "1536:4EGpD2xTM1LLWew7q+vXvZnYk6vB1yH4xhvGwK:4EGpDWTMVWew7qofZnOs2k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772789028, "uuid": "7f03ade8-4fd9-475a-9138-cdac1dde9d85", "value": 84056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772789028, "uuid": "cb4e8c34-3ad5-4bf7-a8da-d698cb2dfe14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772789028, "uuid": "90a8a60a-349a-493e-9768-ccbca55b813e", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "902fb550-1968-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807231, "uuid": "8be10edc-7ec1-4a3d-babd-aa3ab9a648ba", "comment": "Malware payload", "value": "acf5cd1a9c51568a2c3dc8caee74fee0", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807231, "uuid": "86dd3c3b-02cd-4c06-a837-a64205445e17", "comment": "Malware payload", "value": "83632e48cc722a8cb988bc4c04d0e301ce8ace08111b9781675c62e5e6757d56", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807231, "uuid": "2cf9828a-3685-4d9d-ab54-f081fb3e9603", "comment": "Malware payload", "value": "e1e77490edf625217c9ae14a0244462482ee67f8", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807231, "uuid": "b9d5d4d0-66e5-422d-94f3-ef83e598a170", "comment": "Malware payload", "value": "4a9ba3c932720a0cca3397fd8733c706577220b38a5145701c9239a08b73c727c3ebdae7e67ec0839010b94e4470acfb", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807231, "uuid": "3f9de5df-0452-475b-8575-2bc06eac3af3", "value": "T15A32E8192EAA05B66583B3A9E8FCC205601F91CB532BBF10B4DC51843F61A2F5BF6347", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807231, "uuid": "65f57b7d-b007-4ef1-bff3-3adef03201d0", "value": "192:YlHjTiCczaDAElrWGn1sA8vtDbbqr1yz3MiuCX6Lrifs4yJrbGHpE7MIyFay9:Ie9wGytn9baRp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807231, "uuid": "97457a53-dc29-4161-a1e8-7da147ae6f4e", "value": 10919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807231, "uuid": "b240b13f-cb9b-4d32-9ae0-c131fb0aacf5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807231, "uuid": "02e24cee-bdb5-4072-b0bf-e65ec88c4355", "value": "83632e48cc722a8cb988bc4c04d0e301ce8ace08111b9781675c62e5e6757d56.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "054e6aff-1961-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772803991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772803991, "uuid": "e4f8d610-70d6-4d62-9f5b-d25916fc9b05", "comment": "Malware payload", "value": "7d6c3a08a8b2fddad8561a9b112cf45f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772803991, "uuid": "e4d79f70-57fe-4d2d-a954-d4ba5d036caf", "comment": "Malware payload", "value": "838bf411fbcb685ac17afd2e802c8144e9c04a8e04828d2c30e67fcbd0a5bc8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772803991, "uuid": "7dff8a76-a670-46ae-93de-c0c0bb703fcf", "comment": "Malware payload", "value": "ed2e284da19ccdb8a71097a5ce03eb07daadceb9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772803991, "uuid": "219d147a-6191-4225-a1c3-805775b40e43", "comment": "Malware payload", "value": "dda76a806c9d34643e328b144ebef0c6a30059288048d994e5a06c8e23975ce627f222f5bb131fd9c6abc68dba166764", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772803991, "uuid": "325d9205-e2cc-4413-9328-b8a789b9f483", "value": "T14823F1C3617FDEE8CAF6593E1D2798C8B901C4157B0A0BDF45DB36E8ADB46C22E11960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772803991, "uuid": "467875bf-ffd8-4a88-a7a4-4015f68763b7", "value": "768:BYlu1gzShvupCJk8hRIE3kpNwWa0xeKyxEy2e0bQ0EST5V4w:jSzSxupEl3kpNTxe32Thth", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772803991, "uuid": "5bf6bd34-d1a8-4de4-ad31-4a2e6435d631", "value": 47776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772803991, "uuid": "e50ff1cc-8612-4407-8154-a656ac108b44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772803991, "uuid": "0c143fe2-6969-4f10-8544-842dc68369c2", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b17ff36-1936-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1772785640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772785640, "uuid": "ac7552c9-9a85-4510-a2d5-c81ffb45ec5a", "comment": "Malware payload (Gafgyt)", "value": "4b67c8e016a7296c6bdc657433835a3a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772785640, "uuid": "e97ed7f9-d75e-41c3-9229-449089c129a4", "comment": "Malware payload (Gafgyt)", "value": "83b01a2854cb4cdcf0e99fe6ee3c15f47cb72c4ccd17e30ab73825883b3afba2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772785640, "uuid": "9ed6736b-16d7-45bc-be9f-76771035e688", "comment": "Malware payload (Gafgyt)", "value": "805a5c39456a56a095f28a74a9a8e0ea780248bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772785640, "uuid": "393d356b-8eb1-43d5-ab2a-2eb058395278", "comment": "Malware payload (Gafgyt)", "value": "ec98791fd0c68d08e4c40ffe30d969ce56c6cf06471d1724749781d8ee36d2242e2ae97dbef6cf81012daed46e7339d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772785640, "uuid": "e2a09ef2-68c6-4002-8d55-854c6724b882", "value": "T17EE31B45FC509F26C6D221BBFB4E428D772A1768D3FE720389255F203B9A95B0E77242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772785640, "uuid": "362c5b7c-03f2-4061-8607-acb35123ac25", "value": "3072:5JeBiqSN2QfJnwwAkyrVJO9s82Q+UIHU:bewDBwwAkEVJOW8BPIHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772785640, "uuid": "e3f88d2a-9148-4753-a8a0-5cf44eb52def", "value": 146112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772785640, "uuid": "36422ae0-a4b1-4781-b279-31bd8ddcd232", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772785640, "uuid": "dcd6a0ae-6ba9-42c2-a26e-426aa08128a2", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9368d998-192d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772781896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781896, "uuid": "44af16eb-7c31-48e1-a351-8f689ff57baa", "comment": "Malware payload", "value": "11021135f57127561d82c07c03edb586", "object_relation": "md5", "Tag": [ { "name": "api-devx-help", "colour": "#8AD189", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781896, "uuid": "bec4e5d7-a76d-4f06-8fe4-d61d30770129", "comment": "Malware payload", "value": "83e9fdf06a347b8528f69055f491d43da83cd365a3de24dbfada9626a3bda6fe", "object_relation": "sha256", "Tag": [ { "name": "api-devx-help", "colour": "#8AD189", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781896, "uuid": "35ce86d3-2c1e-4009-aa87-90ec22f16f5a", "comment": "Malware payload", "value": "3124462a0c563e45093a3a1b1874ef4091c1965b", "object_relation": "sha1", "Tag": [ { "name": "api-devx-help", "colour": "#8AD189", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772781896, "uuid": "6df1565c-f967-48d5-8ea7-3c265d9c4736", "comment": "Malware payload", "value": "e704e845bf10d4ce44e27604c980ce261430572ff7e5485799cfb79fa8d79f1b69f21b8024a8cec527d4fc7c190cface", "object_relation": "sha3-384", "Tag": [ { "name": "api-devx-help", "colour": "#8AD189", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stellar-conquest-fr", "colour": "#CB1FDE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772781896, "uuid": "7dd7bfde-b503-454e-a54e-06ab2d59ecc9", "value": "T162183322B7E5C57AF0BB0B3294F1A7544A7A7ED51E34E20F7308924E4D71A80DA38767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772781896, "uuid": "38308885-d216-41c9-88da-33e80b2ecc0d", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772781896, "uuid": "2e70a322-6486-405f-a045-116e92a80071", "value": "1572864:v+e4h7TL9BHeLLQfvxvhKDLwCXiaBcSrufGanp7GgtcQ3AsERCjqTe:We4NGQfvx8PwCyaBcSruZkUECWq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772781896, "uuid": "a5e3d3f8-6479-47e1-8608-3f7d107dad5d", "value": 89334073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772781896, "uuid": "22dff767-8669-4371-96af-1c607a863795", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772781896, "uuid": "4f53f2b5-9f1a-463e-bbb0-a9050d1ba80b", "value": "83e9fdf06a347b8528f69055f491d43da83cd365a3de24dbfada9626a3bda6fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df65b90c-196a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808223, "uuid": "9545b7b6-cb18-48f0-96b7-733a7923e77f", "comment": "Malware payload", "value": "d5faedaec7867888d88cc8d2c4f7da82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808223, "uuid": "8a8ff361-ce1f-44d2-9d1e-74f6f7b0b5a9", "comment": "Malware payload", "value": "847d82e3a694345cae6df528f1bfe086fd95b87d628cc4968e988ba7e17ed255", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808223, "uuid": "22a63970-d5b1-46f3-94b5-7d57b03aa4c3", "comment": "Malware payload", "value": "06f73ed207aa559d6f56cf77555f33f72be3820f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808223, "uuid": "aae5c466-8a69-4f00-90e1-347c5a40bbba", "comment": "Malware payload", "value": "cb5a71785bc2294b6f30cab16c9731a3b2ff0f5850b5791750be56836a0ee571940361be934e3140830ff1a638921da4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808223, "uuid": "a7aba4e5-91ac-4518-932b-8cf2503eab56", "value": "T1A9B4E611FA60B525F89346707D79A296782D3C362542EC0BF78A9F8636B0593B8F431F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808223, "uuid": "d90dac8a-d184-4210-9dee-746df68d5654", "value": "1b621fe6b02dca2ac366757d042e13f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808223, "uuid": "ede0f74e-b4c9-4edd-a5ce-e922b8af502d", "value": "12288:tpam9OCGE63owiaAyAtJIXuF+wFzXRWht9Kf2DjjGFIF/JBVG:+6KgJIXC+wFzXEh9jjGFIdJBVG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808223, "uuid": "c88a57cc-1c37-43a9-b76e-e3770ac490a7", "value": 503808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808223, "uuid": "627eabc6-cee9-4a54-9519-bc2e9ae6dc54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808223, "uuid": "3fcf640d-3981-4278-b543-835a851d225f", "value": "847d82e3a694345cae6df528f1bfe086fd95b87d628cc4968e988ba7e17ed255", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef6eab8f-196c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809108, "uuid": "0ae5a652-a00d-4392-b258-599d2b264c0f", "comment": "Malware payload", "value": "8d71acf0765d5ab9158d083ef62e5cb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809108, "uuid": "bf2e5e73-51b0-495b-ad31-748fc0a51560", "comment": "Malware payload", "value": "848308f9609745e901cfe9d88964ecde888484d2d309b89526cdb39273bbc3c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809108, "uuid": "4688e4e2-fb57-471d-aef2-d0077b3dea74", "comment": "Malware payload", "value": "ee04999a3c2c745d4efc81baf801fe9997af48e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809108, "uuid": "a89510c8-9f2c-431c-bdc5-033e00616e65", "comment": "Malware payload", "value": "51f719836bd8fd288897a73ac3063c4e70f47c63bc5e396fe6b8b5e1ec3462df56dc17f13d15ac24dedf09a5556ae8a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809108, "uuid": "d7f2566f-ade6-411c-95e2-760696a92f5b", "value": "T19594F612E620B126F89345703D78A246692D3D3A2651EC0BBB8DDF5A3771983B1F931F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809108, "uuid": "ca9e27b5-c392-4c30-8109-524139bfc076", "value": "fb4aab39824a1caa5dbf4ff2c0c1e6a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809108, "uuid": "e27c528f-b4d2-407c-9608-40c730d3d703", "value": "12288:F66kIDNRwcxDbDOMNmu/OGeNsNY9lAVwPgoI/XfHP3aVx4Mot9shABflDLiRDqvq:3DoVeMowRDq6TN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809108, "uuid": "43b7beaa-ce1f-48f8-a641-907b0fc6bea0", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809108, "uuid": "675979b1-f4f4-4173-9830-0e564e22193a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809108, "uuid": "d1706a42-7cb8-49e4-89e3-841f27c27046", "value": "848308f9609745e901cfe9d88964ecde888484d2d309b89526cdb39273bbc3c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6af51704-196c-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1772808886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808886, "uuid": "91249b37-dcfa-43cf-8372-76de89db5f01", "comment": "Malware payload (DarkTortilla)", "value": "2b3ea935f81e3de4a896a09df6a14a6b", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808886, "uuid": "8d08406a-b765-46e6-965e-5ce4c12688b7", "comment": "Malware payload (DarkTortilla)", "value": "84ba9c511c0b30ad8decd242e3066a18ef69bed549bc29761b70d5473c2092cd", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808886, "uuid": "50394b77-9154-4237-a583-9452ac08d5a7", "comment": "Malware payload (DarkTortilla)", "value": "de759ca979ee142913eff1385acb7da51eeb54a1", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808886, "uuid": "9f317c60-9035-4728-ab58-af0d09da57a0", "comment": "Malware payload (DarkTortilla)", "value": "fbc90259123000bfcfa48c15921689c3c915b284242751e79bb483c21c20dbff5c88e5b7a0c49bb90b6ecbf95905dfb6", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808886, "uuid": "9a3cc2cb-31b7-4bbe-9570-3d691fd6a2a5", "value": "T12255012B1DC366A4C4904F78D3B910E963F0C65B1115E7BF6AED42F0DEA2B4ED9131A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808886, "uuid": "96c5f84c-2449-4286-89cb-6cfdf6871da4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808886, "uuid": "40172213-8469-4979-ab19-a4527beddc86", "value": "24576:ThpLT/4PPH7caoc7KrxRri1N4Mtwa9Zvl51KOb9JblNB1:vLzswaoPr2N4uDv5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808886, "uuid": "b8488057-83d9-497d-9c52-19c11d30ca56", "value": 1320448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808886, "uuid": "e35b9883-f21e-40b0-89cb-7d9f4a9a2d13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808886, "uuid": "f09d6067-e9d0-4fe1-b298-0037da2e1810", "value": "84ba9c511c0b30ad8decd242e3066a18ef69bed549bc29761b70d5473c2092cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea1bb977-1968-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772807382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807382, "uuid": "832257cb-2f9f-4551-a893-67280d9f0792", "comment": "Malware payload (Mirai)", "value": "f823d435762735379a17b06ab68ea0d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807382, "uuid": "ba68de7c-4912-41f8-895a-9ba8832b6dea", "comment": "Malware payload (Mirai)", "value": "84dc78acf07c09ff8547999bce9a5da80cb330a2d1d227908c4421182550f461", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807382, "uuid": "cfc6d60f-e7b4-4b0d-a8f7-7a0190534e49", "comment": "Malware payload (Mirai)", "value": "2d7ff71328f0e484a6b5e7faf7a4b0c5eba2f3c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807382, "uuid": "28b15b98-dea2-4858-8fd5-672fa1984d1f", "comment": "Malware payload (Mirai)", "value": "a4c31f030bea528bcd6b2f81bffa08ada8b8b78430eaf7d315b0ba44d81518a9af8e14ca85120875940d347d7ed78085", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807382, "uuid": "6dc5bb23-dc3e-43f6-adbb-b8920c099804", "value": "T10AE31AC1AA56FEF3D5C39FB502A3D61006F3DC155B2B8E45F3ADADF04A1A5C8B10A258", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807382, "uuid": "6fd76f82-555d-45ad-8f6d-b2f00faae12d", "value": "3072:csv81eNAImYKr8ooRuRszav5KGZbiobf03mc3BkU:Fq/8ooRu6zav5KGZbiobf03mc3BkU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807382, "uuid": "b9d1efd9-999d-4bff-8e7c-4d52327b484a", "value": 153840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807382, "uuid": "f5ad8723-4f7a-4e57-9ee7-3680da201de9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807382, "uuid": "43516e25-3038-469b-a6fa-83150856ac56", "value": "x-3.2-.dick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a4a67a9-1967-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772806657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806657, "uuid": "39291f59-98f6-406b-86fb-cb7e554c19a0", "comment": "Malware payload", "value": "56ac741cf003c2973d0279e0cc9e96b1", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806657, "uuid": "12ab9724-c866-41df-83ba-e689f5c304d8", "comment": "Malware payload", "value": "84dffd306e8bbdf1c1eaf39526dba36c8c442c673348c63445e848aec737e0ba", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806657, "uuid": "c971519c-0d70-4b16-ae0d-c739717c5205", "comment": "Malware payload", "value": "5c156be40c97133464e03ddb644a897ea3d87fb5", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806657, "uuid": "bfe82ae3-8746-401b-aecb-1d7d27d374e4", "comment": "Malware payload", "value": "449a39b70196690a11b409ec416a62a60cecd81cc09eb0a6f532b8cdb619ded193a9aba7d1e67c84e0d9285e54ad6476", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806657, "uuid": "8067e436-66af-4772-8c1b-af47197522ad", "value": "T14976333AF1746986E95BA43BF1E1094243AD331DE557C43AE5F07CC8B2E078A68CD19B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806657, "uuid": "2e1cc9c2-9620-4db2-bd22-83a8d85c8acd", "value": "196608:+ZftcqQuVgiVT2VrOSOR8A0uU+HB/OGUElH6XU8YYlbHXUX:+B+qntTAZOR8ArU+h/PUEl0U8YYlbEX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772806657, "uuid": "b274cd55-c665-41a8-b866-f79c696d1099", "value": 7758047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772806657, "uuid": "bd93a4ae-8580-48a4-863f-01dda9dcc10a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806657, "uuid": "a6e96c90-48bd-49c1-bc58-62ee6b60d40d", "value": "bkmsiqop.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "843fce9f-1951-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772797332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797332, "uuid": "27fa0bf1-d357-438a-b3f6-b595f783af67", "comment": "Malware payload", "value": "31d7ecd1dce2db8d4ce4aeed3390da05", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797332, "uuid": "7cb815e7-4889-466f-83bd-02b8acadb0dd", "comment": "Malware payload", "value": "85b51d61dc468c5e252b094a2e08f079e32a4a6df39522c1b02ebd483c13d31b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797332, "uuid": "3b896eb2-8962-42eb-b4b8-e9eca60660a2", "comment": "Malware payload", "value": "09a515e1906b324bd2809d1ae166320a58cd35f8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772797332, "uuid": "18708abe-636d-4084-8174-6632a6692401", "comment": "Malware payload", "value": "06f9be5a71a0c1f92be51d8f3f79581bd45b0aad138f2f8d19759120d0bfc9e5f0deb032a3c864f53f8941eac640e24c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "serialmenot-com", "colour": "#C21594", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797332, "uuid": "ff877aee-ff6e-46e4-88ce-16b26b4810d7", "value": "T1E45196451ABA3A268AB3555B852FD409DD3986170C068F10BDCD0F032F7E6983ED6F68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797332, "uuid": "35e6242d-529f-4093-ab08-e45d0ee96bf4", "value": "48:CjOKzDr7b5PA7g35/zGbELybf2cbtl+i26MRLpoQu8peL/Rf6Wc9bE1Tmo:CjZ1PJEf2cbCifMZu80Rf69gN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772797332, "uuid": "851ca8df-6a34-4204-b113-1efca26a5855", "value": 2520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772797332, "uuid": "fbf57fbd-93c0-4aaa-9774-97c6aaa58a9b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772797332, "uuid": "34e1ac3b-157c-42ac-957e-c3014e109b7c", "value": "85b51d61dc468c5e252b094a2e08f079e32a4a6df39522c1b02ebd483c13d31b.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e5227a7-19a2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772832111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772832111, "uuid": "12553936-906b-483f-9eff-7a566e56ba8f", "comment": "Malware payload (Mirai)", "value": "ccb89b37e830f822e5d3711621ba8845", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772832111, "uuid": "e79b61a8-59e7-4342-b064-424ca8fc217c", "comment": "Malware payload (Mirai)", "value": "85f14e5b653e95e442a16eddc38bf0e895a47fb26c1ecc4f23df54cd5c7d3608", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772832111, "uuid": "7a1edc2a-c364-4b7f-95ff-65226a687d17", "comment": "Malware payload (Mirai)", "value": "36c27c1456e3714c4e4e431167f5940081e0885c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772832111, "uuid": "3f6b74c1-c809-427e-80ec-a64b24a1289a", "comment": "Malware payload (Mirai)", "value": "0761d430b0a78ba11044c85915118461bf5ab59c74591247eb104112906f3de399bc8ae4f036aa1bded2866fca00383f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772832111, "uuid": "59d21f23-b74b-41df-bb30-a5d6a50ae1ca", "value": "T1BCB32977A61C0B43C49B55F02CB77BF28F69ADA312A611C0A209FEC05B73AF12551F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772832111, "uuid": "1889504d-8098-4434-979c-a97320855fa0", "value": "3072:X3FM0rpGAJluQs2c+GCbid/mm/Qcud9HnirNb:X3O0rUAJAQs23GCG5mm/Qcud9HnirNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772832111, "uuid": "81879755-1e01-4d89-a438-9d19a572d31f", "value": 118004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772832111, "uuid": "a3f52c06-41d4-4baa-bb31-3327c1945845", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772832111, "uuid": "75ff213c-2daa-4f22-a2ab-5825a7fed149", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e97a617d-1975-11f1-a769-42010a9c0008", "comment": "Malware payload (NirCmd)", "timestamp": 1772812964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812964, "uuid": "70548f2d-dfdf-4844-9eed-e60349535890", "comment": "Malware payload (NirCmd)", "value": "570dcb09980de944815a0dbd7c4bf440", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812964, "uuid": "abc8c9b7-661f-4dc7-a5a9-3bf2452303dc", "comment": "Malware payload (NirCmd)", "value": "8638caa95e7b012e1ba8425c7d6de94c1e97a6f807caea1c85567a12f53d6f18", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812964, "uuid": "ebaf643b-f3dd-4e1a-90f7-847a57eeddd5", "comment": "Malware payload (NirCmd)", "value": "8f4f0e34d6c8b4b52f561bd6a8ff2fed57ba05e3", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812964, "uuid": "1c051500-7121-4501-98ba-b346c456a4bd", "comment": "Malware payload (NirCmd)", "value": "91b8f4031bc61ba3186a2d81577b43e2b9b56a3bc2253d2a66738c1da24379a8c5f435a042883aa4e2f029db0e861853", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812964, "uuid": "3d43e13c-2328-485c-adfd-4decec0d47de", "value": "T147A52342F8C485F3C4511C331B65A7616A7DBE202F268EDBB3856B1DE9614D0EB31AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812964, "uuid": "7f219d82-eb68-41c8-a482-860cbd63dfb2", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812964, "uuid": "78892919-4c56-4f34-81b7-5ea1bbdc7317", "value": "49152:ABRhTpc8iYM5pF9UBB6jdLXsuuX4/cqZIiQx6lSONx:a/TFM5pXUBB6BLXTuoEXx6lSONx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772812964, "uuid": "d5a28e8e-81d5-412a-acaa-87d82c178363", "value": 2110512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772812964, "uuid": "eac8e362-8598-4553-b3d1-a47c6b2e0fa2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812964, "uuid": "ae8e13ec-cec4-4999-aa4e-1a0c20d5ad45", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "facc4e11-196e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809986, "uuid": "089180d0-881d-4a03-9541-a77e28ad0de7", "comment": "Malware payload", "value": "2146c659f9d9630fdd74b8c5f67cd0a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809986, "uuid": "b9a60ed2-6860-42e6-8a7d-6f17b7b95e58", "comment": "Malware payload", "value": "868089f83d51fd0662de97ce98471e2813acef3a1c4e1f317f19012d4e9e5e4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809986, "uuid": "a431110e-9b8b-4bc7-bf04-014ecc1a5788", "comment": "Malware payload", "value": "5f96f495314812a04f510622f146d1c2f2b862fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809986, "uuid": "83ace606-b453-41b8-98fb-88d134d2aeb1", "comment": "Malware payload", "value": "bd5d2d1e0980d07e966c856965263643c66dd480766ffb5e53580572286477e30dc1dbec3027782d98590460df699075", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809986, "uuid": "038380a1-fbea-4355-bcdd-fd08840af556", "value": "T1A694F526E760B426F99344712D79A256282E3C3A3681ED4FB78D8F4A3A7058375F431F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809986, "uuid": "070f4d69-023e-4648-964e-29d57c329845", "value": "2513ea0abe63c8049ac23cf37fd47295", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809986, "uuid": "7700a744-5201-4484-a3b5-6d5b2b9329d5", "value": "6144:N5wbH+V1DPYmPdJXN4D4bHVn5nTCMy1JMx7GDUhE1HfymWI4h5JBgkMg:sbeVN4D4bHVn5eJv1HfymY5DRj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809986, "uuid": "a51d8f2a-36c1-4982-a725-26a472f634d6", "value": 417792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809986, "uuid": "77c753ac-91d8-4aab-8dcf-151f8ca9daf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809986, "uuid": "d0db2fe5-f654-48b0-93e0-cd2d912acc82", "value": "868089f83d51fd0662de97ce98471e2813acef3a1c4e1f317f19012d4e9e5e4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20d0be7b-1974-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772812198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812198, "uuid": "5468f128-1ad1-4769-ae84-aa8e05f7064e", "comment": "Malware payload (Mirai)", "value": "3d34a6b35c2b1d35897cd1692966645e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812198, "uuid": "61310cef-bdef-48e8-ba02-9a2ec32cbcee", "comment": "Malware payload (Mirai)", "value": "86808d452a5247486788f89b5a87cb03071d6404e6877cffa6fcc87dc03b0df7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812198, "uuid": "b064ee8e-a63d-4727-9161-615f3a37f7ef", "comment": "Malware payload (Mirai)", "value": "9ab12ed5e78b2e0df133e4642c96f86855314432", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812198, "uuid": "6b38e822-14ae-4ef2-960c-660ebbc1e577", "comment": "Malware payload (Mirai)", "value": "a62161dd7f68ba365ffa5c6e50501f3f3ddea2d9644d833fc5222e56796a8d87f5de289d01ac8af7b720cf5202641af9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812198, "uuid": "240df0c2-9799-4f07-a5bb-0aad30bf2655", "value": "T13B043A45EB404B13C0D627B9F6DF424633239B9497E773069528AFB43F8779E4E22A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812198, "uuid": "7b9634af-5b42-4b2e-984e-1ff038e7812e", "value": "3072:v8Fh7MtehGB9ewa0WauwBrrWgtwy7X3yaooOM/RXiIkYS:qh2eheQwa0WauwBnQy7X3nVOM/RBkYS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772812198, "uuid": "1e62d642-422e-4a45-a904-62c0a60e2420", "value": 183859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772812198, "uuid": "f6b8cee7-2b96-40b7-b6d8-bbacf2ceb5d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812198, "uuid": "3bf47c06-578f-477c-92ee-cd4cbede0a4b", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f03801b-1984-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772819255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819255, "uuid": "b9937a10-f46e-4443-90da-e4f0ebe7c9de", "comment": "Malware payload", "value": "783268eeb0f8ee7a64691b8cde6bb53d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819255, "uuid": "5cd1942f-af67-44a3-ad74-29c468a0c5aa", "comment": "Malware payload", "value": "869c4b03c1c6cbf686804b3dbef55240122de0075ab21850f6d9d4cf3b44a240", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819255, "uuid": "fb7dc6f6-e3e0-41ee-9bc8-14359e15cb1e", "comment": "Malware payload", "value": "e205fcbe4c66a4a680f958bbc00d0eac03d5b4fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819255, "uuid": "7270d647-8d55-4ae1-b503-12b7735a16a4", "comment": "Malware payload", "value": "ef215585e03c1586db16d308cbac102de587268d6feae073efd56df1a41278a34356876b52ba649c239e1352c5a7aca6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819255, "uuid": "2ff9efbb-017c-472f-94b1-46911beffa93", "value": "T18D923A81E943D9F4E81242B11436EF6BF530E27D1048EA46D37B56B2A493940C6BB7FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819255, "uuid": "b66e3612-16f0-439d-9f3a-040eee392b5b", "value": "384:fVTuQw50VoldMrHtRpQjc1p9DQel1HF8r3yVF:MQw50olWLajcFQelRF8LyVF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819255, "uuid": "a16a58cd-952f-4489-8921-3f73a7a5d6e3", "value": 19952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819255, "uuid": "210dc984-8b2b-4330-9495-2aad4cb22bde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819255, "uuid": "96c48a15-3e17-4f0b-9184-31932b12bd6f", "value": "violetx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "055b1dd1-196c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808716, "uuid": "645eb8e0-11ba-49b2-8265-60b306e56dbc", "comment": "Malware payload", "value": "9bd9056c8a3798ecc7cd2624e460d9cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808716, "uuid": "6f3e2ba2-2cce-4ce4-b576-625e626e54c5", "comment": "Malware payload", "value": "871f50c83ae5a8620fded1cbb226df9636bf55abe90ebddd61a39015585f0268", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808716, "uuid": "6c2cb764-cbca-46b5-81d4-3f21085c0ce4", "comment": "Malware payload", "value": "1f02125f72201021887bef2f0e0000eff1f68aa5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808716, "uuid": "a4f2856c-39e4-4f16-bccf-2edfcd30f027", "comment": "Malware payload", "value": "e516c1f4206e348bab2d41840eb84d3532515115838646db70e219c3f2631d8e2af5c6822cced12a5891eb1dbd7ef72f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808716, "uuid": "c254e861-a257-49cc-982a-c78674fd5316", "value": "T13E45D04627E84958F4FA9F39297464144BF9BC279939E72D2A4840FD0C72F45EA22F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808716, "uuid": "7913a3bd-db8c-403b-ab0b-783c02030563", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808716, "uuid": "848bf8e4-400b-48f9-a5b7-c6a4762b143d", "value": "12288:ufDDKyKMr5ZeGszIMjy1j89CFnLT/N0HPNI0iAxxrKXBxoo1C7I/hPkg+CaHmL2e:2jhpLT/4PPH7caoc7IRkWaAJXA1BPgP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808716, "uuid": "4656a681-d4a5-4d86-a863-a2154f82b235", "value": 1188864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808716, "uuid": "2da35717-d666-488a-aa9a-7347010321bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808716, "uuid": "40d73162-dc9e-4e3b-b138-a50f67d803c4", "value": "871f50c83ae5a8620fded1cbb226df9636bf55abe90ebddd61a39015585f0268", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "102b437c-1968-11f1-a769-42010a9c0008", "comment": "Malware payload (Kaiji)", "timestamp": 1772807016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807016, "uuid": "30dbd907-b0e9-4dc8-95dc-e806c54f4ed1", "comment": "Malware payload (Kaiji)", "value": "7dc6a0892cd5887cc00ed7ac3bfa9996", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807016, "uuid": "dc96da41-063b-4bf6-bce3-f3114fa28ea0", "comment": "Malware payload (Kaiji)", "value": "875d10dc7f2e41023cbf1e34a7877722d739cf239f475c53d389b3c69d126206", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807016, "uuid": "58ad3dd2-b1ec-41af-9eab-bf95e4a4767d", "comment": "Malware payload (Kaiji)", "value": "57e5723f2ed114ba55451b6e5371e5464e8e7540", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807016, "uuid": "77adb219-32c2-4497-bad6-252b4d2fc2f0", "comment": "Malware payload (Kaiji)", "value": "3577d4d0f7561169e0b8125c7f4b08547069e396168687b85019448a8a56e48227fcd00ed1986f07951feb1e3a131329", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807016, "uuid": "acd471de-40dd-4d38-89c5-605515056f5b", "value": "T1A0A5337F5DFA6EDBFE3B251969D9A484E0E704B20FA528466EC05608737C2E0CF31265", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807016, "uuid": "e89a0c33-1f81-4efa-8070-8d62e67b94c2", "value": "49152:ZjNz0wE6WAsByYLmnNXfOssMRq3hk+8mDyH:1N1l6aNXfOKwx/8V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807016, "uuid": "6bfbd0d8-2853-4a14-8717-c3e2541055f5", "value": 2083124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807016, "uuid": "443aae07-5269-4132-9bb7-6c624b114616", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807016, "uuid": "acb44598-b1a0-4fe5-a561-ae4f5e4fc6c1", "value": "linux_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9773503-196d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809555, "uuid": "437c274f-3062-4668-810d-674eff05de44", "comment": "Malware payload", "value": "04cf3dd040ee62b942daa32b098b3a56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809555, "uuid": "381e87ad-efbb-4705-84dc-68bc81fc397e", "comment": "Malware payload", "value": "8845ef3a6073b6063817e01607e3ba49d99bed413529e6ad2623a390a27d8cd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809555, "uuid": "3eb4c790-426c-459f-a2ca-3dcb695d5a80", "comment": "Malware payload", "value": "650245c908d1eb7e37cde62e3f364653838ae585", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809555, "uuid": "e6bab88b-8800-408d-a3b5-347640be53ea", "comment": "Malware payload", "value": "b9f928a50a41078b5b7cdabbfc724b9fbf90e385575407098d8e17da1ef8690b18d3540d8f4205982b2c7a51a74dca8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809555, "uuid": "86d3bb2f-b70a-4800-8eb9-c276cb948196", "value": "T178C4AF91F715DAABE56B0ABA8CBBC4302567AC1E86D2111E315DB22825F331211DFF4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809555, "uuid": "07790eec-608a-44e5-a542-ee3f2990c2ca", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809555, "uuid": "d4a89764-ec48-4c02-9d26-3c220207f8d8", "value": "6144:owq3NpQ3wDIywUF5ykHERIe6M1thQuYnx8hPEMwMdozvn1O7CLF2jtM0OtTq+f5q:ozcae6utMnkRdAv/h2jtM0OtTVBSp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809555, "uuid": "b6447666-bd10-4e91-a206-8ee0352d27ab", "value": 567840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809555, "uuid": "c0a5603f-ec7f-4743-9abe-ee9f2fa1f817", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809555, "uuid": "400b0fc3-246f-4e82-8f28-5a924b55efed", "value": "8845ef3a6073b6063817e01607e3ba49d99bed413529e6ad2623a390a27d8cd3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7826daea-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811056, "uuid": "e0f16231-1f89-45ee-acc6-bc309b3ff9f7", "comment": "Malware payload", "value": "be8c6bb094a54637c4b66e22bfe14e24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811056, "uuid": "ef074f1e-3c24-4061-9f6b-c1b1ae8b3389", "comment": "Malware payload", "value": "885d9e7b8aab053be49501f03ec67a4c6d6f5daf45cdc232ceb67fafc0aee3b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811056, "uuid": "eacde669-33ca-4cff-b376-6e8b95496b04", "comment": "Malware payload", "value": "f7cd13dd48eb8c7e2b8671dfdadd06ab688d93e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811056, "uuid": "d80092a1-29fa-46e6-be64-ebb00219d99f", "comment": "Malware payload", "value": "f8ca0daa14df18449a9067ff46e904b4e33234134adc0e57bb5b41aba68488844289ff12f0a912c76088eb722210eca5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811056, "uuid": "cde01e89-fa44-4a01-8e52-19f265e83f61", "value": "T1C773E626AB57446BF141093182958BFF4ABD6C33316A202FEFD09CF73CB059A8545DAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811056, "uuid": "ff550aa0-55a1-4ce1-bd1c-6df20a0b45c0", "value": "c4b8b0aba9f9c876ca624bdbda64d516", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811056, "uuid": "1386e909-0593-48a8-91fe-19884258daf0", "value": "768:oepnjAK/y7yXdQxlVfnHKQtV7eSHs1Iqzy7NIaH/f74tFGXnedGiB9G12uZFHQzi:oepnjAK/yGtQNqydHjq6j4tu/2uCoI/y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811056, "uuid": "233fe2f2-34f8-4194-b0bd-4b7b1a5d99b8", "value": 77842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811056, "uuid": "c68ea2e9-1ac3-4c7e-a8e1-75663ba90975", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811056, "uuid": "61f386c9-4b4c-4cb9-be7e-b67aa47c2379", "value": "885d9e7b8aab053be49501f03ec67a4c6d6f5daf45cdc232ceb67fafc0aee3b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29b3d028-196c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808777, "uuid": "0254b323-f647-4673-9530-8ead9a9d88fe", "comment": "Malware payload", "value": "93a0d0182053dadaef253310bf8c78a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808777, "uuid": "82fc8166-b24b-4db2-843f-21a0e9e6c32a", "comment": "Malware payload", "value": "88c39c5585b2dcb585724f878a07705243df1f14f8d6b54f81b112cc1261af74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808777, "uuid": "cefcdfb7-fb34-40c2-8a7c-7e8113baf175", "comment": "Malware payload", "value": "dbef4eecd1e8310191be846c9a5d2bbf6852396a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808777, "uuid": "59bddb6b-e778-41d0-a403-74c077542f9a", "comment": "Malware payload", "value": "0700d2c33a3b877dcde2951bab0894872f2ce666b2c7079b95606fc168dff348763b81619574c86156b08731083a3ad0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808777, "uuid": "037687f2-0577-4d1d-9166-2173fa18c3df", "value": "T1D643F8013B974361E41C257680EF052447F1A7D226B3E7EB3E9C639D9E033A36E52BA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808777, "uuid": "7dfbe83d-c9ed-4552-9070-b94649930059", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808777, "uuid": "5f34e133-1fc9-4c77-ba2f-1458cc154d81", "value": "768:34NOwj8HdrxozXoqi+rgzQCiJv1T3rbqS0ayq8ZMaqXhSCA2Gar:oOPHjojol+rgcCiJd3nqrayqQMRbtr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808777, "uuid": "98305f9c-0fc3-41f5-8165-284d8eea9d56", "value": 57856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808777, "uuid": "87d9be9b-ffde-44df-867b-39106584e9d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808777, "uuid": "fd6324a2-e54f-408e-b75a-dfe0cd08d245", "value": "88c39c5585b2dcb585724f878a07705243df1f14f8d6b54f81b112cc1261af74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f85ef5e8-1983-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819002, "uuid": "eb56dcfb-8627-49e1-9d8b-3bf7c9098d7b", "comment": "Malware payload (Mirai)", "value": "c09b6bdaf5394952a0548e09bb9ccbbf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819002, "uuid": "4d9da027-cb40-448d-8e8a-94bce2881178", "comment": "Malware payload (Mirai)", "value": "89047c4d5133421e773e5522e4891e36c68cf06cb72cf0f9495b92cd77a3dc13", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819002, "uuid": "bd411361-1468-4bc6-b219-98a7ff260729", "comment": "Malware payload (Mirai)", "value": "208e8a1ee317b4d95244fe94c1017118d02ec45d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819002, "uuid": "d6f3d36d-cb62-493f-96f3-643cbf6dce27", "comment": "Malware payload (Mirai)", "value": "14b87e0b6f7c06c7fd36b060b0667b8b323975f71ce43e9e419a3334898a5cd8cb72ad9962a52f2b4bd70133c7752f67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819002, "uuid": "7ef37f53-0074-41aa-a7a0-aa9a0ed16529", "value": "T10EC3C85E6E219F7DF368833047B74B25A75823D636E1D685E26CE6001F6038E241FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819002, "uuid": "02301d6d-b593-4bf8-bdf1-4a7f1ee2b39a", "value": "1536:GZlDgu2haCVrzs2lBChIT0VGZ70C41rHQ0MHFBef0oO0BpoC4:qgu6tXs2/YVVCmrHWHFR04B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819002, "uuid": "4bde9909-b87e-44d6-9235-b15dee6af0f8", "value": 118400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819002, "uuid": "79828734-9d3f-40a8-b965-7bdb5928de7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819002, "uuid": "762421ad-e348-4361-9051-07d5770d42eb", "value": "jawirbot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3b0691e-196b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808632, "uuid": "8be5ffe8-5813-4c03-adcf-c8f6dcc959a1", "comment": "Malware payload", "value": "e41f4f74b05ccf18d3a10a390b01d66e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808632, "uuid": "46b1b486-e5f6-4f91-aec2-aa0fe8061bb8", "comment": "Malware payload", "value": "89b72ebde221120ed45ec704b9d5c14d68bf693e2910658283fdeb91a9219ab3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808632, "uuid": "aa4aa86a-119b-4600-8961-54227381c2ec", "comment": "Malware payload", "value": "adfdfe2190c3091f95e62e1b1f5b4d4b973320e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808632, "uuid": "4be8720d-beb5-4ad2-9c95-56289045ca27", "comment": "Malware payload", "value": "3b09a4407f06a287eef82414838b9cec85bae3325c369906da11330f0a712c2f5a58c853db21738f2f640481cc01463c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808632, "uuid": "020fc45d-397d-4fa8-a36e-1ff43405e68b", "value": "T14B55C00273D1C062FFAB96334F56F6115ABC7A260123A61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808632, "uuid": "b8829e32-6655-410c-bea0-3929129ffbfc", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808632, "uuid": "bb0e22b3-956f-4e2f-9f0f-8d9591e1cc45", "value": "24576:w5EmXFtKaL4/oFe5T9yyXYfP1ijXdatT7tH6T4FzzPU6ORSMK:wPVt/LZeJbInQRatPtamHU6r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808632, "uuid": "3de747a3-37c4-458a-a712-4c25947d4335", "value": 1402368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808632, "uuid": "16ecc893-278b-44e4-8d75-3f582500522a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808632, "uuid": "3debe127-1918-4f44-8e6b-aa3e7df05264", "value": "89b72ebde221120ed45ec704b9d5c14d68bf693e2910658283fdeb91a9219ab3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff8fdd88-1983-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819014, "uuid": "fab75f07-a2d1-4ee6-b260-d3ded9684bbc", "comment": "Malware payload (Mirai)", "value": "37d167e2e1d0a1a1223a506913dc8220", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819014, "uuid": "983cd4fe-99be-4933-bca2-3d8b85b813d8", "comment": "Malware payload (Mirai)", "value": "89d1cf0d80f26f4a506d666e0ffc7df7f344511da9e62c20fd39efa75850dd39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819014, "uuid": "b1900800-67c7-499e-9cd5-93960a56caf2", "comment": "Malware payload (Mirai)", "value": "f19ce4e5137cdac0c0a3abe8a4aad02348e80cca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819014, "uuid": "9ec9fdf1-9a49-4e8d-9204-77978b416148", "comment": "Malware payload (Mirai)", "value": "cab7e678cfc636a9157e62c83b0abfc80f55256f47be13353f9158c869f885cfea5bd8bceff3651a4830ebd174fe106c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819014, "uuid": "3ee8e6d8-95a6-4887-a19f-50b17c40e35b", "value": "T158E30D8AAF713EFFFC1ECD3301D95646214D565A12A86F7B2A70C528E28A14F49E3D4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819014, "uuid": "35355b8c-7476-4327-ad10-51f576459066", "value": "1536:2BFkgl6O0cn3q1Zuk2pMQmBz8l72GaC7u5xnXNkXrG8FKpcC7cFnZ/vIAJqY79t4:6JINopaC7PacC7Anl3wLNuFBwl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819014, "uuid": "9bb441b0-85c2-4f57-803f-5711aa0a1d63", "value": 156348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819014, "uuid": "6e4294a4-c0bd-411c-b401-5a9817c8dc87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819014, "uuid": "4e41b33e-e361-4cf0-8ecf-66688db76272", "value": "debug.mipsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c57349b-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819250, "uuid": "aec9919b-6eb3-448f-bcdf-cd4e4fc6a15d", "comment": "Malware payload (Mirai)", "value": "8bfc6881a1ea4cfdf6008e1b0736ec8a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819250, "uuid": "faef2d56-bba3-4e46-b5ee-05cfcb57b144", "comment": "Malware payload (Mirai)", "value": "89d2cf74a5deb6dbf61e1410b6b9ad2672ab6fcd9851b984d8c0af39a8fa491b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819250, "uuid": "20744e3c-d277-420b-a1e7-68cc9b81c448", "comment": "Malware payload (Mirai)", "value": "6882cc34b7b2f877722e19aaffdfe057009964fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819250, "uuid": "6d1f4793-256c-416e-8449-94ebd250c9f7", "comment": "Malware payload (Mirai)", "value": "02fe1bce7eefcbdb0f03a408e88922c8beb9557094cebe259ad82505e81f84980755bfabd9d356ba90f370ca5ffa9ea8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819250, "uuid": "8dad85c1-b278-4c63-9e3d-79856f544f82", "value": "T161A34AD7F800DDBAF41AC73B44975906B230E7A10E8217B67353796BEC391E91827E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819250, "uuid": "1a6b262b-e02e-4050-ade6-9866e1369674", "value": "3072:ZgFlfGbGNyb7IFQn+F6lB7XsnnicydZwPJ:ZUlfK3UQ+FKhuicydsJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819250, "uuid": "d6e9c324-df86-493b-9f24-b434c54f370e", "value": 102992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819250, "uuid": "7ff6dc3b-ec1d-4215-a845-2dfb26c787b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819250, "uuid": "66ec093e-ab13-4ad8-89f9-9df5f08ea5d3", "value": "violetm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "947cba7d-1964-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772805520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805520, "uuid": "b679ba3b-02ed-4992-a16b-d569805805d0", "comment": "Malware payload (AsyncRAT)", "value": "322291e44783484067d04f34af2de3ec", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805520, "uuid": "5363986b-dc63-4fb5-a438-8df40392396a", "comment": "Malware payload (AsyncRAT)", "value": "89e52fa31535e46b5f08becbe1c591aff709036554856e6d250a503719081705", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805520, "uuid": "19d85e23-b8b2-4276-9a24-7df83c5788fc", "comment": "Malware payload (AsyncRAT)", "value": "2e62329fd4f8a02e59aeebabd6653052c0e9d524", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772805520, "uuid": "63095075-2030-422b-a95d-ad7b97f95e7c", "comment": "Malware payload (AsyncRAT)", "value": "caf4eb1532ce81d4b5efadb089c09e676ada38dba5a1310800d05f9f6179091398bbea518585a165ec6b7a25b428685a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805520, "uuid": "8edaca4f-f216-4fe1-ba40-6d9b087806d8", "value": "T1B124C041F6C08472DDAD183804689B368F7EB860CF6099DBA3C45BA99F742C1DE35E5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805520, "uuid": "c8b8ad0e-6a69-48b8-8037-ee5864b11129", "value": "3e1b9abc7b12e5ae445d7539e5dd133e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805520, "uuid": "1973d4d5-d4d4-46a8-b2b2-ba09065e9a44", "value": "6144:LTC3PMP9KgSWHMcl8sG77SXlCKZmWVcP8E6F/6N:XCfMPxnL5lCKI0EA/Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772805520, "uuid": "dd961d41-b139-4af4-8251-b7b610f516a3", "value": 213272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772805520, "uuid": "72639fe8-53a8-42a4-ba1b-b1c762f22bca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772805520, "uuid": "12895a46-196f-4c8e-9ab3-2b553d95652b", "value": "SDL3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c05d2be-1974-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772812217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812217, "uuid": "2eacb841-b0a9-423f-bf3a-8dabae359760", "comment": "Malware payload (Mirai)", "value": "c793fc330da9d17ade538c1ee9c2227a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812217, "uuid": "6f019a62-fd98-426c-943d-044d2161bd13", "comment": "Malware payload (Mirai)", "value": "8a4c1bf89270c38f910c2a24d554175c876a7a1e25a86e5b7def2b2b905cb4a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812217, "uuid": "87f32fef-9db5-4678-8a70-9f1211dc6d1f", "comment": "Malware payload (Mirai)", "value": "2397ab77ffddbd45a5c1c9704a74b538b73dd201", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812217, "uuid": "0377e2ae-dfd0-4c4d-9a73-dcbeb207fc93", "comment": "Malware payload (Mirai)", "value": "81bb896d13c95470d9290ae30b12bdcc0b3f242fa365a0b4727819fca76628a9f2652da09f5320b5037722cd9652ec36", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812217, "uuid": "47a2c0fb-77de-47ea-9033-1362aa31ca9d", "value": "T156C38DB3D8296FE8D110D9B0B4B48FB82B63A58541472FB965ABC3B41487D9DF500BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812217, "uuid": "58b296fa-5081-4d3e-885e-466a16b78bcc", "value": "1536:kmM4DRZqJO8NUz0Bg/Rm5eKUFEHzr3mRjiH+6VIF0/HfZa2W0Q:kmM4DvqJrNUMbVu0xH+TF0ffZa2V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772812217, "uuid": "812a5d98-76fe-4ca4-9a09-f3c028e5780d", "value": 129096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772812217, "uuid": "78119ba9-9fd9-4ee8-9ab2-0149cf55ed7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812217, "uuid": "3b615759-ee71-46a8-9042-b007efe74819", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bcd6551-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772811330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811330, "uuid": "83ca3652-b4cf-48e8-9e66-5e4e8e8c31c9", "comment": "Malware payload (AgentTesla)", "value": "0795bfa8a65f7b8f59d493ac23ae29bf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811330, "uuid": "302e7bc4-99b7-4c5e-815a-d3e6ca6c51a0", "comment": "Malware payload (AgentTesla)", "value": "8a83917310bca7fa86b7532e0a3a50db2e9055c25501f348c738daf6262bb303", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811330, "uuid": "85b89447-55e2-46ca-99fd-e605919bac02", "comment": "Malware payload (AgentTesla)", "value": "dfca5a89365aeb4ac591b8e87b6138cd1c6a9a99", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811330, "uuid": "c6e1c24a-2fca-451f-9f3e-86022e51bdc2", "comment": "Malware payload (AgentTesla)", "value": "3096cf8ff9c849e0c62c5903609fc5936bc61ac87e149ef6362ff2ad2052f2e640c25b8afc3690cdbba8123beb630143", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811330, "uuid": "3116462e-6a15-4555-a865-c0c8a6eef3b7", "value": "T1E135AE027391C062FFAB92734F5AF6115BBC79260123A62F13981DB9BD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811330, "uuid": "d0c2576a-1990-4e47-b6ed-41571f04e791", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811330, "uuid": "7e5e4e37-7931-41cc-b69a-1e3710008580", "value": "24576:S5EmXFtKaL4/oFe5T9yyXYfP1ijXda6mBQ2MqMhw2GE8q:SPVt/LZeJbInQRa6mBHXS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811330, "uuid": "70358188-13d7-4c01-b3c0-127046a4e07d", "value": 1146368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811330, "uuid": "1f806913-998c-419d-ad8e-b057aa794faf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811330, "uuid": "f0e42101-866e-43ff-a671-5f750980bbd7", "value": "8a83917310bca7fa86b7532e0a3a50db2e9055c25501f348c738daf6262bb303", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b465f82a-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772810298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810298, "uuid": "bd30c951-e857-40c4-a319-cbb9e606659d", "comment": "Malware payload (Formbook)", "value": "7a71b7f9a9d70d2a008ecfc3bf171129", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810298, "uuid": "63ad92c0-2b70-4593-a9b7-69d4e5e9a1ea", "comment": "Malware payload (Formbook)", "value": "8b18785bba5bd6332ad6ce55473d550714793d27104cd04e8507b9cfdb1019e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810298, "uuid": "1f2b3f21-c12f-442c-8cbc-86b11b328c98", "comment": "Malware payload (Formbook)", "value": "d68fbc1ec50aa997706e190dfb5d883a4ff8e4a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810298, "uuid": "1e92a8aa-4ada-42e6-a211-ce8e8c5be385", "comment": "Malware payload (Formbook)", "value": "988e611b54857af301120bbb617fb9dc1a580f2d09ea79bef8c9ece5c70bc9d4b0a9e4bf1c307f43aadc3750651257e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810298, "uuid": "8e7ab804-e3d1-4d25-b18d-008ba212c545", "value": "T18D45CF027391C062FF9B96734B5AF6115BBC79260123AA1F13981D7AFE701B1463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810298, "uuid": "45dfc394-a91c-41f0-8a88-61a6c1085c67", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810298, "uuid": "8ad4b39a-9fb6-4738-88e8-5ea68d353b4d", "value": "24576:05EmXFtKaL4/oFe5T9yyXYfP1ijXdaqNr4rjXp5EOIZ:0PVt/LZeJbInQRaqNqvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810298, "uuid": "166dda3a-8cbe-4053-8d5c-6bce63fa4284", "value": 1280000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810298, "uuid": "ccd4e0cb-8cb7-41df-8a02-38cb4d8600ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810298, "uuid": "1e3640c8-322e-43bd-9dd8-e39be8069dc8", "value": "8b18785bba5bd6332ad6ce55473d550714793d27104cd04e8507b9cfdb1019e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "555dceb3-196a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807991, "uuid": "c1d4ede4-bafb-4703-ace2-9f06e836cf69", "comment": "Malware payload", "value": "5341d490828908e8058a1e4438e2afbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807991, "uuid": "75579644-4c88-4084-b8f6-213bcf81d3db", "comment": "Malware payload", "value": "8babc82a9c0bfb6b4ef92362e0be5f8fe9cf98bb2e459609e92107283193e5ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807991, "uuid": "4f7bf572-61f8-4c0f-ada0-a6891fb8c5b8", "comment": "Malware payload", "value": "4cb7ae0971810253652239c07e29ba2e3030d729", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807991, "uuid": "cd1b2bde-3c74-4057-bd8d-971f399b0c03", "comment": "Malware payload", "value": "ec9a5df38f0eca9f4b7114eace3a9bf6162a64b1fe89dd8a7f21d10a7b754ca9f81e0e903f3d108691495725420ad111", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807991, "uuid": "a2f95136-7900-4984-9c2c-3d16b7ff1750", "value": "T101D63300D6E012FEDAB3143CB8D15595E974B4B563B1C6DB4BE8D7A16EA32E04C39B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807991, "uuid": "209e64fa-0585-4d07-b77d-8546b98b5701", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807991, "uuid": "ab291122-364f-4453-96dd-9980e25fcfee", "value": "196608:K1NFtxaBlgKqFpoKzcntFlCt3hm6/m3zXMCHGLLc54i1wN+MCyPIcu9KYK39sI3h:K1NaKju9C3+jXMCHWUjXdcuI3/PGTAI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807991, "uuid": "fac57b03-524e-475f-94ef-267c404fd6ce", "value": 12734555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807991, "uuid": "de719fd4-bfb0-4dd7-aedb-fea74f010ec4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807991, "uuid": "d4f147b8-e693-457a-9571-83ab58a41670", "value": "8babc82a9c0bfb6b4ef92362e0be5f8fe9cf98bb2e459609e92107283193e5ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "730e38e5-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819208, "uuid": "69fe4b5a-ed88-4e97-b4a7-2ed86db558d5", "comment": "Malware payload (Mirai)", "value": "d8a3898b3e7b41ee2523791faa329a7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819208, "uuid": "af4d49a7-d99f-4de4-baff-523035abb6d8", "comment": "Malware payload (Mirai)", "value": "8be8b1d15d2a9bf1117ba9bcf99796b404807e111168f7b001607e88bff95c31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819208, "uuid": "2d21f060-ebfa-45bd-8d60-9dd85a61c58c", "comment": "Malware payload (Mirai)", "value": "ebe68af5f8420d595f16a301e6bdd3bcf758d389", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819208, "uuid": "7e8903e3-52cd-47f2-8bf6-e7054f44e73b", "comment": "Malware payload (Mirai)", "value": "c9db56f5ef91bf290c3847c76b0aa39770ee8c11f6399c914cb0433427ed8233e3f4ccc8a64798f831db4db8eeb3f09f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819208, "uuid": "7d5e289d-fb29-4598-ad4f-296afdaa9f31", "value": "T11503F646BA828E16C0D51575FE0E218DB713473CE3EE6322DE246BA9278F5B70B39C15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819208, "uuid": "d28be584-4139-46d6-9eec-7852065b53db", "value": "768:k9nhLHEDcotRh16nVy0KQ+VDQma5IIEVgIiI6b0B3qaR3rVPHdd:k9nhLotRhQnV5cVBjISiI6oB3qa7d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819208, "uuid": "dde2b787-a9c2-4b08-9828-91714843c632", "value": 38176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819208, "uuid": "d5913a76-cd99-487f-8fe6-f2d66f58560b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819208, "uuid": "72e09412-d92f-4cbd-9f72-5fc86d98c3d6", "value": "violetarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a870d2ef-197a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772815002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815002, "uuid": "3e71fdda-a338-4899-8fa2-c6c6e268da0d", "comment": "Malware payload (Mirai)", "value": "45609dff74b0ef26b64d3ea9480b4f6d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815002, "uuid": "1f26aaf6-ee1e-4f4d-9cd6-0883811703fd", "comment": "Malware payload (Mirai)", "value": "8c67a60301ec32183b034f2da1f6e2cb837c91c9222124cf8d99c2bd49873a8d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815002, "uuid": "2540c8b0-036e-4c9c-b9f3-ae7340d982d1", "comment": "Malware payload (Mirai)", "value": "a424286b91475559a940746dec142f15e6611245", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772815002, "uuid": "bbb46b85-6678-4f98-a3c9-440a48ce37c7", "comment": "Malware payload (Mirai)", "value": "24e0733a1212f15dc833d17ed94df5e17a3e0c078f0a5831a4a3dc4d05a6d77898f5b5d18c931fe6900082e6bb2efdbb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815002, "uuid": "b05f8ed5-7456-48e8-899e-f0383d1f211c", "value": "T1BD12BAB3F5F2BEB03C4950195A865E82E4492D3D0E687D427443BD1C717CAB8E1B5A3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815002, "uuid": "20b3a6bb-98dc-42d9-9404-cfc6383c86fb", "value": "192:oNOJ++FWXymrmECHxdm3wgYqIlPotECoY+rvJ29e:osJ++FWXymriHxdL+2F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772815002, "uuid": "660c4998-9d54-4dd2-bf7f-af6bc2f8b53e", "value": 9612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772815002, "uuid": "a65970cc-7741-45a8-83f8-d0c6203587ef", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772815002, "uuid": "ade5bf48-0c38-4dce-a60c-43d5b0436a18", "value": "x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae0136cb-196d-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1772809428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809428, "uuid": "c95e4a5d-ae29-4dcf-91d4-49a264f2b7b6", "comment": "Malware payload (SnakeKeylogger)", "value": "d2086866010f64786062d8afbcbfa8eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809428, "uuid": "52a416b7-6d26-4630-983a-6970c3b0a00e", "comment": "Malware payload (SnakeKeylogger)", "value": "8c7214863d5cb9c77ec74b55c27062828cee382fb207a1aac8c6ec1f95808f4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809428, "uuid": "6a3e6b8f-d6c4-4b7f-948a-ef913ccc671d", "comment": "Malware payload (SnakeKeylogger)", "value": "594dffc6e6ae55e05aa7b1e21e534164a29eeff2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809428, "uuid": "c87297fc-c3b4-4ebd-ae33-b934ef6a18e1", "comment": "Malware payload (SnakeKeylogger)", "value": "71679c2ef0a391cf9663a7c76407a9c1b941cd92b4987f28a2e138ad860868da1b4c5f6a2f66f6ce72eaa793837d3089", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809428, "uuid": "9a61a5e1-6987-4bac-973a-e8a621d0513f", "value": "T19BD4229686C29D95C2506371D836CC904A7839719D05B72E872AEA6FBC393D3EE13F0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809428, "uuid": "308d9881-50e9-4613-a3e2-cb12cebe41d8", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809428, "uuid": "fe1a3828-8810-41e2-8c00-33552722dfe8", "value": "12288:Yz7hU5I5yuNHIgzSFKxWltRohBfSTso93U+/Q2Lg6qgTgydF:Yf+iN57Gtene3bQ2+EL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809428, "uuid": "8e519352-5e19-432a-9ddc-f769ec914a0b", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809428, "uuid": "bd1b34df-b927-4131-abff-1b5a80eaea8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809428, "uuid": "70067e5a-3af7-48d8-a2b9-88cac5674152", "value": "8c7214863d5cb9c77ec74b55c27062828cee382fb207a1aac8c6ec1f95808f4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d036d485-195b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772801755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801755, "uuid": "5f722d57-5570-494e-940d-bfe9b63bd4a2", "comment": "Malware payload", "value": "d2c72104212b805ce981a097eb424c52", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WikipediaJsWorm", "colour": "#A0BBD5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801755, "uuid": "1a9a43b4-b473-40fb-bd65-adcd37e7c908", "comment": "Malware payload", "value": "8cb76c1cf4dd1bbcb32af03129ed1e62a6249a946dfcee7b3751d8fcc6169075", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WikipediaJsWorm", "colour": "#A0BBD5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801755, "uuid": "1b427d63-cb5e-4524-94ee-ce91c01c00ab", "comment": "Malware payload", "value": "42f400499ceb8b05c3719d06afc909c7883d23d4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WikipediaJsWorm", "colour": "#A0BBD5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801755, "uuid": "a09d8d2f-6fac-44d3-9443-9b0406043900", "comment": "Malware payload", "value": "50ddc26d179b2a4d99ae520e0cc76149744d581fe6cb5e1501c54a6f88b869b18be353074e7f0c2b88bfd3e5f2339204", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WikipediaJsWorm", "colour": "#A0BBD5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801755, "uuid": "c3d5d2ae-2f6e-40c5-8116-5d19bf8cae23", "value": "T100E2CAAC72239C6DDC63266BF19D735EE2601F13F5ACA0507A4C10486FE4C9ED146AED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801755, "uuid": "e19d4390-901c-4a0a-a080-3588e4a479fe", "value": "768:Hp/yCus7+KRzihuh0/zZp/yCus7+KRzihuh0/zzsF:Hpn17+KROxzZpn17+KROxz4F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772801755, "uuid": "be6250f0-6924-4692-93ca-b19eabb507c3", "value": 32076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772801755, "uuid": "463f56e1-3488-4b20-ace1-0425ca2367fa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801755, "uuid": "a91b4415-2969-440f-8ca9-b2197cb1237f", "value": "8cb76c1cf4dd1bbcb32af03129ed1e62a6249a946dfcee7b3751d8fcc6169075.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1e76ab8-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1772810777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810777, "uuid": "2aed1089-edd8-4274-8e56-b348cfc66fab", "comment": "Malware payload (QuasarRAT)", "value": "3dd5c4df8024954b7cf424e170baf7af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810777, "uuid": "e25a5c72-c5c4-4945-b089-1d5f7d96b8c3", "comment": "Malware payload (QuasarRAT)", "value": "8cdb00e3e157f21a13e73dd32f04c1a110c4a54bfb2b705dc9878edc3490e525", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810777, "uuid": "da49c74b-7e33-4372-aa44-2c5ff79e3e64", "comment": "Malware payload (QuasarRAT)", "value": "11c6d66bcd54a3fb8a3dd93f001492e88de25187", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810777, "uuid": "311f18c8-7567-43c4-ab52-a9e35e14d177", "comment": "Malware payload (QuasarRAT)", "value": "e1f0fa1803e86fe8f1f812f4f5b2d54367edf40ea5b34f4c1efff341884aa2c5384f2044f8fa66776e3941612f025c82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810777, "uuid": "8a3a8bf3-d86e-48d8-8cb7-f1630ce547ba", "value": "T1BEE56B143BF85E27E1BBE277E5B0041267F0FC1AB363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810777, "uuid": "9b51cbd6-7d3e-4739-9c76-a98c4b6796a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810777, "uuid": "4e5a7913-ba10-4530-92ca-483c58f88ee8", "value": "49152:ivIt62XlaSFNWPjljiFa2RoUYIl9RJ6bbR3LoGdxTHHB72eh2NT:ivE62XlaSFNWPjljiFXRoUYIl9RJ6t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810777, "uuid": "9253d3ca-bde4-415e-92ad-ed0f29630d8a", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810777, "uuid": "86267469-303b-4081-9b58-84064b161303", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810777, "uuid": "9e39263e-071b-4563-a41a-de915d2d868c", "value": "8cdb00e3e157f21a13e73dd32f04c1a110c4a54bfb2b705dc9878edc3490e525", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd67fee0-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772809937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809937, "uuid": "ae5e68e8-bc1b-4f47-bea0-a31e3d458a27", "comment": "Malware payload (Mirai)", "value": "6e063db1812473256e35b8358fb129fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809937, "uuid": "655a454e-c63f-43e6-90c9-2308db337263", "comment": "Malware payload (Mirai)", "value": "8cddf9679c83d10252ec7581586dd9dd333a6018210081dfec47a6324e1cdf9c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809937, "uuid": "8a4747a0-02c0-48dc-b9aa-9a321ecdf0ce", "comment": "Malware payload (Mirai)", "value": "dbc43adf60f1a005ca4b1aab55f23822787b3773", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809937, "uuid": "26ac57c1-b8ac-4af5-acee-fe70f803da78", "comment": "Malware payload (Mirai)", "value": "e585772c24b8d13aa661033d9ca3f3225dcb29d97658358526887b4e7457ec8b7eb531d74cd5c144df82714f4542ff1b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809937, "uuid": "6c17d4bc-ea87-4b26-99f8-72b4aa62c787", "value": "T1B8B3194AF9819B12D5C922BAFE1E51CD336347B8D3EE32029D14AF2537CA96B0E77501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809937, "uuid": "3bd4ce3f-4312-4048-81ea-570675463162", "value": "3072:4b51EVs47PgAO1XYrou7advNrjThUraCg2j9JWO:4V47PfO1IrV7advNrj+rJt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809937, "uuid": "8014ff52-b176-48cf-bc56-1da37db82e96", "value": 108044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809937, "uuid": "2f882d6e-6c70-4526-921d-ad077d13cd75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809937, "uuid": "f63fbedb-7758-441b-be0c-19aa7d577031", "value": "tul.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5afdde1-196e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772809844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809844, "uuid": "ab113224-5c26-4c3b-8617-feee21d0734b", "comment": "Malware payload", "value": "cbdcd537963097e1655420ad6757d057", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809844, "uuid": "4713f3fa-3147-413a-8cf5-040b1c809546", "comment": "Malware payload", "value": "8d0142d5594d2ddcf8f6918a02e77a54e1d47e4d6e5c792399490f0248add965", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809844, "uuid": "25660a00-06c2-4ecc-905a-678135b638fd", "comment": "Malware payload", "value": "8968882c7f6e6b42a6308a783e2613c2ca6df45e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809844, "uuid": "cfcb4180-b75c-4d5a-aa8d-f77c9beaa749", "comment": "Malware payload", "value": "ff3a13358f1abd58072e5ddbc78b0b0fab5e31086c34eec6d01fc01a4ae059397cd8cf41a2f61461131c513e3496903c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809844, "uuid": "f13dfc3a-d82d-49ad-b99f-40cc2a94bdf4", "value": "T15985D0027381D062FF9B92334B5AF6115BBC7A260127A62F13981DBDBD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809844, "uuid": "34bf58e8-9169-4a22-8e43-61af6c9cfa15", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809844, "uuid": "3f3a331f-839b-4ac0-b234-16573ecac801", "value": "49152:uPVt/LZeJbInQRayFjKytswsRxlKNpFB4kP:0TYbInQFzqxlAvP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809844, "uuid": "4d9bb9fc-f5ee-47c4-8a39-2b8b48cdd6b6", "value": 1721344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809844, "uuid": "9b8ff51a-9894-4d6d-a3c7-df44d9db81d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809844, "uuid": "622b480f-322f-4c2d-be87-df3e841ac9cb", "value": "8d0142d5594d2ddcf8f6918a02e77a54e1d47e4d6e5c792399490f0248add965", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77c70233-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819216, "uuid": "f08c7df3-5f62-436f-abf4-34b881a7c8ce", "comment": "Malware payload (Mirai)", "value": "563f5a255a80fda7dd6d9ab4a2d48c27", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819216, "uuid": "91e4c504-d81a-4007-b074-4988c4192813", "comment": "Malware payload (Mirai)", "value": "8d47228c7aee256d63bc19e02f76df95f961067ab781931f1b905e7fad92d0a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819216, "uuid": "ba0a014a-c434-46db-842c-82c987c4cb69", "comment": "Malware payload (Mirai)", "value": "56da9edb2ae42f77051c7258c1797b7cca141f6d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819216, "uuid": "f658b36d-7a1b-4d54-a46a-37d3052ceeed", "comment": "Malware payload (Mirai)", "value": "0be6f18f5debc6b1ac57f330db5ad67d037bf0ffe4c4442604ff4ea25dc331a2721c9ea982e019335814748459e6d689", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819216, "uuid": "992bb04b-5eeb-4fff-a7a0-12f679dc49fa", "value": "T12A930A45B9819F12D4D621BAFBAE418933136FB8E3FE7111D920AF5023C69DB0E77612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819216, "uuid": "b0ae416f-0e55-4133-b42e-71b2f35ae687", "value": "1536:5TnuF1UvUXZiKyoFYpra1j3/pMfbhxf9lK/igCgBO797ZVYHyLs/x1HUL:wGvUh9FYpra1j3/pMfqxCgBO797PZu1O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819216, "uuid": "4e7c1bb1-d6e8-464a-ae31-7482b0296bea", "value": 97560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819216, "uuid": "7fc3ddb1-09b4-477e-a7ff-280d5be7800d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819216, "uuid": "6a18c7e8-1685-41df-94e5-071fb2bf9a59", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24be2bea-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772810057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810057, "uuid": "2ece716d-c1b8-4ae9-9511-958134e938a6", "comment": "Malware payload (Formbook)", "value": "4262eff5ecb4bf09150576b46bcf002f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810057, "uuid": "04d217af-1377-4bed-a017-401227bfe8a3", "comment": "Malware payload (Formbook)", "value": "8d4eceaa33aea3e283d479921a7b6e79a97258f0017b79fd5d05e079d446571c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810057, "uuid": "be44bc73-8686-4394-ad14-96816196c804", "comment": "Malware payload (Formbook)", "value": "387efcbbbb0a20ea626e2142263f67855cca9851", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810057, "uuid": "36eb61a5-d2f4-47a8-9203-e79b9107d7b3", "comment": "Malware payload (Formbook)", "value": "7c4060b2f3fa0f73126bc7393a378b30c21929600616b518b84047ee945f54c6e2f3922df31faef2b8baf1d634eda8d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810057, "uuid": "e3efa21b-c45c-41dd-9f51-12d82055d615", "value": "T14745CF027381D062FFAB92734B5AF6115BBC79260123E62F13581DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810057, "uuid": "b97f2b8a-219b-4be4-8729-4dd32c337fc3", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810057, "uuid": "19e75399-2254-4f66-a46e-6037aa385f8d", "value": "24576:Z5EmXFtKaL4/oFe5T9yyXYfP1ijXdax/85bYGRuN8y0i7crEGPedoU:ZPVt/LZeJbInQRax0lNRu8y/wr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810057, "uuid": "f4a996aa-55ab-4e03-8db3-77c6169a7822", "value": 1266688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810057, "uuid": "b92873b9-4ffa-4ba0-8d44-0eff5742623d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810057, "uuid": "21e5f1ed-e977-4e42-8acc-a80274971934", "value": "8d4eceaa33aea3e283d479921a7b6e79a97258f0017b79fd5d05e079d446571c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81381858-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1772810212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810212, "uuid": "94c74c1f-9eb8-47ca-b459-0b51d150cee3", "comment": "Malware payload (LummaStealer)", "value": "569a206d498a0bbcd3abb1c546e60e32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810212, "uuid": "9a0965c2-8ef0-4d4f-b62b-fbbc7a5d5e4f", "comment": "Malware payload (LummaStealer)", "value": "8d54680fb23876f74748a75efc73c624864bf826e5656b3f3aefc5dc105fc8d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810212, "uuid": "31a9f34d-ebdb-45a7-aacf-aec2e8c98bfb", "comment": "Malware payload (LummaStealer)", "value": "a51f21b47def76e028d44b50646d662d69536036", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810212, "uuid": "26d2a499-e464-4cc2-b6fd-4769608f384f", "comment": "Malware payload (LummaStealer)", "value": "781a1bd0d084f057518f997c3c5fc6feb5550951044d89e1b889f7e15e8ae755f6290474d4d351f16d10e412f9623e14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810212, "uuid": "dc7ff829-3027-4783-8563-4aa5d44802f6", "value": "T194D5110156D94AA1F2AA42B689BE96371B797CD49FE4C28F32C8363F0C705854F7532B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810212, "uuid": "92c5177f-2ab3-4ad0-806d-3e6562bc4748", "value": "49152:w5qAsSm6H9BWT/U4ia3dvIxr7O0bnfdPxBsw8MKpZPY6om67pwwH+h:Ka6H9BWrn33dgx3nfRxBVWQ6s71H+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810212, "uuid": "78512327-949e-4c17-9550-e2ba2ae9bb2e", "value": 2889728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810212, "uuid": "41c0b616-dda3-425a-8758-bc86a00556f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810212, "uuid": "2cfeaa92-7627-4a7a-a93b-a69189f6fded", "value": "8d54680fb23876f74748a75efc73c624864bf826e5656b3f3aefc5dc105fc8d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee2882d7-1972-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811683, "uuid": "58c0379b-47f9-437e-b1bc-536be7ace602", "comment": "Malware payload", "value": "4c588534abee22f3480556119d1a4e6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811683, "uuid": "834ebbe9-fddd-48a1-8f2c-2cced8431b2a", "comment": "Malware payload", "value": "8d7a02a1ba95b2695ea3890a8012548d9e6813c9c433c1bcd023bf3f1e73ad9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811683, "uuid": "7f6cc062-9a45-46b7-91e7-2fa7144552a0", "comment": "Malware payload", "value": "b367dac9e1ce1f182761c5c8da44745f8f9c1968", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811683, "uuid": "9c535821-8a0c-4530-bc03-e375f4f23d7b", "comment": "Malware payload", "value": "ad8d21d3da46c0927c937b2005ff317678022f28c2688f802e83db7b4c0818ba645fff6c282a7365dcaadfce6ef5a5cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811683, "uuid": "47c4e2d8-15ce-4e7d-8636-5e1a8d123514", "value": "T15B94C412EA50B825F49349B02D79A256782D2D363681DD0BF78D9F4A3671B83B0F532F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811683, "uuid": "0aa385d1-b8ac-4313-aa57-d680654c7a54", "value": "50448f3cd38618db54f6ffa11eaf5f3b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811683, "uuid": "4a8de7cc-961d-4f3e-b7e1-f6fc7069fa91", "value": "12288:LRGOj+hppmv1VmPPQtcHK7QDtnTeCPERXb7GySMYvLOd3t569:AbPP+7Anx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811683, "uuid": "d7934e0a-4a60-4a2e-ac37-b640ab9a149c", "value": 430080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811683, "uuid": "6731f4b2-53e0-4243-8a94-db2ceb5362d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811683, "uuid": "e9f6ac4e-7032-49de-86de-b9200a3b3fba", "value": "8d7a02a1ba95b2695ea3890a8012548d9e6813c9c433c1bcd023bf3f1e73ad9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "038080c4-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772811290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811290, "uuid": "1518fad0-1ebe-4850-b57a-3abe3a315712", "comment": "Malware payload (Formbook)", "value": "47705bcebd467eba998a337efe320770", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811290, "uuid": "922ed8a4-0bb4-4bd1-b802-74a2b0c674ec", "comment": "Malware payload (Formbook)", "value": "8ddf24152eb78df606522c0a2080bffe9b09b2fffe21ab4ce9bc4cdbf467a992", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811290, "uuid": "6126655f-44e3-47b5-a7ac-970b716e61be", "comment": "Malware payload (Formbook)", "value": "55bd14b16dfdfaa1a855218b523d661dd64e57b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811290, "uuid": "781f33b9-f50e-40e0-aac0-5fe8b0fb29aa", "comment": "Malware payload (Formbook)", "value": "e8d1160d3a8fa9e9bffbe64487311366f4ac3b66718e8588ddf1ae7c66508d42052dc6f93d506f71124e36c4bb24d2d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811290, "uuid": "19f9c91e-4fb3-4cb3-bf14-bcd0f06bb289", "value": "T17045CF0273D1C062FFAB92334B5AF6115BBC79260123E61F13981D7ABA705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811290, "uuid": "39e0bb84-a0f4-4285-9797-c3977d144c61", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811290, "uuid": "47476924-ec14-4bad-bd57-2fe90f0bab49", "value": "24576:R5EmXFtKaL4/oFe5T9yyXYfP1ijXdaofutV2f8er1digh8:RPVt/LZeJbInQRaotPxY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811290, "uuid": "f1a8cab2-7a5c-4691-b5fa-1ed0c7bc2c73", "value": 1279488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811290, "uuid": "9e3a8164-2cd2-48f2-8ecc-9bd3a4a5eb35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811290, "uuid": "a1248d14-2547-4a47-a91d-9d3a9e0c0a14", "value": "8ddf24152eb78df606522c0a2080bffe9b09b2fffe21ab4ce9bc4cdbf467a992", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25186a6f-18f0-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1772755511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772755511, "uuid": "57325414-a942-480a-b924-7d72736bfc4d", "comment": "Malware payload (Stealc)", "value": "700a76feefc2738aab348a823a949753", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772755511, "uuid": "2970ec50-52eb-42e0-a409-8f1f2118d482", "comment": "Malware payload (Stealc)", "value": "8e11b66836fc4afa3bf1c102f072857ffb3ec2faa227e2f94c48bcef1f20cb19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772755511, "uuid": "b737f0c6-5d59-4bd6-9565-e84669f3dffd", "comment": "Malware payload (Stealc)", "value": "d49ca4cb2b5eab8c518aef8a171331f9d299259f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772755511, "uuid": "7444eea1-648e-4697-9805-1b91b68c6049", "comment": "Malware payload (Stealc)", "value": "656313e1953aeba06646672e6a509d5988a33ce6dde5f2df36eeee13d4934f9914c88b85e80840602e6b240e171d36ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772755511, "uuid": "c4002488-6e88-4730-a0f2-fa81fbc98485", "value": "T133547D1212E468B5E12207365E3FC7F53E5AF9614D357E5D298BBE7F09380E2C129B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772755511, "uuid": "9793b972-cb58-4f6e-af8a-c5c66a7dde9b", "value": "bcad5afb62b59a3de8dc0f219fbb01fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772755511, "uuid": "07fe0916-8bb4-4122-96a9-ae1fa9385ba9", "value": "6144:Qeh/H+Zhyu8Jfc080/OmUMo4gW2UhgSWtAg+:Vh/ahy80WmUMo4xlhgFtAg+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772755511, "uuid": "5c72485e-34aa-4299-8aca-de7df6afceac", "value": 298360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772755511, "uuid": "1b3baa2a-5473-43f2-9729-dc9d2e22bb94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772755511, "uuid": "238788ab-1ca9-431a-9d69-40d73e6c4180", "value": "x8e11b66836fc4afa3bf1c102f072857ffb3ec2faa227.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c00961a1-1969-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772807740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807740, "uuid": "9dba1c9d-6006-4761-9a66-9ff638c83153", "comment": "Malware payload", "value": "8800576725cc5cdd11d25dd3b600a3ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807740, "uuid": "537a22d3-c848-4e4a-b0fd-3c04784d45c4", "comment": "Malware payload", "value": "8e59795e6d8d2f4dc5f0b7911b5969f225c8886e374a35d1d9ff04d24f552fd4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807740, "uuid": "70fd4596-2d4c-41ac-8a02-2e4fa3f35b56", "comment": "Malware payload", "value": "3893e43662c503535eb6bb36d485646433c46b73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772807740, "uuid": "f1ba88ff-3022-4820-a76f-8a78cc8589c7", "comment": "Malware payload", "value": "073d19d3972a0796250872a6d8bd11b15338bdd2e9a8c45e649542a47dd5944db89d94111c753c0027f4aa6c7c2526ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807740, "uuid": "d4c228f6-5140-476a-93b0-c6e3f49bc22f", "value": "T10EF4230529A0C05FD77251B0ACF087FA2AEA7E5309928E4B739B7F5CB124790921F767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807740, "uuid": "85971269-5429-4c57-83e8-435a2179a2fd", "value": "24f4223e271413c25abad52fd456a9bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807740, "uuid": "55622581-702c-422c-b050-1137f92157d9", "value": "12288:RDHb0vUa4vG2TZHl0brdPEWuBhDoIB0ImkZZzY7PYgbLTQyXZ5nnMaU:RDHYvUa4v9+1EWuclImIzKY2LTPZ5nML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772807740, "uuid": "630517e6-9d8c-4721-9d27-bb960f606c38", "value": 738672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772807740, "uuid": "0615ee19-18a2-4af7-b47b-c7d135c875cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772807740, "uuid": "99133b73-76a1-4cc4-a2ef-e7d9e9af9fd5", "value": "8e59795e6d8d2f4dc5f0b7911b5969f225c8886e374a35d1d9ff04d24f552fd4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46bf1155-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1772811402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811402, "uuid": "ae02f62f-3059-4ada-8d3c-967bfbf6a751", "comment": "Malware payload (ScarfaceStealer)", "value": "7b3a1c044988d30719204f60c325617b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811402, "uuid": "6f540134-5537-41e5-ba23-5e45cd13a144", "comment": "Malware payload (ScarfaceStealer)", "value": "8eecc9f79b03b29a6853441a08fd6ac28b77a509aa2ffe3b10174328cd9e7068", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811402, "uuid": "1221e72b-2800-473b-874d-e8fd3e9be13e", "comment": "Malware payload (ScarfaceStealer)", "value": "60a1dbfa7be60508aafce69e6cedaea6fdc67e44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811402, "uuid": "bed08b12-4fba-4796-b15f-e07f5ad4b23f", "comment": "Malware payload (ScarfaceStealer)", "value": "94c6da37c63e36d06a180529a877f288a6ad89e564d3889acd6d96c665fffa75861dfcb967bf38bbf2a0f961b7513977", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811402, "uuid": "3a66d47f-9519-43d1-85f7-ad6d3fab6e22", "value": "T1EBF7594262EA04C4F9F7DA359AE65217D673BC166F3081CF325C172A1F736E08976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811402, "uuid": "dd3ee050-5127-4dd5-b1e1-d9cb10a036d2", "value": "772ec87d3452991a9933a3ba0d9963a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811402, "uuid": "42fc31aa-b579-4785-b17f-6a0818dd6283", "value": "393216:5n1XQgPR2k3m5C507G9ITEc5eAlkLbQurxMWhAsIyNOPS0B4AycWsCYaxFzwW/ts:51XR7AsxYqt2oRGj5rs3wb8/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811402, "uuid": "884e9cd6-515c-4061-bccc-5fd7e6b49b94", "value": 71438848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811402, "uuid": "c5646a98-a30b-4e32-ae78-052d2e2471a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811402, "uuid": "57086873-16e3-4e53-b277-bcd938c2097e", "value": "8eecc9f79b03b29a6853441a08fd6ac28b77a509aa2ffe3b10174328cd9e7068", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30d0a0ec-1974-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772812225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812225, "uuid": "969a8335-441b-4e0b-9d16-c31c69ce6898", "comment": "Malware payload (Mirai)", "value": "6a107fdd75fcb5e4365483faae006c47", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812225, "uuid": "1976674d-6eba-4153-9508-2d54a03f1aa6", "comment": "Malware payload (Mirai)", "value": "8ef30ae2c8ab8c2f8d1e3a91f15cfed373d499e15902f1e2634cb3aba1d363fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812225, "uuid": "6c61d4ef-20c9-4dbf-8c06-98b298c24bae", "comment": "Malware payload (Mirai)", "value": "9f00f2d57cfb40f9e371a87aefca5cf64de1e198", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812225, "uuid": "5ecf2cbe-cf31-4afc-a8e4-b899781ea410", "comment": "Malware payload (Mirai)", "value": "2f16fc57d60dd2ad1ee54c9964e9dd47ca37737548b606634be593d26f2e551057673362bfc14b4c7e62d3f8ca8bbde6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812225, "uuid": "b5a5676e-2229-4b37-b332-59b8467ee387", "value": "T16014841E6A128F7DF6A8873047B74E20AB6D23D617E1D684E1ACC5105F6039E641FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812225, "uuid": "01592f7e-3468-457e-89bd-dd012f7aada5", "value": "1536:lAgcoS1qrywSAbwPqf+yDbPa61bNYKrnEaMzzMQ+RmdqHU+D7DsYOoHPancK43Nl:vcoSZiw+P62dUosqPL3NVeqNJx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772812225, "uuid": "7733d887-0681-4ca3-877a-692eaebe57c9", "value": 194276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772812225, "uuid": "38ceca1f-3735-4f90-98f2-e4e0ea69f934", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812225, "uuid": "225e31e3-7220-4e1a-9577-bca66b763fdb", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "911885bd-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1772810668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810668, "uuid": "8e53bec6-eb88-4fe7-991d-5fbb36bc19c9", "comment": "Malware payload (SnakeKeylogger)", "value": "8eca7856f7d2381898fcbf8bf0098994", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810668, "uuid": "3d37fd90-cccc-4ad3-b837-cd32fa353eac", "comment": "Malware payload (SnakeKeylogger)", "value": "907ef6a8894cb48e4c809ac5616237b59593bbdd104e7fec32e4599c0db45505", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810668, "uuid": "3227431a-1dc7-463c-94d4-3c6bc573f6a3", "comment": "Malware payload (SnakeKeylogger)", "value": "d0a46b9d4b89091a7bf3fce004e6121caf3c68aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810668, "uuid": "1e2b9f00-597b-4d65-ab57-f639211e59dc", "comment": "Malware payload (SnakeKeylogger)", "value": "7d71dac2ca7bf859143c2859f4485eb82acf696dacc0a24c4ad5949ef7a8b5b55d6314d3363bc89b8cc794d8f0d4eb67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810668, "uuid": "ae88848d-60a2-4cfb-8203-5c7c37ffef71", "value": "T17AD4239249C0AE54C5546370C432CC6086783A709E25767AC32EE6AF7C713C7AEA7B5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810668, "uuid": "5e4036b8-906d-4123-b473-4227226ee100", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810668, "uuid": "14e1596c-f80f-4d68-8ceb-d673af7c8ae9", "value": "12288:Vz7hU5I5yuNHIgzSFKxWltRohBfSTso93Uz0LK1d51FYllLUg:Vf+iN57Gtene3xlKg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810668, "uuid": "22d89036-0d24-4504-995d-e3a4b33c641f", "value": 611840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810668, "uuid": "3d0b488b-85d8-424a-bb40-bab28128bc2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810668, "uuid": "35f8e2c0-5c86-4699-bd35-a03723e0d6a8", "value": "907ef6a8894cb48e4c809ac5616237b59593bbdd104e7fec32e4599c0db45505", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9716cfb-196a-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772808186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808186, "uuid": "d071441a-5bdc-44ef-abd2-9dc96634908a", "comment": "Malware payload (Formbook)", "value": "4aa57aa8fa0325887f9a5eb4f133d949", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808186, "uuid": "2117c973-6733-43ac-84f6-6f12cc51a51e", "comment": "Malware payload (Formbook)", "value": "908de3fb0e63cedadeccd5db42063e2b84ce91dbaa3935e17b37affd8018fd5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808186, "uuid": "b6fded29-5d2e-49c6-a52f-7f3140be5f15", "comment": "Malware payload (Formbook)", "value": "220efb9d6c2ff2f5b7e646d2cba46b0060735a94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808186, "uuid": "b047c4bc-8334-4fc6-b1b4-99b7fb444b74", "comment": "Malware payload (Formbook)", "value": "ec0221727c23d6f9444abcace7348013e5aaaf60d8fcea7b618093e2e2181f7312be80fd7aaadd0956c453fae242e928", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808186, "uuid": "f15cf722-8593-49a6-a564-0e2c1c661f92", "value": "T16C35122062AFCE22C2A51BB784E2E63053B18F49E053D247AEDD6DE77947BCB4941347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808186, "uuid": "31bb547e-3a79-4368-86bf-583b9d09e22b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808186, "uuid": "fb1f87d5-52b3-40da-ba28-d5e3ad6e52a3", "value": "24576:FplguQT9YOp5ob5ZwKwY7yFbzaH0+j6/4IwPHa1X17hVict:F4uO9p+NZwK/7y9mHRmQBm1NQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808186, "uuid": "492c0e1f-2b82-4ee7-9546-d05d952eb815", "value": 1091072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808186, "uuid": "aa264b92-0110-4fd7-a7af-e9c0acdc0394", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808186, "uuid": "2debab21-b6c1-47dd-b17c-14d1d0a3849a", "value": "908de3fb0e63cedadeccd5db42063e2b84ce91dbaa3935e17b37affd8018fd5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8982ecc-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1772811620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811620, "uuid": "6ce31511-bbce-4bc0-a510-de93b9534bff", "comment": "Malware payload (a310Logger)", "value": "7079cd9f21e84b423b8ca0a204d13f9e", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811620, "uuid": "1cb54ec7-ef52-4889-8c85-b7422a8cf010", "comment": "Malware payload (a310Logger)", "value": "90a3ef988d6a911ad74db85cc4a68bf8365bd1f6272bd758210728d1b4eda493", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811620, "uuid": "dab555ed-f164-4439-9f60-214625d1569d", "comment": "Malware payload (a310Logger)", "value": "46e19d4991f4c2cf41875e027adb059fa46fd371", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811620, "uuid": "a517dc8a-ae1c-4fc5-beff-3c202345a66b", "comment": "Malware payload (a310Logger)", "value": "61db73f5933f43c6774a83c00eb661a885c4126d2506bd067e3b21e3720e3cd5cca8d602a4d3dd67027197c523b64399", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811620, "uuid": "1601a47b-dde8-4381-8204-acc392b5ab34", "value": "T1BA35D0061EC32B94D1984F7CD2A610A823F0D65B5252E77F2FDD12F0DEA7F4ADA06462", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811620, "uuid": "63d845e7-3384-4905-b6ee-d0964e86ec4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811620, "uuid": "9a7a5b7c-6775-41d9-b02e-5078b7dca442", "value": "12288:DJjV+VJLiokGOuXJxNB3+MLi6qvL5vknNUKMCM990+lLUfOOuhhKtkCP21KObApf:D7oNOYwMWVkMXs+lIf0hQtde1KObEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811620, "uuid": "c71c6cde-0d32-4d00-ad4b-0b942fd25110", "value": 1155584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811620, "uuid": "717460b9-ffcf-4d34-a474-266427b8db2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811620, "uuid": "384b2795-2c04-4490-b9b0-96bd99261891", "value": "90a3ef988d6a911ad74db85cc4a68bf8365bd1f6272bd758210728d1b4eda493", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fe01903-1974-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772812196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812196, "uuid": "406822ac-16d6-4024-a1fa-e29c64ab0f33", "comment": "Malware payload (Mirai)", "value": "44c4dc4c89ce5f267e1b6f10493653b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812196, "uuid": "c1409983-b15b-4c44-b5de-0b3f3de0fd72", "comment": "Malware payload (Mirai)", "value": "90f05f640c1188739e8a0e8ba0d99b8ca8170cad625d860c794853c7f8ba278f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812196, "uuid": "6ef3b769-7a62-440a-ae2c-d401a77455ba", "comment": "Malware payload (Mirai)", "value": "9039116d15819ef4dba9f16054b85b1b11c8a8ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812196, "uuid": "521a5856-ce70-4673-bbf7-a27b271ebf1c", "comment": "Malware payload (Mirai)", "value": "f0c83aec3e655ba8ada6cbddcfa1c8802d8669830838ca7437fbd89460d94d5b5c9ec8bc6fe024d9083126274df6f15c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812196, "uuid": "01e9a42d-f647-4bc2-b47f-51ca677fda09", "value": "T150933B5AF880DB16C6E5267AFB9E118C332207A8C1CE7106DD149F3577EBD5A0B7B602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812196, "uuid": "198e40ef-9611-454f-9e58-c0c472295a87", "value": "1536:U4J3XaYGxA5tUZFcWVE4blFlycjJMDcOvnaWceSdq4RgO03KiZDXVbmN+Hq7Yw8m:UQXxMpE4pFlycjJMDDaWZzM03KiN9mIm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772812196, "uuid": "f9909f59-eed8-453b-b014-efa9e445d414", "value": 91436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772812196, "uuid": "136a7c7c-1794-49f8-96d3-e2a28c2abb0a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812196, "uuid": "127aa72a-2560-4cc1-a19a-a214f6c27323", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd395c04-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772809883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809883, "uuid": "938ed66e-5939-490d-8208-789638aa1cd3", "comment": "Malware payload (Formbook)", "value": "a28bba168bbe49059bac3f1c4d823005", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809883, "uuid": "b3cdb924-2c9b-48bb-b3ef-68348bc45214", "comment": "Malware payload (Formbook)", "value": "90f194a38a34ee6212b02d0ac457911d2e9ca72c7940f36d434e259874e2bb2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809883, "uuid": "5e80ea4d-ac0a-4e23-83cc-7a6ca0ccf4b7", "comment": "Malware payload (Formbook)", "value": "16bd75b9e93e4f5f165e18f7b2f59d43d0197990", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809883, "uuid": "f213a282-4187-431e-9dd2-d9a561507357", "comment": "Malware payload (Formbook)", "value": "c6d00dfbbd0680d18c8614dde7e38b82d2a4f398f738505ff32701c7353c690d2c6d4816689327e0016f493129ae597f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809883, "uuid": "b79b30d1-868e-4731-98da-b6e016f20979", "value": "T19B45BF0273D1D062FFAB92334B5AF6115BBC79260123A62F13981D7ABD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809883, "uuid": "2d5aed22-d22b-4ce4-87c6-ec5e3de8dba8", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809883, "uuid": "08793f66-b3b2-4935-adf7-d16aa281e409", "value": "24576:y5EmXFtKaL4/oFe5T9yyXYfP1ijXdasmd2rTbHA0zylzl:yPVt/LZeJbInQRasu4TbgH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809883, "uuid": "a0e5e389-edfa-4390-9ea2-ca19ac5839ee", "value": 1261056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809883, "uuid": "9dbc1235-a96e-4af1-89ed-f61463806619", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809883, "uuid": "673ebd71-710e-42bf-8278-f1f2f0184a99", "value": "90f194a38a34ee6212b02d0ac457911d2e9ca72c7940f36d434e259874e2bb2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc6f43e-1905-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772764678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764678, "uuid": "0411cde7-5c66-4f30-b86d-6519dbbf6776", "comment": "Malware payload (Mirai)", "value": "8718f0e2483c058db8330e588e9a1605", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764678, "uuid": "20c000f6-f6d2-4cf6-9ed0-6031ae4c867d", "comment": "Malware payload (Mirai)", "value": "91621d0c2c33c6108dc9c6b49cd081a5bf3f6c50f3f75dbb6be80c7332f2accf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764678, "uuid": "e7d41603-5799-4e78-a699-4b487e43a21b", "comment": "Malware payload (Mirai)", "value": "b7f2927bf7966b255b7f9eb4071b2f15b20fc31c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772764678, "uuid": "d12ce3b7-2ccc-4411-9a94-82e53dc12715", "comment": "Malware payload (Mirai)", "value": "822661409e22847ff33fe165f840ca452fed6d32a7ef69a46e70fd138c2db2f94c150e825bf4dd0c71a554f45b4d0607", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772764678, "uuid": "2482aed9-4f0d-452d-a818-7d4dc579e07b", "value": "T1D2C39E32D8396DC4C1945434F8B1EE711FA2A5C441A25EBB1AE5C97900C7DA8FA0EFF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772764678, "uuid": "82c0eb23-8e52-4e93-9dc5-974853189516", "value": "1536:iaZwsA5XjVZJK0twtfXd/GW25UhMMJNu5xWKQk0kaXN7Y+UKigHcYSQwKprlzwwD:if5Z5Z98XdmVMJa5aX7biySQHrMwES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772764678, "uuid": "e2c469a8-8623-4acf-a9fe-2b61699583d0", "value": 120332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772764678, "uuid": "5bc73028-4563-4909-af5f-de87aa9a0d99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772764678, "uuid": "31a2d23c-14ca-48b1-9c70-08b24a45a882", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c7a2ebf-1974-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772812190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812190, "uuid": "e5139461-9e7e-48c6-8088-16bb990acdfb", "comment": "Malware payload (Mirai)", "value": "0ccb9913a51bfe9ed7a22719dbb7a99f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812190, "uuid": "87092117-6640-46d6-981f-8f62aaaada79", "comment": "Malware payload (Mirai)", "value": "91aace515ca82254eecca8056a4c4c57b7f72c0d0ba7df4d7c6adcbdb994bdb3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812190, "uuid": "a07a441b-5b7c-4050-9e83-886ad49a7703", "comment": "Malware payload (Mirai)", "value": "6195762fab2e7c8f999c54a8f2a3ff6fd00386c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812190, "uuid": "1c0a88b6-f5a9-465c-ab62-7a4ae8f5632b", "comment": "Malware payload (Mirai)", "value": "814b0e16f9ab9bdd40166440f1d26e2c1e78a7ee67560b68b78f1e1d7205c8987324388bd97a1c5cfeaa7eb7ff72c66c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812190, "uuid": "4d403015-5523-437d-a702-40118bc79f7b", "value": "T113F3186277B60A27C1E4A57AB1F75333B2B947C914ACC60B3FA11D8D6FA46503113BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812190, "uuid": "fd7b2769-1fb7-4ae2-be5a-cc366c57a792", "value": "1536:jwoKXQtmrw8ZYYRD6NZ/NbQsgHjuVVQWeT6p2Q7cRwfw+HSRsytaJte3+Iq2hfn0:jFwPB6NZhhcWLgSfhyN3+bRz5YZ7i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772812190, "uuid": "a6bb5a5a-9970-410b-a4a7-602b7c4ae7d4", "value": 158892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772812190, "uuid": "1c22938a-0d93-448e-ac9d-ae3a6df4b283", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772812190, "uuid": "6278e479-1df1-4c23-babd-b4676f520bae", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c3a80a9-1966-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772806311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806311, "uuid": "3ca1dfb7-394c-4856-92d4-ec1b4ef8f4e5", "comment": "Malware payload", "value": "8bc0d482df214d7c0a791fae220bf3da", "object_relation": "md5", "Tag": [ { "name": "172-94-9-250", "colour": "#CFC547", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806311, "uuid": "8afbb141-525f-4f2d-9abf-e3c73a48b5e9", "comment": "Malware payload", "value": "91bd5c7ce5da1747e2983a8addb4ffe8c015cc1d80f904a76c861e487e3c64fc", "object_relation": "sha256", "Tag": [ { "name": "172-94-9-250", "colour": "#CFC547", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806311, "uuid": "0448bb47-da42-42db-83eb-c3846cdbb73b", "comment": "Malware payload", "value": "b927110b5a1d67d59f1604f385890e663d0a2c6b", "object_relation": "sha1", "Tag": [ { "name": "172-94-9-250", "colour": "#CFC547", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772806311, "uuid": "23a766b4-aabe-4cb3-8c07-8bac918fce73", "comment": "Malware payload", "value": "f2eb8799821eb216b0060b6c76651aeed8e845a7a5800ad278d354fd40b1e0d585009233ed14be3cb838d13114988605", "object_relation": "sha3-384", "Tag": [ { "name": "172-94-9-250", "colour": "#CFC547", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806311, "uuid": "3d90d42e-0331-48d3-953c-f94b13ebfda3", "value": "T1BAF19E11954C9318FB6BAF389112F7E752882921261A0A31F90C09EA2968FC4CF9778E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806311, "uuid": "c8135624-9b5f-4e02-b69f-dc52741ef634", "value": "192:RM3cnvZJBPv1WcP2UkrwbpyhLK1+KuSpU9W5:R8ij9v4Typy2CA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772806311, "uuid": "abaaa7a8-81ea-4cf0-8f55-5977bc6e8da6", "value": 7626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772806311, "uuid": "0ce0a787-fb28-4822-843e-bf1e952b67e6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772806311, "uuid": "5c878345-3b72-4b7f-8191-f2802c7fb42c", "value": "xxx89413.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73d701e1-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819209, "uuid": "9ea1b41e-df65-4185-bebb-88c1dee0c54c", "comment": "Malware payload (Mirai)", "value": "5afcef057fe3b5fb199ffbed2ea25bef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819209, "uuid": "aaf44f43-162b-49f0-8913-c0648299a0ee", "comment": "Malware payload (Mirai)", "value": "91d59508c12a508cefe48a058ae04dc666f9444ca2369f5c5e6d5bc0ac22c514", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819209, "uuid": "e24e23cd-266c-4ebe-baeb-0103e570af4d", "comment": "Malware payload (Mirai)", "value": "60313c07713570c2111035cd7e362984e53d42c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819209, "uuid": "afa83747-2cf9-43de-875e-e2ee2c5df865", "comment": "Malware payload (Mirai)", "value": "1216e3da141699bfce454339a99251bd78c5fe90690c1085ed3f16ce4e43a04fc0f00d3e5070ef3d185ba75392793e75", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819209, "uuid": "abb2283e-3dbd-40c8-a5a9-2dec0f56496d", "value": "T161737DC7E743EEF6ED720031802BE7365272DA791024D68BD7B499369C26904F61B7AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819209, "uuid": "6bd9b81a-ee2e-4d80-afc2-763c989d4f1f", "value": "1536:AtvDnFJFKUKluQuGoS4a7yUSHWaJbunandHQILVHLgcUWeduy:kvDnBOluQkSly/jbgqikPNy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819209, "uuid": "9c1d2133-80df-42f3-b006-2978f9b719b8", "value": 78952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819209, "uuid": "f9b43561-c391-4824-ba26-44f8c19ddc7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819209, "uuid": "4faf0e54-68dc-46d3-bfc4-9b756bc1aecc", "value": "violetx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4464b27b-1985-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1772819559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819559, "uuid": "db932800-1cf8-411e-803a-8ca5f51dfc1e", "comment": "Malware payload (Stealc)", "value": "25ad1f920a80c66ee9678c55a9b1352c", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "80-97-160-190", "colour": "#FFCA15", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-4784", "colour": "#283905", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819559, "uuid": "bbe80029-8119-4f50-8f9e-0c5c2f0669a9", "comment": "Malware payload (Stealc)", "value": "91f9fda387f046c07b068c5bd16445f8d524ce6f4fc066e4d4899776eec2b510", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "80-97-160-190", "colour": "#FFCA15", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-4784", "colour": "#283905", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819559, "uuid": "7dc7eff3-3c1c-43e8-8726-ef8f1779085c", "comment": "Malware payload (Stealc)", "value": "f04bd65ed7cea4b0ae3f8d6057c8c1bd7c71e111", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "80-97-160-190", "colour": "#FFCA15", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-4784", "colour": "#283905", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819559, "uuid": "e0a16855-eb78-4a32-a29f-2223ac8509b3", "comment": "Malware payload (Stealc)", "value": "092ce7b388bab58a608537f04bac9c2becbb6d39faf30171bcbbc43058da4197947a6e856103bbde5888bf8872773756", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "80-97-160-190", "colour": "#FFCA15", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-4784", "colour": "#283905", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819559, "uuid": "d2176613-438a-4aca-ba44-e9252d3bfd9b", "value": "T1960633FE90876A457D458C2A5B3F6FAAE4332135EDED1B9736080B988250F26C87CF15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819559, "uuid": "753f5ae2-0814-4996-8b6a-494f69f13b67", "value": "98304:hZVRGHFN+XoH4VhpctOcKzBehHYaZRW4lOkR:fU8Xlzv1cHlW4sY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819559, "uuid": "4f72ce4f-d47e-46a4-9c2d-9d45b8eebaac", "value": 3732995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819559, "uuid": "1ae3aabe-38c9-4b76-8e6a-b79d2060b6bd", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819559, "uuid": "f313e597-912f-4e0d-a1b1-9906f9e9c59d", "value": "downloadsetup.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0281351b-1970-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1772810429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810429, "uuid": "26ffc753-1a72-4827-bc74-00e2a56400f2", "comment": "Malware payload (Amadey)", "value": "e6da679301430c87a3d3187fa9f5b578", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810429, "uuid": "6e75ccec-3598-4d08-8887-964971dec4f7", "comment": "Malware payload (Amadey)", "value": "91fe640881d22c7dd821cdc76aa92e21766bdf05fb227bd55177acf9c5b87114", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810429, "uuid": "aa5e26ee-991b-4e94-9ed9-563f09ff835c", "comment": "Malware payload (Amadey)", "value": "87f9ced79cb77f0d265ffe59ee293142ab91dd16", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810429, "uuid": "77813bf2-7aad-4c4e-bd06-2123a5c2135d", "comment": "Malware payload (Amadey)", "value": "b1c154382c971dd5e6b3229eaf233ff080eba2e0a9c86f88c2373158a25e69012f197abc19837e4306b7c47900abfac3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810429, "uuid": "739643d7-481b-4b9d-ae49-ccb48a35a3ca", "value": "T109945B217916C032D66292711F79FFF185ADB8259F7109DB7BC00F769A202E26A31F39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810429, "uuid": "3c7787a5-b8f5-4351-97ad-9a7bba2cf4d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810429, "uuid": "f5100ed9-348c-4997-9c4b-a895030e103f", "value": "12288:oJHF0VKkWrb4QDwR4QWdyzsAlWZBR8qM:C346JuWHen", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810429, "uuid": "fdbf4b04-bf94-4fd8-9f81-e06abc6989f2", "value": 443392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810429, "uuid": "d120ed00-0d63-438b-82dc-f5cccb444cc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810429, "uuid": "2d787ac5-520c-40fd-b1ef-53c56b1448fc", "value": "91fe640881d22c7dd821cdc76aa92e21766bdf05fb227bd55177acf9c5b87114", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc1f2963-1954-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772798714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798714, "uuid": "70ea9d96-afdd-47eb-ab9d-76a4d618257e", "comment": "Malware payload (Vidar)", "value": "d1e897e45e42f293036f8ca251dfbd6b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798714, "uuid": "726decb3-b293-4be0-8786-d8ef2cc8b585", "comment": "Malware payload (Vidar)", "value": "928b819cbc327ba9d52090b4961d6194e5d3683152ea9ce947d734c5497bec52", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798714, "uuid": "b13f8c38-3606-463e-9b41-a61e7f82ece5", "comment": "Malware payload (Vidar)", "value": "97384e4a6d0759df5e9d85e0d864da1147924d45", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772798714, "uuid": "51fde887-dbb3-4538-ae02-e8a1b8641341", "comment": "Malware payload (Vidar)", "value": "3bf0ba4707cbdb5e4082a314170efe8fb6c21cc6e9fbfe95b1aac1ac8060146c19b937fca05731a811a19b429bf62b0f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798714, "uuid": "1f1871c2-e5de-4de2-8757-aa8cccca77f4", "value": "T162242271BF0AA46DF5F0503905718282F617EC8F1FC0E61C2E552BB56B2E1950AE3A6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798714, "uuid": "c7ed322a-16f9-4629-92c9-6cef872a913e", "value": "ee53c10aff1d01eafea53328179e33a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798714, "uuid": "584e0ce3-b145-4ac8-8277-17b092af7aac", "value": "3072:o48mCtjMdioR5v95lv3gsuu9i04n0PfrheKBrdMp7baIbkK0B+KPjL8gzQ1GPh:dCxEigPlY/nOthdMUIoK0Bk0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772798714, "uuid": "f1fa7c8b-7740-4ad6-aa34-4845cc3b72b4", "value": 219648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772798714, "uuid": "b3031d48-e1ad-4967-9d7e-ecb834971635", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772798714, "uuid": "1175c171-1463-44a2-ad07-6f37e80dce8b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7a8a906-194b-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772794949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794949, "uuid": "4480983f-65d6-46a4-b15f-a7e6a1225744", "comment": "Malware payload (NetSupport)", "value": "ba3e1aac95e5ced304071f2cc7e3b1f0", "object_relation": "md5", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "sonosuiteqr-net", "colour": "#5B0FC8", "exportable": true, "hide_tag": false }, { "name": "sonosuiteqt-com", "colour": "#50A2F3", "exportable": true, "hide_tag": false }, { "name": "tronantivirus-dev", "colour": "#ED7EA8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794949, "uuid": "cda3f9d1-b964-44a4-8cb1-138509a42688", "comment": "Malware payload (NetSupport)", "value": "931c3852833c88681d76de5013422fa20e192ff3d4e9561c893ff66aae276657", "object_relation": "sha256", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "sonosuiteqr-net", "colour": "#5B0FC8", "exportable": true, "hide_tag": false }, { "name": "sonosuiteqt-com", "colour": "#50A2F3", "exportable": true, "hide_tag": false }, { "name": "tronantivirus-dev", "colour": "#ED7EA8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794949, "uuid": "2a5c67d2-1cf7-4a78-bc77-6b991099c58a", "comment": "Malware payload (NetSupport)", "value": "fd0bd3f97042571f359e25ba1bdb73b3305244f0", "object_relation": "sha1", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "sonosuiteqr-net", "colour": "#5B0FC8", "exportable": true, "hide_tag": false }, { "name": "sonosuiteqt-com", "colour": "#50A2F3", "exportable": true, "hide_tag": false }, { "name": "tronantivirus-dev", "colour": "#ED7EA8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772794949, "uuid": "f742b98f-1acf-4bc8-be6c-56f35c33aee2", "comment": "Malware payload (NetSupport)", "value": "8bdcdb8d99f2722ef0e6b9f51183bdcf6f40f050f101710684cd668586482018ac9dc830ab5942ad2f03bd7556014697", "object_relation": "sha3-384", "Tag": [ { "name": "activatenoda-dev", "colour": "#12115F", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "sonosuiteqr-net", "colour": "#5B0FC8", "exportable": true, "hide_tag": false }, { "name": "sonosuiteqt-com", "colour": "#50A2F3", "exportable": true, "hide_tag": false }, { "name": "tronantivirus-dev", "colour": "#ED7EA8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772794949, "uuid": "341cca74-86dc-4cee-a21f-88ba064648d1", "value": "T1D6A5339A990D89DFC94B4F74C10B5E1AD33E3941F29E7081F6728252CC89B9F4BB8719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772794949, "uuid": "60ad262a-a723-4426-bbf7-754c12a4c635", "value": "49152:hbWKcquaFYrp7ZnuVnJTmm3F+WVcBdj3b2+3bw/0JBAThAnk1N96:hmquYSlu/VYj3b2+30/wBWV6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772794949, "uuid": "006e4baa-e93a-4567-bd06-9e8c9d2508c3", "value": 2214668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772794949, "uuid": "4cd391f6-57cb-4395-8dfb-d429b0c030bd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772794949, "uuid": "87f4d2e4-685c-484d-af62-1e046599ec56", "value": "ax.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5ab5adb-194d-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1772795778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795778, "uuid": "be3d095c-605c-4b2c-a88e-d9bce6e9af1f", "comment": "Malware payload (Efimer)", "value": "bcfecacdf8786ca32a905b0bc2c5c58a", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795778, "uuid": "5343274e-d987-4e51-bb7f-3620e8073686", "comment": "Malware payload (Efimer)", "value": "9388aca1d972b16549ebfe248087b870b00583f0d93f7483f1b53b3bb4e984bd", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795778, "uuid": "b8fb1de7-78a8-47cb-aeb2-4b3450c84481", "comment": "Malware payload (Efimer)", "value": "1db907a10c7130ac183f25e22482946de439c0e4", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772795778, "uuid": "76179028-374c-4d3d-aae8-f08f997de6b3", "comment": "Malware payload (Efimer)", "value": "a88f28a298f8c6ff2e821604bcc04db5d5c2d61413f934a7e21637796af4831d2242c1a7f992d94890a14d561ae4fb63", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795778, "uuid": "3106ed60-9cd2-4bb8-9c94-518f6f4f74e6", "value": "T169D6331C95D762ACCAA2C13476E16BB4F4F5B4B81739CD5B5B6CD7B2BC030A0A69C10B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795778, "uuid": "214ce689-6e34-41e1-b246-e1ce5323bd8d", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795778, "uuid": "bb2ea230-0b86-4201-8924-49878511fa66", "value": "393216:l+jvPIN1mwZEADkaAqtGXMCHWUjXZcuI3/PGTAI:l+jnIn1S8AqwXMb8XuH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772795778, "uuid": "bb621a84-c27c-4516-8d55-b7a01ac9ce72", "value": 12622563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772795778, "uuid": "4131ab75-eadb-4345-a184-1f4c557f8415", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772795778, "uuid": "0aef4c78-520c-427d-ac3c-86fe554e6ab6", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74127fa9-1971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772811049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811049, "uuid": "0ddab849-1d16-4260-9b88-0e080e4ea81d", "comment": "Malware payload", "value": "43094a7080475c6b027c3e4d787974c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811049, "uuid": "18d1b0cd-7d87-4a3b-ad6a-637f9c6313c8", "comment": "Malware payload", "value": "938a65fe31c9f0bd915fb266214492880f7ecbff2e541a2248660eb6d9a4bb9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811049, "uuid": "1b7f33fd-02d4-4c1c-8413-3085ea5fcde0", "comment": "Malware payload", "value": "facd3a12c9fd43b915a799df151d3a782c443b9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811049, "uuid": "a853dc13-3b2f-4ee1-8c7a-b2b87e9d1058", "comment": "Malware payload", "value": "2e7b3f96652963025e3c50c15ed3598dfbf1991f854c0d6ef29076634edd147314d4694d485336808c434aaa61d9e553", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811049, "uuid": "e2dcfdf2-6055-42f1-a778-b9c2757d049e", "value": "T167C4224255B4E513CA934EB263F75DEB7FB589022C3C5B066B01DF08BE23395A94E398", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811049, "uuid": "e90bce9f-18b0-439f-bb1f-2ab6e8c4904c", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811049, "uuid": "5d8de11e-2d5c-48a3-99c6-354d6f09c72e", "value": "12288:+1yDJXlu7DWcOHHGPoxMAM/SCM4pB1viw96Yvh7:+1yDJ4rPaMvMqB1B9R9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811049, "uuid": "fca979f1-3578-4d8b-823d-900c4cd1e19b", "value": 546968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811049, "uuid": "2ff478bc-75dc-4345-bdb3-2ae3b9a080bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811049, "uuid": "96ec5483-d1f6-43f3-9381-69a50cf618d9", "value": "938a65fe31c9f0bd915fb266214492880f7ecbff2e541a2248660eb6d9a4bb9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1fd8252-192d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772782028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782028, "uuid": "50c3b031-4aa3-4a89-b486-7bb8156c1057", "comment": "Malware payload", "value": "1539967d51c37e0b7664111df5cbf83b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782028, "uuid": "c8a504f0-7e79-4233-a2f5-e084c3263aa6", "comment": "Malware payload", "value": "93bfa9e434b5164320e1a71dce684ab6cb0d680622561e7cb5bc03238f29a03b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782028, "uuid": "94625236-587a-42ab-a29e-13ecee564644", "comment": "Malware payload", "value": "b3476774ccaa12ae34e54aa293584db234c75201", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772782028, "uuid": "9eaf1da6-bfaa-4754-bde6-c3b08e6b3113", "comment": "Malware payload", "value": "8fdc2b8755a3466794a5ae3a856dab6a129752b93c5de138be5d8046aa9fe9a1f99d2a0e749f4af3ccdbca47a721ece3", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782028, "uuid": "8e610212-a8c4-437c-8a75-2fc1531c9afa", "value": "T15D161299ED93CF86FEB3C379A2250F82D90E92512D41AD77A7214A37DDC30C9B71A124", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782028, "uuid": "b9752667-30cf-4dd2-9736-980e7b81025c", "value": "98304:qMfCCvypJBfddcU27GS1y315kqCS3I9Ov9UOoyUOfRCUipfipzjZHO:qMXEddc/lc315kq73vUA5gpKpPZu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772782028, "uuid": "c43c1834-060a-45d2-8530-1652de98e360", "value": 4050337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772782028, "uuid": "ad1b5f81-f107-47f7-b70d-4358ed77d438", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772782028, "uuid": "9f1d82a0-5cd1-49fb-a84e-0bb386df660f", "value": "LAKE MICHIGAN CU.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3008141d-196b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772808358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808358, "uuid": "8b86ee61-e5df-4755-add5-35e71d1ce3fc", "comment": "Malware payload", "value": "030d09022b42acb17979a2ddd9cb44b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808358, "uuid": "9fe9a7aa-6823-45e4-abc5-7d7c488ad24a", "comment": "Malware payload", "value": "94075c4cad842827eeb001b8ea7812c6734a7fa7cf093e0cb197aeb3b43073e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808358, "uuid": "908c5ed9-d2c2-4117-8bc4-762a8693da74", "comment": "Malware payload", "value": "5b3136a8aa8ff9cf86ca802a03293399526501e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808358, "uuid": "4b4fc7c2-4b79-4c1a-81d0-d1396626b7d9", "comment": "Malware payload", "value": "0fd780439b0d0da02861a25c9b45fcac064b49bd3ea97dde726920dc48e50062139859ef2b3f57def86cb3561210cf43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808358, "uuid": "65d7b3b4-72b4-4fda-916b-404cfeaa39b9", "value": "T154E5E64329DB0DE9DED267BC61CB5335A738FD71CA291F2BAA08D1212D536C4AD1EB40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808358, "uuid": "9d4145ab-fe30-454e-b163-7aff42ca3df2", "value": "e7bd7d531026c8b0f161dc4d7a60343b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808358, "uuid": "a0034b8b-73b2-4421-9ef9-11a5f28f6d82", "value": "49152:I6H2h0X1JsaR3HsMY/nh/Qxd87Ycn6WFbWu:I6wMsRhoY7Ycn6WFbWu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808358, "uuid": "0abd842a-02e6-4cd3-ba72-240885ea55c3", "value": 3227451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808358, "uuid": "d18587b3-785f-42fa-9814-f3193c9d7abf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808358, "uuid": "c9a3c5c0-f4fd-4e11-bc7e-59b46b29f599", "value": "drive-printer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c75affe3-194f-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772796586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796586, "uuid": "72456cac-5fc2-47bd-8117-2d67fee1e427", "comment": "Malware payload (Smoke Loader)", "value": "342c9652dffce8de46aa6f96a59a7c47", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796586, "uuid": "9da57e34-9c02-4216-a4b5-56fca1644634", "comment": "Malware payload (Smoke Loader)", "value": "941901880c61d3aba1060a23c5732970d7e3ad55a3bf42ad92f32e88763e7ccd", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796586, "uuid": "9baa84d1-1df0-48a3-b7db-3a787e9e6ada", "comment": "Malware payload (Smoke Loader)", "value": "cd7347fe21d69094fcf3d4d1b0f8d1bbe4f5ea14", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796586, "uuid": "f79fcfbf-c863-4816-b048-ce4ddb925da1", "comment": "Malware payload (Smoke Loader)", "value": "2aed1120c6d40f67e95a3ff5b298ed3803aa6fe6a377f9a0cbaf29c2dd64bebe61245a23e745d12639b4cbc24259dee9", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796586, "uuid": "64ac3c6e-ccb1-4a9e-ae38-c0ea0daa96f6", "value": "T16B954A0ABCD108E5C0AA977289B766A23B75FC190B3223D32E90B67C2F727E05D75754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796586, "uuid": "8cdf219a-9e33-4d58-b7db-4ac7f07eab29", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796586, "uuid": "850a308e-5fc5-4830-8021-9b18a1bce1be", "value": "24576:r/2+ancs/XxbwJ0DpHFb4GN9cXZK6rtPR800GSY7c:r/Docs/XxbwJ0bbR9cXZK6f80Wa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772796586, "uuid": "dd1baec9-cf5f-49d1-bc45-246f81135893", "value": 1966080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772796586, "uuid": "c8564c56-0175-4c96-a057-932f8cc051b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796586, "uuid": "cb29be68-ca7d-4852-b9d7-e54f1b32c08d", "value": "recuva_professional__technician_(2024)_full_espa\u00f1ol_[mega].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08dbd808-1971-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1772810869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810869, "uuid": "921f4625-0fc4-4802-b81e-711bec3ef9b2", "comment": "Malware payload (Amadey)", "value": "86bf33a76697c4f6daf329e55f92e9a5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810869, "uuid": "18db3fcd-39de-4fa2-b239-e8135157363f", "comment": "Malware payload (Amadey)", "value": "9450c8f5fb17a1faf510d3ed6ce78430b103ce4e54474e5f50a53c5cf9b414d3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810869, "uuid": "90ebf950-512a-4614-9749-b9ea54b75744", "comment": "Malware payload (Amadey)", "value": "6b8204605fe8fbe06db4e5fb844f6802f69a2083", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810869, "uuid": "1682899b-e188-4dc0-a7ca-5ae123b37bce", "comment": "Malware payload (Amadey)", "value": "897d613da5de3d117840fd2b58768992c49d6003d5d44cf5e572c6153a4cfb5733776cae42ba0581ad8d2023d872d5e8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810869, "uuid": "5c7a5114-b7f0-4126-b1e7-63ed9d86fbd1", "value": "T10C945B217916C032D66292711F79FFF185ADB8259F7109DB7BC00F7699202E26A31F3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810869, "uuid": "2ec8f331-7b67-48b0-893e-565815d6cb60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810869, "uuid": "acd577f9-72d6-47b2-a4ea-59b11f2eea32", "value": "6144:TbzHF0VKkWrb4QC1uwzV3ohQU1d+/mN9peVHzsAyuWZGUf/Sdfy9103T7fms4AOk:7HF0VKkWrb4QDwR4QWdyzsAlWZBR8qM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810869, "uuid": "2d65e40b-f576-4e0b-aeb6-7cd9ef949645", "value": 443904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810869, "uuid": "50519074-70bf-4ad4-b33b-9b2ed40563c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810869, "uuid": "537c776a-d641-4ad9-b1f6-cf4c31451afe", "value": "9450c8f5fb17a1faf510d3ed6ce78430b103ce4e54474e5f50a53c5cf9b414d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3a31f90-195b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772801760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801760, "uuid": "b3ee66cb-6962-4327-a5af-0858409b1bb6", "comment": "Malware payload", "value": "fcfcf495d9d208a3b3bd426b701d0ac0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WikipediaJsWorm", "colour": "#A0BBD5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801760, "uuid": "c0b68c97-0dad-4fbb-86a9-a86d2fac8177", "comment": "Malware payload", "value": "94c34ee97eb7d50ef9446c11cacea0bbb803235f3d9843e1b7d5ff60d7705d6e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WikipediaJsWorm", "colour": "#A0BBD5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801760, "uuid": "2f348be7-488b-4396-82ae-d55d42fb1471", "comment": "Malware payload", "value": "485a2338aff001b74ec33e46760dad4426d3b38c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WikipediaJsWorm", "colour": "#A0BBD5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772801760, "uuid": "3fa18c04-798b-4f26-a59f-27d062a994c4", "comment": "Malware payload", "value": "943935416b86160cea9ce56f322844a24fcccff51b75e49ce12a66c997cd956859e331f85553b82106d6a656e6af74a0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WikipediaJsWorm", "colour": "#A0BBD5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801760, "uuid": "7f552424-c45e-45e5-8417-9c16e16844ae", "value": "T13BE2CAAC72239C6DDC63266BF19D735EE2601F13F5ACA0507A4C10486FE4C9ED146AED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801760, "uuid": "fbc96df4-0b00-4f5d-b146-8192fb75893f", "value": "768:Up/yCus7+KRzihuh0/zZp/yCus7+KRzihuh0/zzsI:Upn17+KROxzZpn17+KROxz4I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772801760, "uuid": "d4a1b224-3d87-4368-a4ea-6758c03ae70f", "value": 32072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772801760, "uuid": "1697090f-512c-4ffc-8160-1c57916d8bb0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772801760, "uuid": "75c573c9-5e51-4cd4-bfae-e5e37268be5a", "value": "script.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e4546e0-1950-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772796839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796839, "uuid": "6d8e0537-4130-4d62-88b0-45b2958ff438", "comment": "Malware payload", "value": "cb88c0319d6463ff05c34df29702ba73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796839, "uuid": "5d856d70-4900-4f17-b77b-c21144897fc3", "comment": "Malware payload", "value": "950f25e039b0631aa95993dc69fa9dac93c8955d7e3222985e919d5d60d8e249", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796839, "uuid": "6e46a900-cb75-4864-88d0-afd945538ec3", "comment": "Malware payload", "value": "d504f2c9c7300bde5700a38e3f01b0398db16936", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772796839, "uuid": "fed869eb-723b-4bf4-9629-bf49fe43ee37", "comment": "Malware payload", "value": "5eb43ffbb233ea39fc0d4e9918dfc30debad470d3fb65c46e26e94acb5ce816e39528c87ea4e352756e92be255fabc78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796839, "uuid": "d381519b-2df5-49c0-95d0-bc65f8d6111c", "value": "T1C745E57B72509A7EC16C823FC182CD42E53771B91B37C9E796D00269CA5ACD01F3EA66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796839, "uuid": "107b3ab2-1d29-4f7b-8cb3-e834315a5d6d", "value": "12288:qrlVvU14I1dl86fD+DUHA0ExVqBaBsZzAvx5IRcNOYJUyQdma6xxECh6l4lVzw:qfotD+DUHAXbsNvy4UxEuzP8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772796839, "uuid": "b04e424d-88fd-4370-b736-b684bcce13b7", "value": 1205640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772796839, "uuid": "1be4b7f0-2a5f-483d-b6eb-79b494be5a6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772796839, "uuid": "f111f25f-8208-4620-9ea1-5ce46a8c1031", "value": "cb88c0319d6463ff05c34df29702ba73.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b5000c5-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819222, "uuid": "1b730a18-f01c-402d-a406-56c1ba7c2ade", "comment": "Malware payload (Mirai)", "value": "0e7c948d3bb8a04e6ffaae4518d31d6b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819222, "uuid": "33f8e4c4-fe17-4299-ab53-78ed1b6f698a", "comment": "Malware payload (Mirai)", "value": "950f9c24339f06a8bed22d2e8d522d59f25ed23554f14c6d4481ce8890b215fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819222, "uuid": "a0a30e65-90a4-4777-9af8-12cec22254ee", "comment": "Malware payload (Mirai)", "value": "c1176493bdf49ab7b68a12cebbbe8d9fd6d9117f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819222, "uuid": "9b3cbc9d-ae95-4052-bee6-6af1955085f6", "comment": "Malware payload (Mirai)", "value": "722e22270871b4386f933b70d86c9819c5fe06905c9276605f856bda7fc4fb4bc3f15e273d57a6032d705bb7fee3f4b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819222, "uuid": "1e013237-a3e8-490c-aae1-6d414577786b", "value": "T17B54962A7E21AF7FF26887310BF38B70879921C636E19746F26CD7181E6028D585F794", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819222, "uuid": "c0702462-d5f3-4936-be7f-f048b03c6dbf", "value": "6144:lHt5qI+SZ59xzFjbDkJsdcMWCxvmsFekuJ+gAfVlruXb:lHtcI/Z5fzFx1xvmsFekuJ+gAfVlruXb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819222, "uuid": "c211c823-3ded-4622-b997-4bddb788a84d", "value": 286939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819222, "uuid": "a3e7fa43-9b20-4493-8c46-c4823152c3af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819222, "uuid": "6fef6d49-1b34-4424-8e01-ff8fd6d20ef5", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ded7b072-197e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772816812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772816812, "uuid": "e71d77d3-9998-4ae9-ae1c-d3c0f09c7566", "comment": "Malware payload", "value": "b16cafecb81b4fdebeeb473049871715", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772816812, "uuid": "a927834d-b9ef-4a8a-aa56-c28c18549fbc", "comment": "Malware payload", "value": "951203b59712cb39ce4f35fdef0db671a82b1267df286f31ca93bb9b45e2c1b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772816812, "uuid": "ab57f6da-751e-46d7-b0a7-635172394240", "comment": "Malware payload", "value": "5e77fc52c84ffbe4229c65c66be3ff2f077e7193", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772816812, "uuid": "1586fef5-151c-475e-bd89-b8fed9224716", "comment": "Malware payload", "value": "e26ea9249f5ca622d5f277bbbcdb26d797c5bdb7765a856fce503fcc927364e517a7b0e014547819dbf761de51c5c1e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772816812, "uuid": "3cfaa2ff-e147-46d6-979c-9f5a171927ca", "value": "T175C58C07BD9089BAD0A9E2359CB543A17735B898073273C32E2766B42FF63E45E39744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772816812, "uuid": "f7041ee3-5cfc-4210-9f28-c3ebc93e5a1a", "value": "7ecc3b9e18c31c23f5275a91f6c533d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772816812, "uuid": "c557b6d4-cdd7-47d9-8e88-973957f65060", "value": "49152:QJ1bkBuGav3L1K1wGtTJwf9EdU0YgtUpFmw:LY31IJw1EdepF/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772816812, "uuid": "d750cca8-53b0-45f7-b3db-1302f248dfb0", "value": 2630993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772816812, "uuid": "fc18ca0a-9c3d-4894-9256-2c48872e777d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772816812, "uuid": "6f9c93af-ea58-4bfa-9523-90c33b85f0da", "value": "intl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cbbd5b7-1984-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772819224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819224, "uuid": "61c9c37a-45cd-4e67-a2f3-888f5a2fc4c3", "comment": "Malware payload (Mirai)", "value": "3d9b2bca978b7bf9d4c89305f9a43fa0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819224, "uuid": "f262ddbd-4f7d-4932-a536-3c4fbf994db6", "comment": "Malware payload (Mirai)", "value": "953da7ca2082986e2fd411035a192603ed9190d9e9838f4ecc6dc8e63f2a7860", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819224, "uuid": "20ae030f-872d-401f-a575-4c886be03ed7", "comment": "Malware payload (Mirai)", "value": "5e81187e553b585e31a6d527b7e88d5db62136eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772819224, "uuid": "d9fce8f2-0a04-4849-9ad8-b3842b26916c", "comment": "Malware payload (Mirai)", "value": "39b17492c53313f07eb19fba9f0c7d7ae05e4fa91a01db4c73847fd30eac93608d5d5ae3426071a506bfa07f592bad56", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819224, "uuid": "658a67e6-cdb2-4199-ba6b-df8d57016eb4", "value": "T1E5932A96B8819613C9C556B3FB5E429937170368D3EB3203AE348F71338E99B0E7B855", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819224, "uuid": "c5fbc77f-8930-4628-86b0-95dca914852a", "value": "1536:2eprTX9Qd3ieJkX4xHQh1RgnsXzjrAfT73b239bZHlKycmJWWl4OonZWe7S:h9E3QIxHQh1RgnsDjrYT7C1lXl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772819224, "uuid": "b10370a8-4ca5-4533-889d-2e3683d1f064", "value": 96900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772819224, "uuid": "26058d85-4f5d-4602-9eb6-23e982d113d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772819224, "uuid": "b3b5c0ec-a09a-447a-84c0-b6d3d95170d5", "value": "violetarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d6618e8-1908-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772765914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772765914, "uuid": "6325d500-9c16-4441-a7da-71f1fed52f7e", "comment": "Malware payload (Mirai)", "value": "455f9003685b08a93fc7c973ca09edbe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772765914, "uuid": "23b4d654-fc13-4716-91c7-187e20e77c1a", "comment": "Malware payload (Mirai)", "value": "95a484f81ee370a6ab3432286b9052df39dab9b9b9a078bd854a02234b2d858c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772765914, "uuid": "9e362b5a-0eaf-4354-b5bb-e97192c51f02", "comment": "Malware payload (Mirai)", "value": "c5dca03cdf1145cc8053e2a3ebdf271329448d0e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772765914, "uuid": "21f941ca-757f-4ad7-b14c-f3e70fa47feb", "comment": "Malware payload (Mirai)", "value": "e78c5fe67ff7e173287026ff0629afabec6900236558e115b49572aaf8d8a37129e63c1a0359203a9e4d5a2faac1cce3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772765914, "uuid": "6afeeff1-8914-4c98-b90a-5e9a1d51e0eb", "value": "T162E30A46B8819B12D5D111BEFE1E128E33231B78E2DF72029D246F64778A9BF0E3B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772765914, "uuid": "dc63e318-768a-429d-8373-4e413333954a", "value": "3072:b8S5KURgw/PXuxMte/aSyuBwSQm9T+cDmbtZ:bj5KKZPXmMtwa9uBwnLcDmbtZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772765914, "uuid": "62111658-a1bb-4791-95a7-c50520296e7c", "value": 146268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772765914, "uuid": "3c3df620-476e-4442-b760-81358662f635", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772765914, "uuid": "4fa24362-2c74-4162-9892-e1380c80ab0e", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d40009d2-1972-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1772811639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811639, "uuid": "237d3705-275a-497b-b617-4351b37c6813", "comment": "Malware payload (MassLogger)", "value": "bac18c4f83f6c7730d3582955de30b9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811639, "uuid": "4d68e2b3-c1f0-4338-8e6d-dd39d3377144", "comment": "Malware payload (MassLogger)", "value": "95a769c7e3b0b372e3e4d9534127d61fdeef9186ccc99ed88cba00423178da29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811639, "uuid": "f6479dfa-53e9-43e3-97b9-ecabe59e09df", "comment": "Malware payload (MassLogger)", "value": "8492dcd12c3940d1111875cce6b0e67f82a35f6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772811639, "uuid": "2b0696f0-197c-4aa4-96a9-f12754a74529", "comment": "Malware payload (MassLogger)", "value": "88a19d2961b3dbfb142d8322a034214fe8dabff4054f822fade9e3b0345cd38b3442514eaa60b17d7cc06379fc27b370", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811639, "uuid": "5a0e20a8-1048-44f4-8334-e4b098f3b9f2", "value": "T10925AD0023E8DF65F9BEAB7812F4247503F5FA069632DB2F6E5990A95C25B814E43733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811639, "uuid": "7fe706e1-22ed-4f67-98d5-a1496880b16b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811639, "uuid": "7bb7b06d-1773-4f8a-a3d5-b07a304c202e", "value": "12288:Pveikl14kuQwVokGOuXJxNB3+MLi6j2YI1Qsc6F3lrK/CDNTIdGzXsbIoo:8GoNOYwMWgsjF3lesT4GzXiG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772811639, "uuid": "88f42c46-0581-4f76-a6ee-2b1b06161713", "value": 1014272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772811639, "uuid": "62769f07-826f-4db7-b7cf-615e5a040857", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772811639, "uuid": "f7f7b45b-2ea0-4285-a1b6-6cd69978ee38", "value": "95a769c7e3b0b372e3e4d9534127d61fdeef9186ccc99ed88cba00423178da29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bea0569-196b-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772808431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808431, "uuid": "e978e2a4-daaa-4d35-bc66-426ab0ef4a20", "comment": "Malware payload (GCleaner)", "value": "8ac32275c0dea252305217d388d50153", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808431, "uuid": "00e8e8af-2ee0-4b53-959f-dfcd71afbdc7", "comment": "Malware payload (GCleaner)", "value": "95aa2ca690f660464153fc3bc996dc54095d90bac10697402a1ec9b6d3a5934a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808431, "uuid": "e49095f5-398d-4c8d-be34-a651ca5625aa", "comment": "Malware payload (GCleaner)", "value": "53e3fdff25236f6538c9fa497380456d8e5c64da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772808431, "uuid": "fdaec56f-db01-4a3a-a911-7697fd9f2aff", "comment": "Malware payload (GCleaner)", "value": "96ca8d8cad73fd4c9a4760a186519eb256f62ee88ac108e3ef956c762c67439415690a7d89574714460b1f40a05ba519", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808431, "uuid": "11b5277c-17ef-4946-9a2c-db7057f4c93d", "value": "T16E16D0433EF13D3DF876B63B89055D49BDA5B1412846483A61BA1BCBC13768CEB781B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808431, "uuid": "80c1be62-9269-4187-9af1-79d52985773f", "value": "336c69b6e8562d1c5231f219b62d7473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808431, "uuid": "2b28bb67-8608-4c06-8956-d12eba0174cb", "value": "49152:59t9uM199DrF/ZMPKhyNedIQnit0EfMhyozbVy6mte24TVBjisT:59zu499XlZLhBdIIhyq3mterVV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772808431, "uuid": "df5899e1-b425-4690-aee6-9f5350c26eb9", "value": 4068352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772808431, "uuid": "d7b123d6-3966-4f3a-971f-63dc72102289", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772808431, "uuid": "876dbf1d-5e28-477f-8843-81892be9796b", "value": "95aa2ca690f660464153fc3bc996dc54095d90bac10697402a1ec9b6d3a5934a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8709bc7-196e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772809902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809902, "uuid": "c21fe613-d8d7-4ae9-9082-3452b0d47e4f", "comment": "Malware payload (AgentTesla)", "value": "05d0214cf12041ec0317172226e7b523", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809902, "uuid": "032dd5b0-e1fe-40c8-8f79-71c230f3a13d", "comment": "Malware payload (AgentTesla)", "value": "9630b6cb9757741f387b00aac49463112e3af8e212a0f807e637fbbd67533c21", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809902, "uuid": "56863056-f4c2-4bac-9821-c661588ac386", "comment": "Malware payload (AgentTesla)", "value": "c6931b4079df72e44564d4f04c6607a66a1d2b02", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772809902, "uuid": "a49fa7d8-ba89-493c-8b8f-b23ee43ca5c6", "comment": "Malware payload (AgentTesla)", "value": "bfc27b0981c900916348cd84e771aa5dc1425fed081f40733fa889054488208e2b33b44767d521b7206e9a9965a9b198", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809902, "uuid": "9eabe326-3586-4f17-916c-51b1150e50cd", "value": "T14484E141F3C0ECE6E45554B3EC2EC7241A03EE6E8066872F326676166DA32D32657EC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809902, "uuid": "5303af75-d9dd-4c7c-8096-f2dacd539d47", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809902, "uuid": "c94cb708-de67-4cda-87da-ef819d6fe73e", "value": "6144:7gORaJ1dhZ3qeDHvSKc3+fY5PiykyCJBP2NUpoG2IhOGAM5UCBLSks5xw2:7gd6kHvS7+fJykRDiUp72IhOk5Uqk5xV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772809902, "uuid": "ae32876b-7480-41b0-8eb4-7318ff92d95d", "value": 399176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772809902, "uuid": "50ef9087-5aea-40cc-8c79-4471739a094a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772809902, "uuid": "46241044-3d6c-41d9-a787-24745e28c8d0", "value": "9630b6cb9757741f387b00aac49463112e3af8e212a0f807e637fbbd67533c21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b511f4e-196f-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772810122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810122, "uuid": "58870ad6-e6a6-42bb-94ae-24b8de66ce11", "comment": "Malware payload (GCleaner)", "value": "a9b5fa072de5b62a4cba639b5208e415", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810122, "uuid": "ede1b05b-204f-4d4d-8896-7c3951ddb665", "comment": "Malware payload (GCleaner)", "value": "964837fb79030ccdc3f45dcaabfeced8c33cd7d4a3838ade0e7efb209d5b93f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810122, "uuid": "43eddfad-5c51-4ccf-9151-76b9b74c3490", "comment": "Malware payload (GCleaner)", "value": "6e6d0402536afa43e75d0a96f56798c854beef81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772810122, "uuid": "f2b3ee08-1fae-49f6-8f5f-674363ebc0b4", "comment": "Malware payload (GCleaner)", "value": "c7f76dc1047cc26b5016cccbdbef36b11661ba078925516e41b603542e4eb0f838faf8f024ed3643c8e26295561bb1f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810122, "uuid": "c90b9fe3-c41f-4a1d-8aec-55d957d269cb", "value": "T1CAE48DF1EAA0843FD1627938CC0BB2A594BDBDD02929640A7AE91CC8DF253F17535277", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810122, "uuid": "7453453e-3419-4fee-afe5-bae3fd1e86ee", "value": "c475b6e242f56325f64c2b76233f720b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810122, "uuid": "db9e98ac-1883-468b-9926-def753b28f7e", "value": "12288:/eM9gzhW/BsjB7V+bRO88pvnHU0rLu3yBYg7mKEMMi+KVL30bf/d/Z:2K3/q7gR8n6ipmKExiLVL30bfl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772810122, "uuid": "5d572db3-88bb-4026-90ad-94a83ebe3ff5", "value": 718336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772810122, "uuid": "890c1655-4a57-42c8-9491-e88ed2d61eb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772810122, "uuid": "ccda2f14-7490-466e-b64c-e443c47c7ff7", "value": "964837fb79030ccdc3f45dcaabfeced8c33cd7d4a3838ade0e7efb209d5b93f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eba2f9d-1974-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772812194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812194, "uuid": "e1a02fc3-1bbc-4364-bff4-5321a68af8e5", "comment": "Malware payload (Mirai)", "value": "06de3b5ccae65d45a2a942ea4d3fdf94", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812194, "uuid": "bdb095aa-ad14-4b8b-9695-958e04f996a7", "comment": "Malware payload (Mirai)", "value": "971b2da958636436110aa3ed29eb3000f3b3645ece4e9e049397587eb4c07d23", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812194, "uuid": "4a072e6c-86ee-4691-9803-f7de7c93c04f", "comment": "Malware payload (Mirai)", "value": "cc3567fc2a744f5172e1beba059da59c06f2f54f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772812194, "uuid": "12dfad92-3b4f-4c2a-96fa-cb703dc10915", "comment": "Malware payload (Mirai)", "value": "9b4b4b197fe1e0977964090890c4f3e6594261df1119a79092c2a5f2e24cd643a259e62ed09def041e5ad907794f795f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22",