{ "Event": { "published": true, "date": "2026-04-08", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-04-08", "timestamp": 1775692982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "229788bb-1ebf-4284-99be-5031f1169ff5", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0230571-3388-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775679785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775679785, "uuid": "a57a3bec-8383-4fd1-8086-f2c4e4265286", "comment": "Malware payload", "value": "d5494893d463fa1d3762f27b5e5fd863", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775679785, "uuid": "6695daaf-e296-42c2-84d3-9b767aa979b7", "comment": "Malware payload", "value": "00ed464e867fdc31ac4eb4e18757fe4b79b2f79ff63cc469cfcfeb205df20af0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775679785, "uuid": "4e012929-03f3-4df6-9ff0-a6ea0345f92e", "comment": "Malware payload", "value": "64eff37e2f5b4f538dc58cff1199be86d8a79b6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775679785, "uuid": "25f8e5b5-7b29-4ed6-a6c2-fe6b5740b0c6", "comment": "Malware payload", "value": "c39929cfe44393fc4080af84755f67437ff42d610d75ad96845290f9f024371c11dcbc47fb0856ececcebf08436544e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775679785, "uuid": "4f2493b0-f52c-4033-b223-fc19f20c6694", "value": "T12FE4F086F391679CC5BFE639CA16173EEA3134925324070B23A58A633F276746F2D352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775679785, "uuid": "f4e35a22-e57a-470c-b6b4-85d6f7a62e7f", "value": "af18b23f8bd85b1fd557930d6522f233", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775679785, "uuid": "8b2cae9c-d2dc-43fb-91e6-82c3554bc40d", "value": "12288:Oshfmpd1uUaxY9YhHG3P4iZNrlUXIDllmzVYxN2WSWfiuVm:Ou+pdMxNmgiXrl8Ipl5xN2WSW6uVm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775679785, "uuid": "452b3e22-314c-4fe6-9b3c-c93229b02723", "value": 687984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775679785, "uuid": "e1ddbb7f-1188-4d24-9b5d-d17888e065ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775679785, "uuid": "1a2cf079-de0d-4755-8330-0f949e48fe35", "value": "image2026040869.com.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dbd43d4-3373-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775670547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775670547, "uuid": "c0dda73c-4a16-4a53-8d50-41a6b1df4ec4", "comment": "Malware payload", "value": "270290628c75fafe4c160e9e6350eb73", "object_relation": "md5", "Tag": [ { "name": "178-16-54-149", "colour": "#31543A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775670547, "uuid": "1128fd77-f6a5-4514-9b00-4559150b99ff", "comment": "Malware payload", "value": "012d8aa150934821a32b79c0634c6fb1b39f4f611b8af00e441e9448dbcf165c", "object_relation": "sha256", "Tag": [ { "name": "178-16-54-149", "colour": "#31543A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775670547, "uuid": "2dc402ae-306b-4482-9aac-9da1a1e6d718", "comment": "Malware payload", "value": "283c8db6edf506eb4ba705c2b18eae56cea481bd", "object_relation": "sha1", "Tag": [ { "name": "178-16-54-149", "colour": "#31543A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775670547, "uuid": "bc9e9390-283c-40a5-bffa-da7a3412efa3", "comment": "Malware payload", "value": "52f0a3d1d9f44b0e67d5b4c4c5ac2fa8e3b53855f1a22592ca8c0fa53d8bea97833b1c693bd7fb377f66d74f83947249", "object_relation": "sha3-384", "Tag": [ { "name": "178-16-54-149", "colour": "#31543A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775670547, "uuid": "bdfc5f11-5505-4254-a9b9-52118971c7c9", "value": "T14395B8081FEF84AE75A37D5045E0422B9B7BFAABA5718B4F488003CD17B3908555EFB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775670547, "uuid": "30f21b2c-7042-4b51-bb8f-b000064c536b", "value": "6144:wP27FZBX/tCxnRTdUeBr6EnyxMwc8YZfauAfDcMfeMuMzlzEvyOtbezZIXcoVlv1:wUvPs+fyiuArcMZzlsU2TVd4n3vgieCc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775670547, "uuid": "c861f8f4-0b55-4c6f-a5de-547cb584222e", "value": 1882010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775670547, "uuid": "0c682dc7-681d-4883-806a-2cc7db982014", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775670547, "uuid": "73f05cf0-4654-40db-a21c-70422ca71193", "value": "31agosto.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "098ae5df-3326-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775637388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637388, "uuid": "0e97cd1e-2619-4da4-931d-e8fd97043c4a", "comment": "Malware payload (Mirai)", "value": "335e124ba09966ac938e04a763371bfe", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637388, "uuid": "4bfe09d7-eecc-4e46-b45f-9b2c6eec659d", "comment": "Malware payload (Mirai)", "value": "01674c371cf15f92d7a08e1597512e11c28e3d1d803d5386b75ce3e9018ae2c7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637388, "uuid": "00d47c58-e9cb-40ab-85c7-0714f73420db", "comment": "Malware payload (Mirai)", "value": "7c7ff35a33a810d3b3a4507f065ff57c0af41d5a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637388, "uuid": "e7b5f07c-ad63-4e47-8cc9-fefd769e5aae", "comment": "Malware payload (Mirai)", "value": "999d925b3a872a943a577a43172a6e53af06f9ee869fc28a06229d60b05f1858b9fb970f4f733dcfc43e764beec455d8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637388, "uuid": "e7c9796e-781e-4333-a04b-b6a6cf974699", "value": "T19104881D6E228F7EF668873147B74E25976C23DA27E1D640D2ACC1106E6029E641FFEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637388, "uuid": "1b680b81-43b0-478f-8bd2-91ec8fafc664", "value": "3072:jg57RM7LHZwbq1YSBan1yvbysxr1uGSII:jglRM7LHZ0Bqyy1BSII", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775637388, "uuid": "d8650df9-55e5-4bf5-b8d4-8ea624addb7b", "value": 173888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775637388, "uuid": "3b3c949c-56a2-46e3-8a66-9378db61ff95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637388, "uuid": "7fe8ad28-5a8b-4376-b527-f272ab5d1ba3", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7926a47-337b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775674187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775674187, "uuid": "8f07fa47-9453-49e2-a195-2e5508f43439", "comment": "Malware payload", "value": "6dd516230cfce8347d2a6ce0ae82f056", "object_relation": "md5", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86", "colour": "#9A8E4A", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775674187, "uuid": "d44a9a57-0218-4a95-a6e4-a8afb3baf637", "comment": "Malware payload", "value": "01c8f6c1ad9dd78c27dad09b1a3cdc9dce27dfbfa1e01f2b601c1808402aa019", "object_relation": "sha256", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86", "colour": "#9A8E4A", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775674187, "uuid": "1de0317a-6864-4b6b-9b67-8de9957c5311", "comment": "Malware payload", "value": "eb77e53a64cbab8c8b4c62fe48b2d2d609802a21", "object_relation": "sha1", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86", "colour": "#9A8E4A", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775674187, "uuid": "c8af5ea0-4ad7-4f98-b721-2f09dc902736", "comment": "Malware payload", "value": "dc1e0de925399fe9ba3b0b8eb6af90693b49e93576a06a51fc6697ff30d0e4e73ddaa144140c66dcefd39b5dd2faf653", "object_relation": "sha3-384", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86", "colour": "#9A8E4A", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775674187, "uuid": "f0757e9e-942f-4d9f-9eed-2569b7e86e82", "value": "T115756D43E2A620ECC05FC170975B6722F93174055B38BDFB92D0D7352AA3E906B7AB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775674187, "uuid": "b701119c-060a-4d28-9aad-9cd35ba2d562", "value": "b712b3f1f6f5dde070c523d4407e5a3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775674187, "uuid": "6dcd1749-a893-4b91-bcb0-903e53bb1d13", "value": "24576:7ds9Esxlce6k91UOld2LMxmeDozCMZyFFUiEymOCUwPPZbP:7daEglcAHNaYczYuyL2PPZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775674187, "uuid": "a005ab48-4445-4a79-b0f5-1ac196499331", "value": 1566208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775674187, "uuid": "9dc7d774-22ac-4d29-9263-b08b963bd6f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775674187, "uuid": "4626b3e6-cb4d-4b78-942e-a33af530bc67", "value": "f_ex86.node", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc11dc15-3388-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1775679805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775679805, "uuid": "cedf9326-d4ef-4fb9-9fde-06e070812395", "comment": "Malware payload (GCleaner)", "value": "f72d170c312fae6ba71aba70fd4c6d45", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775679805, "uuid": "8a9a5a8e-4d47-4798-9ef7-fb60205c7d60", "comment": "Malware payload (GCleaner)", "value": "01f08c76c9ef8b0cbdbdbc1298888c98ea9a33f351a3876537e7f29ff282c5fa", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775679805, "uuid": "884190cd-d795-433a-9877-76ed39c94eca", "comment": "Malware payload (GCleaner)", "value": "fd72c7420e88cd55ff9ce6c6c362706656ba24ca", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775679805, "uuid": "925c3904-05ce-438d-94a2-09fe1b3c25a9", "comment": "Malware payload (GCleaner)", "value": "2a51a4c0fc57c7c553af1b078f455bc668659842384b7e203beba8b92080caf0fc1c340abe6f4bf15edd7de62c633d9f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775679805, "uuid": "514e5d09-58cc-4712-86a5-3d0596b18258", "value": "T1A3F4AF32A1E14437D1221B788DCBA668583EBD332D3B5846FEE81C48DB35E81746B397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775679805, "uuid": "76cd1ab5-e9c1-4b07-bb7a-c0e7ede1b56d", "value": "18614e74aabaf20869258e1ccc56687f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775679805, "uuid": "a2530ff7-c544-4b1d-b067-f97679f88ae5", "value": "12288:CSPmOGRt5u+0oqZLFk36QWjQF1WRCC3nS8HHyqVq66kKy6iflyn36V2d:FOvlqZm36/UYR3nS8yqVq66kKy6iflyt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775679805, "uuid": "7744752f-19a7-4bb3-97d8-263e5ea16179", "value": 725504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775679805, "uuid": "16939abf-1ac9-492c-9f84-ff6a53dbbdf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775679805, "uuid": "2a41e4d9-322d-4675-907f-3050cf93676d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8735e162-3325-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775637170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637170, "uuid": "e91327b0-f9a1-4ef9-a942-d964df98c5cd", "comment": "Malware payload", "value": "afb9426eb0ec3de92c47b5c044522a09", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637170, "uuid": "ca8dc5bc-717f-4438-92ab-70f2b87b98e7", "comment": "Malware payload", "value": "021391124b6f7d20bfb7edc87c063ee22019913897f2ae444c4ce630933d08ef", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637170, "uuid": "e498260b-37c9-497a-9c9a-058e55ad2088", "comment": "Malware payload", "value": "0b8d8fa3b8f4fe9e62fa49fb5f724c3d16ce2a18", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637170, "uuid": "c624797e-f990-4db7-843a-696e7420c2a9", "comment": "Malware payload", "value": "faef37b4f7e4b70247f2a1bec4b7ef7b68127e65e5edcbc8b741c70613ae678d41233d3ed4226c578941e757eb91e0c6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637170, "uuid": "e9d55c30-ea26-49bc-aa7c-8bd177f6f374", "value": "T12AF2E190A9C82550E00C9275F5B2AD816806718FA5C03E4173D9AAFC5E4A4DCD6EBFEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637170, "uuid": "14461b13-c9a4-4a4b-bb44-3c81c338297b", "value": "768:AZwOJ1GXMuhbTb+68BVI9u8xGyfy6cuP1mALYypDCHpnpI:AZj1EMmbTdPGqp9mALDC9u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775637170, "uuid": "176040ec-0fea-4786-bdc5-c9229e4db32e", "value": 37495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775637170, "uuid": "73c53ba0-0d1e-4417-88d9-8d93f2535d81", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637170, "uuid": "69d1ece7-559a-4ba2-88ec-306889efb251", "value": "Dienstangebot_Gavranovic_I_27-03-26.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "805e0162-33a2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775690845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690845, "uuid": "198593f0-6a05-40f3-917a-30ef660053f3", "comment": "Malware payload (Mirai)", "value": "d303756ccf36ed6c410aea49227d9862", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690845, "uuid": "065c85de-b7a1-4fd6-9093-cc62f078d8ff", "comment": "Malware payload (Mirai)", "value": "025494bc99dc49f47a4734722b48b62e15ff13cd468b2eaeb25178c00f04b98b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690845, "uuid": "1b180b54-a5f6-4cf8-a720-fb7e64edccc4", "comment": "Malware payload (Mirai)", "value": "27194c906fdd46a481c791f0216770b2291002e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690845, "uuid": "bb697993-0a52-459b-84ea-a2372875bf85", "comment": "Malware payload (Mirai)", "value": "c6bcee5f0a3b290717b656bfea593d14e3092b402d3d99632903d6835ffe8805c82f57864fd7d1f32388a509d046cbc5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775690845, "uuid": "b90fc971-0b1a-471b-8c44-0b725ff88065", "value": "T13C332942B22C094BF9E65AB0353F0FE093BFE98024E4B585695EEA458136F331586F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775690845, "uuid": "eca1d86d-1e06-4cc6-854e-2d4829c3be28", "value": "768:/KfsbnHAt1ezbnAgCN7RkIV3fgB1ERNRR7Eg3tbv6VFssuWXwdyZB:k6HAt1ezbnAXZUB833tbC/3Xw0B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775690845, "uuid": "b4c3217d-f10d-4469-baa6-35be3908aeb7", "value": 51332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775690845, "uuid": "e7ed4ddb-7dc7-4a4a-a3b2-a5161fdca056", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775690845, "uuid": "7c7419c2-b7bd-4406-aabf-2ab69d6f93e0", "value": "Josho.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c07fe0a3-3326-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775637695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637695, "uuid": "ac13766d-f2c2-495e-aabd-4905fc6083e0", "comment": "Malware payload (Mirai)", "value": "4736f2f8adefd1291cc89be32ffb0423", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637695, "uuid": "e18a4f4a-a540-41cf-80a3-95e001542c2a", "comment": "Malware payload (Mirai)", "value": "039421bcb90d621ad5d3d80d7c904fe1a8cf7cdd72c0c745283a322d12acd33a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637695, "uuid": "a7377520-d0b7-4936-ac4c-e028687e99a8", "comment": "Malware payload (Mirai)", "value": "9d4001080577f18b0940dac30ce7b7d75c644892", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637695, "uuid": "5b9be365-2ce2-4f99-83a2-7d3233cd438b", "comment": "Malware payload (Mirai)", "value": "1dd325037b1c8a42af3431433c762b60fe7d2433c91f96d5777ca3dfed785c1fc53a7f30bfacb12fdf08cadecb484fd6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637695, "uuid": "4c5adc79-ae64-465e-b666-1394d0a90e2b", "value": "T10551949B0180DB72D65EC94EB7F0B134620AB08356DF9E18ED80185C8EC6E5C7385F84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637695, "uuid": "5114a030-5a8b-4462-973b-c5c56eb722c2", "value": "48:qudMOM2JMIFyFbiB8BnBuZUwUwcvyyUFonobwLf9h9WNoR3O3hM3IKE:cp2JMY6biB4BuZkobwE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775637695, "uuid": "40e79ae9-fa5b-46d3-b75a-25b30f9921cc", "value": 2881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775637695, "uuid": "472a9d5c-b3dd-4306-a92b-e005bc6496fc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637695, "uuid": "e312564c-f332-4530-958d-8d696282c8ac", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f18de621-3364-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775664406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775664406, "uuid": "27b09ad0-9ca1-4207-aff9-035a3d7c98f9", "comment": "Malware payload (Mirai)", "value": "55f3ca2761ae0e7a6f72864b1eb7efed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775664406, "uuid": "a15526fd-620b-4460-bd67-6ca8b98df58a", "comment": "Malware payload (Mirai)", "value": "04fd7a525655c734e46679f03b06ee6e5b7340739308f14ed331f7cfd2e13a87", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775664406, "uuid": "be3738f5-501e-4d66-825d-79c72290488c", "comment": "Malware payload (Mirai)", "value": "86d2ce4cbc3f7578120b7c93202b8037d815968a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775664406, "uuid": "ccc0bec4-c6b8-4bcf-ab2b-f561dcd1ca08", "comment": "Malware payload (Mirai)", "value": "6edd48f1cce151e90116a3a8adbb5ebe6ab68bf3727d28f96657acc284ebfe754b7842f5da1a44a4ff3b7c28be55331c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775664406, "uuid": "428bde52-5843-431c-97ae-395a3d5acb08", "value": "T1ADF2D0CE78E06DC9EF5C2CBCC8AF17C16D53E6E5226B439C8350581E991191FBD490AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775664406, "uuid": "853b2e57-3382-420c-8a27-79c8afd4fac6", "value": "768:O5eMsmfACEuGVXpLSbkkg5B80SNxjxF6FL4JDiWMD:OE5m4CEu6xCkk0BC/6FL4g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775664406, "uuid": "d25d619f-0f11-484b-8cb9-4cb11654ad35", "value": 34688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775664406, "uuid": "e9e0c46d-e0d8-4909-b0e7-876fc5b741a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775664406, "uuid": "f479304b-5037-4c9b-9a2f-58d24ab9069f", "value": "db0fa4b8db0333367e9bda3ab68b8042.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93f82695-3374-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775671121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775671121, "uuid": "f80c05e4-5910-469d-b8ff-65c027a96c0c", "comment": "Malware payload", "value": "02c93cbff25d6230e12852586c21fbd2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775671121, "uuid": "6f7eb021-06d1-4220-90b8-8d966b032ef1", "comment": "Malware payload", "value": "050fb15146ce0c354071e0fde7cd4c7948e89c339c37e27a422fa554b27f6d9e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775671121, "uuid": "792141dc-7712-45fd-8e25-3e4f122edd9a", "comment": "Malware payload", "value": "e292bd911c232c7e19c03984afbf5c6395e5c902", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775671121, "uuid": "db136125-ed63-4b90-af9a-b9e752d2d2c6", "comment": "Malware payload", "value": "d9a10eb6a3a22e204ab37c00abfa2c2ead265f6ce9fc898c5ef0ce897e006973892f8e03731f5e3cb76e8f5745a3da98", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775671121, "uuid": "c93e100b-ed7d-4560-a784-98308cc43304", "value": "T18A1517E6DC2448013F0C963922BFECBDDD27A8BB36DFE46243D215B107598A94E5683D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775671121, "uuid": "ca02cc25-4315-4205-941f-b3e719dd5612", "value": "1536:gb4bAb4bAb4bAb4bAb4bAb4bAb4bAb4bAb4bAb4bAb4bAb4bAb4bAb4bAb4bAb4c:Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775671121, "uuid": "f7119371-ed3a-4b66-9d21-d805bbe5b712", "value": 937540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775671121, "uuid": "3c09f666-0fe2-46c3-84b3-a1e8538d519e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775671121, "uuid": "9f730a86-6c0e-47cb-ae84-70f1ab28b42e", "value": "proceso.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "023cb369-32ea-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775611606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775611606, "uuid": "87cda3a2-34dd-4a56-84a5-30a8ccf5f3ac", "comment": "Malware payload", "value": "b05135dad46bf92a9e8088f203154930", "object_relation": "md5", "Tag": [ { "name": "177-136-230-88", "colour": "#346922", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775611606, "uuid": "f9d31991-bd03-4ad5-859a-0a1982046eed", "comment": "Malware payload", "value": "060bbc3a3b4d00b12d8b3ca7d9ed15b3b6a0b4bdd92791d05428d0eb3c127f83", "object_relation": "sha256", "Tag": [ { "name": "177-136-230-88", "colour": "#346922", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775611606, "uuid": "7986ff9d-d039-4854-9df2-83b651fa18d6", "comment": "Malware payload", "value": "44179e455f092b9978fe3727213f640d594928ed", "object_relation": "sha1", "Tag": [ { "name": "177-136-230-88", "colour": "#346922", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775611606, "uuid": "b879e3ca-3f44-4e7c-a942-7fc044e9d7fb", "comment": "Malware payload", "value": "eeb00b27a2dc2412a89e287748712d0b6d8e7900f12757d552d08bfc6055bca7e4dfef4b4a4b13f711b7ce12168c8577", "object_relation": "sha3-384", "Tag": [ { "name": "177-136-230-88", "colour": "#346922", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775611606, "uuid": "c473e44f-623b-4a3a-8c45-6c241df0921e", "value": "T10DB633BE5242BE83E610623A2D33DC545C21BB249B511231E45F4FE670A725C8FF9B7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775611606, "uuid": "aeaa0f5d-bcaa-4fd7-adf2-d347dad64133", "value": "e5f2017b56edbe3f3846ec720ea32630", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775611606, "uuid": "24bac929-1ba1-4299-a9c2-05c496839332", "value": "196608:vNPUOQZ0awCOR5HPviV/9F+YR7W0EipMaa6:v6OApC5vqD+diW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775611606, "uuid": "126885a5-cab3-4538-83b1-fe10883ca9ea", "value": 10916864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775611606, "uuid": "d36fff77-214b-4635-89a2-20964f453354", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775611606, "uuid": "d08f9492-4b7e-4b40-8689-dc8d244874f9", "value": "060bbc3a3b4d00b12d8b3ca7d9ed15b3b6a0b4bdd92791d05428d0eb3c127f83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d034de5-3332-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775642655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775642655, "uuid": "a73a967d-28a5-4c39-93a3-7e54c587492e", "comment": "Malware payload (AgentTesla)", "value": "aa0ab313d177587c8ffc52045f842b2f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775642655, "uuid": "210e7a1f-c6cb-4a8c-821c-b0b8028b6fac", "comment": "Malware payload (AgentTesla)", "value": "06d97ad7c89d2e5c08e53f46e5a405a4a1ae40231e8415d990d1315111e26bc2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775642655, "uuid": "696ea6a1-2576-4132-b712-63fa3a0db6da", "comment": "Malware payload (AgentTesla)", "value": "81d8c7431d288e5e3e808ff56f3125094a7180cf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775642655, "uuid": "326460c3-2550-4cc6-88df-97e7804fa99d", "comment": "Malware payload (AgentTesla)", "value": "4a85c6f7ba74f5bf5b4f4af949922ef8d48b27ccb99a7f09b430ccdb539af1212898667a7e3e8dc29b511fd18c258405", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775642655, "uuid": "7766cea7-74e1-4d73-9ad5-0985cd9a46b9", "value": "T1F865021189C47FB9DFAC571980FD161EE3E14A8A5015B98AEB33BE4AEFF7900110F589", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775642655, "uuid": "042141d6-cb46-45a2-af72-908b2f31e37f", "value": "24576:HoCcMSGfic5Z6mwRMwH89P5Bya9+KM3KffUNdnedsJ:1SGfd5ZpuqJyM+KP7e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775642655, "uuid": "707e9625-b512-4e18-a7df-6b520782f123", "value": 1421308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775642655, "uuid": "29e2a2ba-24a5-4525-9ad3-cab817f08171", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775642655, "uuid": "37a60293-8b0f-450b-8be8-54d9c57e9452", "value": "HG987667890009909876567.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35df3226-332b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775639610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639610, "uuid": "23916b59-3bb0-4b0d-b75f-8fb6804f6ce0", "comment": "Malware payload (Mirai)", "value": "9206de76d56e839409f9bafec45b7de9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639610, "uuid": "e95bec7e-d67c-466e-9c3b-1ff46cb09023", "comment": "Malware payload (Mirai)", "value": "087a2c1fd114fde61160b4ee02b220d358f6c858c4f6193dd402d1a34282827f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639610, "uuid": "95c649ae-9eb6-43c8-ac1a-aaad95ec58cb", "comment": "Malware payload (Mirai)", "value": "9a105b984adaae697fde7bb13777b9bafc220f44", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639610, "uuid": "bfdaa06d-5b56-47ce-990f-e21916c331cb", "comment": "Malware payload (Mirai)", "value": "afc46d6c80f97ff89b80264c31ff793670040c32d892614a1798f5111445004430dfbace0a79d3f17994b2da02ab8113", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639610, "uuid": "82b46313-b216-43b3-9b72-16693f78dee4", "value": "T19DF2F06CD79999D7E7BB6A604F60E7E9BFF38B09B186C98770A1D521800640F8D024DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639610, "uuid": "5974d067-14b0-4b7d-8a9d-4816338867a6", "value": "768:0EZodkE7kj7UdPaI5FRsq8YfUeLLBOJoW3REH57YQsq4uVcqgw09J:0EZod37dD5FRvUeUJVEHT4u+qgw09J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775639610, "uuid": "484678d4-038b-4dcc-81b9-1aa475e0c25e", "value": 35992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775639610, "uuid": "9bae9e90-ffeb-4543-bb3b-3e4a7adb4d46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639610, "uuid": "4d90f4e0-cd77-4549-9793-e52e345b8cfd", "value": "tony.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98d574ee-3374-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775671129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775671129, "uuid": "dc52f59d-936f-4b7c-a745-cac5f883f9ad", "comment": "Malware payload", "value": "3b75c26490c60dbbda7fe4027f807c0b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775671129, "uuid": "b6441ea2-01b0-4eb0-81f9-6d7f19e8dc96", "comment": "Malware payload", "value": "0a2c926442601cdd883dfc4d4b64b2f275d42fdeab88c082ca1cadbce2aad59c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775671129, "uuid": "f73c5a7c-215a-4b54-8b1e-b170a1b33697", "comment": "Malware payload", "value": "2f1cf5392a0d38e2bd22bd4ba25132b7336faa5b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775671129, "uuid": "d707edf9-2a73-421f-aaa0-1236e794abe9", "comment": "Malware payload", "value": "b7c4e5f7e7638fafd92d11e28740309e10b5176fda4926df175a738e5d1a7aaf124fcab4a899847a3fda7c210cf8bb2b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775671129, "uuid": "6de22b68-dd04-4cc4-949a-872601eb6855", "value": "T1EE156AC80E384C95B61E407446B3C97AEF972DC73ACEE65847F70ED06A19D28962E4F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775671129, "uuid": "237da858-dbe4-4880-9013-e73a15b867ee", "value": "768:ZnRb9O21q6YiVLovrq6YiVLovrq6YiVLovMJPP0acketq1h3IU0a:9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775671129, "uuid": "9e598d2c-373b-48de-a74b-f68f81e7f7ef", "value": 937540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775671129, "uuid": "c3fffbd7-7141-406e-8ff3-d60ec3208001", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775671129, "uuid": "ff125972-b0eb-4d9e-b4c1-dae374ff1a6e", "value": "svchost.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43626c49-33a5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775692031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775692031, "uuid": "0137b8ea-60dc-4a3c-adac-4605b2080c27", "comment": "Malware payload", "value": "bbda850aa9a287c86f4aad829334653c", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "antiddos-protection-net", "colour": "#3CB326", "exportable": true, "hide_tag": false }, { "name": "ChromeStealer", "colour": "#2EF335", "exportable": true, "hide_tag": false }, { "name": "jmn-la", "colour": "#8F5854", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "NDA", "colour": "#2F516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775692031, "uuid": "e61799f0-fec3-47c0-ab66-e6e30ebab83d", "comment": "Malware payload", "value": "0a471929e0a11811da7f078f17639ee9b0a727e86e55bccf6a537f3bae7964a3", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "antiddos-protection-net", "colour": "#3CB326", "exportable": true, "hide_tag": false }, { "name": "ChromeStealer", "colour": "#2EF335", "exportable": true, "hide_tag": false }, { "name": "jmn-la", "colour": "#8F5854", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "NDA", "colour": "#2F516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775692031, "uuid": "224524f2-039f-45b8-9edb-679bb28d9f6b", "comment": "Malware payload", "value": "77b51fa055ec8f7ffc50067bd205153112b999ad", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "antiddos-protection-net", "colour": "#3CB326", "exportable": true, "hide_tag": false }, { "name": "ChromeStealer", "colour": "#2EF335", "exportable": true, "hide_tag": false }, { "name": "jmn-la", "colour": "#8F5854", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "NDA", "colour": "#2F516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775692031, "uuid": "c81ae92f-75a7-4b16-aacd-a8d0cf8be22a", "comment": "Malware payload", "value": "83de96d358d0be3ca4ee4813b5844f15980ba5aff0d4c1aabc762bae0a3b60e6dfb9f690914622008d36c5470e3ec718", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "antiddos-protection-net", "colour": "#3CB326", "exportable": true, "hide_tag": false }, { "name": "ChromeStealer", "colour": "#2EF335", "exportable": true, "hide_tag": false }, { "name": "jmn-la", "colour": "#8F5854", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "NDA", "colour": "#2F516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775692031, "uuid": "a86d2f32-0dc5-4818-b457-f2aa929b2fad", "value": "T15C512B2804684AAAF57281F46DAC1557B39824F86A14063698D7B7D5520F3BCDC161F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775692031, "uuid": "af018e4e-2514-48f1-810f-812799037c95", "value": "48:doV3DGX4rrYVxPvJrc6YqOI2MTK/RnLzYdCeUhUfF8SXlaHPiVf/zUbjN1Opj/tn:doNaX4QrPvJZYqB2MopfyCpoaqVrU7GF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775692031, "uuid": "f18a3202-0d4a-4d84-a57e-f90101c3165e", "value": 3057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775692031, "uuid": "2e5d16e8-ec49-4b02-9514-492b49abd842", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775692031, "uuid": "8016f8da-bbca-421d-93e2-1551eb26d214", "value": "7275ae50273ba08e6e1e56b2c553acabdf3d3f632cef14645480cd115b2aa672.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a74bd83-332b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775639618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639618, "uuid": "7833e137-5d67-42c9-b791-452781ea521e", "comment": "Malware payload (Mirai)", "value": "9ef7feae29357b681a4372593e22117c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639618, "uuid": "6fe6639e-d3ec-4dd2-b093-d945d33c8cfd", "comment": "Malware payload (Mirai)", "value": "0b0e30467ac85c6c9bbcb171fc944f14ca763c912ad4dc5d237782c811a61d06", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639618, "uuid": "22711596-c779-40d4-a012-5d14efd2374b", "comment": "Malware payload (Mirai)", "value": "1112a6c0124354cde00342026d5c92d74f946e35", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639618, "uuid": "313e039d-812b-406e-a2da-400c0130c735", "comment": "Malware payload (Mirai)", "value": "e070ed7331b6c1ab8c5f6ae13957c41e139cf082371484329f68b28b3fc4fe85fdbe5102bcef4ed1e0703304e026fab5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639618, "uuid": "814ae5ee-3f67-4338-aab7-08fc9d6d87c3", "value": "T11883175AF8818B21D5C5127AFA1E168E331357F8E3DE72239E24AB3037C651B0E6B855", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639618, "uuid": "9ae6a18c-e5cc-4f50-a073-20eb6f7cac59", "value": "1536:5Wn1xYngkdZ1tkyIqmJwj5E7LeHSiampoRcaIKioGtmzc97f05XYtFP:gxe9k3p/eHSiam8Gtmzc9T0t0d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775639618, "uuid": "223eed88-7076-4adc-b9ef-789dc5c1a8ba", "value": 88324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775639618, "uuid": "7cfc5205-dd64-424b-a44e-4e477282fc2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639618, "uuid": "d6b16019-f20c-4db6-8dae-361e181eb43c", "value": "tony.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bcb0842-3327-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775637821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637821, "uuid": "3ce6d6df-f5fc-413b-8f46-d7db278c0c2b", "comment": "Malware payload (Mirai)", "value": "1fbd8f6068d7897073c5b58c4e448af2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637821, "uuid": "560222aa-b47a-46d0-97d7-87df7796ae53", "comment": "Malware payload (Mirai)", "value": "0b49825803f2294cba06208a0243cb839ee3cc833e134f3dfd29a2d5c44d31f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637821, "uuid": "4bbfcaee-732a-4032-b071-6db821b93539", "comment": "Malware payload (Mirai)", "value": "39a9230af966601500502a3b2091b8d5348f65a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637821, "uuid": "37ec834c-aebe-444a-95fd-c719005acec3", "comment": "Malware payload (Mirai)", "value": "bb54e188c98f4791aba1abe839a7530557031bd6d9ce9fe6ea98b2f94e62d5968248258ff135764effe30837cccb4073", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637821, "uuid": "8d7c8b28-69af-473c-b16e-4a7602839af1", "value": "T1A1D35C0A78D274FCC687D170926E9F61EA3A745C02183DBBA3C2AE711937DD05E15FA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637821, "uuid": "ddfef3ea-b862-4d4c-a5cc-616580277a01", "value": "3072:lAF2acRfkY6z3xv+ErH4vk9954rlvLFZW8YYQw:yIRfe3xvvSrlvZZ7Uw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775637821, "uuid": "6c7306f6-b437-4ade-97eb-b357601f1c9b", "value": 136064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775637821, "uuid": "7361e442-c5e6-44da-bbcc-dec2a951daf7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637821, "uuid": "d1dbf103-dd31-4d40-84be-65aae3f24b5b", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e8bbf42-332b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775639598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639598, "uuid": "5ff7d114-96ef-4f23-a2a0-b74069b763ee", "comment": "Malware payload (Mirai)", "value": "d0ca3281f99f71acf09cf5de91ee1074", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639598, "uuid": "2d359550-c731-451a-95d4-cd5eb5d1a31a", "comment": "Malware payload (Mirai)", "value": "0b64556de49ca4bcb1b78763f09721cd541ff4e49a26d83cc37843ede0f00383", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639598, "uuid": "d196c4b0-2b28-4936-9e0e-ca7ef81c8f84", "comment": "Malware payload (Mirai)", "value": "6399f9299c7e78198f9b1b35f503d187ecd290dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639598, "uuid": "2ab2b092-fa2c-4c6e-809b-cec2cd0b01b9", "comment": "Malware payload (Mirai)", "value": "7d5584da9fb629f5fc0b4a66bca97a6b3e3bf4f8b715a1ef5074c206a3366d8476f4497c086a6ab75166c188409cc0ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639598, "uuid": "646791b5-0541-40da-a452-c66c976e787f", "value": "T10EB3BEABF20725A2C85243F017C79F8E7E2322919F47A5EB7C1E267A15391DB1D06F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639598, "uuid": "83ba7895-47d1-4d40-a193-5d05abf8ee44", "value": "1536:BavMa19DTAY0sG6kWzSCa2lGTONa2e5m/lpvxJ63sgqY/LWj:qF19fCvNWeCNEEa2eulpKsgqYq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775639598, "uuid": "31a29b9c-428c-4a5e-bfd5-48bc5ae7f06e", "value": 115992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775639598, "uuid": "d8b64567-2195-4063-b455-3c1965d93450", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639598, "uuid": "57a5c5da-bce8-43f1-80e6-40f7f856cdcb", "value": "tony.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6a9d11e-3326-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775637786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637786, "uuid": "c1953dec-2989-407b-aa63-c6f6a1da0a84", "comment": "Malware payload (Mirai)", "value": "7d3c177f415f11745de0389ffcdf8190", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637786, "uuid": "c03d9780-61fa-42e2-a69a-82a52a38fe4b", "comment": "Malware payload (Mirai)", "value": "0bf5fe45abd38b01a774ae42d38109c690bcef75a2a632cb1472263f30eb9fb2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637786, "uuid": "d2547347-79c4-4f80-a410-a0c17202201d", "comment": "Malware payload (Mirai)", "value": "5d3ebd56ebe4fdceb3dffe64366f2cb8ae6946cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637786, "uuid": "7ecfee60-941a-48db-9bd2-e0919643f518", "comment": "Malware payload (Mirai)", "value": "c3b13d6c00d731798391228b06220553f3d5a7f6ebe9247dd54feb7fe2d7615f1f8b58eeb1949d7b1566d55551d2b9b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637786, "uuid": "e8de129c-962a-4872-9b57-dc180d0a04b6", "value": "T169145A01FB0C0463CA931CF44E3F0BFAA3621A9115F99115250D7F5A2A32DB7A68BFD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637786, "uuid": "1bdf3aa4-5ac0-40df-853f-94342e6b4d27", "value": "3072:ESZAGIiEgACYrerYqlNSwppHaecY4NXTUaN:HZ15BTYCrYq1QDY6Q4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775637786, "uuid": "4e45ec06-fd68-4149-af50-af6afbcbbb38", "value": 197308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775637786, "uuid": "25e3831e-6414-4949-a9a1-b3a53d3d188a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637786, "uuid": "50bddd21-edd5-4597-8711-e150faf3e1b6", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d6ac190-33a4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775691699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775691699, "uuid": "bc369133-4d9e-42ce-9d11-7278850a7cf2", "comment": "Malware payload", "value": "976892534a54818a506187a331ab5e24", "object_relation": "md5", "Tag": [ { "name": "antiddos-protection-net", "colour": "#3CB326", "exportable": true, "hide_tag": false }, { "name": "ChromeStealer", "colour": "#2EF335", "exportable": true, "hide_tag": false }, { "name": "jmn-la", "colour": "#8F5854", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "NDA", "colour": "#2F516A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775691699, "uuid": "9336115c-b9f9-48c0-9a4b-3ac94f5506df", "comment": "Malware payload", "value": "0fcca8220dcd1337e134d9b1e4844bd0ad78d2a773b711a65a5e108fe70bb1b9", "object_relation": "sha256", "Tag": [ { "name": "antiddos-protection-net", "colour": "#3CB326", "exportable": true, "hide_tag": false }, { "name": "ChromeStealer", "colour": "#2EF335", "exportable": true, "hide_tag": false }, { "name": "jmn-la", "colour": "#8F5854", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "NDA", "colour": "#2F516A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775691699, "uuid": "74404eee-6bdc-492e-8101-de86135a2031", "comment": "Malware payload", "value": "4f850be92335a287aca300c8181b91f2cf54d895", "object_relation": "sha1", "Tag": [ { "name": "antiddos-protection-net", "colour": "#3CB326", "exportable": true, "hide_tag": false }, { "name": "ChromeStealer", "colour": "#2EF335", "exportable": true, "hide_tag": false }, { "name": "jmn-la", "colour": "#8F5854", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "NDA", "colour": "#2F516A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775691699, "uuid": "e6e0127b-ddc7-4b7a-96eb-02b7a7dac392", "comment": "Malware payload", "value": "6b6f05b26240fb79fcb25bad95c5899e526845166e3dc81d5eebc252f18dc32428627094bc464896c48ea8da871eb771", "object_relation": "sha3-384", "Tag": [ { "name": "antiddos-protection-net", "colour": "#3CB326", "exportable": true, "hide_tag": false }, { "name": "ChromeStealer", "colour": "#2EF335", "exportable": true, "hide_tag": false }, { "name": "jmn-la", "colour": "#8F5854", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "NDA", "colour": "#2F516A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775691699, "uuid": "e2206844-b249-463a-9007-69ce235cdadb", "value": "T103411979DB58C357DE8FD13E4FD2B6A0D086F395328AAF2EB33422C0738C08546661A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775691699, "uuid": "8a21552a-bb74-4f0b-8636-bb10a2e0c937", "value": "48:9nlRzL2Rv3V/3RodKJBSK2X80VS0yocxyN7r0W:9L03md0KMiS/xyBr3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775691699, "uuid": "aa33f4d7-4dcb-4c01-aad0-254876e98637", "value": 2184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775691699, "uuid": "35226d69-ca3f-4c7f-8f02-43b27fbbd0f2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775691699, "uuid": "a2613ee6-8a22-408b-a8f8-87c1a6c2d5e0", "value": "0fcca8220dcd1337e134d9b1e4844bd0ad78d2a773b711a65a5e108fe70bb1b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22d287df-32f0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775614238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775614238, "uuid": "952785de-741a-46b3-b6a8-3a2acfdf5ee7", "comment": "Malware payload", "value": "cf1447debbd5dc75c46ed691896d29a7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775614238, "uuid": "461fe70e-5e63-4eeb-be86-5e486d470784", "comment": "Malware payload", "value": "10deb5950f3028834cb114e55df2643221e6a2aef4ac4353198ad2e8fc227f29", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775614238, "uuid": "0cb03b61-945f-4236-a855-9683b4a3a872", "comment": "Malware payload", "value": "3ecfe8377e4ff8c5af5363184380b33375e7d9d6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775614238, "uuid": "234d69c8-28ce-4d73-aefc-dda1033f4b55", "comment": "Malware payload", "value": "48175afbc7b32fc086f28c7f0d927b237d29a0e4810d723bda31f0a5debf1e5326358608f2766b9f25c23559c13e863d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775614238, "uuid": "f8d1cdbe-885d-417c-9623-ef14865e6ad2", "value": "T18BF0F6D25861843ABF00E87D7D6B4790BA8231AF7D886E58306E7E104B8CA2871411A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775614238, "uuid": "dd3ba68a-5c12-40b2-a238-aca436339dc8", "value": "12:yncxm3AOnxEWIQhFF0AOnxEWpQoMAOnxEWIQcsdqWgoIQeFQyK:aYm3A0EWI+F2A0EWpjMA0EWIHObgFiyK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775614238, "uuid": "740f67df-d82c-4683-a9ca-7b8dc6196855", "value": 550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775614238, "uuid": "af1a154a-103c-4644-81d9-d579f6486b89", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775614238, "uuid": "c308e4ce-b4ab-463c-8664-b019e4132738", "value": "loader.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6124d407-332b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775639683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639683, "uuid": "26ad4316-1899-4d03-b013-7f4ab0610c6e", "comment": "Malware payload (Mirai)", "value": "e4629acee8399ed326a5389595d8d4d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639683, "uuid": "8c2bdfef-af71-473b-a2a7-c26874918e03", "comment": "Malware payload (Mirai)", "value": "131ae5dd5f6a42cbd2545befbda6ee051dfface7f9b0968940d36b830cda0dfc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639683, "uuid": "3a1fbaa4-f4c6-4603-9f56-0885c615f2fa", "comment": "Malware payload (Mirai)", "value": "cdf76f6610028e50641849c2770afe57bac53432", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639683, "uuid": "e58460d2-28a0-45e7-ba24-5ce75d40270d", "comment": "Malware payload (Mirai)", "value": "ee64313cdf6cafe312736102f5d9fe22a95a312fb08ccada53dcbbf58e479a734a991bfbbe7457cf8dbf6de6d8371651", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639683, "uuid": "3c7672ef-7baa-4747-9a20-2211454fe8e5", "value": "T144734B01B3880D43C1571DB13A3F2BE69BBFD9D122E4F685265F9B869172E33154AEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639683, "uuid": "5aa2181d-1c6c-4967-9957-91abad117aaa", "value": "1536:WddLAR3lg2NuNR6svs7I9l+cY3k3EvASJd:WddcRFS87In+01SD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775639683, "uuid": "20fa3d97-73c9-4640-bef6-f3f4787cd34e", "value": 79264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775639683, "uuid": "336f42b0-97d8-4b62-a1be-f610f439ae98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639683, "uuid": "7b0d21d0-41d3-4122-80a9-053aed2079bb", "value": "tony.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98737ef8-3374-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775671129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775671129, "uuid": "3ef01315-97be-46a5-8760-89c5619fdb49", "comment": "Malware payload", "value": "c526d2ec3c46274ed52664c98b35da77", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775671129, "uuid": "5e2af480-dcf5-46cb-a96b-5967ca1da0f0", "comment": "Malware payload", "value": "13beedd8a3f0a76dd864ff5693f3da4e70f7abf2fa846c9e51f1c87994ee0f61", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775671129, "uuid": "21a33617-5265-4dac-a606-f56cfe61011d", "comment": "Malware payload", "value": "a32ca202e48295c912128b1edb2eb8adbc18fa3f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775671129, "uuid": "5d2798f0-20bb-4a73-a8b0-bc82cd0270be", "comment": "Malware payload", "value": "3f9103a2ef13c20a8b038800647fe3898a722b8ba292711db6a177166684203a88ccdf7b57ade9af34c10d954457846e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775671129, "uuid": "2f008307-46de-47d8-a087-74a80bbc9712", "value": "T16415FB51C8701C027A4874758EBBC67DDEA3659B3FCEDBE307E715A2430CA686B06876", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775671129, "uuid": "84e1aed0-2382-4697-97f6-a46cb3988a27", "value": "768:xnRb9O21q6YiVLovrq6YiVLovrq6YiVLovMJPP0acketq1h3IUsP:k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775671129, "uuid": "ef32d874-9f6a-4c19-a154-15296201aa6b", "value": 937540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775671129, "uuid": "c1848c20-7e33-4229-b07c-741d07ef067d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775671129, "uuid": "cb7f057f-f665-4cf5-9fcd-f6ed0e561b46", "value": "sostener1.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "854b9974-335c-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1775660789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775660789, "uuid": "043e24b4-223c-431b-8228-215d8bba1948", "comment": "Malware payload (Vidar)", "value": "8c27301f9e6afb6097adb5fc88b2e5d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775660789, "uuid": "88b33849-1a16-4d73-9c3a-b2a3bc0c6109", "comment": "Malware payload (Vidar)", "value": "142fdb8fd9050a03e994ef33697c847cb64c2e2a1c822b48a32c01e2ac744149", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775660789, "uuid": "37849f90-56f3-40c7-826c-51ba28434fcc", "comment": "Malware payload (Vidar)", "value": "396e9ebd9b42f5b7e8b0af38549b11d76c21529f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775660789, "uuid": "587d02fe-c449-4756-b003-dbb2526bf576", "comment": "Malware payload (Vidar)", "value": "88e53e932d24130bde9cd5c3fb1a4f305476d477d14208384008d91a206e1357f4d12a88a70fabe55b90e3875462b69b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775660789, "uuid": "06a67735-d7d7-4a92-ad95-10e931721a43", "value": "T142862306E2DD7376E8769B3084FEF1438332B8914B6A269F1295C4ABDF735C40A39716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775660789, "uuid": "3989f3b5-7e18-4de5-9fd2-a80c3d7e7766", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775660789, "uuid": "bbe1fb53-949d-4039-bcb1-0b949a6a5cb1", "value": "24576:QW7T+/CIoTMi8e+oxbvWQA8ZqPYynIr/RkrJpxpWKCFB38h3FFc3zP9CMkyWvf9K:PjIU00TATPtnIopyD8pF63b9Chh1pgj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775660789, "uuid": "8f9fd582-68b7-46a0-ae4d-5eda5906df94", "value": 8389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775660789, "uuid": "0af03c55-7b00-42e5-8d1d-624a5211ff9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775660789, "uuid": "4e55e28d-786f-472c-8070-9e87bdb54417", "value": "fixed_Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c53b3f37-335d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775661325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775661325, "uuid": "b7f4f5d0-f96b-49d4-bd7c-2f7e70dfabd1", "comment": "Malware payload", "value": "0541e78739c29579f9266daaada067ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775661325, "uuid": "a73d268b-e9f3-44f6-9bb9-6c091c837fc3", "comment": "Malware payload", "value": "146cd7ad383cd52d1c66dcbff1d29703456b7b8ac170086908c0a6ff109d0507", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775661325, "uuid": "88af00cd-abae-4a8f-b3cb-0f09a8235260", "comment": "Malware payload", "value": "f2b6cb396af3a72b242d77ada2eaf549e67caa55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775661325, "uuid": "769eea04-f1ba-4bf3-a5b9-0a3b9696faba", "comment": "Malware payload", "value": "b7d0ebc7aa2240f459ff736cde97a7c58ea2fc2fac8d556acdbb0932b930149fb16d51667c24bf7c39c2fcdf43f32a3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775661325, "uuid": "8d98d962-3190-4ea8-bdce-8fabb0c810d1", "value": "T19F66AD0993E401A1E52BDB38C6268733DAB27D926735C24F015AF6492F73A518F3F726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775661325, "uuid": "826c1070-d9d8-4fe9-a8be-a862a0cd2fb4", "value": "d904dec91f80ad88d37892a2fc5c52b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775661325, "uuid": "f61793e1-7d4d-41cc-b80a-909193f6423d", "value": "49152:aJdyICvaFVHcOknH7+2e7/r4Ssqar9fqmJ0lXTRcH9VE+lO6pnyH+/QHGMEaxZBF:j/yMf4/+HBtf+B7BlKDV1gs7tuFvvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775661325, "uuid": "5c26f23c-63fe-4983-8f54-56d99faf17bf", "value": 6884352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775661325, "uuid": "d724317a-7748-4bc9-9c42-4696d02597b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775661325, "uuid": "4f9a6915-37ab-4a64-af58-3fcad28acff5", "value": "0541e78739c29579f9266daaada067ba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c1f65b0-3314-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775629769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775629769, "uuid": "39af58ef-0379-4905-88e9-c714d6602894", "comment": "Malware payload", "value": "0f0085911b7680f02b79562b50326a06", "object_relation": "md5", "Tag": [ { "name": "oficiospolicia-com", "colour": "#4B94B2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xx-kak-is", "colour": "#B502AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775629769, "uuid": "fbcdb211-0f1b-43a5-8b7c-c93ead0321f6", "comment": "Malware payload", "value": "14c92156444da27d28035f1612a6d4bc01d08c16bba1603d5aac398a6a987f8d", "object_relation": "sha256", "Tag": [ { "name": "oficiospolicia-com", "colour": "#4B94B2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xx-kak-is", "colour": "#B502AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775629769, "uuid": "43eecddc-0309-4929-a821-dbf199bda84b", "comment": "Malware payload", "value": "60eeb9f75d773a8fcf9e645df8d8e7b45bb3746b", "object_relation": "sha1", "Tag": [ { "name": "oficiospolicia-com", "colour": "#4B94B2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xx-kak-is", "colour": "#B502AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775629769, "uuid": "175edb1a-8693-4375-95f8-2e42fa57c1ae", "comment": "Malware payload", "value": "bdcd87f7027a72424c73d8f5469f634ae6af786a8d32f37e6d2774fa4c5ed1c56c068ea877a575052653c914e51fb0e8", "object_relation": "sha3-384", "Tag": [ { "name": "oficiospolicia-com", "colour": "#4B94B2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xx-kak-is", "colour": "#B502AB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775629769, "uuid": "181bc588-c01e-41d3-bece-f0e4c2553c47", "value": "T157D0A7046E20568C0A6510994FA01D4B3001672787F520F2E7656CDA8E48B1EDF125DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775629769, "uuid": "150ec804-d901-4a53-b47c-8271bd2fd0c7", "value": "6:sih85oMhrSt5VpCj7b2C3IsHnEkukbKunpXNLm4QqGJ:sY85brSvVK2uIsHEn6K25NvYJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775629769, "uuid": "e7158550-e10e-4453-a77d-719458c9e29a", "value": 232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775629769, "uuid": "357e555a-ff94-4020-b8ba-97d5a432d804", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775629769, "uuid": "a280d37b-6365-4f26-9917-8d9b8d06556f", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef1fac2c-3326-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775637773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637773, "uuid": "a04e275b-4991-47b5-be37-918018e555fb", "comment": "Malware payload (Mirai)", "value": "352e01d60f2d3f51218c2825db937a2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637773, "uuid": "0f63eea5-c22e-4d67-895d-60207620a391", "comment": "Malware payload (Mirai)", "value": "1579cc1357653da82ca9f6f0f5fcdebd6f21402eb5b035c3cc40cd5da074880b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637773, "uuid": "bbb4dca3-49aa-4795-8ac0-305296f403af", "comment": "Malware payload (Mirai)", "value": "72f4e6984162d3bc98852c39134ed8c9a8f7dfbb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637773, "uuid": "4fe757d5-f4a6-4979-be7b-81c67c3b3f50", "comment": "Malware payload (Mirai)", "value": "3a46fb582940789870e0f8c822364484f413c33b959d11042d246a8ae411a726dde3163bd52f160f8ed116bea1925154", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637773, "uuid": "964b43a9-0c42-43b2-a519-4c4164dfe716", "value": "T19F148D68FE4F68D2D2C7E37DAE4A0FA230277D749565C0B51A00A29FD5EAFD488D0613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637773, "uuid": "9a6a208e-1168-44f9-88e8-bf1fe8158c22", "value": "3072:badBpAIWIfbEdOcdY3rZiigZ2eNRzPxc:bOVfbEdxm4iube", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775637773, "uuid": "03faf24e-5cd9-472d-be02-b65d85177a6b", "value": 197488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775637773, "uuid": "be0b4e85-b76f-4642-b5fa-930a06b508b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637773, "uuid": "638f9498-b848-4dc0-8105-5bb7826bbfa8", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23dc8f02-336a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775666638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775666638, "uuid": "0cf2743a-1906-4e70-bbd9-1076d678ccf9", "comment": "Malware payload (Mirai)", "value": "0b51185df9e14e02a317781c76f829d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775666638, "uuid": "9083fbaa-3050-4af3-94f2-ad8b3d724b24", "comment": "Malware payload (Mirai)", "value": "1611b91d57637bebb6eb97642973d444fd10184e44c7f2639a57834953722741", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775666638, "uuid": "4b477036-5418-4c25-86f6-25ead5e07422", "comment": "Malware payload (Mirai)", "value": "67a09539f9663df1922056ea0d289654b7251845", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775666638, "uuid": "90800c03-ec77-43ad-89b4-304278b80eaf", "comment": "Malware payload (Mirai)", "value": "44efae8b708c2cacc2c8c37098f2b4b889f14c4da3050d292bdcef8438e75b84fd586c0a4424de9053865c7544a14216", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775666638, "uuid": "ba395c6c-0403-4758-b1c0-4c4907cc1859", "value": "T178533BC5AA47DCF5DD1405703073FF369AB6F13A2128EA8AD79DA6B3AD42602E00735D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775666638, "uuid": "353292c0-8a32-4b6c-a930-4f278d1d995f", "value": "1536:Lugo/Y7kAs3fRWTei0EgKX00L8VdZYgS3Nbvd6DuKR:LugyY7fsvRWTeicSrLQdGgS3NjcDP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775666638, "uuid": "7ad0bfef-7ebb-4a65-ac69-4732f0f8daa3", "value": 66544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775666638, "uuid": "ee17392f-738c-4014-8912-c998a033e476", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775666638, "uuid": "8b396001-8533-4250-a1eb-3cb4962e22c3", "value": "db0fa4b8db0333367e9bda3ab68b8042.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0011e5a1-333e-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1775647680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775647680, "uuid": "dc9a7849-a2ce-4224-8310-d06c963011eb", "comment": "Malware payload (ValleyRAT)", "value": "cadf12da2af1c6af6c1804d23f7ce046", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sx", "colour": "#3EA36D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775647680, "uuid": "bedec090-8a7e-4d3d-8a23-0b0c632a08fd", "comment": "Malware payload (ValleyRAT)", "value": "16e824e07ea10296bcea1a6b577f9199b8b10175b068b3d7f5d28b64577436e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sx", "colour": "#3EA36D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775647680, "uuid": "760139db-bb39-4a8e-8171-b46c50a959e8", "comment": "Malware payload (ValleyRAT)", "value": "df7205bf834d624ce9a4e0e79a72e82ca2af50d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sx", "colour": "#3EA36D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775647680, "uuid": "55634800-0448-4d5f-8412-3fb4f84a5f26", "comment": "Malware payload (ValleyRAT)", "value": "f18596499025f6c546e9d72039bda8fe192d45df865533f2527ac5f37dc4f03b0f0f1ada4293a7a859dfef7dd2f6c436", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sx", "colour": "#3EA36D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775647680, "uuid": "70bbaba0-28e2-4379-b6e3-82dc0eb902e1", "value": "T1A9267CAEBA7E5399C4B7C1B0E6B38186E53038459B7096DB2384535C2A731F09DF72D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775647680, "uuid": "725afad2-05a9-452e-b7a5-13f5ff6be64b", "value": "8b58c25d39acfac15143d9c5019818c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775647680, "uuid": "51ff90b0-b10c-40a5-8980-287c8e3c4724", "value": "49152:6jFCA7zd5/lAdq+jbZSuEmBNj9WS7NQRyZmHJsv6tWKFdu9C4PTvG7D/pHFhh6D8:OTXdar2rJsv6tWKFdu9C4i2m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775647680, "uuid": "8ed8baaa-9f13-4eda-89f5-5d727b7a5ce2", "value": 4481464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775647680, "uuid": "0b02273c-71ef-4f03-b642-6ce7e9a2b9d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775647680, "uuid": "e007c0a4-14cd-43c1-901d-24c8db556a13", "value": "2026\u5e74\u7b2c\u4e00\u5b63\u5ea6\u8fdd\u89c4\u8fdd\u7eaa\u4eba\u5458\u540d\u5355.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9fdd971-3365-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775664716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775664716, "uuid": "b24db59f-1f1c-4e90-954e-a147da7c4687", "comment": "Malware payload (Mirai)", "value": "9e2e76cea376d8aab8c25c6aac78614f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775664716, "uuid": "58f3d04d-6408-4f6d-a4d4-646f9e355a26", "comment": "Malware payload (Mirai)", "value": "174584584df9e7301ea990ffd5eb2f9965eb7091f80b2e566c2d9c17e8c338f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775664716, "uuid": "3621153c-3f86-495a-9678-7d56d0d1ce64", "comment": "Malware payload (Mirai)", "value": "d09d82b8841316b02468480be39d2b0fc38c059b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775664716, "uuid": "7cdcf213-add5-4e54-85f3-05fbffc806fd", "comment": "Malware payload (Mirai)", "value": "e6c353dd4923a6ccc46008e38e5eab95c42db0efe270842eef4115382391b5a0989c991bb83d4179b1f66d92176c2134", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775664716, "uuid": "6a4eb5f0-ee3f-4f44-baec-c41ddfc24415", "value": "T17B531A46BDD29A2AC6D023BAFA6E118D3321B3E8D1DA3247CC105F147BC991F1D77A91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775664716, "uuid": "f21ebaf8-8652-4661-8a8e-fd3619c9c4e2", "value": "1536:wBjIhKth6SvkEM5wcF5gz2Gq9ykyMpGz0U:ojUKth6BZg2n81MpG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775664716, "uuid": "16132697-1169-4dde-b29e-804e94d32d68", "value": 65000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775664716, "uuid": "9cfb9adc-8070-41d1-8d84-6a398f968bc7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775664716, "uuid": "683fc4b7-fd29-4da1-b620-debb022247c6", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25b1e4b9-336a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775666641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775666641, "uuid": "3bbf40f8-93c3-406f-8552-00fb8dbd167e", "comment": "Malware payload (Mirai)", "value": "4f0e8c2e35be31e3b04f4b1ff7e47a55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775666641, "uuid": "274a58b8-8ca4-45ae-836b-07757c083329", "comment": "Malware payload (Mirai)", "value": "17cb36c937204bbd02879edef6324ef5c8df945a344d239c3083905c8829410b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775666641, "uuid": "8eea52f3-8375-4cb4-b7a5-4fb788c2af8d", "comment": "Malware payload (Mirai)", "value": "6c553c59845a8e021c19362d9f078d4a07257a56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775666641, "uuid": "9696f415-f112-4ef0-9ea0-8091e6556261", "comment": "Malware payload (Mirai)", "value": "a026548915b3759ea634acc74c39330cc2efe8ab4803e2bfd1066b8b0c3eef703ff7d43a426c8bba891c02ceeeb22fe1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775666641, "uuid": "6258debc-8d5e-44ee-8dbe-a493f103ec31", "value": "T1B1E36C46FA808F13C4D5277ABAAF42493322A764D3DB33069D189FB43F86B9E0D63515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775666641, "uuid": "43e2e2d8-bad4-4c99-bb72-c19b99f56d0f", "value": "3072:mNAyqWSZYX0at6vnPi8R/Wx+t5C9gUcSLKuM/9ZJJl3:mNADZE0oGPi8R/Wx+tQ9ESLfM/9ZJJl3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775666641, "uuid": "78edfde9-b4f4-420f-8989-88a366c080b0", "value": 148381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775666641, "uuid": "43a40484-8f33-4f95-9821-d383e72be3d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775666641, "uuid": "6f8d0921-791a-4774-885f-9bc7d0114cab", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b20fb3a8-3352-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775656569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775656569, "uuid": "c3004572-b97a-482e-848a-5b9b2bdfdb46", "comment": "Malware payload", "value": "0b64b60c4ca8ff19ea1aaae786c44b8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775656569, "uuid": "c9ac38f5-707d-4e17-87b6-c1130f9529d5", "comment": "Malware payload", "value": "1819a4fa82f07a3409971fa80f9b318dd7cd7589b6654ee62d74c6cbc06c9901", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775656569, "uuid": "0717a015-98e1-4544-9148-fc541a493c0b", "comment": "Malware payload", "value": "59c7a860e6bc05fc79fed9ce18c1bbe54abce97c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775656569, "uuid": "5c36149b-538f-4c08-b2c5-67c5dce8771d", "comment": "Malware payload", "value": "d331981917b33d093021ba4dfad988b07f7795e6dffc1a3553777877fa9cedd2189ea8fb8a3d5a393a2f72c2f78b0c1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775656569, "uuid": "cb6d5d81-9cf2-492e-9bc0-7e5243917fd5", "value": "T171A45D2CDD78013BD2B3C60988D74E83AC571E0E140DDA5D94E6D7FBA233516B8926AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775656569, "uuid": "75312a43-3717-450b-8688-aeadbe61304c", "value": "6144:b5j72yse49Qu7I7/CIlghGZD9bhWy7tSuZD4puQMj4wL6jBmzIu1:BKyvu7I7/CIoGtR7tjd2uQPc6jB4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775656569, "uuid": "e0b1cf30-67ef-4c2c-be14-38cad44d04f2", "value": 462404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775656569, "uuid": "89125825-38f4-4d8a-ac1f-7fa87bdaeb6a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775656569, "uuid": "cc6d3dc7-0006-4002-8e26-f9ae8168e128", "value": "DRAFT BL AWB071-60559310.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0181c328-337f-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1775675600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775675600, "uuid": "55cc0e2d-5d27-4519-b691-e54be19837e7", "comment": "Malware payload (RustyStealer)", "value": "beb167453b4d5ff82ecad6779c4aaf03", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775675600, "uuid": "b861a99c-c241-42f5-8646-e17db3a41419", "comment": "Malware payload (RustyStealer)", "value": "19436d2d2d68eb4aa129d6878834e05ea939a13c09d83fe5ed3460c03ba85cec", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775675600, "uuid": "58b01baa-20a7-4a22-acdb-bb92aefbdd02", "comment": "Malware payload (RustyStealer)", "value": "4a2516d17c1a2f9bc9f32686ecf0bffdc982d95f", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775675600, "uuid": "56334cbc-86ff-4723-94ed-3c2db6675f30", "comment": "Malware payload (RustyStealer)", "value": "1dba793ce8eae4f69c001132eda41cdb313923d738241d00c76e13f57f254b0cbb0b55d00099bf32dbfae2603f5146b3", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775675600, "uuid": "f3e1cc84-0424-48c2-a512-46f0a2550009", "value": "T14BC51264598671D1F487DC3A5BCBBBBB7C92BC3C751BAA3E4088492C4A317B83594C4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775675600, "uuid": "04b1117d-ce0d-452c-884d-ac40840fcd7c", "value": "82fd9f56b5f7529d49a0f63b8ee9dd8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775675600, "uuid": "5f2c3f3f-7cf0-4789-bfd8-55d019783e01", "value": "49152:aWEMw4JM5JKAEymwaqxKW+E7bm6oTfEK8QQCqtUT8MSdcky5Yu/0L:aWtU4AjnjZsTfvVQlMxkyj0L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775675600, "uuid": "e86a4c1e-d70f-4e86-bb96-31d822841ea8", "value": 2695680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775675600, "uuid": "558313f0-faad-418a-973f-a9701a897e77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775675600, "uuid": "37cb9d7d-6954-42d2-9c55-cedd88c268a0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4c6dd07-3326-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1775637756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637756, "uuid": "08d179b3-a7c5-46df-a518-d34eed908284", "comment": "Malware payload (NetSupport)", "value": "8b02ae9b385fd3372ad6509ccc605553", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "hsgeowvi-com", "colour": "#212A9B", "exportable": true, "hide_tag": false }, { "name": "lkboasprqw-com", "colour": "#1C34F7", "exportable": true, "hide_tag": false }, { "name": "lkhpihf-com", "colour": "#C1C187", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637756, "uuid": "ea8ab1de-5492-4913-a873-aab470aefe57", "comment": "Malware payload (NetSupport)", "value": "1b325130ae390761a06cf420e6f9fcd8c7fe76baa0b356e92ef05b223534ddd5", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "hsgeowvi-com", "colour": "#212A9B", "exportable": true, "hide_tag": false }, { "name": "lkboasprqw-com", "colour": "#1C34F7", "exportable": true, "hide_tag": false }, { "name": "lkhpihf-com", "colour": "#C1C187", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637756, "uuid": "6af22fe4-1280-46bf-908a-797c6816ebf0", "comment": "Malware payload (NetSupport)", "value": "6ce79450481c1af490414aed81541690d61aac0b", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "hsgeowvi-com", "colour": "#212A9B", "exportable": true, "hide_tag": false }, { "name": "lkboasprqw-com", "colour": "#1C34F7", "exportable": true, "hide_tag": false }, { "name": "lkhpihf-com", "colour": "#C1C187", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637756, "uuid": "941f34d7-25e9-422b-8e2a-f78c6f94e656", "comment": "Malware payload (NetSupport)", "value": "0c50e99c30210d623c642e09a00dc6c24067e69b860f4ef0c7e82ebd9c22633162e961df766c0baa18b531950d3544f6", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "hsgeowvi-com", "colour": "#212A9B", "exportable": true, "hide_tag": false }, { "name": "lkboasprqw-com", "colour": "#1C34F7", "exportable": true, "hide_tag": false }, { "name": "lkhpihf-com", "colour": "#C1C187", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637756, "uuid": "5585b90b-eab7-4c88-b32f-dd80fe56eff7", "value": "T1E4B01233C0E446FEAF5FC83590151C58390002D8C3148FD136D052497C0CCC8C32280C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637756, "uuid": "e564d136-2843-4d06-a1d1-73b2ce28454c", "value": "3:VSJJFISnMcXR/JJNLNNQXLzEfOWM3FAJJArTyyN1shwdn:s8SMOBd+qAAJeTVm8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775637756, "uuid": "44d740fd-5101-429b-9273-3514a857057d", "value": 100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775637756, "uuid": "e0ba1de9-08c7-446f-9d2e-070e110564ee", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637756, "uuid": "94a348f0-77d8-4dd1-b357-bd10e1ab8d18", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac0236a1-3365-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775664719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775664719, "uuid": "6a7fe543-835e-4d01-a395-73f1071767a2", "comment": "Malware payload (Mirai)", "value": "7e6a4b02fa84327fef5ff08a690019a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775664719, "uuid": "2a45befc-f2df-477d-b932-18bf5795c823", "comment": "Malware payload (Mirai)", "value": "1b981385c18064399a3060cb55b1a98c443bd8c90f164fdcfda49d91ee6e5977", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775664719, "uuid": "453f213d-76ea-489f-8148-3830b57cf55c", "comment": "Malware payload (Mirai)", "value": "a3004aafd093f50fd94c8f4fb9595d9827599687", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775664719, "uuid": "16d9bae7-537f-49cf-a17d-0ce81e080156", "comment": "Malware payload (Mirai)", "value": "c05cf1c113af252d8745ce0589fdbc35d14e7a3c283720147f602a5171060905983e7c226c39b9a9980b03f1837dc630", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775664719, "uuid": "7cb7b713-4a2a-49b7-b493-e690f63e0e95", "value": "T13D731782F98B45F5D807093060ABF63FDA31E579407097ADEF4EAF34DE23A42911624E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775664719, "uuid": "0ef8797e-55c1-4b0d-bb1f-72e514decb55", "value": "1536:0/8IhWh7Iyvz7EydD3cXEqDAxPuxLv44xPuGWKt:0/VWqyb7EydD3Gd8x6w4xPT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775664719, "uuid": "94847fc7-2fad-434d-ab10-85405b4fe5f7", "value": 74512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775664719, "uuid": "2e8bb086-9e2d-445a-bca5-a0dfe8f1ae99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775664719, "uuid": "f3febf8c-6bbb-4afa-9fd1-ac05df19c642", "value": "db0fa4b8db0333367e9bda3ab68b8042.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de1fa9aa-32de-11f1-a769-42010a9c0008", "comment": "Malware payload (Ngioweb)", "timestamp": 1775606821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606821, "uuid": "f2150726-57d7-4a25-8c06-915d3fd18334", "comment": "Malware payload (Ngioweb)", "value": "96975cde1d8d6adeb8ec9396f10caeb6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606821, "uuid": "acd93a79-ae90-483d-b12a-2a32acb0e024", "comment": "Malware payload (Ngioweb)", "value": "1bea422550db39a211f644ad63eeb34bce2ae9a70b39d6c38d1b423203f619d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606821, "uuid": "2072523d-8649-4bcf-99df-7d1a4f97efac", "comment": "Malware payload (Ngioweb)", "value": "c78d0635c898ac7786ac73cd9d1028b810ca63a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606821, "uuid": "c0e13c7a-cbd9-4bb0-93a2-cf31500ab841", "comment": "Malware payload (Ngioweb)", "value": "af45ca34b7e859e31838a713f2e1245577091424792f8607116fa1cdb5168bbde1ea87fcb080a04b0e7158e379559ad5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775606821, "uuid": "fc539a9b-b639-43e4-a923-3a6fa8b5e574", "value": "T1FFD3F896FA809F46C5E03A7EFF5D238D33131B78D2EEB505CD259B34639648A0E3A941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775606821, "uuid": "7b8ef47e-748b-47d8-a679-ea92e616fd11", "value": "3072:qqqWJGjsWcnKiiqLrho5kb7ShqKy0Tz5zv0NMGgZa1:qUgj7cnKiJ9oKb+8KySRv0iZa1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775606821, "uuid": "fdee0903-9078-48dd-8d13-f28474dd12b2", "value": 132520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775606821, "uuid": "87e497ac-b4d3-4fad-8bc2-3a8416b53063", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775606821, "uuid": "4a8adf08-23b0-4f68-8227-4b8b29b5c856", "value": "QJSF", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a68cd219-3326-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775637652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637652, "uuid": "c5907cad-8e76-4f9a-9c62-38bf54a3f5a4", "comment": "Malware payload (Mirai)", "value": "60275b9180b50833662c893efc8da65f", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637652, "uuid": "4c8318fe-cc58-4ee2-abdd-2775bee65c4a", "comment": "Malware payload (Mirai)", "value": "1c4307d429ee6c11acf7ed5736591a8c7eee8991668f8e7a78f0f199a2a0202d", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637652, "uuid": "76a2e26a-947b-46bf-b14a-d343fa2a7d9e", "comment": "Malware payload (Mirai)", "value": "aa787db1786c4979cce94f3f3d3b1c04af077ead", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637652, "uuid": "1030629e-fdfa-4b7e-b39e-f1448787fe94", "comment": "Malware payload (Mirai)", "value": "e417c9357fa0afbc14e2578a138a47414967f8b45de786ce5251c184a77f7497d8adc154f23ed579153cf67366c4e614", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637652, "uuid": "44ff35c8-dd02-46e7-83d0-0ae75c6c54f6", "value": "T178146C2BB3C39CE6C51063308C316362776FD7081958EAFFDA1B3794A9977225A246C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637652, "uuid": "1fefc41f-1b70-4d91-ac8a-18f303f5022f", "value": "6144:1R9Om5159ZA0mzoWcz4Mm4ztkES7IKTtE:BZAyFzQSdS7Ix", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775637652, "uuid": "7d0715df-6c58-4590-b272-8a5aad213c8b", "value": 197352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775637652, "uuid": "fa1d59a8-f463-4ff0-a5b6-7e4402f8832e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637652, "uuid": "d262c82a-5d5d-4a1a-b4ba-c116b9294157", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1af03ae-3321-11f1-a769-42010a9c0008", "comment": "Malware payload (VexxStealer)", "timestamp": 1775635550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775635550, "uuid": "da53320d-a35a-415d-8286-98cfda2dea09", "comment": "Malware payload (VexxStealer)", "value": "a3bc64cbbd807f9c3fe10c5fae8a255f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VexxStealer", "colour": "#10C996", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775635550, "uuid": "a7b49034-1726-4324-9555-074b40ae9cf7", "comment": "Malware payload (VexxStealer)", "value": "1db4f6493fac300ccfa94b40376bba730b92618dd448a8106a11939de3b76030", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VexxStealer", "colour": "#10C996", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775635550, "uuid": "1bbe42ac-3144-4c83-a083-8ed671d068bc", "comment": "Malware payload (VexxStealer)", "value": "7886f825b252bbb688b3d823d3b709e55074b4bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VexxStealer", "colour": "#10C996", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775635550, "uuid": "4d83202c-77ec-4daf-abf1-61b8c5371bac", "comment": "Malware payload (VexxStealer)", "value": "5c27d105dbb236a88d15c424b89965d6b1beb554bf8475d971a3539e4ab5a45af4d4b003d1f5472282f6f94dbdce6ec9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VexxStealer", "colour": "#10C996", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775635550, "uuid": "8d1342f9-0ef3-4c98-bcc4-83e5e0894b25", "value": "T1F318337A5F96D84EC00635BB87E479B214E3B9921E22F03F735A81A894FCE32D534587", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775635550, "uuid": "7b7b7165-aa9b-4359-b8f7-e218dfd0f222", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775635550, "uuid": "8c77c536-8dee-48ed-92cd-260ca52a6f1e", "value": "1572864:nE+BWMFDe45k4cM06hDRVOzGyD1KWHsPKhwC8coHhdXmaXALwpD/M7rC:nlBFle45n7hDRVeBKQ5wvS4pm6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775635550, "uuid": "2f24df54-51a4-4152-83ba-3a82443ab53b", "value": 89084311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775635550, "uuid": "e4703139-fa87-4002-8040-71fb45dc8444", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775635550, "uuid": "64e82b40-4d5c-45fa-a3d4-da1e3b59bedd", "value": "Palamod Setup 2.1.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aceb01c4-3326-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775637662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637662, "uuid": "edffb883-41b6-4990-b4df-06ec5f546205", "comment": "Malware payload (Mirai)", "value": "934afda0005dc6f510a020fb3632e972", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637662, "uuid": "46aee948-34c0-4816-84ee-d66a71e4d852", "comment": "Malware payload (Mirai)", "value": "1e046c1095d82fb2f9ce180f1dea20db93cb1bfe6d03af49622e452179e900ac", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637662, "uuid": "b02f2f8b-8fa1-489b-896c-f43b7e392c48", "comment": "Malware payload (Mirai)", "value": "63776eb222743717b2a002a3004f5256b216530c", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637662, "uuid": "12aca9c2-acbc-4ae6-b462-4128242fe02a", "comment": "Malware payload (Mirai)", "value": "46ad473eeb91f55b1b9fb9f4142322ea9c2805eb3040974a146ec0b426370369a0baaaa064cd42e48a58b47ebb72abca", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637662, "uuid": "89096dfb-b90a-423e-8fd5-d681e046b6bf", "value": "T1DE5301FA70E83ECCC1954670060B05463DD66738A15E663B72C8F6A84BB1740DFD8BE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637662, "uuid": "6e244274-24ce-413f-a424-82064e04b51b", "value": "1536:e1/S5aOdeB51F+yuXkoPgvFbFX6hTZ0f8AS9Lkg4azHJ:eM5az1Fy0oPgdZX6hTo8R9LGazHJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775637662, "uuid": "d7b85698-ef0d-4242-8843-06d22b183e23", "value": 60816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775637662, "uuid": "d7d41059-489d-4161-b73b-aa4956f6e84d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637662, "uuid": "a406b8ea-1038-42fc-8662-077719016b80", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13b70206-332d-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1775640412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775640412, "uuid": "b27cf0c9-5ff1-4044-a0d2-0656aded9401", "comment": "Malware payload (Smoke Loader)", "value": "7417003ec2389448208d1ee4e1743da1", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775640412, "uuid": "67856288-fbc2-4f89-b9b7-5c7667c5b179", "comment": "Malware payload (Smoke Loader)", "value": "1efe0eb53fbd3e9c2353e27db46a403e93f187860895530b78cb40ca2d2a2d75", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775640412, "uuid": "b67c042b-c497-4028-a595-b5a6742699ca", "comment": "Malware payload (Smoke Loader)", "value": "ae5e25bcf26d4aa338ba619685b8755925453bd9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775640412, "uuid": "80281c06-9fae-4a46-8308-144e8a998b48", "comment": "Malware payload (Smoke Loader)", "value": "b846adeb43d9a2055b3c7178773d6789d2db83875c6e1cd5912f444ff9a72018acde03fb170576f22b4f2b1ce9e71e2d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775640412, "uuid": "701b8d62-da84-42bf-9621-f1342bc79702", "value": "T1EE654A8B7CD008BAD4AA533288F26192BB76F8290B3233D72E50B6783F767D05975754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775640412, "uuid": "5feab377-f2c2-4515-b534-c13a2f6b879b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775640412, "uuid": "2f466ef3-1925-4fc4-8f4f-8e164dc4678b", "value": "12288:DiETxyRaKhCXeh2hHRd68SWajL+H011T6bTHeB8RqGWdzkDMfbGb0SWy+fTfn:Di4wtue8hHz6DLZ11T6bTH7qGiWPbkf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775640412, "uuid": "148b4860-1833-45de-9baf-169ed54a4e58", "value": 1473152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775640412, "uuid": "08251fc3-bee5-4ba7-8647-b3699fdb05e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775640412, "uuid": "ec7893e2-9fb9-4c65-ba9e-8265acf0e472", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6813380-32de-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775606808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606808, "uuid": "b10f3926-43d3-4eb0-abfb-1d95f93451fc", "comment": "Malware payload", "value": "c44eec70ce2841997012f91a28cc62cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606808, "uuid": "c4f8801d-ca3d-4c9b-b96a-ffa7f34ade32", "comment": "Malware payload", "value": "202d1e3eccffe6ac67e54882c0e070f8a4730d5e117ed52043e4ad294ec857db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606808, "uuid": "0fd02886-ba68-4e6b-9169-a20db4bd4ac3", "comment": "Malware payload", "value": "751cb5d69c347123ee5598dd1f4c790826da30f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606808, "uuid": "edd09beb-168d-479e-a49f-54e1492f0376", "comment": "Malware payload", "value": "fbbd3de7ec5dbdf3feaf834505614449f98328bc67b27e397da58023ccbd8d4d270f94bc9b603b205209533df841ba34", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775606808, "uuid": "9beb9002-3647-4d0d-bfa8-29a88428b107", "value": "T1D5148222A344B799CE467C3B56CBFE41739A71D4025081627A10634EDBBA72BCF0EB4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775606808, "uuid": "b9ddf216-1fa5-4cb9-bcf7-90f32d33654d", "value": "3072:rHvZLOQdJ0vUV7Hpq42dWSSLgkKpArmnsUSOdJ7ZyUlT8T2T7:rHUQdJ0vUNqWSC5dKnVZyUlT8T2T7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775606808, "uuid": "24b34f1d-4859-4829-b273-6a0ae926053b", "value": 198200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775606808, "uuid": "2e9a7046-1718-4015-9041-02521559146d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775606808, "uuid": "cec2fc20-2050-4968-8eb3-ff43bfbca3fd", "value": "JUIX", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90edc71d-33a2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775690873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690873, "uuid": "8a5c5930-b958-4851-b3ed-4280146ccbee", "comment": "Malware payload (Mirai)", "value": "fe0687ec974b9c81309b41d7fc520731", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690873, "uuid": "72b6f67e-6b4e-4db7-a29c-f3d27a156a84", "comment": "Malware payload (Mirai)", "value": "203e7f4f42be2000730f80f1ec0eeb716da09f5e096d91f1ab9c601ca4af6d4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690873, "uuid": "2becd613-6303-4c41-a9da-252ea847bf74", "comment": "Malware payload (Mirai)", "value": "288c081e23865110311906e8a35f512e2bc5a2cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690873, "uuid": "4249f69d-89ab-4e89-bf25-311fa12d33dc", "comment": "Malware payload (Mirai)", "value": "2cd091e4a424abadb801e7db0fee1a8c0914d36e6999c7252ed112019876ad79f66273174efd5cf13546b9eea7b13c98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775690873, "uuid": "8ad38ba3-8da5-4aff-8d4a-48d6de41db3e", "value": "T114432925AD792E26C0D4B57A51F78714F2F2220E26B8C61E3CB21E4EFF04B4065577BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775690873, "uuid": "f594b9b5-3cab-470e-b692-6ad29863607b", "value": "768:TXon00+q9wp3C+vactfa1sDHgYAzsv6WswWSHoXdss63B/9JO+zC3o:TXw00+SY3CaactfI6gvzsv6vwcGJL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775690873, "uuid": "d3e5c226-4ccb-4ac6-bb35-d0f4e3184b30", "value": 60116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775690873, "uuid": "7548dff5-9f67-4e3c-860e-f751b3f6abbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775690873, "uuid": "8480737e-e674-4706-b7e3-6b39754a1695", "value": "Josho.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e970005-3363-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775663757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775663757, "uuid": "958ce65a-ac36-49a5-98c4-faf5f7d9a562", "comment": "Malware payload (Mirai)", "value": "d3518d22261b20ab27b906ab96c57f5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775663757, "uuid": "24a74df0-e06c-476f-8ae5-8b990e7c15b5", "comment": "Malware payload (Mirai)", "value": "2062a9dea2bc961f72b424f7b5dc8e510cc8bdf01475f9c15b23156a6224afbc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775663757, "uuid": "581b36d8-8b35-4b85-9eff-882402a0e9d0", "comment": "Malware payload (Mirai)", "value": "bf5a94c3039be60112b95ca0e5dac07be6d65201", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775663757, "uuid": "f94dc45f-302d-489b-aa61-54f7f3e27636", "comment": "Malware payload (Mirai)", "value": "a70c15ac8d24105635de284b86ce23bcc4ba5da8a56541e98e6a6641fde14a95e5dfe16e0dfc7fedc8e51ee7780c7ad2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775663757, "uuid": "a2f8c46d-8d66-4a3e-b232-c868e01e7452", "value": "T17743F172D48E19F7CFD0EE31F835020F219CA736DCECB166076991A695D7249AA3820F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775663757, "uuid": "0facd241-ae7a-4308-adc8-effe030e758c", "value": "1536:W7a8M/l+526ap8I6rR/TAIeHIVGu9Vz3aY:aKy23p8zdf1zB3aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775663757, "uuid": "a314a5b8-e53e-4bae-984a-7c5a5cc919f6", "value": 55992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775663757, "uuid": "acbefd4b-4157-4fde-bb46-6135ba20a1b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775663757, "uuid": "0db16952-b0be-4e92-b833-58e3d5b99f63", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f644d72-339e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775689126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775689126, "uuid": "4a311630-8cf0-4992-b378-6356160a0540", "comment": "Malware payload (Mirai)", "value": "e53a4d648763334a68b0a4e0aab8f752", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775689126, "uuid": "5bd5297f-0222-46ff-991a-85c2b09e921c", "comment": "Malware payload (Mirai)", "value": "20f0d750693f4bd1ec3e0479f4a6d7b5fbb087ccc852881fb356d6a247eb1b70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775689126, "uuid": "416bd0c6-8fad-4377-98ed-03d07eef89ca", "comment": "Malware payload (Mirai)", "value": "0eeb944eafac8b962856558ccc1c628530c3258b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775689126, "uuid": "bcca1968-e483-4bfc-97e7-94da7b209364", "comment": "Malware payload (Mirai)", "value": "5689ef4b022ebf7177b3b322105f0b75dc9239dcdb6c9a5fe85b08d6e8dd52ba17340e660d10d00e7abd9f95bf20df11", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775689126, "uuid": "47fbc836-5c59-4b61-8ec9-831e2fb5d446", "value": "T1DAF3E842BD418F13C5D722F7FB9E42893B156B69D7EB3102A9257F90374A8DB0A37211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775689126, "uuid": "b2c6921e-31ac-4281-af28-f9f2027cb195", "value": "3072:oeI2E8r666OF4V4rBPXtmITdVpl8qywTFWICi0a:oeX661qV4rFXtmITLTLywTsji0a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775689126, "uuid": "596fa89d-eb5a-4212-b932-c836195167cf", "value": 170556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775689126, "uuid": "8b45785a-8c08-45ff-b66c-eeb6b990a505", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775689126, "uuid": "1c585ab9-43ea-4384-bf77-d6706bb10864", "value": "narm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81ece7e6-335d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775661212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775661212, "uuid": "4fe9c8bb-2b25-4018-866b-f158a457a6c6", "comment": "Malware payload", "value": "0f52b8c7b98fea48d9d23ec0de4232f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775661212, "uuid": "73a8acd8-7ab5-4869-b44e-6c91f902425c", "comment": "Malware payload", "value": "214d49d162775a25c3c8b2d55cef0b717406e8636fe125062560e65aca8374b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775661212, "uuid": "db6e82ca-a092-4a47-8881-251fa086e8c7", "comment": "Malware payload", "value": "bfc3a48cfa930c1a69d4a340932248f434815c00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775661212, "uuid": "fb12df5a-48d9-4774-b74b-1ab1f8d17987", "comment": "Malware payload", "value": "8cd8f34f2dc9877654d2334c9216041a8ef8ccde0eb5580692b3156ac752bf1129c5a8c4b88c0ec1dbf2a09c7b6da12d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775661212, "uuid": "12e3c1e5-251f-4825-9c4a-37c4191e94d1", "value": "T120F5D087F3E944D9D027A1388756970BE2717424032087DB3F958A6ADFABAD0DF7A710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775661212, "uuid": "e97e3a33-a84e-4ff7-8e00-cd792a356821", "value": "941e08113cfef3293a0bb27a0904601d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775661212, "uuid": "8fc15733-0062-4aa2-9f93-16ae47b4f06f", "value": "49152:zIYdjuq02PQ3MwWC05AjDRdla/3NT4N7Oh3dFt/Nn1Er2:8Yex3Dl0YYPNshOh3d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775661212, "uuid": "0d6b46c2-61b8-4c60-b94a-9938a5d43312", "value": 3411456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775661212, "uuid": "01dc0aa1-4561-414c-a907-eb55cd8f624f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775661212, "uuid": "b9533fe4-d9e8-4135-9974-16ed3641fcbc", "value": "0f52b8c7b98fea48d9d23ec0de4232f1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f6f1222-33a0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775689958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775689958, "uuid": "64262d42-c3ee-482e-945b-18a141c62046", "comment": "Malware payload (Mirai)", "value": "ec00ef6b46b381305e8f06829ac407a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775689958, "uuid": "fc1e6065-8fc7-4089-91d3-cf616e829b88", "comment": "Malware payload (Mirai)", "value": "22698b276f1330cc5bba78d3f16381a1ecc6b200a92b936ae63fe714439f31a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775689958, "uuid": "2b12ff30-69e7-40a2-ab42-4bbf70941497", "comment": "Malware payload (Mirai)", "value": "4311751e4cda01a670fb7bddcc192597278e69b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775689958, "uuid": "0eeb474c-221e-42eb-8165-87acea7a74e4", "comment": "Malware payload (Mirai)", "value": "57532c8675934feded6a2151557c3eed84b2aac4ace541f4cd8f280e0ef842e0c4e7517f0fbc4a64410142238c7da60a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775689958, "uuid": "19a9a2aa-fdea-4599-a877-ffd78d38d3d9", "value": "T1FD44641A3E22DF7FF66D877047B3C920569836963AE1D585F16CD7081E2028E641FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775689958, "uuid": "155ee443-aa24-4dbb-9d1a-25eb19ea4172", "value": "3072:bp8O+azXTIvb9+5kSi4X2SC/XEuV9rS2V/sMBWVACt54L:bpp+a3IvbgiVz/UunrP/pYVAg54L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775689958, "uuid": "b63b36a6-7919-436c-a6d3-0a377b83929f", "value": 254000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775689958, "uuid": "66678acc-cc9c-4d91-8a06-35c862133c03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775689958, "uuid": "6bf8b22e-ffc5-42ad-8105-6962e5ec31b2", "value": "nmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3247a27-32de-11f1-a769-42010a9c0008", "comment": "Malware payload (Ngioweb)", "timestamp": 1775606830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606830, "uuid": "99064cb3-8d80-4f9f-8d9a-ff020f57038c", "comment": "Malware payload (Ngioweb)", "value": "c1371a58bf70f14fc2897dd53d7680e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606830, "uuid": "7848de6c-7cc4-4d8c-ace7-50d4890b3e5b", "comment": "Malware payload (Ngioweb)", "value": "25756bd4d6028d9402d02e00f7ac00bf2b23c64e420efa4be01cd965c0594b9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606830, "uuid": "f98401f2-ac31-48e7-bf22-82ba5dff2863", "comment": "Malware payload (Ngioweb)", "value": "f62d8e53fed08f976b7549c25a89eedc6fc2b532", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606830, "uuid": "b5f6e21d-650d-40dc-a62e-4041aef5cd1e", "comment": "Malware payload (Ngioweb)", "value": "744060d37e18047e385f123868ba3afb70dd3459ac634fe54cdaff93ca3a2b48d185bad765cd4ebffa80a94d9b42fa6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775606830, "uuid": "8c353c1a-b6f6-44f4-816f-e2f209e0aff6", "value": "T1B483DFADF3E66D0ED894F73D3711A4D50810FE3FFAEDDB0A691074BE662C5281A21264", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775606830, "uuid": "31483848-0281-4dac-83c8-5238ac369e0f", "value": "1536:0O9zgt/ZsCbbIlAe2jarx5/trjUMPKHZOgO/TbFoTgFEWsRTJr94+L9s:D9zgt6me2erDtrfggFo0iWsl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775606830, "uuid": "8142f9ff-046e-4442-8e41-e0c09f6f1c17", "value": 88160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775606830, "uuid": "746ac27a-5543-4c26-ab6b-0a608e371d45", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775606830, "uuid": "2e7bf053-dc23-41c8-a80f-4df6ca003fe8", "value": "MGZJ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e14dd369-3335-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1775644193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775644193, "uuid": "d9c66b41-bc5a-4196-a5a6-71b9389a6227", "comment": "Malware payload (SalatStealer)", "value": "8ad80ca6ff823594cb94808363f779da", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775644193, "uuid": "afce7d8e-1f52-4c4b-bfbe-fb85f5dba3c3", "comment": "Malware payload (SalatStealer)", "value": "2596ec68cb1e482e28d53e1ac2ec22d2cf21b3df24c6fb7e6398f5cf50fb50b8", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775644193, "uuid": "fc29005d-dfb0-4926-be62-e5a4c8ed2e33", "comment": "Malware payload (SalatStealer)", "value": "0d0ffa3e6f4c370911b399b4a923632ffc6c9e7f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775644193, "uuid": "5f4d8ab6-5ffc-449d-a637-ebf36342b545", "comment": "Malware payload (SalatStealer)", "value": "303f81a6cac81d2ecc1ee85a3da931b4a66c4fc042585581e7d26c597cf2e12fed88ac960df8b1cdefb13a070a3c8438", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775644193, "uuid": "f1c804d8-aa88-467e-bdb0-b1aa2cb91704", "value": "T124F533D5A3A67EA2C6053FB341940F990FD20E42F631B0919E609BC8F1B511BA75FBD2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775644193, "uuid": "220ffa93-7c08-4de4-a963-ea453366dc4f", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775644193, "uuid": "0edc07cc-c350-496b-95b3-31b4214ea934", "value": "98304:4dq7taTJ2LNYv0DcI8jDmxeKLa6V/ERinHoCi:CoiyZv8/TIaOaei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775644193, "uuid": "2a48f58f-1856-4256-b3dd-c6ccb89b7243", "value": 3593728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775644193, "uuid": "2e6f783e-3b7a-4623-a8bb-75d231d3511a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775644193, "uuid": "3bd8faf3-5a34-4ba5-a993-ee4dd310e909", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c44fdebd-3352-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775656599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775656599, "uuid": "a3a74af5-0b7b-4ac5-b08b-cf98dfd71dfe", "comment": "Malware payload", "value": "ea67bf74c5c6342580075c2a309d520e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775656599, "uuid": "e8695630-3254-4dd8-941d-ea54df4e6a0c", "comment": "Malware payload", "value": "2676c426fe4f4be2fe9c6152ec2132ad4fe6640dfec291a2ca4a6749414a7b1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775656599, "uuid": "e2e10e18-734d-4502-a2e1-f766689ceebd", "comment": "Malware payload", "value": "8cf7bffaab48eb03525ca237036a2827224294ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775656599, "uuid": "2da2ef98-1c83-415f-826f-1396e10f17e5", "comment": "Malware payload", "value": "7debec3761964867857eb722522d97cf58703aa762ec850ff49d92b28be99db344d45c55198d6e1cf50bc4c02f726e62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775656599, "uuid": "4190b512-2b93-47e8-aaf6-d077d7e52eea", "value": "T1E294D13AD8BC423FC43F890C948E5E09BEF0595B371C4F5A8586B75AF6125C3688369E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775656599, "uuid": "b6c67690-55ef-455d-ac17-3a4e647e9b6d", "value": "6144:O2esNP1Gq4+JkPwtLSFdxKeDMyr88D6FiOQBTe8cNJjncSfXCFv4VSV0:O2esHG2k1FdTDT88DfON/NlcykS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775656599, "uuid": "a9c05ff9-14bc-41c5-9957-09f51270efda", "value": 424770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775656599, "uuid": "f2567882-d6f4-48bd-891d-67e037609793", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775656599, "uuid": "9e3e2e10-c14d-4d03-a713-587b1ca0ae22", "value": "PO M20875001.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffc21e03-3316-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775630929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630929, "uuid": "0fdf2654-4677-42ca-ab12-670e1c29aae2", "comment": "Malware payload", "value": "b24ed7c9b7e2236ff34a944170b67fe0", "object_relation": "md5", "Tag": [ { "name": "Agent_AGen", "colour": "#118452", "exportable": true, "hide_tag": false }, { "name": "Cerbu", "colour": "#E330E1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Xegumumune", "colour": "#523D5E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630929, "uuid": "e56c56a4-e607-4000-b393-eab68f8bdac7", "comment": "Malware payload", "value": "26ab095109deba210323ff03c72d8ecec9c33c7215b530d2acd00ccaa0053edb", "object_relation": "sha256", "Tag": [ { "name": "Agent_AGen", "colour": "#118452", "exportable": true, "hide_tag": false }, { "name": "Cerbu", "colour": "#E330E1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Xegumumune", "colour": "#523D5E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630929, "uuid": "e84d1fca-dee3-4130-b20e-85f50edb1481", "comment": "Malware payload", "value": "a7adbf18210809b5dad572a5ce6def04a65b9844", "object_relation": "sha1", "Tag": [ { "name": "Agent_AGen", "colour": "#118452", "exportable": true, "hide_tag": false }, { "name": "Cerbu", "colour": "#E330E1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Xegumumune", "colour": "#523D5E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630929, "uuid": "fcf71f64-61a4-4ec7-bec6-e50c791ae151", "comment": "Malware payload", "value": "2afb64918f6976dd2f39e4400e86c330da87b8b2480b96c2fc8fc3c63cf1b5dc2556293d2fbd5433a4ba7d5818522d3b", "object_relation": "sha3-384", "Tag": [ { "name": "Agent_AGen", "colour": "#118452", "exportable": true, "hide_tag": false }, { "name": "Cerbu", "colour": "#E330E1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Xegumumune", "colour": "#523D5E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630929, "uuid": "09c758ea-9680-402a-ad07-87cbbfb739c8", "value": "T14F368D06B7E50AE0D126D27CCA6AD372D77078545734CA4F25D8E61E2F33A908E6F326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630929, "uuid": "ef274514-51da-4f14-8d4d-a461835e50a2", "value": "5ddd4d07d62bcef8c27a53c26c4f53a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630929, "uuid": "86e3ed9e-49c3-454b-b0c8-960794bf8c64", "value": "49152:qmgSlBWQALRnq5monrLnX8/rnq4/IQfG/m/XA59nCZ54Q+WeRYkma+eAstueK2Gm:gq5Ajq4/y6qjweK2GKH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775630929, "uuid": "adafb964-1fdd-4f5a-8750-9699acb8c150", "value": 5317120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775630929, "uuid": "ad65e2e2-6d4a-4261-b563-93b1b3fa686a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630929, "uuid": "aa674a01-d2a9-4927-876a-8c7c7eac79d1", "value": "\u70b9\u51fb\u6b64\u5904\u5207\u6362\u7b80\u4f53\u4e2d\u6587\u8bed\u8a00__.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e267678b-32f2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775615418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775615418, "uuid": "49bed78d-8edb-4001-85aa-c4361fea3b07", "comment": "Malware payload", "value": "609c2c301519250c32eaae0cb2141cc8", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775615418, "uuid": "61371cec-f615-4ca4-a8a7-ab371c014f26", "comment": "Malware payload", "value": "27333051b76472e14cdcb8068481288cc5ab1fc7ffb1757244511bc0705d2e44", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775615418, "uuid": "f68dcc1e-d81e-49da-a01b-019c31092f3b", "comment": "Malware payload", "value": "e34823fdc5330977bbed7e7cb029acba7b5d9959", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775615418, "uuid": "af17937f-09d1-4a9d-a616-6329abb311f2", "comment": "Malware payload", "value": "7dfd829684af974d7fa88d85d40dc581b985b870f87f1123131c84fc183ac3e5f7d3ae81c9043604f865624923f30a50", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775615418, "uuid": "6ba7cb9f-62ec-4a28-9623-bbd7739bf34f", "value": "T1ACD57C213686C836D57E02F02929D77A53693EA40B71C1DB63F8ED2F3DB45C25E31A62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775615418, "uuid": "b2d02fa4-3c55-4ff7-9fb5-db55a7cff1ab", "value": "49152:44qYaZrf5jSTUial79JrMf+7UVZDEFec4vLNgmUESIEjPMN2lv+oBsYQMV3eVou9:KjSTB6q+N4veHjPMNaAYQMV393A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775615418, "uuid": "92a47b21-1d7c-4750-a896-67312e9cac92", "value": 2844672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775615418, "uuid": "90291776-557f-4e17-8f59-01f74c34751d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775615418, "uuid": "8fd46ff7-5781-4bbf-b8b0-0cc76a69eb74", "value": "resources.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80007b27-338b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775680966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775680966, "uuid": "25257497-20b8-4e1f-a02e-e9514704624f", "comment": "Malware payload", "value": "67b3b2c8b46d25dae0345441e13a2f56", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RomCom", "colour": "#3E17A5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775680966, "uuid": "c8ec965f-e155-4a6a-af2d-f3de8bfc0d8a", "comment": "Malware payload", "value": "27a7a18e16955efd361fb35ccce7cf9e49209a3ffe16b2b9fbb41c658dcf28a9", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RomCom", "colour": "#3E17A5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775680966, "uuid": "52c614f0-d1db-4edb-a9f9-13188387a01d", "comment": "Malware payload", "value": "81de3dcc440aa6137bbc5b41ce68f7d74416f1e8", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RomCom", "colour": "#3E17A5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775680966, "uuid": "3ced9500-1bf9-4fe1-b002-a93810189ceb", "comment": "Malware payload", "value": "e8906a2e7bcb5d33a379737a50cc2f44217aadc97ccb59347084647553e4088d2a390ff787dd596324b3cf830e637ddd", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RomCom", "colour": "#3E17A5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775680966, "uuid": "dc5317a3-a448-405a-83e5-6f0ebf2f4ba6", "value": "T116331D2959E06091626AD14638F9C940860CB1325EFEF8F9CBB9C4DF2D4DC58BACD9F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775680966, "uuid": "bbb5e2f5-e44c-40e6-a069-553e11c5f487", "value": "768:J+/lgWX2GV2T248JzsYnfpCkYZkwfRRruq5cDrZ3:J+/iE2GVmR89dBCkYqwfRJuqiR3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775680966, "uuid": "2da227c7-19d6-4b92-9c77-e3ce58cfdc7c", "value": 54643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775680966, "uuid": "2006ed73-aa12-4a89-8559-dedc9400c66e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775680966, "uuid": "329eb33e-f140-4956-b6a4-912d8228cd0b", "value": "service.global-e.com_orders_2026.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61d4d1ce-3366-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775665024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775665024, "uuid": "dbdf133b-1378-4a53-9d2d-52c6e61299d3", "comment": "Malware payload (Mirai)", "value": "1222e02087bb9bf3fed013914c7ac705", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775665024, "uuid": "11740f25-3939-4446-b485-0f2ddb318916", "comment": "Malware payload (Mirai)", "value": "27c6787249e552a19789a8b55cd5e23e88b11512a79201f497df183234b752e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775665024, "uuid": "c1795772-16d4-452e-9ec0-7c31c5cb4052", "comment": "Malware payload (Mirai)", "value": "5cdbff6843dc37c362c93bd0e99e5296b42ee348", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775665024, "uuid": "397c0d2f-c995-4336-9c64-1fdf7766eede", "comment": "Malware payload (Mirai)", "value": "823786036a7f01346de0b4e1a8c40181e8cbabcd21c52dfec3ae5bfa5fb59354faf4eab52d5e3ed289d81a0c4220c8c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775665024, "uuid": "91f6141b-aeda-4032-8dab-b83ea3e55e40", "value": "T18183F746B8818E11C9D423BAFA2E118D331263B8E2DF7223DD105F6477CA96F0E77565", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775665024, "uuid": "a8edd6d6-f755-4d3f-8760-9e741b32485e", "value": "1536:7hnDvYSVYi7qKizSAoCS15c1K1Br8URud1yec7IjipEbMb4jR5:hv1uKmS/CyOGJRJEbMb4jL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775665024, "uuid": "1257a05c-fe08-490d-ad9f-f8c793b8f793", "value": 83776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775665024, "uuid": "4229d288-a8d2-4db9-9594-927761c9025d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775665024, "uuid": "0741ae11-c784-4a16-bd62-2bf7dd2340e6", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cf9e0a2-3367-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775665365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775665365, "uuid": "63c20fce-d9e8-4e94-aab9-3d88dfa458c9", "comment": "Malware payload (Mirai)", "value": "cbc65427a87201cc13298095ca33008a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775665365, "uuid": "5be78401-4e5b-4300-838a-1a6de50b9246", "comment": "Malware payload (Mirai)", "value": "28199e4ce03ce27a9b80b995553abcd08a5195065e77e33c3a17afd0fd6dc4a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775665365, "uuid": "6a797c1c-5090-4131-8de0-773570600eae", "comment": "Malware payload (Mirai)", "value": "68fcb45333091046c682f8793dbeaa763a88c58d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775665365, "uuid": "37a0d830-8233-4ba0-b42a-f1f743148eb2", "comment": "Malware payload (Mirai)", "value": "cc8beda5f3b04acd205961cc1d6369795b8120c0db1fd4533913a34a4d6641291e4482a86dd697e432aba177b43c36ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775665365, "uuid": "6e4729dd-827d-4c82-af8f-0b451608dee7", "value": "T193634CD5B4018E7CF95BEABE41164E09F92173004FA30F2BEA67FC936F621999D06D42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775665365, "uuid": "33327b12-e292-4425-8a71-16a1ac4f4488", "value": "1536:rXoMCyq+4odqqVqnj48tiYFw0SEMXDMqogATBOx+zx7U8Z+w:rV4omj173ST3fP+dH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775665365, "uuid": "c7ec9afa-7600-4acd-bc06-e2866e91ddb5", "value": 72680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775665365, "uuid": "63ec1dfc-cd94-4c28-b8ae-2474ea0d504c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775665365, "uuid": "b99e4b1c-71da-4de9-8d66-b816596fbd1d", "value": "db0fa4b8db0333367e9bda3ab68b8042.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9ce7fa2-3319-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1775632127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775632127, "uuid": "71858d9c-4a76-4313-a26d-492797a1883c", "comment": "Malware payload (VIPKeylogger)", "value": "f01acb00793e52775511be7e9ab2bae2", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775632127, "uuid": "91d3ed64-8b38-4ae5-bea8-ad1ae6b84138", "comment": "Malware payload (VIPKeylogger)", "value": "28613bfb4e866186133235a88e318df3059b01001f297ad6a524eab0885305a5", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775632127, "uuid": "c1335161-9102-4ec0-9d51-327e58740d1a", "comment": "Malware payload (VIPKeylogger)", "value": "33d04bc8c99d67f32ef4ba9d64594adbd8732cb1", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775632127, "uuid": "a369c65d-c831-4bcb-ae7f-65ebb538eaa0", "comment": "Malware payload (VIPKeylogger)", "value": "e408e4f6caec6c428d6084d4fc8e520b007737e4028d1761a6b71a815d7e64c7c03a65d0cf32ac55f7b3443f8945567c", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775632127, "uuid": "411f7272-371f-4260-8f07-c2235c0bd5de", "value": "T10AF3F12648C46FE9DFB85E2890FF161E5BE58787929B658DFB337E475FAA500010B0C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775632127, "uuid": "9c833682-cb2f-45b6-9a6f-3af033c9bbde", "value": "3072:dfVb26oKmtXXPq02Dy5p6ZBDgG5yMeo648ikoTW86k76AhqHOny:VVtoKjpyUBDgqN8Ddot6k7aF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775632127, "uuid": "9200316d-a2fc-4b38-8d7d-9835200ef149", "value": 169008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775632127, "uuid": "1403b328-9de9-4458-9c69-0990cd83fa0b", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775632127, "uuid": "02624297-20a5-4062-a9ce-8ce72703bbbe", "value": "ENQ PO_S23BK.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eb8f152-3324-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775636592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775636592, "uuid": "12394c42-86c8-4ddd-a3a2-b4a331394d24", "comment": "Malware payload", "value": "570722dfc9398f6e748a2ae70900616d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775636592, "uuid": "7d926b9f-42f7-42b8-921a-f42f41f4a084", "comment": "Malware payload", "value": "29ca6ec9910beb1243a1c556c593a987dd990a0b996618443bb6c61703ee6d2a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775636592, "uuid": "cc256f72-452c-4d1c-a537-49489b1c1a25", "comment": "Malware payload", "value": "e295424178abad932f5552555022a256b601428f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775636592, "uuid": "5336a67b-df81-45d8-ae73-767d4c13c571", "comment": "Malware payload", "value": "11d72f985cf634aed40026d5ef23a35cb7c3caca744e838d609e190d515689af07fbd44b4a8c7d008c83cfd0a929ce81", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775636592, "uuid": "569695a0-acfd-4b33-b602-ecd635eb5af6", "value": "T13C02ADF891EE01B8C56106F5503CF835510C3A6D6AC7E72CC59812ABBD21EEC53B78D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775636592, "uuid": "fd490471-cd29-4f2e-9106-fa1162b21bdc", "value": "96:PWzkZ7fL1BHPYovdz9a9EAB4Hc/AtnVEjyGvxu4MjwvNupcgPndvjrdbbkQQ79mv:WYjA+8/AsOGpPewvEDpNlA++xVXqn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775636592, "uuid": "508b12c4-5dbe-4edb-8999-258cdbed1e56", "value": 8980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775636592, "uuid": "da9938fc-829f-4e10-baff-84446275298f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775636592, "uuid": "aff06415-5db9-46e9-82e3-1e5dddfcb06a", "value": "photo-485197365.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "143f98c9-3371-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775669618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775669618, "uuid": "c71e98d0-0b0f-48be-a139-dee9cdaa3733", "comment": "Malware payload", "value": "7613b17f061ae588d13d477056634480", "object_relation": "md5", "Tag": [ { "name": "178-16-55-80", "colour": "#48DDFA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775669618, "uuid": "6b72dccf-4804-4707-9362-24ff5f8f6d46", "comment": "Malware payload", "value": "2c44a8d802cf2d05fe996e97a27ff9b123ecfba2b9be48cf35172b6489201605", "object_relation": "sha256", "Tag": [ { "name": "178-16-55-80", "colour": "#48DDFA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775669618, "uuid": "6d1ae0ba-6f87-48e2-9494-cf9b1b263ec3", "comment": "Malware payload", "value": "479082fd98111f4924a86c819f9c73a0372f9edd", "object_relation": "sha1", "Tag": [ { "name": "178-16-55-80", "colour": "#48DDFA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775669618, "uuid": "633e639d-cb4f-4249-ae2b-24672ddef157", "comment": "Malware payload", "value": "f2d87151ddaa4f2fcc951fdd020e79fb28a6e283d355aa2ce479dca5dc125cafcac4ba8fa7ecadd34391be5720d6ee89", "object_relation": "sha3-384", "Tag": [ { "name": "178-16-55-80", "colour": "#48DDFA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775669618, "uuid": "d0e305ed-b364-4a95-8875-c5852f0e8c19", "value": "T1F115B631ED302C503D20E8BD453B5DFDE85798B77ECDDBA2C3C684B29B049916A568B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775669618, "uuid": "b23e4cbc-748e-456c-9adf-c9c906435b4e", "value": "768:0nRb9O21q6YiVLovrq6YiVLovrq6YiVLovMJPP0XIS0Tc1eBAvWdcHd1aQXYUuk:d1aQXjuk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775669618, "uuid": "e11886ff-987d-4863-b486-7f4870bc4a04", "value": 937620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775669618, "uuid": "626d0e81-1b72-4039-8e7f-0faca44944fd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775669618, "uuid": "1ec92dbb-f0aa-425a-bfd4-4992ab1c7c7b", "value": "TaskSvc.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdf64c72-3326-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775637691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637691, "uuid": "fbaee097-434b-4c7a-b257-a53a79ba9c63", "comment": "Malware payload (Mirai)", "value": "1a6a8c8f40893c8f6f0fdcf0492b426f", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637691, "uuid": "d91c28d9-c7db-405c-bf81-1137e16dbcc8", "comment": "Malware payload (Mirai)", "value": "2c7c3d236032a5653a040d82d701811348469aade5472cfd85f45b3e9574d01f", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637691, "uuid": "c1b42a6e-8111-42c1-9d80-f911b59e348b", "comment": "Malware payload (Mirai)", "value": "3b285736742eeed8fdceedf5cb68fa84dc3d9e6c", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637691, "uuid": "37809882-9956-4cfc-8b9e-bd6125b21ba7", "comment": "Malware payload (Mirai)", "value": "b633d5b90f0cb35351367a2f768952a350d973399016b2836b612e69aa2d493600c29274895ea4e40da6a3b0e0c3de49", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637691, "uuid": "8d5c4684-d832-4c34-860d-9c4b2bd41c8e", "value": "T15004392F358191F0F6411B746BCBD3976C390BBF51A9909F6B416329B6E0B7BA02C487", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637691, "uuid": "a1f04ebd-2a2b-459c-9c7b-20f568885993", "value": "3072:7mPX5bl7RDfPIX5eG/L1AL0SFU66gOSNL9CnNgRdgJi55wIUXS:7eJpJUVD1A8n0YNgEJi5a5i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775637691, "uuid": "3f493beb-c6ea-4ae9-a050-5c4304aeb928", "value": 180808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775637691, "uuid": "610018e4-28d3-4e41-8638-42dcba141edb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637691, "uuid": "aac3934b-2a1e-419a-a678-1b172921fb7b", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d67eb87-333e-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1775647783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775647783, "uuid": "0468c197-b3e1-494f-8e17-d5e87a73a636", "comment": "Malware payload (ValleyRAT)", "value": "de2217346379223a09d186cc6f8a5ff8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775647783, "uuid": "9fb45209-3c00-4c88-98f3-881d63367f24", "comment": "Malware payload (ValleyRAT)", "value": "2cb5614936ef42e52c44ebb7b758bf57fde6c7b2d68cc21a7ec94d2f0adb3435", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775647783, "uuid": "7add4f8b-6690-4b81-84e1-0bad92a045a2", "comment": "Malware payload (ValleyRAT)", "value": "99adc4ab7d4cf58b4cc028bd57e3278ecee232ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775647783, "uuid": "ba70d77b-6891-4f7a-a642-d7e1bd9aff56", "comment": "Malware payload (ValleyRAT)", "value": "df9f21672469ae557f87ec84831744c06c1fd0997a03310b92014b7a5b18b93d8540b0916c795a2167447f3d7c62c4b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775647783, "uuid": "4f7f7e51-39ff-429e-9053-54f8c745f2fc", "value": "T190165B9EBABE53A9C5A7C1B0A7B38196E1317C019B3056CF2384735C26735F09DA72D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775647783, "uuid": "e9de1568-9b7c-4dd5-95d2-15a898c1165c", "value": "baff4071a279938b756ddd24226c0da5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775647783, "uuid": "5b7dc1ec-a064-4603-ba9a-d723791653ef", "value": "49152:HE2xEp5CjVFKejRmmM0jVN9EaOurQUxYkSSW0Ib/Jsv6tWKFdu9CPPTvG7JvpHF8:HOeZn7HRUJsv6tWKFdu9CPiW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775647783, "uuid": "adcc680c-faa0-4649-9ae4-193f7b5c225c", "value": 4193792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775647783, "uuid": "52d6fe09-a516-4725-b931-8040b6a8b847", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775647783, "uuid": "3aaffad1-3ea4-4263-b50d-fad39ea242bc", "value": "2026\u5e74\u7b2c\u4e00\u5b63\u5ea6\u8fdd\u7eaa\u8fdd\u89c4\u4eba\u5458\u540d\u5355pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa4c9f91-3363-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775663991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775663991, "uuid": "e193c926-711d-4d38-886e-d0e4d41b8313", "comment": "Malware payload (Mirai)", "value": "78a12bfd65190548c924b98fec5ac376", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775663991, "uuid": "5bfd078f-5578-4240-a021-046c6e930dea", "comment": "Malware payload (Mirai)", "value": "2d158263a11571dfa1146ff7a91ae75ee39b47818c2edfc138e475a7da939c51", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775663991, "uuid": "521518bc-ad0f-4f66-94a1-806ac7807a3a", "comment": "Malware payload (Mirai)", "value": "b41e3f3b9539227db939b4f491a9376df3ed66b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775663991, "uuid": "4b63da41-892c-4cba-96d4-851198b724cc", "comment": "Malware payload (Mirai)", "value": "3db29099152764fbf9f18a115b89a4ce09287a497b1b0a01180981b091efd8f81e11ddaa21262159fd3febafefe046f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775663991, "uuid": "90b71f2e-9ee9-4d79-b8fb-1b0ec2831aab", "value": "T1BAF2E14691651AE2E8B25E33F93541853016DC9C826F7A39CAAC4F6CF6426A733BD04F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775663991, "uuid": "b7aac0f8-7a4b-4142-bdec-602edb2e6326", "value": "768:g3TL2iD3coS5NcH1lNoJP3Lun94iwhmH3G3+f/pxq3UIld:g3mEsTDIwJvyn94iwhmW3Eev", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775663991, "uuid": "a7aa403a-a7c7-4a93-a3f5-d62a5b79569c", "value": 36324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775663991, "uuid": "996b9773-bd75-4532-8e03-929ca39fe589", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775663991, "uuid": "8a63c13a-2cde-44f2-844e-797172d80d0f", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43c4ca83-32f2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775615152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775615152, "uuid": "19f111d4-3620-4718-880f-dad416628904", "comment": "Malware payload", "value": "7234598daa4d8c1f053e06579d59f08c", "object_relation": "md5", "Tag": [ { "name": "BeaverTail", "colour": "#3B1A5E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775615152, "uuid": "bf061b15-3d00-4de2-8670-3fa7ce023b10", "comment": "Malware payload", "value": "2d64a0776abb8fc200a0d364f562d2e4abe63bcbb25d81ae2cae9cdfb3213549", "object_relation": "sha256", "Tag": [ { "name": "BeaverTail", "colour": "#3B1A5E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775615152, "uuid": "07134c59-9a0c-446a-bbb8-95f2bc8bfb13", "comment": "Malware payload", "value": "2fe33e5a7ed773ce1061d5bc2178282881388abc", "object_relation": "sha1", "Tag": [ { "name": "BeaverTail", "colour": "#3B1A5E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775615152, "uuid": "373f0e82-d0ae-4411-ab26-a7b401783a19", "comment": "Malware payload", "value": "f94803cae1ff5bf282f491f0d61e3bf4d711f7513ba7a304071c7f31bf67d664805003e5175fa25e97dacbbf8a4ebe31", "object_relation": "sha3-384", "Tag": [ { "name": "BeaverTail", "colour": "#3B1A5E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775615152, "uuid": "10c2af34-d51a-472f-b9af-34be78c7a371", "value": "T115E5FBCC3EC56037BBEEA567AE085EBC90734052B5886507F980FC8B7E68236D974E51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775615152, "uuid": "0894f4ab-9cfe-4afe-b70a-207afa98c249", "value": "49152:IO0EnXBTtHDCZt+mtY5zkBLv5HZx7wriEbMLj5Igd2XnMznltwjeIUxxjoZQGCrr:G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775615152, "uuid": "e6e4d7b4-6588-4a20-85e1-9e38ce7422b2", "value": 3071239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775615152, "uuid": "1e5ab620-d96e-450f-a7f1-052b62eb81d9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775615152, "uuid": "3d8c0681-b65c-45f6-a68d-9281acb7c94f", "value": "sample.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5f7ff8a-3315-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1775630457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630457, "uuid": "d9868e83-a42d-435b-a120-b99a9ae8631d", "comment": "Malware payload (RemcosRAT)", "value": "d60c1344d0f25170e0668de162509b87", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630457, "uuid": "0ee36ca8-c140-43cb-8ffd-f127124dd078", "comment": "Malware payload (RemcosRAT)", "value": "2d80dc323c5aed21b40ee8f54a1d9c8ab6897799da8859cc8fcfa61d8674e120", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630457, "uuid": "769235cc-c290-4ed8-84dc-921d39795395", "comment": "Malware payload (RemcosRAT)", "value": "c1c6b47f7e43146b54d5333dd0a92bd54cd94d4b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630457, "uuid": "4287d529-ca82-4ae3-8f4c-b9df9700066c", "comment": "Malware payload (RemcosRAT)", "value": "b2f93fa86cf9b1e0f605a8702d44fb089264d209b22ca8371cf712b7f18c0deefde9a82c8b8ce47764e82b9d1d50daea", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630457, "uuid": "100a8410-dd1f-4a94-a72b-15b3b8f2eab8", "value": "T197E5021189C83FB9CFAC561C80FE160EA3E04ACA5416758AFB73BD4BAFFB6045117199", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630457, "uuid": "e126670c-96be-4b4c-a34d-a1fba3ffa639", "value": "24576:8so2tSwFvbcIU7JLXhIeBR2OFNw5iONPF1faHUGcr7vhP5MN0J0Zi1dNRqJgxso5:5ToxLfSnGUvw40D7pyxbYOjSH+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775630457, "uuid": "272a2843-c00b-4c94-b1d8-b5d24af52062", "value": 3259623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775630457, "uuid": "fea55288-22ac-4496-b633-52efa03378f9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630457, "uuid": "7603a233-3472-40eb-b4c4-65d3f3094d5a", "value": "Wire payment pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c8a8ac9-335d-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1775661096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775661096, "uuid": "61bfbb68-d885-439d-a5ef-18a2ced30738", "comment": "Malware payload (Vidar)", "value": "d718a1f909c72e6712be8eec6c42f6fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775661096, "uuid": "fafc9c3d-10c1-4f4c-9ee4-b0ad4667afbf", "comment": "Malware payload (Vidar)", "value": "2d9181af847f64ade5f31f8129fb4e29e45f569cb4e1191b0eeab31b2c1de1d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775661096, "uuid": "f10e167d-500e-40eb-bcf3-ac9379aa37d1", "comment": "Malware payload (Vidar)", "value": "51c42a347ab8e47acdd936576303d8cf56dabde1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775661096, "uuid": "dc0c309b-925c-4a31-bc9b-35f098844712", "comment": "Malware payload (Vidar)", "value": "68356fc4b71bd1041ea15f8318894d39219ae71a021f0157dc02a91282e5442eb15bd5f158cee13954686b43a8418b94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775661096, "uuid": "10cd9807-48e6-4dc4-b23b-afb9bc42778a", "value": "T139B6E017B2A960E9E177CE7C84910D45E776387A4720BE9F03D486EE1E12FBC8D29B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775661096, "uuid": "e25b1d8c-540c-4c34-90bf-2c37a245580a", "value": "d010692da5e0e07c07c8928e1fe93691", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775661096, "uuid": "0bc40229-fb2f-408d-968f-11a74276ab75", "value": "12288:fGQP33VVJ9q/WzHHuoDfHIAlDfi5NIx6xJJoATLX+7IF:fGQPHaWzHOAvIoLINI+D+7IF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775661096, "uuid": "857a4de7-d30d-4d7a-a282-96e065ffe60e", "value": 10946048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775661096, "uuid": "7f704669-b21d-49ea-917e-725a0e61f0f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775661096, "uuid": "e22a88ce-e3e5-4606-ac9e-73a99aebd275", "value": "2d9181af847f64ade5f31f8129fb4e29e45f569cb4e1191b0eeab31b2c1de1d6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "262defc1-332b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775639584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639584, "uuid": "f2e5fad9-ce21-4c3e-9f86-46ef73d2ed53", "comment": "Malware payload (Mirai)", "value": "dbb92760754f31fe00ee9fb78e0af747", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639584, "uuid": "9701ef4c-9e2d-47f3-9367-46c9f658e212", "comment": "Malware payload (Mirai)", "value": "2e8824972143ef3f829ec410d6b1c60f5b88a48fbbbfa7758850987a1651630b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639584, "uuid": "32e2f0da-2468-488a-89c8-8f9477a27764", "comment": "Malware payload (Mirai)", "value": "2fc95b072fc387ee15f012602d0be64ea778b77d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639584, "uuid": "1c4a488e-a56d-4c27-b2f2-11da7d1be68c", "comment": "Malware payload (Mirai)", "value": "b65ead1037e5a7ae4ec634411444141165146e1cfed004baee552c0172c69fcae34857e7d6d5c166a5808aa50bbf6221", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639584, "uuid": "a0d99c26-5707-4920-9145-c6fa49a13b29", "value": "T191A2D09669042870CB702879D87C4159A9C587F8F1D9733AB0412BBDE390BCFE5759C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639584, "uuid": "57b9ebde-770f-4a35-8f73-f38cf2d94f21", "value": "384:X7pe/EZ6L01sSWjDDR/2gmjI8RiEb9Hx5uA3r3by0AAPdhymdGUop5hthjd:U/EsL0iSaDPI1tx5uA3rKcds3UozXhB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775639584, "uuid": "35c6e4e7-8024-4eeb-856d-04eed776f5aa", "value": 21656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775639584, "uuid": "26ba24fe-eda5-4aa8-8acc-4efc6fc5ade7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639584, "uuid": "7d4fa624-c1bd-467f-a582-062d2d167aa4", "value": "tony.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2bd1a3b-3315-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775630478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630478, "uuid": "5364da7a-966c-4823-9504-3d1bcdf872dd", "comment": "Malware payload", "value": "d7b194d868793de8b8c44b76a5d24e15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630478, "uuid": "d5f9cf91-e050-4bcb-a120-12d0bcf54ddc", "comment": "Malware payload", "value": "2f4867af39270eb87757f810013ba921bf56a650cabe113dcb1bcbc271f2ccb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630478, "uuid": "24abf87a-2215-41d3-9973-99f021f8101e", "comment": "Malware payload", "value": "5a486b177ff016e8e55ba5051b3ed9c343f33a09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630478, "uuid": "f9cbf844-684b-4ecf-baf5-05b138e348cc", "comment": "Malware payload", "value": "8afb820f0a2bc0eb9ab9643cc5dfc23333d4eafcb20298f1e49fdb6725c320f58d5da7d9c04a668df9d77a96a91bc8e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630478, "uuid": "2a8eae2c-b0e2-4744-aa9f-22b883dba66d", "value": "T183368C01F7A50AE0D166D638CA669332D670BC955734CA5F25D8E21E2F33E608F6F326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630478, "uuid": "d1f15e8f-3ab4-4975-94c6-f27e6128124d", "value": "e336643bdb6579145d71c5bd27119fa6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630478, "uuid": "e9a2b8d9-3a62-47de-bcc4-1c2c0f30ac8f", "value": "49152:grWFNEnyS3yzEwxwSS+4LTsztjQY3JeYrjNE90WSZnG45zGsu4tAbrOurmgm0TiK:gvY3/ugGBTiFGEg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775630478, "uuid": "4d78b5cf-99b2-427a-b58a-cea86bbed7b6", "value": 5320704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775630478, "uuid": "0d9eeb00-df07-4de2-94da-e4e060502b72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630478, "uuid": "47f93392-5397-45ad-addb-556a063875a1", "value": "\u70b9\u51fb\u5b89\u88c5\u7b80\u4f53\u4e2d\u6587\u8bed\u8a00\u5305 (6).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ece905c-3311-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775628458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775628458, "uuid": "58f6971e-8652-4f89-a3a7-ec9118b15bf1", "comment": "Malware payload (AgentTesla)", "value": "ab36739d5adee67b4e099e9b22a5dcf5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775628458, "uuid": "61cd040b-c688-43bf-b108-58042f4e5c91", "comment": "Malware payload (AgentTesla)", "value": "2ff1097ed1f607c9e499441e8ba6bdf8592f831d558b923bd4271bd6d1840abf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775628458, "uuid": "269905ca-2702-46c5-a596-ec2e4817b418", "comment": "Malware payload (AgentTesla)", "value": "1147636b30d676c48397dc97aa6fa38a86cbc9a2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775628458, "uuid": "0820fc41-7f03-4d07-b14c-e9c0f7dc763b", "comment": "Malware payload (AgentTesla)", "value": "bfa229ab1732a636934b036dfe8999a31ac7efd68f3c210e1cd91cef997d5cececa0f427bc259ea9c9f41fcbf563094a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775628458, "uuid": "1594ab9c-fd09-4809-acf7-07cb6ac17b1a", "value": "T11045BF0273C1C062FFAB92734F5AF6115ABC79260123AA1F13981DB9BD705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775628458, "uuid": "5fee3b17-ae8b-4949-a8f8-a0e3f55fa2ef", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775628458, "uuid": "f01d827d-eb15-419c-b6d6-24e36e8a0e73", "value": "24576:g5EmXFtKaL4/oFe5T9yyXYfP1ijXdaTR/rXa/JxhZ7fQpLY5:gPVt/LZeJbInQRaThU5AL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775628458, "uuid": "2c352a83-ddb8-4348-a439-c0bd379b21b0", "value": 1276416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775628458, "uuid": "5d5cf44e-ed68-4bd3-8da4-9c6c4942022a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775628458, "uuid": "e430831c-5419-4a0e-b8e1-3ec07445f09e", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fd9fa4f-333d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775647277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775647277, "uuid": "806a6d21-0253-433a-9082-274069e75f23", "comment": "Malware payload", "value": "371792816ed3d8cba9b5522a04280023", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775647277, "uuid": "986dc3b8-0d21-4c04-9b15-3b439d0eb785", "comment": "Malware payload", "value": "302f923619a2e40b32647eb9ce9055921f4c6e7a957df6b22e42e50d5d181389", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775647277, "uuid": "fc760a9c-6c91-4b88-b76e-6ee86326ca92", "comment": "Malware payload", "value": "3a7f119974fef862f6175f8b45a4d8f592879f04", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775647277, "uuid": "e741467b-3377-4bbc-9cf7-3b084ca3c291", "comment": "Malware payload", "value": "04fd6d7ecbfdc940bb3fcdfe0e8f91d4a1b0aa689f98ed822e55d2e936760cff85f2d7c304d51ab83e3c8eb8a90b9ebc", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775647277, "uuid": "aa9f1b49-a709-42fb-975a-8ea608eea2e4", "value": "T1A8136C6566913C28AE9988371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775647277, "uuid": "fd10406b-9a46-4155-bf36-d884df9328b7", "value": "768:bWXRWNGxVU9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bSlxHco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775647277, "uuid": "ace8ce23-19fc-439f-8f5e-c097c63080b8", "value": 45522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775647277, "uuid": "7f88bc9e-1a21-4706-a03d-6c89bfcb9bc7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775647277, "uuid": "2097e169-d7a0-4b45-9e84-d2270c68eb79", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8897ba4f-3340-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775648768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775648768, "uuid": "728df7a2-569c-49fc-bbe2-d5ec1f801095", "comment": "Malware payload", "value": "93dbbcf2609ef41b3f41ed1618a5a9b7", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775648768, "uuid": "255a148c-138e-4a2a-b52b-b2f76c7a0038", "comment": "Malware payload", "value": "30457d2c9e234e883a9ae93ce2f12e49ec9e41ae108eae5911a087b0548a3c04", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775648768, "uuid": "1a85368f-5a91-42b6-80ec-67838cee11c1", "comment": "Malware payload", "value": "b58567b898e4cf72f67860e7bda4c6b57c7c26ca", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775648768, "uuid": "81062e5a-b155-4fd9-9e11-5341d6428db1", "comment": "Malware payload", "value": "9c35a4af7763c356b76dde359e12317f35e42cf98d908a6b14ef9435ffafff4e3dcc195506b9aa3e5fd65995b24e4795", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775648768, "uuid": "11147ae5-0dfa-4959-9e80-852c80d8813e", "value": "T1BF063381D1DBCC76978DEED74CCBCA7D236A600A58E066A7860515F2CFE24ACE45C9CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775648768, "uuid": "cb243971-2ddf-46bd-a95f-b8d01643c2c4", "value": "98304:Zu+F7y0p3cRAC8iNc2RJm/37JzFirA7Pqrz/d2dZdBl:0+FPp38qiNcEJ+37JZiLF2dBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775648768, "uuid": "962dbed2-330e-4b58-a8d8-bd2ddccd3ccf", "value": 3720696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775648768, "uuid": "c6b5ee0f-d0f8-4e2d-b1af-bd9bd8ea117d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775648768, "uuid": "ccc44d8e-ccf6-441d-94fe-ba6e653a8827", "value": "test_office_cert.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20059b52-330b-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1775625830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775625830, "uuid": "1f9d4587-50a7-4209-9fff-15a66aaedb8d", "comment": "Malware payload (ACRStealer)", "value": "d800261a48e81785bb842667a4e33005", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775625830, "uuid": "c7560855-b2bc-4c64-a02a-201bfe3ce4d3", "comment": "Malware payload (ACRStealer)", "value": "30a2ed1f4a2f69cfa902b3956429c079115607c0d560de618099c9a2b239e20c", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775625830, "uuid": "7b393e13-3cdb-4f69-a9c6-e0f8e2799c42", "comment": "Malware payload (ACRStealer)", "value": "d544f5dbfd75257aa9568f7b978f42f2245f3003", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775625830, "uuid": "e7b84994-be6c-4661-bd6d-451b7e4286fa", "comment": "Malware payload (ACRStealer)", "value": "e3f75837d46a3b7ff26b29006fe5e6601737f6fb822c2ca384a9fb77b92f0c1e6fa3a5deb6235d16d547ee554b7630f7", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775625830, "uuid": "d4f50e80-1a8b-42ee-99af-4f400110414f", "value": "T163064B0BFCB98CA8C499E63484336157BE25B8405B2173D72BE1B6682F737F098B5B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775625830, "uuid": "52fddd4b-52e9-4b02-9001-330e27757ca2", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775625830, "uuid": "11b1b15f-04a3-49cb-9d18-b5f0372de477", "value": "49152:4PB0HqAJymWwS2vArmv0RGLlk9Xlbw76NUpojkAcQhGHrm1Q:4KdS2Fs1Y1YlGHQQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775625830, "uuid": "a724e497-59d9-4990-97ab-8198af4a25c9", "value": 3809240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775625830, "uuid": "82aaf53d-c434-4ae9-b6f2-334f4ec30779", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775625830, "uuid": "6f5b4fa2-bb33-47df-8909-b386ba349b53", "value": "SecuriteInfo.com.Win64.MalwareX-gen.95961192", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59ceece8-332e-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1775640959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775640959, "uuid": "038e799c-324d-4f37-92dc-6e6e7fba48d3", "comment": "Malware payload (Smoke Loader)", "value": "611f47c2af3a636c601ff8205f50d982", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775640959, "uuid": "cd36d774-80be-4d58-95fe-2223193ced90", "comment": "Malware payload (Smoke Loader)", "value": "315303fdbcc0de5b097db35137863e475b625a2f8cb9175e8a0cf4c7f55c7bd2", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775640959, "uuid": "c47d3765-d81f-4e6d-a1ec-5e32ef89299d", "comment": "Malware payload (Smoke Loader)", "value": "df39ed7b3a3a748a1d856b551f9f1c4a50a2ce13", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775640959, "uuid": "f8622778-62b2-4326-86d2-7790b60e382c", "comment": "Malware payload (Smoke Loader)", "value": "a17d784088bf440147ecd52c6ce865256a9dd62dfcff6b068668a909041bbf221bee9eb983d71c7ea3e7a5809a88be8a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775640959, "uuid": "bc8af0fd-7f84-46db-86d0-e2fcb732370f", "value": "T1A265494BBCD008BAD06AA33288B655C27B71F8290B3233D72E94B6783F76BD05975754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775640959, "uuid": "7b6f5254-c7a9-4e3f-81c1-7fcaa8b7f605", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775640959, "uuid": "6b23d8a2-2bfa-4074-877c-aa783e40947e", "value": "24576:ipMt1hI8qoK8iA5hF5J9VRhO1SKtfZEcmGiWPrzJ:ipa1hRKNicx5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775640959, "uuid": "6edd8c56-23ac-4dd1-99db-568a425d3f02", "value": 1470088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775640959, "uuid": "bcb02cc5-e482-4007-9dc9-d0af6bda8880", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775640959, "uuid": "15cac8af-d076-4b69-be7e-92bb0329fa35", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4081cd3a-3314-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775629749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775629749, "uuid": "39d3faee-ef3c-40a0-b777-a11af975370f", "comment": "Malware payload", "value": "e8a94035a7ffe8a609821f09f4b419d6", "object_relation": "md5", "Tag": [ { "name": "oficiospolicia-com", "colour": "#4B94B2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xx-kak-is", "colour": "#B502AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775629749, "uuid": "ab121e7d-7821-44b8-88c5-8427d85d394a", "comment": "Malware payload", "value": "3160b30b91440f72901037f790edd642ef3d9812aaf973f1d3afb6c856a71b59", "object_relation": "sha256", "Tag": [ { "name": "oficiospolicia-com", "colour": "#4B94B2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xx-kak-is", "colour": "#B502AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775629749, "uuid": "47d5ed35-8c48-41ad-b438-e9a0540ad6ef", "comment": "Malware payload", "value": "4a12dfe114288c7af4b548bb421c6bfc18244c43", "object_relation": "sha1", "Tag": [ { "name": "oficiospolicia-com", "colour": "#4B94B2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xx-kak-is", "colour": "#B502AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775629749, "uuid": "d6ad432a-eaeb-42aa-8b47-45c554546192", "comment": "Malware payload", "value": "6eab75e28bc0c3de8ba62b61656eb1cd202a6c51a56eb28df1337312acdfb79035e7173bed6ae97b53bf98a7127124ac", "object_relation": "sha3-384", "Tag": [ { "name": "oficiospolicia-com", "colour": "#4B94B2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xx-kak-is", "colour": "#B502AB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775629749, "uuid": "83601e89-3b6b-4396-9bbb-08cd3452e1b4", "value": "T13832B055A218E378839109E4846C1B5115F4D4F7B4DC93E5202076DA88DEF0C7F3BBAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775629749, "uuid": "bad9371f-2979-48cd-9b29-e46e8977c9e1", "value": "192:nWXxmsk+kmJhlOLjZp6choAq1zzgPVFHWyYDJToYCBvM5p2/N+uQt5T41KpLMMl:knk2O5pepRzgrWTkYCvM5p2/6b01Kvl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775629749, "uuid": "a2b55106-c405-4910-872d-e738cc84723d", "value": 11140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775629749, "uuid": "c9e2a249-7011-43e5-ba42-4e632a4d9dff", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775629749, "uuid": "cb3164b6-7944-4baf-9e65-21601bb791e8", "value": "xx.kak.is_clkfxlnk1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48f22007-3316-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1775630623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630623, "uuid": "f2e7240f-dbc8-42d2-bb9f-bbea3e332ecf", "comment": "Malware payload (ValleyRAT)", "value": "d2d1b06a20282db972e2f18d82143aa0", "object_relation": "md5", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630623, "uuid": "1c9e9880-e947-40e1-9a7d-7f373bf238e8", "comment": "Malware payload (ValleyRAT)", "value": "3174ab3322f1ea5c5b7a7a86bff169294af09cb76730870f1e097a66675e736f", "object_relation": "sha256", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630623, "uuid": "d2fd831f-195c-4b5f-a961-9c98ddf76cf9", "comment": "Malware payload (ValleyRAT)", "value": "5ef33c4a8c9f7d75fa16306b9020a113d363be13", "object_relation": "sha1", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630623, "uuid": "eba0b241-56aa-4569-bdda-0dd6eb7cdeae", "comment": "Malware payload (ValleyRAT)", "value": "0a6850921decb0f8ba92b7fcf06aacdc3d43e5c06bb652747b492945f1e2cb31da3a06c2bab0809324a4a18d61e8cc29", "object_relation": "sha3-384", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630623, "uuid": "f7c09676-3233-4073-b77d-c6eb37f90258", "value": "T126263355F99CF729CE761EB4A09C62BE8C1EEC180A521802FA4CF7EE337705259953E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630623, "uuid": "7b1f8ca1-f90a-432f-9ef9-eb99975f5db5", "value": "98304:1uq3MHrRWw18w60r3XaBpshF+gN9B5eX6ecoWekXRH5oIwNCZW:1uq34//bXUqndeX6hoWJXRH5oICCk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775630623, "uuid": "a5ef0656-ce2d-429a-b53f-b6eb695803f6", "value": 4476928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775630623, "uuid": "0cb8a9c9-937b-45c9-9172-933b15820c2d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630623, "uuid": "ec175626-dddb-465c-b8c1-59abc8328d53", "value": "\u70b9\u51fb\u5b89\u88c5\u4e2d\u6587\u6c49\u5316\u8bed\u8a00\u5305.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af049723-3343-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775650121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775650121, "uuid": "284f38d1-fc3d-473e-b5d0-2ad6b557c687", "comment": "Malware payload", "value": "730cbe6e15e8b715e3878f6c2a925dc0", "object_relation": "md5", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775650121, "uuid": "a2a23f7a-3e6c-49a5-9224-2f2f1a0cbcd4", "comment": "Malware payload", "value": "31e7440169a618dae21ddfee2580fa2b78846187c529610d994812202661fbee", "object_relation": "sha256", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775650121, "uuid": "0e275a71-1c67-422c-bc79-7c98b2ee5163", "comment": "Malware payload", "value": "0da8d5abcf8d4157da86ebaea3c6691120964409", "object_relation": "sha1", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775650121, "uuid": "5320ea04-89bd-4769-b05a-74cae80ed5a9", "comment": "Malware payload", "value": "fc7b1c2a7c04f1b35c2522c4c56f46b3f0afa0c29de44e059bdc6a1b6ce241638dcfe0b7a335e6ee46858286caae6279", "object_relation": "sha3-384", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775650121, "uuid": "5fab5720-7c76-4368-9c9d-54da8f7a7b27", "value": "T1BBD7336CF5AAEE0EDB39EE37C02D7D4BB8C1084DB1A94E7698553A1735DB79108ED002", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775650121, "uuid": "04808cdc-fd4a-432a-b3e2-96b4746ad134", "value": "1572864:4We6Y/ZGJ0M34DktVUy53JYfGl+GX90hbCGIVgfEcR7W+K77T:4J6YRGiM34DkpVeOlDXeOG3fHRSHT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775650121, "uuid": "ce9dd673-47be-47f1-9997-fcdf903ffc60", "value": 61661166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775650121, "uuid": "873e2b4f-9718-4eb1-af23-c3448cb32098", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775650121, "uuid": "059f1eb9-4d3b-4dfc-8e1c-10335713333f", "value": "pnpm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9fb943e-336a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775666917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775666917, "uuid": "cde8c4c3-15ff-4183-a1cc-60feb4ac9106", "comment": "Malware payload (Mirai)", "value": "f07c7e41c7d0d40995794d567d726bf8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775666917, "uuid": "b69310e3-9b0d-4853-8044-4780f62e5c59", "comment": "Malware payload (Mirai)", "value": "333f0b7d8757650f66607b17f9bbc7744da1c67254cbcded8512414c7218e717", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775666917, "uuid": "e43772ea-4801-41ac-8ddc-15d18554a0b7", "comment": "Malware payload (Mirai)", "value": "d68c9abe32d478a0026d5774321289e73df01439", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775666917, "uuid": "738df62f-897f-4912-a9fb-79a6d842444a", "comment": "Malware payload (Mirai)", "value": "7030df9e71dfbf660a9dbd9cee27899c4bfeeba76e14d0da3f4a01958a5ae9d6dc8afd9df3413e703703f8dd77afd063", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775666917, "uuid": "7cdbd2ff-3dfa-48b1-9cc7-a3fbca29adf1", "value": "T1D17319B41A96B27CEDF140B8F85320D628A20A1C3BACD2E3B5C7543AEF75B0C7169D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775666917, "uuid": "0b83eae2-79fa-4330-981a-946f0c625a5c", "value": "768:GgUWix2EZgU/5h2hZg+OTvKZg0Kn13NZAf+/W4LzLU8JIoPiWs8ltX2ZvB:XUWdEZgTAjTg23ZAf+/WSJJXPihg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775666917, "uuid": "7ccb8c4e-8cae-4f30-b43d-f68877b006af", "value": 75132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775666917, "uuid": "e9987886-3c45-4b2a-a756-f4c9f3da79f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775666917, "uuid": "70ebf36f-c2c8-4dfe-808e-ba8bd1875415", "value": "db0fa4b8db0333367e9bda3ab68b8042.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c8139f9-3317-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1775630978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630978, "uuid": "034e9061-9225-4ae8-bab9-10833c9320e1", "comment": "Malware payload (SnakeKeylogger)", "value": "58db982ce6846009fa164f1b474a3fb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630978, "uuid": "a534d6aa-73cc-47c8-8219-5e1fd0b72ef5", "comment": "Malware payload (SnakeKeylogger)", "value": "348237414eee4aa489c5177650309e35d10f87e693cba723f49b068665a7acbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630978, "uuid": "4ffbb94f-86ba-4646-87cd-586e499cc25f", "comment": "Malware payload (SnakeKeylogger)", "value": "020c25a21ac1a2f4c7adf9e7b266a542d6571c38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630978, "uuid": "5d14d7ac-470c-4579-ac54-228cc85daf4d", "comment": "Malware payload (SnakeKeylogger)", "value": "8494629a41487dc5b8772a52a7d95d3a857b821dd4f9afde1ae13b5c5ec647ce907315eb026e46d65f38e176e79344de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630978, "uuid": "0d0a93ee-1148-40b9-b55c-159a1fdf0cb6", "value": "T1C24512192315EC47C5A69FB05DB1E3B82BB89E4C5112C3138FFAEDEB752E71A3844291", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630978, "uuid": "04713655-bf2c-4915-b506-90f87ab10047", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630978, "uuid": "a3bf6646-d46f-4c4f-979e-e675cde65fec", "value": "24576:G/ciaAVC5+9r+awj37m0p0diA5IBHXVQR+6iVY+1LwDu:IcSY5+9r+awPm0pxAiE+ZY+1wDu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775630978, "uuid": "1f0575f1-9fdb-460f-84e1-f44396b1c840", "value": 1277440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775630978, "uuid": "e9340772-4c08-465b-aa5a-1427cb083488", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630978, "uuid": "0c23524b-f7b9-4c07-a8d5-c959b0b81504", "value": "Dekonk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff5c3832-3326-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1775637801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637801, "uuid": "08f49822-676b-47f8-b58b-95ebd0a5b77f", "comment": "Malware payload (NetSupport)", "value": "7a3fa6a96617ad4be2f84f023123d0cc", "object_relation": "md5", "Tag": [ { "name": "5-188-86-165", "colour": "#DE80D8", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "pw-forpost", "colour": "#03624D", "exportable": true, "hide_tag": false }, { "name": "pwn-forpost", "colour": "#EBE1EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637801, "uuid": "ebc75eba-de7d-43f6-9531-51cb7aebb317", "comment": "Malware payload (NetSupport)", "value": "34c6256c392d918d19ee29f97d48feda4e0125061b422af0e9303e4bf39cad74", "object_relation": "sha256", "Tag": [ { "name": "5-188-86-165", "colour": "#DE80D8", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "pw-forpost", "colour": "#03624D", "exportable": true, "hide_tag": false }, { "name": "pwn-forpost", "colour": "#EBE1EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637801, "uuid": "3c589ee9-6990-4654-af75-7bd1776015d4", "comment": "Malware payload (NetSupport)", "value": "8d173ab9fb6f8509306b16c2117861f8aec62d5d", "object_relation": "sha1", "Tag": [ { "name": "5-188-86-165", "colour": "#DE80D8", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "pw-forpost", "colour": "#03624D", "exportable": true, "hide_tag": false }, { "name": "pwn-forpost", "colour": "#EBE1EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637801, "uuid": "86a95ea5-45f6-4fea-9ee1-e8d3c45a747f", "comment": "Malware payload (NetSupport)", "value": "039c193b84721d35448206e7836ec7f73bb33995faddeb293b3db24ccf39551f799bd26964dc66e2f341fe2c52a5a146", "object_relation": "sha3-384", "Tag": [ { "name": "5-188-86-165", "colour": "#DE80D8", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "pw-forpost", "colour": "#03624D", "exportable": true, "hide_tag": false }, { "name": "pwn-forpost", "colour": "#EBE1EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637801, "uuid": "68e830c9-615b-4a5a-aa4f-4d88f5c38d17", "value": "T1D465337C6BAEBC29279AD627A0C19D7CE17E180C447852AF8530D6F3E188BD953106B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637801, "uuid": "44d8519e-c909-4c7e-a475-4caddb116aec", "value": "24576:Cg1gn1Xck9+4X+wrS47VYEzzBncIhgg29V1sopoz8lKqxfshgfFjIeAmRhlPzt:Cg1Fkw4XTrbZYo1tha9V6opogKQag9jR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775637801, "uuid": "80eda963-4695-4e10-908f-db2dc5b835e7", "value": 1506284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775637801, "uuid": "1d892ab0-720b-4817-bf9c-fc188f75f418", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637801, "uuid": "f353a67f-08fb-401a-8091-3de01aeaea8c", "value": "gggs.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb04bfad-3372-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775670435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775670435, "uuid": "3edd811a-8a0b-4e7a-a2d4-010cedbd2692", "comment": "Malware payload", "value": "d91b39ef97d80337abf7d0b948c18bf9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775670435, "uuid": "43affece-4f4d-4b22-a87c-f164e3604d07", "comment": "Malware payload", "value": "35221372cfd63bdede638c87ed80a7cc6ddece26bd3c719dd3f18ad1581c70f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775670435, "uuid": "455b543c-4f02-4a02-a46b-fba903916b8b", "comment": "Malware payload", "value": "21913d213a34ae3bc8aac6917c9156cd7ddcdaf4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775670435, "uuid": "e73d94aa-8c4f-407c-9e88-468c134893cd", "comment": "Malware payload", "value": "17504f70ac727a6017088282475500aa97bd19ff98e323b5f108a6d4fadd9fdf523401117b25d6295a791d6ba0ebdddc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775670435, "uuid": "c38db775-e749-4ae8-99e7-e0eccff9b750", "value": "T14D166C83F1A791ECC019D074936AB137FB32784947246AF797D087202E65BE06F79B1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775670435, "uuid": "4e28cb46-a516-49c4-a9e0-a35247ea9e14", "value": "7aa8d40cb7e83e30e897fc11163b765e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775670435, "uuid": "9521afbe-cfdc-400a-95e8-a1dffe04ff0f", "value": "49152:TjwPPgVCxDo7lsGy4qCyFGrzBQzZ+ozJ0hCfOpCOhv1aBW2Cd2ymmT2vMhjO6IdN:XE74EJ+h9B2ym+Udp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775670435, "uuid": "7a51b208-3ea9-4e48-a466-e7a5f48bb4e7", "value": 4049408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775670435, "uuid": "b75887d1-68c0-41bf-a3ff-fbc2034442c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775670435, "uuid": "b50e92b3-df67-43b9-b76b-676b7d165d31", "value": "rune_drift_v1.0.0-dr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68aa0f13-334c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775653869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775653869, "uuid": "512e7d5a-c415-4737-b1a4-b7b2221fcb92", "comment": "Malware payload", "value": "fd3a6313a8880b1f9df80f327773519e", "object_relation": "md5", "Tag": [ { "name": "177-136-230-88", "colour": "#346922", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775653869, "uuid": "6dd1f1a1-42ab-44e6-a743-6816e1a35efd", "comment": "Malware payload", "value": "3574afffd40c6b2d29264685f67f12e29f4030bd0d05566fe342297f108c23d5", "object_relation": "sha256", "Tag": [ { "name": "177-136-230-88", "colour": "#346922", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775653869, "uuid": "64e5884b-4f64-42fb-9d72-2c2012580369", "comment": "Malware payload", "value": "4336ce92994f0b4fc0b4e885403374bacaebaa01", "object_relation": "sha1", "Tag": [ { "name": "177-136-230-88", "colour": "#346922", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775653869, "uuid": "17f506d8-c84f-4b2c-8cb4-6353c9532848", "comment": "Malware payload", "value": "6cbb6369e542457828f2a82d43b61092945302fc507d722b4acb3a45e4c960317a74884c66eb2050d9ddbc00d8a423f2", "object_relation": "sha3-384", "Tag": [ { "name": "177-136-230-88", "colour": "#346922", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775653869, "uuid": "428cfeb9-d63f-4cbf-be38-75d87bbc3dc9", "value": "T1B707E131724AC82BE56D11B1693DEAAE912C7D370B7108C7B3EC7D5A57748C22632E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775653869, "uuid": "e1818d31-c440-4a23-a788-3be1d121ad6a", "value": "63ed59597dad42eeec3f01fae0ba2a2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775653869, "uuid": "61643c72-ad6b-4303-8711-900660993452", "value": "393216:XZNVjchuWAR4qmANNPnG8OjVza3TKPspQvpnASMgKD2Jf:JNVjchuWARCINPGZZa3TKPpBB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775653869, "uuid": "0f0463aa-45bc-4dd1-ac8a-c8e019b2bb70", "value": 17277184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775653869, "uuid": "d396d57e-cd16-4e21-bf47-a8508f729edd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775653869, "uuid": "bb2973de-79e6-4b7f-b1ca-7c7b02ea0ca3", "value": "3574afffd40c6b2d29264685f67f12e29f4030bd0d05566fe342297f108c23d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfd4b355-3355-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1775657907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775657907, "uuid": "89a3e3de-e606-4802-8431-5f9c21a924dd", "comment": "Malware payload (Formbook)", "value": "5420c17772154007d2e38429f64131f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775657907, "uuid": "7588df19-5f1a-45a6-a732-20f2ee9f2754", "comment": "Malware payload (Formbook)", "value": "3680ce1ea0b26bed5d9f3e1fd91b5c859288185795c89268eba14e508c3a7c5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775657907, "uuid": "ce4884b2-6a01-449a-adb4-663cc09d249f", "comment": "Malware payload (Formbook)", "value": "d9f0bd89395bbf9889cbea438f5d6cc9e61c1dd9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775657907, "uuid": "0feea2e5-339f-41bd-b8c1-fe4db06b23f8", "comment": "Malware payload (Formbook)", "value": "fbd5766eb0e1e22b780e4d3e593d6b6e5bc1ed0569ac49679d20a9adb2b1f28f8a4eb4811bf6dada75d1415ca4d89180", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775657907, "uuid": "5aa578d9-766d-45cb-adc5-1201e17f13a3", "value": "T1D72512686629CF03D8D647F80AA1E37253B45CDDA422D3138FFDACFB786AB151509263", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775657907, "uuid": "d548693c-0eeb-43fa-a37a-7e9ae67a2ec1", "value": "24576:+p8+v9r5RSvrui8f974KSsgKkYZTnWSCi+yU5USt/ew:Yv5SSiVFs1kYZTnWSPU+i/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775657907, "uuid": "b254e680-137e-44b4-89ea-3562658c6b21", "value": 1056768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775657907, "uuid": "a3a55147-7739-4509-9125-20d3701ae3e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775657907, "uuid": "9e793e19-0dc7-4f45-98b4-e501995f5565", "value": "APRIL PURCHASE ORDER#.60055911.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e978a2d9-3326-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1775637764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637764, "uuid": "ae575e3c-6e18-4ee8-9909-0720dabaaa21", "comment": "Malware payload (NetSupport)", "value": "201cb5c744193f358a7da953facd53b1", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "hsgeowvi-com", "colour": "#212A9B", "exportable": true, "hide_tag": false }, { "name": "lkboasprqw-com", "colour": "#1C34F7", "exportable": true, "hide_tag": false }, { "name": "lkhpihf-com", "colour": "#C1C187", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637764, "uuid": "0a44ffa6-d24c-4ffe-89b3-6aee59921dc5", "comment": "Malware payload (NetSupport)", "value": "390190dfd7549b5e193aee0448dc0b0646d01f197d38cf994682f561100e6b69", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "hsgeowvi-com", "colour": "#212A9B", "exportable": true, "hide_tag": false }, { "name": "lkboasprqw-com", "colour": "#1C34F7", "exportable": true, "hide_tag": false }, { "name": "lkhpihf-com", "colour": "#C1C187", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637764, "uuid": "6cadf6ef-33e1-4147-b42d-5efcd07da255", "comment": "Malware payload (NetSupport)", "value": "0eb971c1b8163ee9454396389d4d1117cc150c78", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "hsgeowvi-com", "colour": "#212A9B", "exportable": true, "hide_tag": false }, { "name": "lkboasprqw-com", "colour": "#1C34F7", "exportable": true, "hide_tag": false }, { "name": "lkhpihf-com", "colour": "#C1C187", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637764, "uuid": "8fb6a6e3-0c01-495f-aa7d-272fa919fcf5", "comment": "Malware payload (NetSupport)", "value": "0b8206608f59a7ea894ccbda57151c5117b7114330f4d973ebe272dddc9d7a6b4519904f70693369890c1e5b3b1126ce", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "hsgeowvi-com", "colour": "#212A9B", "exportable": true, "hide_tag": false }, { "name": "lkboasprqw-com", "colour": "#1C34F7", "exportable": true, "hide_tag": false }, { "name": "lkhpihf-com", "colour": "#C1C187", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637764, "uuid": "c94caae9-c486-426c-9fd0-2af37fe467cb", "value": "T1E5B02B57D001005C0F04831022183F104113434D57A8DAC1DAA44050380C02D4103040", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637764, "uuid": "568c1207-6656-4a16-8563-cda06a162c98", "value": "3:LjD0rSLqVMnlRl7bJJFISkMoVsBeLYXLzEfFOLCP1h0CCAKSJGYqCn:L0GLqVMlRv8SkMTUoqFOL6gCCAJiC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775637764, "uuid": "da250eae-b77b-4d41-bc1b-f16fed2634ea", "value": 126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775637764, "uuid": "f32e2ced-69cd-4931-ac10-51d7a91fdc4c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637764, "uuid": "44045a9c-6b7c-4041-a438-aff243ed843b", "value": "ps2.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8b271af-32ff-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775620905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775620905, "uuid": "d890a04f-89b9-453b-b44b-f6053b043d2f", "comment": "Malware payload (Mirai)", "value": "3e4598341b7f7fbc02bfcbba03b3c6f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775620905, "uuid": "e5dcf380-e062-4bdc-87d2-e9e931182ab3", "comment": "Malware payload (Mirai)", "value": "3ad327e815be5f02c871028e0a48300158696a64c3d907cc8d1d068078ebc1a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775620905, "uuid": "7cb6576a-a956-4055-a92b-80ab97edd271", "comment": "Malware payload (Mirai)", "value": "9187c115bfaad6df6f110b1159c5c03cddc0f117", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775620905, "uuid": "0bf0011c-57fd-4839-9044-000ba375ef0f", "comment": "Malware payload (Mirai)", "value": "650c43434e199283ecf5677bb90efd7bf614a4e740afaca587537d02e736e501426e43661d77d312618c785965ef0ee1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775620905, "uuid": "072d3a05-6a48-43f5-a30d-11fab52db4fa", "value": "T11A435D43321C0E47D1A25EB0253F17E093BFE95124F4B689265F9B5A8B36E3B1486F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775620905, "uuid": "1c314b33-20b0-4b44-8bb9-2f931acea17b", "value": "768:lgbf8RQzh1r3FgzRaN7+faVt7Ymuiygu1HoGczEpGVuz2GipH6TnSgGABy:ybUg1Jgzz4Cqu1Hisi6nSgG8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775620905, "uuid": "7d7b0e48-127b-43bd-afd6-91ff5f7abb6b", "value": 55472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775620905, "uuid": "6a0ccc26-6b7e-45b7-b320-36c7841989fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775620905, "uuid": "e4ed0518-2c9d-4d21-bf92-52de6970779e", "value": "jew.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21432f1d-332b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775639575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639575, "uuid": "27075115-e66f-4822-8d3f-82c6f774290c", "comment": "Malware payload (Mirai)", "value": "4c7422f6f8ecbf2810157a5e36fcf0b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639575, "uuid": "8c3e709b-a3b1-4298-90be-9054dbc2b38a", "comment": "Malware payload (Mirai)", "value": "3b89869aadf312ff766e9f8c87899dbb5de3319268ce351267f03b44e5630e06", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639575, "uuid": "373e2dc6-4476-48ff-a79a-6fd9ea15f254", "comment": "Malware payload (Mirai)", "value": "907da181477c021869113321ead5b0e832339bd9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639575, "uuid": "c6242091-44c9-45d7-a8c0-5116d9729747", "comment": "Malware payload (Mirai)", "value": "68a6b680cc766f7695a70c6b4bfc7bd8bf0bdbb0f61033daceb2e40d40a423ac0d8e4f61a4c6a659b7e851682e5957d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639575, "uuid": "a6f388cd-6dfd-45d3-8dfa-ff44bc4f3831", "value": "T1B003F1219B17DB91D63648B6733C88D7F2160FE490AE26BE3509C42E3679E239BF5085", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639575, "uuid": "6a854ae8-fd16-4a12-8ff7-345f5943ccfc", "value": "768:kskNb+0HIHluEi0ToLhuZrnsM35nW7W33tnSFacKADcfEMZeMO1/Zg+pyOCz9q3f:kskNybFuEhTqersMNWYBRpfE6YY3OCyZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775639575, "uuid": "1fa631d1-ce7c-4466-9fc2-af4ccf4d17dc", "value": 41240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775639575, "uuid": "81f2b4b5-bebe-46ac-b588-b77f2d6b97d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639575, "uuid": "dd1c03ef-e271-436c-88a2-bb0b5d65f777", "value": "tony.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c815e305-3321-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775635560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775635560, "uuid": "97356b99-4ded-4a52-8f45-301d8b775e0c", "comment": "Malware payload", "value": "c30d3b4204445a0ba5681b099671fb09", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775635560, "uuid": "7f184881-7f91-48a3-ad6d-2621975af2a0", "comment": "Malware payload", "value": "3bb232c03a74ed215e385bc1d53674a34624b5b5dba4f60e8c815d1d5dfeb54e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775635560, "uuid": "9cf25741-02bf-4a87-81c8-3fa9ed518502", "comment": "Malware payload", "value": "3a00ad61abb8d35916da6518791cea9186760c7a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775635560, "uuid": "907594d9-d8b9-454f-b52c-1c73bde889ad", "comment": "Malware payload", "value": "b3a7fdead89f3250c69c7bed4d1dc4fa60c270a2baafb67496f46ba74feaf6c024195e8eaea2d5a09b597a499603c216", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775635560, "uuid": "48442db0-2bd2-4f0f-a958-73aa76d3ab20", "value": "T1CB16337EC245D58BF1E6AEB769515BD3ED0A225F42AB022230C051FE6C7AB3095CD633", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775635560, "uuid": "aa258fac-9d85-4bf8-a703-c0768b1dbd5a", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775635560, "uuid": "96834cc8-459e-482a-8658-2f453759b7f9", "value": "98304:1L2Nwvy/T6VM3R9stnx99dUJqK10YLpa9k4IWR1:Bvy/T6VEvQIJN1Lp0531", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775635560, "uuid": "f1d1994e-fb6f-47b1-82df-8cac356ef574", "value": 4243456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775635560, "uuid": "56aba24b-c6ad-451d-ae28-1261b46f3d44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775635560, "uuid": "d91f200a-f7cc-42c9-a7a0-a685b4fcbcf5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f29198b-338d-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1775681797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775681797, "uuid": "e9eef5c6-ab6d-4af0-9624-4b2e957d6219", "comment": "Malware payload (njrat)", "value": "bf504fe14d211aa134d8a47f73e9f812", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775681797, "uuid": "8687ed4b-6fce-4d8c-b87b-9ce773df20ea", "comment": "Malware payload (njrat)", "value": "3c2b04027907f87fa162b0b8e63a91e1fcef4c37098413cb84528a9d3c6fa364", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775681797, "uuid": "96c955cd-1d02-4e1d-8d20-565d4176f878", "comment": "Malware payload (njrat)", "value": "49ae6479318a0a27ef7b6873b147ec5f5dfeb30a", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775681797, "uuid": "8d395a13-b813-417d-9a6a-18fa009d9d47", "comment": "Malware payload (njrat)", "value": "ff29be7acf2e7c261b18c1a2177fab84cef907c48b78e97f730a16868bc947dcc4102fc302f5cec268a21eef63a1e128", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775681797, "uuid": "36754b66-7b74-4136-bf0a-664169557e15", "value": "T135F40165BB28CA42DDA44BF84A70E23513F54D9DE911C30B8EEDBDE778B1B562808247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775681797, "uuid": "4207e6da-de5d-495d-9094-02b6626f1c17", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775681797, "uuid": "e37b8b12-2a1e-4a63-a1dd-52e9a0adc35e", "value": "12288:rtN8+DbFdr9/OwCNkS3V77i5P1DRPfI3K2cONJ8RNVHfMd2mKpnX3kR:b8+v9wNZdu5Ppnz1MdQS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775681797, "uuid": "bf8d9841-b27d-43c1-8396-6bc18398ac13", "value": 777736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775681797, "uuid": "faa6b42f-7891-4a9a-8f58-8f9a888fd785", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775681797, "uuid": "99aa51de-eff9-4309-9388-a3453da9c532", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0042c4f-334f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775655277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775655277, "uuid": "71571271-1350-4b75-ba07-67675178fd71", "comment": "Malware payload", "value": "6dfd8fe4d0e2d6d4ea3b1f3f53db7f8b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775655277, "uuid": "235c7d92-a882-437a-a4c8-c741425c73b9", "comment": "Malware payload", "value": "3c339ec65e662180578f0c8a3245af6bc924e6343ab29272c3370d569e4b8350", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775655277, "uuid": "f0072e74-c669-44b0-988d-9c0bfe9cfa87", "comment": "Malware payload", "value": "495be68cdceb8bfc790991a2ba6e379b3b7f6767", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775655277, "uuid": "a1261076-a07b-429b-b282-e562991a8232", "comment": "Malware payload", "value": "a1266e361f679479b4768f8a1095356fa0c3a14c675509be56bdaa6a6c88a2015a8680068a35d1d204dd8f4bad10575b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775655277, "uuid": "0adebc23-183f-47c9-ba8c-77451741b91d", "value": "T1B2F2F1A4B4C81581D5449332F5B25E54AA1632C7EBC07D8273E8A9EC2B414568BFAFFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775655277, "uuid": "17dd38cc-cc98-4c26-a8cb-2ed54fdef323", "value": "768:IZwOJ1GXMuhbTb+6sBVI9u8xGyfy6cuP1mALkTqbVw/P5:IZj1EMmbTBPGqp9mAqq25", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775655277, "uuid": "497368b0-b2e1-456c-ab28-7844936db3b9", "value": 37139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775655277, "uuid": "c1011b5a-f3b0-46c1-b632-a6b14ace28d9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775655277, "uuid": "0dfc0011-1992-4c3a-a9f3-aa24b4937fcc", "value": "Dienstangebot_Trninic_D_07-04-26.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cead65d-3343-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775649930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775649930, "uuid": "67cba67f-4f87-4599-a3ac-ed81fb54ca53", "comment": "Malware payload", "value": "143f39d3db636b61475cc98035ada214", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stalin-Fabrico-Loor-Romero", "colour": "#7A8459", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775649930, "uuid": "7f23a83b-3b7c-4193-9331-ed510b515a42", "comment": "Malware payload", "value": "3c676480d5303fe68ee88a630cb1d635613422f08d43b9b5fff8e46cc4a387a6", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stalin-Fabrico-Loor-Romero", "colour": "#7A8459", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775649930, "uuid": "3ab5455a-3ec3-4dbd-b241-2135728334e7", "comment": "Malware payload", "value": "0d74bf86a76a0beb0e5d9cd384a1364d7082e0c0", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stalin-Fabrico-Loor-Romero", "colour": "#7A8459", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775649930, "uuid": "2e90e7e5-19cd-43da-8eb9-d7d1fd36a139", "comment": "Malware payload", "value": "58569cc71edcf1a01cdc4c646e7335546c8c009b1dfe86329b53aad4432338d61478f4a70d4137ff8eee067cfdfbdee5", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stalin-Fabrico-Loor-Romero", "colour": "#7A8459", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775649930, "uuid": "6ed1bf5d-8229-4124-a9e3-c9e09f957c0f", "value": "T126A63360BAC5407EFBEF28329214CB34FA3DBD383B09E64A43D079675D326901677A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775649930, "uuid": "544fe705-7e70-4046-83b4-55b56d0f5aee", "value": "196608:CjXXUIG4L8HLCVeM7Koh9tiyGwBLz5AbGfqNm9XvuV9q:CjXXrwZM7KojtNBLe1NmEq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775649930, "uuid": "00a6fab7-8653-44c5-9f85-4e81e312cfce", "value": 9650176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775649930, "uuid": "c629c8c4-d51a-40fa-aaa4-4d46cac0401d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775649930, "uuid": "81ce45fa-283d-4752-b46f-241cf7f32925", "value": "3c676480d5303fe68ee88a630cb1d635613422f08d43b9b5fff8e46cc4a387a6.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1abf67e-32de-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775606827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606827, "uuid": "d9e0ba5d-5bcd-4eec-beb6-9920698b5e8f", "comment": "Malware payload", "value": "720d813057868ec904ea57966eb0132f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606827, "uuid": "3d6bbf26-6c6a-41bf-8cd4-336a474e35bf", "comment": "Malware payload", "value": "3dd83802e4a3c71b8a7a03cd7b065fbd7b9eec3ebae5e0c29d4fc09573409ed2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606827, "uuid": "5ea86bcf-e0eb-4485-a81b-22c1a4a71260", "comment": "Malware payload", "value": "d731c2e8e21aeef2027c27e80fbd244c93b3a45e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606827, "uuid": "388981ea-9b86-450c-b532-18c966c1bcd8", "comment": "Malware payload", "value": "e8f8f03f9023778464143e6fe9a2a37ec5243509ffc3e21a744d811daa48452aee55c5ff1849fdbc3600e276b57f924c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775606827, "uuid": "124c5411-e5bd-47c8-99be-50c78ed36755", "value": "T188F36C93738A1BE6CB675B704FF74926ADD9260103F3C4AAD772AA5007952E43C1EDC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775606827, "uuid": "3eb7e32d-c69a-4ed0-adb5-6e34f0766d3f", "value": "3072:FPJt0NhPO3YhLQfhnJQP+AfmkC0zqmAXKqGz:FPuPO6LQfhKP+AOkNUKD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775606827, "uuid": "83627b35-81ac-472d-b4a2-6408f6e66e72", "value": 157984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775606827, "uuid": "da8f4145-56e6-4a68-9ad4-3100b1bd96f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775606827, "uuid": "a1a68076-1b7a-45b3-a578-410c4762a373", "value": "VKZF", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7717c156-3324-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775636713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775636713, "uuid": "3601cfa0-4435-4337-94e2-b11a9d225d11", "comment": "Malware payload", "value": "a1431dd0a4b7a70f80c81fadc35f3a1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775636713, "uuid": "caabd930-2972-4f04-b41e-ab2d746a998b", "comment": "Malware payload", "value": "3fe221da343b004c56a8528ead13f477c4fc878411ec51d58852f160fa416ed9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775636713, "uuid": "8eeb7466-fb23-4c00-a4a1-055afb7c37db", "comment": "Malware payload", "value": "d827be654984a94fea5ca6be34fb7889cb7ccf0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775636713, "uuid": "6174ba00-499d-4723-8636-1f3d3a09f48e", "comment": "Malware payload", "value": "320a029488e742959e033952cb0936b3010319e6449cb027e97a644a999cf74cf5f7d4e27aa03b1eced76d33ac84e776", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775636713, "uuid": "50d8f6ef-3ea3-4590-8e7d-217a361c88d7", "value": "T128C3F8C5BAC5DDE7CA09063585EB432D2738F6C51BC28B034D3476361E276E0BE8B65A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775636713, "uuid": "c25955e1-570f-436b-a0df-d68231c19bb4", "value": "28f2dd3f9218cef68e457f77ff271529", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775636713, "uuid": "4d038684-bc5a-4856-964a-e9736cb8410d", "value": "1536:VoIkdPsT3sgoVF7eWTxr0OnxtJNjj3WvXn/AyA5MJH5PBNoDrReRu/Bf:Vo9dkT0V7tn3mgOxQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775636713, "uuid": "270dc964-d1d9-4cf5-99cb-8807fbb9eca8", "value": 118286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775636713, "uuid": "c70f590b-7ee4-4ab3-bc65-048b16871328", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775636713, "uuid": "57950eba-b1a0-429a-a6a3-b46eb60829e7", "value": "a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9e3d11d-334f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775655374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775655374, "uuid": "d2b6d0d1-8c1e-4ab6-affa-8b6c3395fb80", "comment": "Malware payload", "value": "7c47618290a2397a8acac78f9b46264e", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775655374, "uuid": "425a61a5-e049-4f0f-8ccc-412fcad5f879", "comment": "Malware payload", "value": "4271e63615907efe119d10f3cf3fdc0e8571ff7e42e7be6f0ffe6fe9333ae6b1", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775655374, "uuid": "a757baac-30f7-4d60-bea0-268aa09600f0", "comment": "Malware payload", "value": "135e0c7749b7f9657d3935ce879d97a1e034ab61", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775655374, "uuid": "bd902887-069c-4cee-9b12-d46b2b4fa666", "comment": "Malware payload", "value": "4dd7e32217d3ef9c45ece67af2b3d712dad4e66c0d5abdb4d43a1ec0476d827ba12abfec8922b49fb3cf1839824a67eb", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775655374, "uuid": "59827af9-8a62-496e-8f6e-885769dc202a", "value": "T149563303EAC14572C1110B36852E8B6C633DE8207D338D7B7359896D9AA397273FB5DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775655374, "uuid": "275bb57f-aa11-48a9-9775-753f091b9902", "value": "196608:Xo4jYBIfPJS6F2LRt0WMsXpIdTFsdPmdNg:Xfj4InFFmRt0NbTmP6N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775655374, "uuid": "af718ebe-c1a7-4b28-92fa-a719ba13a74a", "value": 6381568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775655374, "uuid": "24929796-96d6-4ad8-81bc-44f00683b2d6", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775655374, "uuid": "e03e1d10-1a41-4983-a773-da47921c7428", "value": "\u8c37\u6b4c\u5b89\u88c5\u5305.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a05acb25-32ff-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775620891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775620891, "uuid": "d6727c9c-0828-4562-bca9-b496d5c08436", "comment": "Malware payload (Mirai)", "value": "33c4367a9271660258ba06f4a9a7a8e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775620891, "uuid": "6220a9ef-ad6a-491f-9043-a6fad967ef0e", "comment": "Malware payload (Mirai)", "value": "429fc857c0890190191bcb8edfd322e8e0cc46977a5c5f5aab760dbf0ee2668e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775620891, "uuid": "d5aacbe4-ad11-430e-827b-2712dad2cb06", "comment": "Malware payload (Mirai)", "value": "c4147c38f0f375088eb938561c5cfa97b3b27dad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775620891, "uuid": "25d25f90-9f7c-49dc-bfdc-1f77a70810fa", "comment": "Malware payload (Mirai)", "value": "faa5a1e3ff78292995e77db59377b8620e92c64fef4798a1f003f70a9a31bf81c32fcc4565b2177228f3d3a368105750", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775620891, "uuid": "43dc539e-b816-4d53-a670-f45499c6a0a9", "value": "T141334AC5AB93DCF8ED1506713177EB328B77F03A612ADAD7C3899523A842B01E50729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775620891, "uuid": "c7633090-5881-4389-a706-cd8669f4a695", "value": "1536:3hSgebzgP/AY+39afOsMJRdnhN66OQ6xpwhNbr/p:xZebkP/Ad39UMJRlhN7L6bIbDp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775620891, "uuid": "5f93ce8b-11bd-406f-ba3e-c839e0d74651", "value": 50608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775620891, "uuid": "bf87ffb3-36b8-4ee7-b75b-1aaddf32e611", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775620891, "uuid": "f046156b-edf8-4007-ad23-d28466b06c90", "value": "jew.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ba1d055-33a2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775690864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690864, "uuid": "329a9ed1-db9d-49d6-9582-f0cd5675920e", "comment": "Malware payload (Mirai)", "value": "0a5ac2d3d6092f402143c8dca2dbdf5a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690864, "uuid": "65509a40-7974-4185-99de-4605f2fd72df", "comment": "Malware payload (Mirai)", "value": "435b700db20235beef0b46a596a059cf60744ddfb4e077e018780cd943c49e37", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690864, "uuid": "010f189b-1be0-430b-8174-d85590a6fc38", "comment": "Malware payload (Mirai)", "value": "95132b69b8191065ed73115b66188b06d8e0726f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690864, "uuid": "57557f86-79c2-4fab-811b-cc9590113654", "comment": "Malware payload (Mirai)", "value": "9333a2db347aaa35cee176bf05e1183c62df2fb0ff1c7cbfa9723110c323a60b84ccb2565e78de98972865516b66d73e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775690864, "uuid": "d7a9ca8e-757a-48bf-a742-41fbf205e3da", "value": "T1C3C32A46EA408B13C5D61777FAAF414A3322DB54D3DB330689285BF43F87A5E0E57A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775690864, "uuid": "45403a2a-4d44-4726-b269-aec36db7c32f", "value": "3072:IZMu4C+u2GLhLRE90bYK5h9T96NOf+5/YtM/9gM/:eMu4C+uxRfbYK5hb6y+5/AM/9gM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775690864, "uuid": "c406202f-1abf-41af-8d85-999464267c2f", "value": 128047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775690864, "uuid": "f22e3f26-01bc-40e0-ab65-b472d55a0690", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775690864, "uuid": "fc37fe92-b316-4701-9595-103c754ac7a6", "value": "Josho.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b31bac48-3326-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775637673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637673, "uuid": "0dcad654-22b8-422f-9070-023eaa94f963", "comment": "Malware payload (Mirai)", "value": "f6b69405f3e197cd6c19f058b1d2a853", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637673, "uuid": "3bae86b0-03ee-4b91-a05d-81bf507af9df", "comment": "Malware payload (Mirai)", "value": "45beeec48e8209f5fdaf899d5dfed99d66f485afae987297242aa73885d6449f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637673, "uuid": "a5eb5527-ecc3-4ea9-ab5f-bcd431f073c0", "comment": "Malware payload (Mirai)", "value": "d592ba69080760dd4653f043b58e4a9a2f52084d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637673, "uuid": "51457be2-adf7-4f4d-baa4-472834e4c0d9", "comment": "Malware payload (Mirai)", "value": "1065c5564c9627d034c02f966b7df064cee22ae262882e28323d826e32bc5393509bf04ec72713c1df8de6176ff54d7b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637673, "uuid": "08f7edb4-c625-44a5-89ff-f7dea4f6f1e3", "value": "T112C3F185BB636991C06342BDA4C01AC387916E328FE217080699F674387DDFB1F69DD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637673, "uuid": "fdaa4631-6ad3-4bb0-a9d2-8891ee923bbe", "value": "3072:OBb4K+nqsnSjZldbaUXGSgqTWo1OWqEwztlMMTnZ:0OCDjXG9qTWywxlxTnZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775637673, "uuid": "dc0fbfdd-121d-43bd-85ef-5c2b2321acb5", "value": 127816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775637673, "uuid": "334e276e-082e-4d82-b4b7-932336d694d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637673, "uuid": "862b588c-9a1a-49aa-be5f-c5a290b401dc", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec406742-3351-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1775656237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775656237, "uuid": "d8d6a268-d7b1-4993-989f-fbb5e2f70f31", "comment": "Malware payload (RustyStealer)", "value": "3031550849b2f8fed8b53f0e2d23c355", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Ravartar", "colour": "#0E27CA", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Ravartar!rfn", "colour": "#50B96F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775656237, "uuid": "a64bd499-67cd-4fae-bf99-959e073d12c7", "comment": "Malware payload (RustyStealer)", "value": "46e9cb375578c105ed8901d36a3f57d8a0f8e1766023514f9dabf332f45318b3", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Ravartar", "colour": "#0E27CA", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Ravartar!rfn", "colour": "#50B96F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775656237, "uuid": "df666895-a9b3-486c-abd6-53008b3dfe7b", "comment": "Malware payload (RustyStealer)", "value": "0e14f870a67503b87f428b04bbe16093a0f2deed", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Ravartar", "colour": "#0E27CA", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Ravartar!rfn", "colour": "#50B96F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775656237, "uuid": "5eeeb461-1e5d-4257-a777-1eebbd47c27a", "comment": "Malware payload (RustyStealer)", "value": "7caac616753f5e9139dafea4cc03c110b36a3dab003c5d3df4132207bb327e1dc29272758f4f8f9df6e7809c1a8d5414", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Ravartar", "colour": "#0E27CA", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Ravartar!rfn", "colour": "#50B96F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775656237, "uuid": "ab8b8e96-9bf7-4c07-b803-7c2a0efadcf8", "value": "T1E7B6AE47F85594E8C1AED230C66692A2BA717C840B3023D33B50FBB92F76BD46E79354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775656237, "uuid": "172e0f9c-320c-4ac8-a022-8c0d43cb7ca1", "value": "9cc6ad26526177498516ce40bf44aebc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775656237, "uuid": "2d1379e6-6286-4ace-bf0e-adb6bd6a30f1", "value": "98304:E8oftyhbU1AekAcZ/GDVU1J2CgPwYhii57kTg7kQq/b1lfc3spKQ4aku+uEtDY:GftGVqcmVLZhiiCTg7kQkZupQU5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775656237, "uuid": "87ddc1bb-bd32-4d8c-be0b-12dc282e39f1", "value": 11225088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775656237, "uuid": "1847fe50-9519-4156-9df6-5deaac417d92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775656237, "uuid": "831a8fd7-27b6-46a1-980d-482c863c01ff", "value": "AI\u7f51\u7edc\u6280\u672f2026\u6700\u65b0\u7248.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb707177-3312-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1775629097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775629097, "uuid": "5ecad7a8-1440-4a48-b033-2529523468b1", "comment": "Malware payload (LummaStealer)", "value": "7b09889debb5e1c3edbce7e7c588e4f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775629097, "uuid": "3c8e3a4a-0eb9-41a1-8d39-f39fc942162a", "comment": "Malware payload (LummaStealer)", "value": "477cdf91cf00519d62d210152b0a5962c2f2da5c7592ea161500db8ef7840568", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775629097, "uuid": "4fbe815c-61bc-4b7b-9e78-e307e340e460", "comment": "Malware payload (LummaStealer)", "value": "edac98acacee93aff54abec5e8a8479e6e73ef1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775629097, "uuid": "885c7fa5-d923-42a4-b35e-339ea6b7697d", "comment": "Malware payload (LummaStealer)", "value": "9e4e5300e096f77d1f215f491c435cdb413ba1ddb5f9618553e915bc3b3a1a5f0b9183261be9e062cdc49f13d450c449", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775629097, "uuid": "a5269ba0-75d5-4db5-8be9-dcc3d70e64c4", "value": "T13AC47CC17A4291B3C4912C3401246A7B3E781F729739DCFBC5572892E6B5EBB82B6137", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775629097, "uuid": "de98a4af-26eb-47a3-9753-977e54c6cfb5", "value": "64c6d83c0343df7b4b0f754fa1d038f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775629097, "uuid": "057fd546-c614-4859-bea3-ddf7d11c1b81", "value": "12288:MFi0ZFfd5Rl1kU4nO55r/fI0vXkw1PBFpCzZJPgRpVdbMY:MFi0fd5Rl1RJ1AZk5FpaLIRpnf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775629097, "uuid": "6be8056b-6e35-49d3-9d5b-17cdeff988a8", "value": 566784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775629097, "uuid": "3674b7c9-2d90-4689-9e93-82bb525c9af3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775629097, "uuid": "8541d3d3-0b14-40da-8848-3df4e0dcf178", "value": "477cdf91cf00519d62d210152b0a5962c2f2da5c7592ea161500db8ef7840568.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96a0fb45-332b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775639772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639772, "uuid": "9d5ba7bc-cdf1-4d21-af5f-1b0ced17cc9e", "comment": "Malware payload", "value": "a1b36c34fc76f90d9ff71fde98ecb09e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639772, "uuid": "b89cb3f4-cda2-457a-9821-bb3b6537cfc6", "comment": "Malware payload", "value": "484975076da9ed79297ea78e999ece0bf51909bf0e46df26ffa03b39cb2added", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639772, "uuid": "456c4344-bfe6-4e15-be18-3ac6329ef84e", "comment": "Malware payload", "value": "0cfbba21bf1ef31584030ac78dd51d931876f2a2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639772, "uuid": "a811bdfa-3dde-445f-a0f4-04329f3c622f", "comment": "Malware payload", "value": "04db7ba64cc52205e51aeda463825ed1b6cea3d0f4efe334d9e9d3e632dc3fa77773726f047cdacdbfcd660395b02f3a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639772, "uuid": "db9618aa-4f6e-4378-b22f-e6aa2e7534a9", "value": "T13994A039C8AC513B95B2859DD582C38DFC87DC06372FD847508726CA4C7A9C2AC5E9EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639772, "uuid": "9f037315-ab19-428a-85d4-96e433c3119d", "value": "6144:xfBaeaZh1FA0W1urU9lLuUPbN3pjBjWhaaNxjnfJWJjizXlB7ToZnD:xf4eaH1FA759JuUPB3lAaExjYdiLroZD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775639772, "uuid": "e3d1a210-1ecb-4a5c-a5ea-e27b5d0c67e9", "value": 408904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775639772, "uuid": "78e6b4ee-acf6-43ee-a735-9dfea5c30627", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639772, "uuid": "6759ed58-befb-4366-a566-777fe7f0e8cd", "value": "Amended Order -592418235.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a186e40e-3316-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1775630771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630771, "uuid": "fe0d3a42-f3f1-46d1-98a9-dfa43a44e985", "comment": "Malware payload (ValleyRAT)", "value": "7a73d01e5cb7d6deb8f279867827411e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630771, "uuid": "5afd896d-6517-4a38-be2c-3c7c2459c025", "comment": "Malware payload (ValleyRAT)", "value": "48806616fa956b070e02782dda7fe9fad16b08e9eac801bb0c9a80230e294460", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630771, "uuid": "ce8dab5c-cc9a-4356-a493-f99e4ee272f5", "comment": "Malware payload (ValleyRAT)", "value": "6594cb66d27175fcadda963f54901e9669e2d4ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630771, "uuid": "d03c1af8-de63-4b2c-be7b-6e9275d3c48b", "comment": "Malware payload (ValleyRAT)", "value": "000628924924a10d61569d27cf44c4c7dc60f1f26cabe404bf78262d14e022b35b9984d576d1871fc7de29d92cec7536", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630771, "uuid": "5cd99ed0-63a5-47a0-9ecd-88141c5bc7f8", "value": "T144E64B38608904D5E56BC135BA9EBDD02133B4A78BF52EE7035CE6710E67FE16F16A08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630771, "uuid": "2b428635-71d2-48a0-92c9-2c7f399f66b3", "value": "ea5924b17580be04b899e21fd3d72352", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630771, "uuid": "d92fdbac-f2da-4106-918d-0c07ac68317f", "value": "98304:OE/xCiNFTNH6053cu5fVX4Avskd6o0/H+mgAW/c:hxCiNFTNH6053cmlC/H+HAW/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775630771, "uuid": "7b8b86b6-b934-47c6-84cb-3daa2a2fab7f", "value": 15074304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775630771, "uuid": "f08a293c-bcff-471a-9396-5a3f6807b7d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630771, "uuid": "ec770387-8db6-4013-8cb6-589df986c074", "value": "\u70b9\u51fb\u6b64\u5904\u5b89\u88c5\u8bed\u8a00\u5305.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20d246d3-335c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775660620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775660620, "uuid": "261ea2a6-bb22-4d39-806b-b414b090ec3a", "comment": "Malware payload", "value": "8b17f1ff17085d380b586b7aafee9f07", "object_relation": "md5", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775660620, "uuid": "0c3fbb3b-6ece-4012-957e-12798382b36e", "comment": "Malware payload", "value": "4887a457b13116ba350d59cd80c988c03c65ed89097c9da8d8037a3af9fbd666", "object_relation": "sha256", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775660620, "uuid": "d7ce64fe-2896-47e3-8e91-a1ac6e188391", "comment": "Malware payload", "value": "566120811db5e09e614bca298d1f416cb95a5190", "object_relation": "sha1", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775660620, "uuid": "b0e5ea26-8051-4e2e-aeff-1e79aceaa5a5", "comment": "Malware payload", "value": "479303f52f72f2f546be1bd09cf2a33bb3aa1f31240cf5f2f97d5a068c24c58e88c4c5f165baae04e07898033e8a778f", "object_relation": "sha3-384", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775660620, "uuid": "2d3b055e-4ffa-4d6f-be8f-17426a42cb79", "value": "T1F3D50E5291214DEF9AB2CA8EEE45A8F8DC171452F20BC3DD0E16EF4C2875240F56A79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775660620, "uuid": "8dabe99a-f490-4dd5-9669-4506445c0f62", "value": "3072:sh9cRyn0PohmCHHZFASfK5eLYtTEiwANcN/ms8DVIfJgVPfvACcDc9ZFASfpyz9P:S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775660620, "uuid": "013a2957-125f-4ad5-afe5-fc1a16f7c59f", "value": 2898805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775660620, "uuid": "0d54cb6a-d31a-494a-af1a-4d1b155475be", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775660620, "uuid": "90941e68-af29-4802-a2b6-486ecdb9901e", "value": "Pedido de Cota\u00e7\u00e3o n\u00ba 08042026.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed97023b-32ea-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775612001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775612001, "uuid": "5ed74315-e036-4946-94f0-a79bd9cef092", "comment": "Malware payload (AgentTesla)", "value": "0309a9277e49d2e4b900ccfcd69c9a6c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775612001, "uuid": "f614c322-9bb2-4b35-b72e-7131cfc36c83", "comment": "Malware payload (AgentTesla)", "value": "494b7386dd15192888bf519e0f72d74597f20d03835bf567756096627df6325b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775612001, "uuid": "6ee0abe7-fcc9-4de1-ae9b-cff2a539b67e", "comment": "Malware payload (AgentTesla)", "value": "e127c31fb8e08317fd83ae7fc1019e81d679a8f2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775612001, "uuid": "52a9f1a5-c809-498a-98f3-900f47428e89", "comment": "Malware payload (AgentTesla)", "value": "0dd52843ee999295500e43853c70b64426278e6ad292d40f89e2290e90193486d43b568a2371f2329036ce14a32360c7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775612001, "uuid": "b1f73e3e-f490-4bdd-a168-c605f1fed9cc", "value": "T1922512246B5EC843E9D5433508E0D6750375AE4DE823C7479EEDBEFBB926B162C18342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775612001, "uuid": "8f8d4a66-3f4c-4a54-a470-b9b71be22a94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775612001, "uuid": "2eb8cf4a-aed4-4064-8294-4d0f8602fb02", "value": "24576:aJNWIETi8+v97l8rhkm2eMwL1z5oVihIiyvrydBVxVC:aJNWgvL8NJCFpU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775612001, "uuid": "cab002f7-e427-4ae9-847a-895f3720efe8", "value": 1008640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775612001, "uuid": "a899019d-a05a-47b6-9b20-3d1e072abe8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775612001, "uuid": "a8600a04-0051-464a-a5e9-a7a70dd7ff6d", "value": "MV_Sea_Princess_Vessel_Main_Information.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c5911c7-3310-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1775627971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775627971, "uuid": "4f71ab7f-52a6-43c3-addc-c323d7ac0c74", "comment": "Malware payload (Formbook)", "value": "c7e114f1fa7037388db44a730cd88758", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775627971, "uuid": "a0a3208f-b46c-4d01-9f46-cbe0276cf2ed", "comment": "Malware payload (Formbook)", "value": "4a33d0f6978c92df2ae270abbde6479ced2e3ff5f690e59e35e6c01577127074", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775627971, "uuid": "25646955-a31d-4fbb-9e7f-f9c7ce2f3826", "comment": "Malware payload (Formbook)", "value": "5f9a16d01ff35799714f2862571a27dacb011d7d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775627971, "uuid": "2c359797-4b50-4f17-b560-9773520ac058", "comment": "Malware payload (Formbook)", "value": "777d86be5f30d0d2badce6c0c795a357abcf3a0c6debe139fdd305f25f78676bef25809d3408eb164901629feefe5087", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775627971, "uuid": "ca86fc2c-ac1a-4e4c-97da-bb628f564680", "value": "T19AC61908E1A865EF44F6EF09853981C26C8D61FBDA3DD946701FC07E6859FA36A610CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775627971, "uuid": "8f2bf948-5137-4792-90e7-e73c7a319217", "value": "196608:3pp/JMux+bEOoIAuvAmFQPIgcNa0DOFdq6PTutC7V6kGiOXS4nXAhk9c0SFahCOv:ZDz+bE2AzmFuIgqaXF06Pqt6wJXS4ukp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775627971, "uuid": "78fd1f89-4d79-4e92-b8cb-9d2a3d41d8fb", "value": 12371637, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775627971, "uuid": "ee551e01-b501-4374-8db5-56429351ccc4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775627971, "uuid": "33b05f30-d868-47f0-9547-905ce49addb9", "value": "Purchase Order no. 4100021754.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23aff0c3-332b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775639580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639580, "uuid": "2a4970a6-8bac-49ef-9dbc-85cf642b7745", "comment": "Malware payload (Mirai)", "value": "bfd756545a20b14a51437724ae6204d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639580, "uuid": "08f46218-d685-4511-9ca7-12bf36326c48", "comment": "Malware payload (Mirai)", "value": "4bfc76bca7eeb6a4b94883f11885bf35af2ccb767481d5ccdc0c06b0930c9b4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639580, "uuid": "00c667e1-d7e5-4d70-81ac-02efec7ad9de", "comment": "Malware payload (Mirai)", "value": "b3dc527f87b5663a5d6696f0f92eface1b94532f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639580, "uuid": "6c6f6e87-4270-42a7-9ca7-57e5962e6563", "comment": "Malware payload (Mirai)", "value": "a79351645f3486bec4de392eb22445d62658b7ef1b6d69a75eb5c2a012b411a800987c7c423260ba4f16fbb1934e6b26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639580, "uuid": "4a1f8662-d2d0-4bcc-ac56-041dde570bee", "value": "T1C503F1421AB85D31D33C1C3AE6FE46C315AF562F83F6517714A0899CB2C2E6C0B787A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639580, "uuid": "6e645278-5165-48d9-9535-0325557363cb", "value": "768:CG2AL8fXpGbEAIOFbTpyAMJRlk+gYoXa0pIGuhe9SsMs3Uozd:CG2iGIEAx3pyAMJRdYKWkEJzd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775639580, "uuid": "e2270a34-3999-411c-abaf-055544082b61", "value": 37912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775639580, "uuid": "ff975dec-5ce1-41cd-8702-29b3ffcaa2e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639580, "uuid": "afbab3b9-c76c-4e8b-ad4f-9b0bb3e172d5", "value": "tony.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af9a06ed-3368-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775666014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775666014, "uuid": "615e3dab-4708-4d94-bcb7-c7785ca96624", "comment": "Malware payload (Mirai)", "value": "c79845efd1a53894138bba721ebcf65c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775666014, "uuid": "7af02761-7bde-46b0-9c82-ebeb67462f4f", "comment": "Malware payload (Mirai)", "value": "4e351484a44ec6ea47bc9dfb03667a829381c7ccb195f94f4037ed5fcbc6c8c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775666014, "uuid": "2f9ceb46-0d5f-4b4b-8706-7d5cd7a4ad60", "comment": "Malware payload (Mirai)", "value": "01b0dae8557f4be0857d0187c7732cea75042453", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775666014, "uuid": "45d9dcd1-fa05-48ae-b309-88b43be42da7", "comment": "Malware payload (Mirai)", "value": "b59b2499ec2b5615d4366e2fcd2d79a2e3e8a1983a3a9c1f9658fa08daa7bab79e68ae43edc689d70f876b312f1f6c8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775666014, "uuid": "5f461b0f-3a70-47d4-b02c-9155deae93a2", "value": "T11B146C2BB3C39CE6C51063308C316362776FD7081958EAFFDA1B3794A99772256246C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775666014, "uuid": "6b276e7d-dc77-47cc-9694-ab936217370a", "value": "6144:zNROm5155gL6mTX7zRR1Lwt8Al7IKTtM:XgLnLzt0ll7Ih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775666014, "uuid": "b1cb8b04-c3c2-4726-ac96-41add6e339dc", "value": 197352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775666014, "uuid": "98420507-8fb5-48db-a06d-aa64785bff55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775666014, "uuid": "bc262944-b294-48a2-b6ce-13b5d0159c57", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "200abe01-32f0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775614233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775614233, "uuid": "f7067364-b920-4cca-b579-d27aefe36f26", "comment": "Malware payload", "value": "e86b3b5c73640fc731c8fa105db2fc71", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775614233, "uuid": "1c7e9472-6aeb-4394-b24d-fa374ecd22dc", "comment": "Malware payload", "value": "50386a8a7b6c5363763a7c98d07adefda868cb89180239bfe4663b6737af590f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775614233, "uuid": "a1843ba8-a91a-4928-8fcf-f1ed39a47a9a", "comment": "Malware payload", "value": "58fbc6c26ec63e6601099963804b4fc4a7c6f7b2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775614233, "uuid": "a26d4012-b9c1-4899-8aa5-81b35de9e0c0", "comment": "Malware payload", "value": "431750df86c02e7f010c64921109ca96d8c1e2164d2a0015d0e771f2dac4f72fcefa5a7e5fcddaf0df63897f6a0b0941", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775614233, "uuid": "74f2a385-e20c-4a0c-ba04-2383155c379a", "value": "T174F165C80363E4759DA5AF5BE268DA347849A482F8C58D84C0FE34F6DD4DE05B9057E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775614233, "uuid": "95d6affb-2cd8-4b8c-b203-37876131e6be", "value": "96:9KhEcfEnsTE1OStfiIMEStfiINqMEqNiMEiN8ME8NaMEaNCMECNOMEONqMEqNoMn:oV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775614233, "uuid": "e6faaab3-5aa5-4714-86e4-b86de5f355aa", "value": 7916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775614233, "uuid": "fb6121ab-d1fc-4986-8a61-802db170138a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775614233, "uuid": "83f7f56f-d58a-4750-8b2f-e2b6bce9f486", "value": "fak.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "733a1eb3-333d-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1775647444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775647444, "uuid": "52bc8657-e7ae-40bd-8e26-7c7ec478b76b", "comment": "Malware payload (Gh0stRAT)", "value": "55a074f29d805b72c702f10d178bf74d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775647444, "uuid": "3639d611-764b-415e-92f4-c82b438e8b1b", "comment": "Malware payload (Gh0stRAT)", "value": "507eca36144b1a080fce72d2a6ad164fe76a33571e1f4574451a7ca135588087", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775647444, "uuid": "84de2333-518f-4bd9-ab44-b5ccebd08a42", "comment": "Malware payload (Gh0stRAT)", "value": "1471b9fee05992c32cea661be8beb30caf0a82dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775647444, "uuid": "11033692-32b3-4680-a319-866e75650b1b", "comment": "Malware payload (Gh0stRAT)", "value": "d50e0ac3470d600943d42cfb4ca9c8b21b1d62e6d7d7315ea557f9c0c7a672cb74a918eb21baa805b80d4a0ac0eaad46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775647444, "uuid": "0ead8a2a-7238-4640-b12c-7bd6a933defa", "value": "T1E2173323B28E223DE06A4B3B45F291615C7B3E60956B8C52A2E4BCCCDF7D4601D7E752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775647444, "uuid": "a2f0455b-ffa7-4221-9b90-61b4f98b5017", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775647444, "uuid": "c0b54190-9db2-4c92-b56c-48eca9d45a55", "value": "393216:ZIWpBYunCdYo93JYbpId0URePCHivVs/aKZFuHxLrIHzMjNBVV0:VpBYuDoXRdYa3/akGprIzMI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775647444, "uuid": "a636a70d-6171-4194-ba9e-c58fd304c818", "value": 19064101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775647444, "uuid": "99417db3-b0ed-498a-9a65-84c743dcd3c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775647444, "uuid": "10c024d7-1d32-4241-a36c-bcbf1212a2e1", "value": "SetupAPP3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8621df6b-33a2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775690855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690855, "uuid": "653f4826-c38f-4f2d-9a48-6abe52d2605c", "comment": "Malware payload (Mirai)", "value": "bf466aff67ad2e0dd5e92ba97b3d3fc2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690855, "uuid": "8ea13313-db3b-4a04-9c3e-80933a0cb037", "comment": "Malware payload (Mirai)", "value": "536e9b6dfeab17970c52c51d0596b0603c8a32da0c1e358df42752d0d64b2787", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690855, "uuid": "73deebb1-1086-4d34-81cb-2d44c609509f", "comment": "Malware payload (Mirai)", "value": "2c0258ee7158d0de3e604125eee9b9a8bd6a1b91", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690855, "uuid": "d3fb8278-671a-4682-9e74-c7a9e761fbdc", "comment": "Malware payload (Mirai)", "value": "1eb061dcef112ba22868d318590cce459752e675da8e017f0c73472b68289140d44b709bd42f05c2495dd6734175a4d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775690855, "uuid": "299fed3a-519c-4298-98c3-7cf72986a849", "value": "T1AB2308C27941B639C3D0577BEEAF014E3354A7D8D1DA3397C8281B907A8A90F0D67B46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775690855, "uuid": "f9b867f1-71b5-48bd-a582-02f7395c09e2", "value": "768:sJeKpHsmyayL1ScT+GRvFES1un1wnjvsDoCerCw7sC/AnX+6k7wCVy/rCxHghW1p:sYFmSJScT4MjvR7sCYnXPfhWt59seR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775690855, "uuid": "e91ac178-fe27-4527-8a54-8323918ed5fe", "value": 49140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775690855, "uuid": "a0f3d2a5-baa3-4948-9e21-3e603b55a703", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775690855, "uuid": "23e9b308-b7dc-49ce-8786-6d383a98f6a0", "value": "Josho.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46f7e988-3387-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775679152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775679152, "uuid": "82386664-a6cd-48b0-aafe-9b279942393c", "comment": "Malware payload", "value": "79a3d3dc112bf5dcff021116fd986e90", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775679152, "uuid": "db4bfd27-eb4e-491d-ba4c-7d2aa0c11c45", "comment": "Malware payload", "value": "53d53dfc8e58d07c9d735437db675d0e6d5ba32aadb76d0d1ea5c9b3a5758d13", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775679152, "uuid": "5a58f8e7-f59e-41bf-a93f-d9ab2819d06f", "comment": "Malware payload", "value": "be08c482448ce8c4cae5e08a0b712389e43cdcd6", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775679152, "uuid": "fa8b90b0-35de-4b76-ac3a-9ec0f250bc3d", "comment": "Malware payload", "value": "b7f025a5693c113366dc8aea463d83246f2cb064d926b3602ace540cdd2d55bddc0af7fc6dedf3eb9e9e2e49d6aa9191", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775679152, "uuid": "945242b9-0001-42c7-91dc-12949da440f3", "value": "T1B7D3FBA85DA988F8CF4F7060052FAD47999C9733224FC4547AAF9E446FA3D74316E8E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775679152, "uuid": "c84b2e5c-3956-46cb-8ecd-c12ea8effe4c", "value": "768:3sRc4F1F7FnYO92eyfnz52vnqKNeEKGQL2V1jP2jO/BeTF02m3t3HVz2l2rXTK4R:q1jUgVXWuA2W07r3ZgLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775679152, "uuid": "48c88b9b-ebd1-40e4-8874-08de4e3d1985", "value": 135680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775679152, "uuid": "85a2dea0-ca34-4c19-8923-190a04739938", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775679152, "uuid": "f1003853-31b1-41bf-a52d-2c4a268bea9a", "value": "Network_Notes_Raw_8634.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "370934f6-3314-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775629734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775629734, "uuid": "b4152309-ae0d-42cc-88bd-5707ba014e85", "comment": "Malware payload", "value": "4076f1d7c690f02d41a386c24ef63a00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "oficiospolicia-com", "colour": "#4B94B2", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stalin-Fabrico-Loor-Romero", "colour": "#7A8459", "exportable": true, "hide_tag": false }, { "name": "xx-kak-is", "colour": "#B502AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775629734, "uuid": "2be3cdc4-4321-46f0-ba2a-f528e5766106", "comment": "Malware payload", "value": "555f42c53dfd9c633f242ef3baca797365c2daee9af2475db2171d6fc2cd2b57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "oficiospolicia-com", "colour": "#4B94B2", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stalin-Fabrico-Loor-Romero", "colour": "#7A8459", "exportable": true, "hide_tag": false }, { "name": "xx-kak-is", "colour": "#B502AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775629734, "uuid": "cd8ebc88-0d7c-4ab5-b51a-fa4f0f85e581", "comment": "Malware payload", "value": "7143f1b57d9a6e419e807580d6e5a13878a797ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "oficiospolicia-com", "colour": "#4B94B2", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stalin-Fabrico-Loor-Romero", "colour": "#7A8459", "exportable": true, "hide_tag": false }, { "name": "xx-kak-is", "colour": "#B502AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775629734, "uuid": "489e5e29-1df7-46e9-9552-d06cb847c417", "comment": "Malware payload", "value": "d321541925d68083b41e09d8996a7e98fd61b09552ea686e97a632f0f742c6d7b11aa9d63acdf67daf7d679dab4358de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "oficiospolicia-com", "colour": "#4B94B2", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stalin-Fabrico-Loor-Romero", "colour": "#7A8459", "exportable": true, "hide_tag": false }, { "name": "xx-kak-is", "colour": "#B502AB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775629734, "uuid": "80b3dd91-783a-431d-a361-341c6d9cd724", "value": "T12818333BE18A6579E06E2D363572E210943FBE5169030C1B96FCB04CDF356B11E3EA96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775629734, "uuid": "85e4bab6-7e95-426e-9c43-b99cd70ae204", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775629734, "uuid": "f3064361-4f2d-43b6-a13b-e8e690b2ca92", "value": "1572864:wW7mT8Psdhx+WQXmyAj+cCWgAv3M5J5ilWJ0bsbvmqEN4BkF1EZDOsLE:DmgsMPXmr+cCWBv3KCdb4p8sLE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775629734, "uuid": "101de4ba-f19f-4e3e-b4b6-2d461dc7a8a5", "value": 84950424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775629734, "uuid": "b7af9826-510f-432b-80a0-7be1d51d1554", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775629734, "uuid": "c5669a90-ac0d-4359-8a38-e73f8cc57f0a", "value": "Oficio_5201042026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74d6c0b5-335e-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1775661620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775661620, "uuid": "337799bd-3d68-4856-8a3c-3769257f49f4", "comment": "Malware payload (ACRStealer)", "value": "bfe2211050886263d50a12880ff6f14b", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775661620, "uuid": "b9d6a7b3-5a7c-4665-a202-ada6e529b060", "comment": "Malware payload (ACRStealer)", "value": "576ccdd7002621a495a6fae64b3e2efbc66da3b67d44d7137d0d71d0a7a1758c", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775661620, "uuid": "7f19dd46-da22-4b35-98f8-b912626f6f78", "comment": "Malware payload (ACRStealer)", "value": "327b57b385e081be25cc335082de17c664a2402e", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775661620, "uuid": "72fdd715-7c27-455d-b831-7fce9076793b", "comment": "Malware payload (ACRStealer)", "value": "4fe32612a605dfbd2a65ca626e83c6435c91269256736f61bab30c89a5800ea1be42c54bdcad558378ee4dc34e43efa1", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775661620, "uuid": "1da6f182-3d61-4491-b374-9edb4de7d060", "value": "T102F54B0BFDB98CE9C099E2344433A556BE317C401B2163D72EE5B6A82E73BF09975B14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775661620, "uuid": "4076b5e2-3ab3-4c04-97ed-ea575c06ce2d", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775661620, "uuid": "cd0c9229-2ea6-43b6-868e-f0308dac92dc", "value": "49152:9CwY4uKFm/ZLj8V7RXnjFyvctDvragAT+xaj7XQcjM3:9G+7agAT+xFH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775661620, "uuid": "d3379f55-1bef-4971-85d3-e3020971605b", "value": 3509232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775661620, "uuid": "732bfd7f-83ff-45f6-8cb1-8158a69c778e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775661620, "uuid": "f0377ffd-7265-49d4-9d8a-613293503bed", "value": "SecuriteInfo.com.Win64.MalwareX-gen.14725168", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f81c19d3-338d-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1775682027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775682027, "uuid": "cbee3e59-9637-4a16-8b4a-b798e9a9000d", "comment": "Malware payload (RemcosRAT)", "value": "fe3b95a1d6c50db3c8c23992e41b3e1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775682027, "uuid": "4248b180-2672-49b2-8e87-b95dc4de81c4", "comment": "Malware payload (RemcosRAT)", "value": "58dad36605825cfee52c608af3e1243d9375189967479a7bfdb98ba682d55a51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775682027, "uuid": "dc4c8762-c77e-4300-a4ed-9db94acd9b0b", "comment": "Malware payload (RemcosRAT)", "value": "ed6a0813d3e3a3d362ca1fd4f05ce5d3f04e4219", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775682027, "uuid": "819a647f-a27c-4bc2-8d5d-0341e260c0ac", "comment": "Malware payload (RemcosRAT)", "value": "5070092cf7098812fef9fa09a674d3633289d1bf3e5d75d6e12e421751d983ecf75921bf4112db6e558758cba6ba9bf2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775682027, "uuid": "bfb976ae-ed20-4cc2-9edf-204a61052a88", "value": "T12EB4B001B6F2C172D976A4300935E774DEBCBD201836997BA3D61D9BFD30150AB39AB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775682027, "uuid": "25e93227-50a7-4240-82c9-7ac5954b6897", "value": "737fc4be4f9f7d7c06c790667c9f7669", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775682027, "uuid": "2d635828-6d01-4303-9db6-45b131311393", "value": "6144:TXEE+QEZJvHVdFjl0WGYB+cvbWvpB+qADnN8XIniCrVSMXcvOsAORZ0AXiBcel:DENlHV9FGeDWv3jADnyYiCNrsPZ0j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775682027, "uuid": "61d016d8-0d51-47cb-bdea-debf07bb8b4e", "value": 527872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775682027, "uuid": "16405ec1-19c0-43ba-b421-f0166428b899", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775682027, "uuid": "d22f4ad3-e25a-42ab-ba4c-e1c4cd299072", "value": "58dad36605825cfee52c608af3e1243d9375189967479.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "095ef163-3326-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775637388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637388, "uuid": "8617803b-cc00-4f0a-a8c6-e09e54232fdd", "comment": "Malware payload (Mirai)", "value": "4289f6017758b994bde5617e5ccc7590", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637388, "uuid": "fb5b4b27-e716-47be-82e0-c90655650673", "comment": "Malware payload (Mirai)", "value": "591e2044917f15a2459bb96a819e4acc227f78480309007c8bd4c24e74ff1b0c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637388, "uuid": "241087f6-b95f-4775-b5cf-185a9aa59ac1", "comment": "Malware payload (Mirai)", "value": "746cc119e1cf641d91637cf2ce4673ca4ad1a408", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637388, "uuid": "af0f387d-1bfb-456c-bc99-41cd58aa49d7", "comment": "Malware payload (Mirai)", "value": "312afbfc7b05a202d1fbbccf48f223c7ebbc4005bc5be82e9f2db24fd19b4ac2187b66f02f75737ad751f1ec8e7eb8fa", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637388, "uuid": "99cf85b3-99bc-4c29-b25b-80648b91e5de", "value": "T119042945EA404B13C0D627B9F6DF42453333AB9497EB73069528ABB43F8679E4F22A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637388, "uuid": "158aa22b-cfc6-4f6d-806c-e141730e8268", "value": "3072:OLe6vhN1QIruCee+asuTuRebU7IVILzZQy38YhTfYo+M/Rvs1tlLn:ee6vhQIr1r+asuTuReAvLz738+x+M/RO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775637388, "uuid": "bc53021a-f7e6-44a2-ad59-aa60c26239b9", "value": 181474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775637388, "uuid": "ac78f7b0-836e-41f1-af42-f305ad551504", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637388, "uuid": "13d9efa8-f404-4687-b9c0-dc938729a782", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e997a660-3325-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775637335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637335, "uuid": "80f6d422-b7b4-426b-b255-ac312cbc3119", "comment": "Malware payload (Mirai)", "value": "8bfe6fc717aac6ea69801f5812377292", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637335, "uuid": "4509464b-503e-4f62-a3cb-dddf62a20b69", "comment": "Malware payload (Mirai)", "value": "592ebee14e0ba4cdaf3ea3c4306ce1bc531216dbd079ab815e666b7bcb985e28", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637335, "uuid": "8bad53cd-7c41-4d8b-8703-a9869e3ed34b", "comment": "Malware payload (Mirai)", "value": "d2c4c201ae42b568bb8dc08a2d0e76a6036a7620", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637335, "uuid": "92badc3a-734c-46f5-8b69-141888d72444", "comment": "Malware payload (Mirai)", "value": "37f7ba1e1f49b4f98c3fef41d18520dbc647f2e84383150afb41218cfdd75e1df6a39298849648f70160bbe7b1dd0ac8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637335, "uuid": "f9d106a7-c7fc-4d3e-b4f2-57e8acec5510", "value": "T180C31B45FC505B23C6C612BBFB5E428D3B2A17E8D3EE720399255F60378685B0E3B946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637335, "uuid": "50ed652f-c512-489b-9418-99b01370df06", "value": "1536:p3Ka0rG5yC/cMChygtXOBdWFAcJX4VlgXTAjcFAaUGxrf851WhXVVlnKwywEReQJ:5KaprMh7ROXWFh4UXwcFAa5xovW5kKR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775637335, "uuid": "9de4ad8f-a923-4f62-9fab-f7524f45822c", "value": 129824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775637335, "uuid": "10d21d5c-68bc-414e-b939-873ec2a95ce1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637335, "uuid": "6d68b533-ad0e-404f-affd-8cc1b12befb5", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21f448cf-3327-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1775637859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637859, "uuid": "ba970533-112c-413c-80be-a0dd52ec735e", "comment": "Malware payload (MassLogger)", "value": "191398dd9436c4940f9332e691cc305e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637859, "uuid": "6590c849-b44d-49ab-b4b2-0b620f86a2a9", "comment": "Malware payload (MassLogger)", "value": "5996e210f83d265a0c745ff669c388a834aedd25426ecee6ddc59111d06eefb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637859, "uuid": "baece624-db58-4796-8cc1-1b0de78c13f6", "comment": "Malware payload (MassLogger)", "value": "becd4e3a58ec2f05665b042c79d531782bcc57b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637859, "uuid": "50e30020-aa80-40da-8aed-4cbe04556a55", "comment": "Malware payload (MassLogger)", "value": "96c567958eb5aff81b86fdacef43adef19e9b0083faa5afd21b456bc31a09d96431c176617449299381cf4c82c40cc7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637859, "uuid": "fe5840d4-e836-434f-afe5-6d4229e652a9", "value": "T17D25CF9523E98754F4BE87B9DB72160087F4F903EE72EB8FAE4910AD9932B50D911313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637859, "uuid": "fe4f654f-4827-4245-b5d1-f4ed91c42de2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637859, "uuid": "f58c1fd8-39eb-4834-abb1-7c206ed49156", "value": "12288:nHeDevF7ljQLUd/Cy/pg9k4P1uYtviq9sEUC2YI1Qsc6F3lrK/CDTO6wM1Ldi:+gFRj0Ud/NKB4kv5sEUEsjF3len671", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775637859, "uuid": "3377f20c-f6d8-4203-a8f1-12020d7dcd41", "value": 1028096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775637859, "uuid": "483ce86d-9e86-499f-af46-61db7bfd66fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637859, "uuid": "29d5ba98-ac6a-4d9e-94d8-7c16e004cb34", "value": "e-dekont_html.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ce57de-3326-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775637682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637682, "uuid": "60dcc5e5-64e9-4004-a419-660e1790f306", "comment": "Malware payload (Mirai)", "value": "20e9174ff9f683730635bf6d90a6282e", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637682, "uuid": "9e5edf28-17d0-48c2-94a0-c906f3824072", "comment": "Malware payload (Mirai)", "value": "599b08342814503817176d7a763d446cdbed1b7ef0981071897ca8346307d58a", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637682, "uuid": "899839a1-baf4-46d5-8c0c-1ba56e2beb3d", "comment": "Malware payload (Mirai)", "value": "7bfb46b52cc8db0157c0a59a144b32619686b678", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637682, "uuid": "479a9137-73b7-492b-9920-5cb85d795437", "comment": "Malware payload (Mirai)", "value": "a453f9bf23aa4bfbae13c24cf96ba79840e9ac5fc36a67fb53e974cf6b8870d3a4936fe4f892f88e902173463fa6835f", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637682, "uuid": "2072796d-88c8-45d1-bac2-830cad9e0aa1", "value": "T1D2B3AF87B2507ABEF0A45E3FC4135E26A6259F705583273D71FDF9906E3A3503292E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637682, "uuid": "c88fb9ad-822c-49cc-a848-bfae052355b7", "value": "1536:tdNSXAeuUGWnKYUqwaJ1Xq/3A5hcB57laZeCNjHWBOdiyWT15Ov6fH9Y8rSR:t3SrlGWnKTU83AQB5A5Liy36f2USR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775637682, "uuid": "9b9c29ed-8d32-4271-afd3-f44957e94772", "value": 115116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775637682, "uuid": "c8ca11e1-dc5a-4b12-9c21-31e0a93f1d29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637682, "uuid": "36db25a5-041b-44f9-a403-a88b68f57e73", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d74f308-33a2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775690840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690840, "uuid": "b9175aa9-5fc8-4a0a-8699-243d001eb0cc", "comment": "Malware payload (Mirai)", "value": "f9ec68a65b570b590cac5ae1b1882d6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690840, "uuid": "7d61be35-24f8-4f1a-aac5-ea83467da61e", "comment": "Malware payload (Mirai)", "value": "5b638b80062079554260bfb0c565cfc16d3e89abc7729062f7b0cd20db38718e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690840, "uuid": "ca752f63-2f18-4f71-93ec-5b685e6ba305", "comment": "Malware payload (Mirai)", "value": "6a38872b83dbfc21374f7d8e8f103eb002d26921", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690840, "uuid": "27609904-89a4-44eb-91ab-868c28e5c886", "comment": "Malware payload (Mirai)", "value": "846a1011d7bee62fbcb446aa29d21e5316b81dc4910e854f72bf35eee2fc5ba9a4f00e381ceae707971210e401c9d162", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775690840, "uuid": "6c58681c-73b7-48c8-9f29-8f083825ba4d", "value": "T1AB233AC4B583F8F9EC15457C307B97729EB7F43A603AEDABC39994239815601AA072DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775690840, "uuid": "fbea07cd-f4db-4b2e-9790-30d8a010a02e", "value": "1536:4LInPCqAAXJLE7cxtdF8NCqBNM7vk9YXPSP0Hoa:FCqxpE7cxtdF0Cqvsvk9sSMHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775690840, "uuid": "e2f8cd1b-079b-4aef-9f0f-006923feb2c3", "value": 49752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775690840, "uuid": "eda2e337-af6b-417c-a4cd-6ac17305478f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775690840, "uuid": "607010f1-9ea7-43cc-b3b1-c4874626287d", "value": "Josho.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30dfc1d7-332b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775639602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639602, "uuid": "8dc1f653-ea7c-430b-a99d-f1eceac4ae4c", "comment": "Malware payload (Mirai)", "value": "32caa02a44b91f8c23366131504e2072", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639602, "uuid": "f183f2d6-f24c-42f7-8d1f-70c241226170", "comment": "Malware payload (Mirai)", "value": "5d5f38e21019a0895e2a309889438d6ba4ed1585355d94cf1d35a049016253de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639602, "uuid": "69fb3375-eacf-4bd1-9e09-96d00aa5f3d5", "comment": "Malware payload (Mirai)", "value": "980b6ea0184477724e27b8761a7b5107079a444f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639602, "uuid": "6258eb36-ed55-4c99-86b7-9d6632db5517", "comment": "Malware payload (Mirai)", "value": "8ff471d2b8ddd0ee8e9f7e9b3aa95bee85f0886735e58a735a95445c6dcdad2743e49de5a7ff019c19b214c68d8e21f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639602, "uuid": "e29cd8fe-6e2a-4c12-84ba-748be1d9b7bd", "value": "T1E55302E1B52EEDACD7E5313BB117CACAC41426389BDEC1B39312490406A65CBCAFD852", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639602, "uuid": "68d3f427-cb98-4dbe-a477-3ea699d3a239", "value": "1536:JEmQIssyqAc0G0a5v3RU+9Z/dwLNbkbP7Mp:Y9syhc0GR6+iLNbsP7Mp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775639602, "uuid": "8ebe2b4b-f203-49a4-8d6d-3720cbf94456", "value": 62816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775639602, "uuid": "4020e852-b8be-4b17-9689-75845b2a5a15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639602, "uuid": "b49a881f-c706-4e8b-8cce-9a708023fd2f", "value": "tony.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfde5518-32de-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775606824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606824, "uuid": "def9e1eb-d5bf-4d5c-96e9-cbca7013b209", "comment": "Malware payload", "value": "62b6a79fad0d7a787ef933c7fe5fa57c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606824, "uuid": "4bcf745a-ac81-402b-9be5-7ba7c0da3d58", "comment": "Malware payload", "value": "5df36281969dcd0fefdc2f7bda8af95577826634311f5a82544002e7e7d4c0fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606824, "uuid": "12d044fa-30d8-4c7c-9c4d-7b20921068b2", "comment": "Malware payload", "value": "faa9b054f73839cf26898fa590896146630a85e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606824, "uuid": "c2fa5d59-5056-4624-9a3f-d79cdc805ffe", "comment": "Malware payload", "value": "70cd9a7a8f7f68927e8bfdf9432e3dfd3fa67114ccdb5c2f133c6b7bb79648827d53d59beff4c0d6ea9573e19ea3e30e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775606824, "uuid": "ef5ee166-473a-4dbc-9f5c-70db2a5d2576", "value": "T1A4D34B13FB0C09A2C2861EB05D3B07E283A6041545B9F31D590ABF1B5E32E3B65DBBD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775606824, "uuid": "b4d5731e-c725-465e-aa6f-105344dd2f69", "value": "3072:QuA6hg2eu7SZGPkgNp6Cx6v+pMBieNwaKQZpYsxX25pR:j+2eu7SZqbp6C0v+pMBi6waKQZpYsxX6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775606824, "uuid": "8a4fd611-5cc2-4ff0-aa30-9ee56f7a4c4a", "value": 132452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775606824, "uuid": "b888cdf2-bbb8-4c64-b0c3-c480b8c7d181", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775606824, "uuid": "21470a1f-e494-4fe2-9255-c2ed73a5a5b1", "value": "CSBU", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36f87413-334a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775652926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775652926, "uuid": "b60c9983-ddc0-430a-a571-4032c6a344f2", "comment": "Malware payload", "value": "5de39b08b95c4d3975f1da066b2402f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775652926, "uuid": "df8f0628-3b38-4c9c-947b-f9bbaec43e44", "comment": "Malware payload", "value": "5e5e8f9a9f680b76e28f4476cb16ccf86db286bd795ffe6ddda16efc1d0ce4f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775652926, "uuid": "bb00f7fb-70b7-459a-9b20-68cb57ab6065", "comment": "Malware payload", "value": "2a9ec559a6e2e3153a18cd9b1e08fb4afff96f3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775652926, "uuid": "5ee08725-2265-4456-94fd-eed3d32700e3", "comment": "Malware payload", "value": "6df81416e897a537d281b293cb413fa0f121f7caba6a2aa10687500d57eccaa95c9c91f9b5b84b1a21c6a4ebdc25882c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775652926, "uuid": "1bf269f8-b228-4062-bb39-56f4879719a6", "value": "T159639A1156565BE3948AA70334C4583D88F46FC214B20ED05E8EBFAFA77D2D2EBD7182", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775652926, "uuid": "f786744c-448a-4310-b65e-33a146f6eb6e", "value": "768:8p9d/MJfEv0Vty22/etfhcdagg9dvrZJoFqQ:LCgy22Kfud4dDAV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775652926, "uuid": "d214f580-5b60-4f2d-891d-beb8b09adb52", "value": 67219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775652926, "uuid": "65a58d0d-b662-4738-bc24-08ff5e44e55e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775652926, "uuid": "669a8366-fc65-4e05-b2a6-c58cf9756d98", "value": "license.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5595996c-3343-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775649971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775649971, "uuid": "6c4fcd38-ef1c-459a-a349-e5fa1de0a7a3", "comment": "Malware payload", "value": "1848d8709e88a9c8b357527a55971c73", "object_relation": "md5", "Tag": [ { "name": "Miguel-GUTIERREZLUPERCIO", "colour": "#CF5345", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775649971, "uuid": "805fe39e-c10b-4052-82fb-221f9ff8118a", "comment": "Malware payload", "value": "5ef56887934c2d8bd200e0068ab2d3674335001dc527698b38deaac973191c5f", "object_relation": "sha256", "Tag": [ { "name": "Miguel-GUTIERREZLUPERCIO", "colour": "#CF5345", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775649971, "uuid": "be0f60d6-0eec-4bf8-a91b-845c1ad14373", "comment": "Malware payload", "value": "90cc05787aa650e16b4506db510b41ec948498c9", "object_relation": "sha1", "Tag": [ { "name": "Miguel-GUTIERREZLUPERCIO", "colour": "#CF5345", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775649971, "uuid": "c400d993-3e13-4001-9c1a-2bba19fa8b64", "comment": "Malware payload", "value": "ae18f23048725f404c90cbf0f94bb04aaa84ad9c136d6bb644aa8af1a7a3d7a4e127c3b38b806928bd2a4d9528af241c", "object_relation": "sha3-384", "Tag": [ { "name": "Miguel-GUTIERREZLUPERCIO", "colour": "#CF5345", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775649971, "uuid": "6fd53f0d-3d26-4481-a34e-66f04274cc3c", "value": "T12AD633207A848F3FD5FA09318A86D731AE357D744DC2D4FEA340790626329E47B7266B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775649971, "uuid": "ad7f9526-4b48-44a5-96c2-a460ee024bb3", "value": "393216:r/TRI2jjfvGdrxxP7ch0I64WmTsXTcHZkStVUeX1L:zTJjLvG5xxDc0r4WMsCZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775649971, "uuid": "70cd14e6-8163-4729-97f3-a4227beea52b", "value": 13721600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775649971, "uuid": "305336af-720f-4ce1-af6d-aab8ad893ac9", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775649971, "uuid": "29a91ab3-10e5-4fbf-97e1-5944e7c5d809", "value": "Zkazino.org.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad63eeba-32df-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775607169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775607169, "uuid": "89d31af9-b503-4c2c-8b13-0957cda4a164", "comment": "Malware payload", "value": "a66d12444a04436b2a55647bd7dc9ca0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775607169, "uuid": "409037c8-2c44-43d1-b803-5ade05d5983d", "comment": "Malware payload", "value": "60769cc0da4aadd603ade2a30ce4791595a43f9727e248a232ee7b6a1ae3fc44", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775607169, "uuid": "bbc219db-922b-41de-a7ed-3d510c169399", "comment": "Malware payload", "value": "af2ffd64b864ba54f9b3e509a83d2d57e5c027e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775607169, "uuid": "4633c876-29c0-4fb5-8e3f-f3b25af4739d", "comment": "Malware payload", "value": "2cd7c7a8e9e9ba2c401942320601c10688dfb70e2fa09df935b235e5a70435ded378e8318305f11f410c3fccbc19774a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775607169, "uuid": "2c929d8d-79d5-42e6-bc04-48efbb3e6f73", "value": "T10DF33B13B7114FA1D75AA6300BF385975AE6259627E2C8D5D76CCB203F503983C2FEA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775607169, "uuid": "e4756802-2228-45a4-8c31-a20385ef909e", "value": "3072:rSndj6tzJBpS3uGCLvPHih5twZ0r3z/7HDPLXeVpjoh5i/VctlcIrp:WndOVJBs3uGUHiVg0r3z/7HDPLXeVpjU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775607169, "uuid": "a0a89aa9-49d2-4761-86a6-0a073bd0dd96", "value": 171608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775607169, "uuid": "598cdde4-2d6c-4215-8485-8fdef51a5d2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775607169, "uuid": "b146555f-4298-4ecc-9767-edc3f6731352", "value": "VCPG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0641762f-3326-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775637383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637383, "uuid": "01d17b6a-3484-40a2-8182-39bac33ea632", "comment": "Malware payload (Mirai)", "value": "bafe3761bc6a676ef7d5d975ebc62de9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637383, "uuid": "fb263a4f-0aac-4bbf-ada6-66a5c6e917bf", "comment": "Malware payload (Mirai)", "value": "60c9013efe25e9f875fcd6def194ed9b70e47598555e2f5634dca220d15fa0b4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637383, "uuid": "7999d5a9-d3ea-4576-911d-8bffba137066", "comment": "Malware payload (Mirai)", "value": "8f3c88a9889a712c86ccff16f891a0bab4866964", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637383, "uuid": "5d1f6566-d9d1-4446-a809-53aee6d72110", "comment": "Malware payload (Mirai)", "value": "ba1be1dd6394edb765db62f3ebd94274a1df1a742841e61a3ffb038ab3649c675d1f6f14460bcad1d5f0402663e0c993", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637383, "uuid": "efc19a44-4156-4fe9-b682-1380cd8edd7e", "value": "T198D35C17B5C180FDC4DAC1744F9BF53AED32B1A91238B26B27D4AF222E49E205F1DA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637383, "uuid": "ce554bbc-d178-48ae-8418-b0e99be50a11", "value": "3072:79eSuygEPjt6qkWqVdKmDnYMb0gBd/gQyVGsdqml6Waj:79eSuygEPjt6qkWqGeH2laWa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775637383, "uuid": "0f6ab121-f0e1-4e33-9646-72566b7a4551", "value": 139800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775637383, "uuid": "de1d56cf-f46f-4312-9650-4b5b0648bf91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637383, "uuid": "0bd3d369-bb30-4b6c-8e7e-72084e9d8484", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5545765-337b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775674210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775674210, "uuid": "da64c5e8-1a35-4207-948a-3f1595ee73c7", "comment": "Malware payload", "value": "d2394253affa7ad63356178e255ec6e3", "object_relation": "md5", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ext_sideloader", "colour": "#5765BD", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false }, { "name": "w_node", "colour": "#C4D305", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775674210, "uuid": "da7ddc5e-1fdd-4fa2-abe0-1a45c44702ac", "comment": "Malware payload", "value": "616171dbe37f615cde522a11ef4d5f631fbf15f70e10d326f83eca954e5552c6", "object_relation": "sha256", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ext_sideloader", "colour": "#5765BD", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false }, { "name": "w_node", "colour": "#C4D305", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775674210, "uuid": "d61f79e7-7e10-418a-af07-0f87ba1f886e", "comment": "Malware payload", "value": "2d6f946e56542f058059a8d7f5774136d3358409", "object_relation": "sha1", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ext_sideloader", "colour": "#5765BD", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false }, { "name": "w_node", "colour": "#C4D305", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775674210, "uuid": "0ef17eff-98ea-4175-b5b9-b32cc919f461", "comment": "Malware payload", "value": "a970f1135832bc2089c727516ee52b7264ff09003d0ec9ba0f7f1804430dd78c5b97697851de568004045bcbb03d5235", "object_relation": "sha3-384", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ext_sideloader", "colour": "#5765BD", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false }, { "name": "w_node", "colour": "#C4D305", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775674210, "uuid": "e55f0d8c-015e-4eab-ba61-924a916d2a73", "value": "T19725BF83D293915CF41AC1715B2EA273F537BC458B29AFE76390DA261633BD02B7A710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775674210, "uuid": "d83dfea5-7e42-4bed-b84d-7c6fa21332f5", "value": "5119aa243ba31aa561ba123ac413a1c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775674210, "uuid": "4596c0fc-1b86-40f3-b737-e9358e3745b6", "value": "24576:w+pqG2TPOEe0JRh+w+uY5bsY5b5Y5bsw:wlT2EeiRhrYqY7Yaw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775674210, "uuid": "438dbe79-2eaa-4608-951b-2998347e008e", "value": 1018368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775674210, "uuid": "3511dcbb-6707-4ea2-b474-3c7ddb7410bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775674210, "uuid": "7e3eb21d-d1c7-4d35-8e3d-0eb941787f77", "value": "w.node", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a82aebc3-3365-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775664713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775664713, "uuid": "468e5b62-384f-4a8d-afcb-3171cffb0988", "comment": "Malware payload (Mirai)", "value": "00b476166882217089429d7e8f800fff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775664713, "uuid": "f7e4f1f8-37b0-4763-a137-8566097f26bc", "comment": "Malware payload (Mirai)", "value": "61ea7b24c1f482d41332beccbcd88f4b40552d839086bf3ca78ddf10e73b4d61", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775664713, "uuid": "1c1aa529-de81-40b9-9a4a-21b4f5b78bcd", "comment": "Malware payload (Mirai)", "value": "113300a7bcae58a2a600ab3151381cb7e6b69d4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775664713, "uuid": "c3e46a29-ed04-4638-a191-abd6c0bfdc98", "comment": "Malware payload (Mirai)", "value": "ea3b5808998db90c5ee3227e346cc056b0fbe42c7771c4795ee50e837032c3fe8f7947359798191b9bd5120ab9f6724f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775664713, "uuid": "2e49f453-a95d-4daa-871a-1db291d6a813", "value": "T16D737B20B87A2E23C0E4A47E22F78725B2F5630E39A4C65D7D760F4EFF2169065535B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775664713, "uuid": "911309ed-0881-4e0a-a7f5-29fa0127f363", "value": "768:y7lNE09syofq9/fxKqjHG3E8KeNheEQ59pU7AT4t1e76mkNjk+6MKO+mOEA7EOw/:+PFTWS/fxKqjCE8KIhkLU7AC6MYEAwO8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775664713, "uuid": "d9d31aad-aa67-4d7f-89ce-9cf60128519b", "value": 75216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775664713, "uuid": "f4823ae8-da73-445a-b883-4a801acebc91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775664713, "uuid": "8fce3c1a-0859-431d-a694-9edfec646e2d", "value": "db0fa4b8db0333367e9bda3ab68b8042.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4640e9e-3353-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775657110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775657110, "uuid": "27dc255e-60e6-4800-9c6a-83fa6631fbf0", "comment": "Malware payload", "value": "114bb977ecb657752dfb90679dc523b3", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775657110, "uuid": "970f8813-3e9c-4754-9f55-a34b4e341f95", "comment": "Malware payload", "value": "62e4efe3032deede76edd6ed217c87a8844fb42040bb408e3fdf45fdb45cf999", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775657110, "uuid": "6e37ce51-72ba-4f90-a48a-1ea9d4c5d8d1", "comment": "Malware payload", "value": "52d21ff2314c8eb475e6ed098cdf060d74163f15", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775657110, "uuid": "05924b87-868a-4714-a6cd-4e6427ab978c", "comment": "Malware payload", "value": "81a991352d408d4352ad73c2d299739160a7cd9ae44959ff5e0b554341df2c5a29e40fc532b1208bc3f6641f1395e117", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775657110, "uuid": "5ce519ea-8d28-4358-a5eb-136b954b60af", "value": "T182D528D2B14181EADD1F0733260E972A46396E72372347E72FC83BD60971F91B675A22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775657110, "uuid": "9f31b81b-ce68-4796-b8e6-283be48ac7b2", "value": "49152:jBqYaZrf5jSTUialPJrMf+7UVZDEFeA4vLNgmUESIEjPMN2lv+oBjYHMV3eVoug1:KjSTBEq+Z4veHjPMNanYHMV39gAILZdE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775657110, "uuid": "72d5ebe3-6b8b-4a68-a0cf-ffc4cc243ab2", "value": 2831872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775657110, "uuid": "65c9f50d-ea3c-41ec-a99b-a6aee54e817f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775657110, "uuid": "5ea63a9d-9a3c-4bfd-93f0-348e2d2ddb32", "value": "Resource.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b00e6c1-3324-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775636773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775636773, "uuid": "9d4c8f1b-c470-4bdc-9ea0-be4e99187978", "comment": "Malware payload", "value": "240c695ae0cb453dfbf5dd4d35e3470b", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775636773, "uuid": "8d66c7e8-3edb-4314-8a0c-e8b5f3587d20", "comment": "Malware payload", "value": "639976690e64bb7e71543d6e3b52bf727dfc357773b25c7105b7b7563a6b0b6b", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775636773, "uuid": "50368eeb-8140-4dcb-86de-52ef1802d47f", "comment": "Malware payload", "value": "b2f944cf5efc0f594f0719a9545ddcbcd71e4d1a", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775636773, "uuid": "e1e38747-e783-478a-8011-67c6564a31fc", "comment": "Malware payload", "value": "a2c8bf48e5fa9ea6ac588f5eacb83326d7919995bea51518b09f6523a3089a0094270329fa8605d4146a89b00cc4c037", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775636773, "uuid": "37a4b71b-0d59-422e-9ba5-abf5d38de92d", "value": "T17F52FE7DD8E1BCC0836B72D065AEF7C6118A8B13BE672B1CF9DC045157143A1EBB9298", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775636773, "uuid": "bfd9fa9a-23a2-4483-951d-2f838542b23d", "value": "384:wsj6QC6WQcXl2SA4vB+t37ukLGtEBgZg0JylurpcuIr/TzZN:fu/jXw4v4LDaJbU/r/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775636773, "uuid": "956ac19b-1a27-4489-9b20-dd8db9c7477e", "value": 13620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775636773, "uuid": "707861a2-47b1-4e01-a06c-8c59bc139ecb", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775636773, "uuid": "bed85a7e-f90f-4b28-b7b2-9f7ee3ff90e2", "value": "SOSTENER.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f07695f-33a1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775690413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690413, "uuid": "741550e7-e5d2-4119-adcb-d222233c757e", "comment": "Malware payload (Mirai)", "value": "a0cb377f93cb7b4898bc8681b55cdb0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690413, "uuid": "efa7efd3-ceb7-42ec-8d85-5f9d8c63773a", "comment": "Malware payload (Mirai)", "value": "644a2f95c8b2df0374b694ea3577822b51b6031ebb86a9a82c4501211ef42b9a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690413, "uuid": "c4e3d108-7833-431b-9c3f-e8e3f5f605c6", "comment": "Malware payload (Mirai)", "value": "8f17464e3e2fa709681b15f0c1b4d28c48a4a03b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690413, "uuid": "53c87141-5972-40fc-a225-69c43d1ec0e4", "comment": "Malware payload (Mirai)", "value": "2eff18b9818b1f1d764f522cb69461b21a21a8a6fc91553a2c497830249ec43675d4249200621312f5189aafd8a99cf3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775690413, "uuid": "5193d621-f485-45c8-822e-c450524439fa", "value": "T1881429D7F900DEBAF40BE37B44930915B030BBA618530A7672577DABAE3A0D51427E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775690413, "uuid": "6d0ffc68-2477-4ea2-a582-8673e4380007", "value": "3072:BaUEcjylWSxND/mCyptn/lUxj5v3MqOSdVmMV7jbiYLlrVGgC:8zJyph/lUxtvcQVmILBZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775690413, "uuid": "84df7907-8620-4e44-afe9-c03c2f646a47", "value": 194840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775690413, "uuid": "2791c56d-85d7-45b8-981a-5e6efd40554a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775690413, "uuid": "c93cc9cd-6b4b-4b53-9dba-323b3985051a", "value": "nm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c9c37e9-332b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775639621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639621, "uuid": "52f8dd87-bb80-4e32-aadd-fe26cc89cb10", "comment": "Malware payload (Mirai)", "value": "162ea88e9e0f8538d26beda442ded1fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639621, "uuid": "4195d150-a846-4b40-af8c-6e62a91c83d1", "comment": "Malware payload (Mirai)", "value": "646920938370232b0e559dfe716cee27f0121c83a5a8fe6534d4fc198bb35574", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639621, "uuid": "e95abb1b-6f9a-4635-8ebe-db571248cac7", "comment": "Malware payload (Mirai)", "value": "941b18dff70168a011cc0154a3f249624fb488d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639621, "uuid": "74dba692-676f-4466-bd04-df6def8b74ca", "comment": "Malware payload (Mirai)", "value": "ff4c95ba30c83703212cbfaf93e7cf8b74b5ffc9eb7b57988beeddd5b5c4c4c601ff2a09a830a3875757e08e3c51392d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639621, "uuid": "89dac175-6eec-4259-8b5b-23a6b113cbdf", "value": "T17F834B46FD815B23C5C1127BFB6E428E3B2653E8E2DA72039E25AF2133C751B0D6B855", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639621, "uuid": "f6e506b5-f83d-475b-844d-9d34f1ca7e91", "value": "1536:fOSM6T8txOgWEdDXYgKjt+K37Th6pJ1LEYYvSba:fOx6lGYgKjt+Mv0eSu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775639621, "uuid": "066711e1-495d-4fef-a5d3-4091d92175ba", "value": 83264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775639621, "uuid": "13c54c86-98df-47f3-a8a8-67a08c2c22aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639621, "uuid": "a4516b10-4f49-466a-84dd-380fdc666aa3", "value": "tony.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23222c60-3316-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1775630559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630559, "uuid": "2601962b-a449-4620-842e-1ffc27779501", "comment": "Malware payload (ValleyRAT)", "value": "43e76c826f3f1699776c37436697605e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bk[b]", "colour": "#AFC057", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630559, "uuid": "87f6d673-38fd-42d9-ab9d-9e6c95345ef1", "comment": "Malware payload (ValleyRAT)", "value": "673b41519cee3034fa81ed4af15e7abdea9a3033b533ce68c7eb4fb5bc9a42ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bk[b]", "colour": "#AFC057", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630559, "uuid": "7cb816cc-d494-4e8e-b459-f4ede3ccd330", "comment": "Malware payload (ValleyRAT)", "value": "b08615deadd6ed3f7224379aa0d8d296328589b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bk[b]", "colour": "#AFC057", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630559, "uuid": "8b7fd68c-e370-42fa-81b1-0ca20d36fbbf", "comment": "Malware payload (ValleyRAT)", "value": "aa9ff7f800c19a005d1e73129091b207eed01d3601515c1e9462620d4b00894763b2960d7468320247d3f0ef522d7871", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bk[b]", "colour": "#AFC057", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630559, "uuid": "33cedabc-2218-4d74-b318-0a2cb114869c", "value": "T115A533D6FB225D41D86D48310433169F6A7CACB224910E0F9FE8BB4B0E71A5146B7FDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630559, "uuid": "0103f8f2-a970-4cb3-9ccc-ad54cd38f0ac", "value": "a24e57cfb1e35030a9b4252bf1fa8b4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630559, "uuid": "d8ec9933-2678-41ac-8d01-2f65641ce185", "value": "24576:esSzlEqF+hVcOw5wpBN16HBDfHGtE2Ox3JXXnv0yaBzWhPPXZmrYssWk8yhX8Qq/:wl8eOw5wpBNADeutZHMIPXxCIzqkmwnM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775630559, "uuid": "0a3b1ab2-cd48-4a56-81f3-159a7bdb70e1", "value": 2162928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775630559, "uuid": "a5d325a2-54bf-4a37-a1a3-390efa2b2869", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630559, "uuid": "dd541d9c-d9d6-4bc3-b6eb-b85cce56ac76", "value": "\u70b9\u51fb\u5b89\u88c5\u8fd0\u884c\u5207\u6362\u4e2d\u6587\u7b80\u4f53\u8bed\u8a00\u5305L.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26fb7dc0-3324-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775636579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775636579, "uuid": "e9438408-3e9c-4c8b-85a8-ebbe26cbedca", "comment": "Malware payload", "value": "ceb23f8372b30bf251f9a5959605674a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775636579, "uuid": "bbd304cc-1af3-49ee-830d-8d64cf3a48b8", "comment": "Malware payload", "value": "67573537051d722351a115c6cdd6d0a1e7367d85b988ca9f692191048c827a21", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775636579, "uuid": "2356b979-8b05-44cb-bb32-456e156deb62", "comment": "Malware payload", "value": "afa2903f140c80f6bcfcd20b03a2b98db3c9d075", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775636579, "uuid": "c1b9496f-9020-40f5-909a-274f7f814536", "comment": "Malware payload", "value": "0f7ec0a839787c6dfb3e199b45d4fa7b10812ad2c998ff8082cc9a3bb2931390a9efdb8b95ef891c181465a24a7fa473", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775636579, "uuid": "cd9df714-9886-436d-957c-606fcbfbe199", "value": "T106814A61A3890309DC6F97F06DB1C18305AB9181DA031DEACF289642F696E8B225ACA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775636579, "uuid": "360b2f1f-c56b-4632-9afc-9f53809a7c8a", "value": "96:FU2NTsJgg/o3BFFnkQkkIDOEOjRnGgaw7l8diADEKI8oq:FU29dUQFnkQ+DkjRnGgCDFI8B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775636579, "uuid": "d682d351-5880-4681-a3b8-af8fb73a9daa", "value": 3902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775636579, "uuid": "a05c3385-1b5e-450f-bce1-afe5930d9076", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775636579, "uuid": "b3daafaf-631e-4fb6-bca5-b5eba011c65a", "value": "photo-627967494.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43dd3a7b-332b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775639634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639634, "uuid": "c84d4eef-e698-4106-9e88-2eb25784e0f5", "comment": "Malware payload (Mirai)", "value": "f78af7b33bfcd98d6391d290a91db04f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639634, "uuid": "c2ea859a-2601-4009-9b14-185d04ccee2d", "comment": "Malware payload (Mirai)", "value": "6790308e801c731f1c221d6c8ac9dafb532972df997714a0667de0b477dbb783", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639634, "uuid": "5eaf78cf-f841-4829-8063-f1fef98f7fb0", "comment": "Malware payload (Mirai)", "value": "1340ed4c1ed8e916b2a22ecbc554f18748f9f483", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639634, "uuid": "4e679344-0f1a-441e-86ae-41bbc299d376", "comment": "Malware payload (Mirai)", "value": "38f067749b1402dbe15e13683b387b0ad4244ea0e4f05767367bfaab980c8317ce1d3dffcee9f11cfde88752c3d4846e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639634, "uuid": "d8afb9ec-a062-49c2-8d26-9a964e39480a", "value": "T17BF33B46FA418A13C0D62779B69F425933239BA4D3D733069928BFF43F8279E0E67905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639634, "uuid": "0d85a68c-beb9-45cc-8975-ba7f5bc63171", "value": "3072:asboodOjSWagC5CfscAPUvu+jWdpwZsXCUXaIM/9vd3Y:nbooTWagC5CfpA82+qdpwsXCUtM/9VY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775639634, "uuid": "39fe2ddf-7b15-4677-bc88-f6de17349ade", "value": 161791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775639634, "uuid": "3d8961ab-f40e-4651-bb34-0980234ee304", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639634, "uuid": "0516f7d4-1782-4a03-b25d-5bb76356f5bf", "value": "tony.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88356b68-3369-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775666377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775666377, "uuid": "5f5c698d-a1e9-4a8a-9bca-462fa19268ef", "comment": "Malware payload (Mirai)", "value": "bf6affeefaca978f0c8360a57dd15cd6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775666377, "uuid": "698348ce-e2b2-4770-bcd4-ed752e9b7616", "comment": "Malware payload (Mirai)", "value": "6822961a6f540f27c54c8581f6adec38aaab0d9cde978c6dc3145feffda708a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775666377, "uuid": "60ad4951-b1a3-49c5-a78d-c7a4dda61b0b", "comment": "Malware payload (Mirai)", "value": "a84bf9238ae86a665ef2923eb706a9ba3b2eb1ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775666377, "uuid": "d8667e36-375c-4481-9b17-d4fa18d609c9", "comment": "Malware payload (Mirai)", "value": "7292cc3acad21ebd8cf0eb34bf8b011c1f68194e254b15ec33bda19e25adad0a1626d6113ada1db4be94d4e3cf395f18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775666377, "uuid": "5f50bed5-d4dd-4b30-8211-c667ba7fc847", "value": "T1C9144911FB0C0463CA931CF48E3F0BFAA3621A9115F99115250D7F5A1A32DB7A68BFD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775666377, "uuid": "f7f13baf-8de8-4f8f-8d3b-e58489e5aed2", "value": "3072:ty5+GoCEggi4NerYqltSwJpH6+cYstkZUat:o5H5BT48rYq1wjY2pY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775666377, "uuid": "c1ca75bf-a276-433e-9931-a8d3025c2756", "value": 197308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775666377, "uuid": "10a2b379-98fe-42e8-bebd-903449344dd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775666377, "uuid": "b8b062a6-9c38-4d33-8c66-d603e04c6ee4", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eb1375b-3356-11f1-a769-42010a9c0008", "comment": "Malware payload (Arsink)", "timestamp": 1775658147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775658147, "uuid": "7204a503-b709-40e0-ad16-d8c019c63409", "comment": "Malware payload (Arsink)", "value": "7ec47dec270b98e95bbdfe86040ca64b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775658147, "uuid": "adaeb6b6-ac21-47c8-9c23-c56c4d506f69", "comment": "Malware payload (Arsink)", "value": "68f800fbed83116ac9efb2524326fa5d710a911b506762d580a34c19932a21e8", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775658147, "uuid": "b77ae23e-1052-4d86-972f-d767ed1cebbe", "comment": "Malware payload (Arsink)", "value": "7007111dad3ed86df7fa9c0d7b76d78c2f4481fa", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775658147, "uuid": "d443d9e1-bc29-492b-b622-f6e785910c0c", "comment": "Malware payload (Arsink)", "value": "dfc5ce099ebd94fbdd04dcf2515026105409aa5a5beb963ddd9023de14f9cc93bb81ffc51fe13e123b925727169a857f", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775658147, "uuid": "caaf04b0-ba5b-4a0f-8211-a99973340d3d", "value": "T1E52523A8E0C56A3CDA3D513B902A378167AEF9A643E07FC32D165C05627DF499E5EF00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775658147, "uuid": "59e34bf4-f226-4dc7-991f-5b0316c5d3bc", "value": "24576:L9kZ5EYnkzieUO3lhulK1GXPz0XPzpXPz6XPzzXPzJPvf:gEYnWieUO3f31Golm3F3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775658147, "uuid": "468738e5-bd28-4704-aae2-a4d351294149", "value": 988303, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775658147, "uuid": "8e9701f6-3814-46c6-91f7-c54c27551e73", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775658147, "uuid": "0aac2506-959f-482d-83d7-4680e07e8014", "value": "base (1).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4674e3a-3371-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775669941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775669941, "uuid": "4c3be00a-fc16-4cf9-b070-2f53a5b5c85e", "comment": "Malware payload (Mirai)", "value": "1566e8c16f9d9f843506e8d166bc09d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775669941, "uuid": "c362b623-a177-429d-ab32-a1a73afa72d5", "comment": "Malware payload (Mirai)", "value": "68fcc9631b18c6a50581e97bb9a8b7cdcfb3f2234a3a9904dae9dfce1daa4f2d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775669941, "uuid": "11e51899-7ac7-4be6-890b-e34cf457adaf", "comment": "Malware payload (Mirai)", "value": "a763fea90987176d25d62c08863bd02e6c628f34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775669941, "uuid": "35313b21-85d5-4987-a153-b030f3927ba5", "comment": "Malware payload (Mirai)", "value": "33028516423ea8c260959d6b8b69a5be900fcf213e960945bf5058353766520688b420ce25a9729ce7ccc6c880216b6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775669941, "uuid": "2e71c01d-7ab3-4a0e-b93c-85f171a0732e", "value": "T13B9361097FA00FF7ECABDC374AEA2B45248D651A21A83BB57934D418F24B25F15E3871", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775669941, "uuid": "4d551769-306d-487f-bb95-55cabc1ae5bc", "value": "1536:9Byn3Yq3EZBoh8lJwPvlIhQZKkhLNMliZaiZTb:Tyn3p6BosaHlIVli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775669941, "uuid": "0f379a2f-1856-47a0-a591-ee328298e6b7", "value": 97192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775669941, "uuid": "6ea33946-6458-4dfe-924f-136e0c3e02b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775669941, "uuid": "97906eb2-2303-4ada-ab0b-283ac738843b", "value": "db0fa4b8db0333367e9bda3ab68b8042.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb4bd789-3352-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775656584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775656584, "uuid": "8fcf165f-1a19-4049-8d6d-3279fe428ff1", "comment": "Malware payload", "value": "c37e73f1214f72b5623bb3921aa7582c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775656584, "uuid": "bb400f24-3d87-42aa-ba17-b1325c587cd5", "comment": "Malware payload", "value": "693624f345bc34aacfee57bd7895752fff5cce75b689b18adc82cfc21eb4666d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775656584, "uuid": "58284e31-2e0a-45d3-8a62-9220e5f6ced2", "comment": "Malware payload", "value": "6d2e55faab66a96326804be831b0693347cd0696", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775656584, "uuid": "846d4b56-e822-4f3a-8198-2ad1a796ab61", "comment": "Malware payload", "value": "c9412858cdf2ac51aa23b3ea5c97cceda7a196478c6481af0dd289f0d631e6ef0ebe23a07c0f3748a0b393cbb4e8cc5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775656584, "uuid": "5e67385c-7c79-4301-8b61-26426bf3d341", "value": "T19DA4812FCDF9113F92B6EB0DE462100DAB016B1F3B0CBE0A34EA76E71D15545F6A2529", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775656584, "uuid": "431ee020-3d64-4000-883e-8ef7b7d8ff87", "value": "6144:s8WoY4HsxmeIZD69s6VOv2wyV8OCetrJfrxkemfhaKS:scHsseiOIOCeRJftjmfhvS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775656584, "uuid": "6fefb41e-c6e5-449c-98de-a6108fcb9b52", "value": 451326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775656584, "uuid": "d2eea723-cb2e-4481-9845-d9173c6eaf2f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775656584, "uuid": "8615c1d3-0ecc-49fb-907c-7573ba2e7856", "value": "PRE-ALERT 876-41513076.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19055b2c-335c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775660607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775660607, "uuid": "ff3d98a8-2cdc-4fe2-8a47-dde9dc6714ba", "comment": "Malware payload", "value": "9c04357b3744cd6e6dccc7e84d6508a2", "object_relation": "md5", "Tag": [ { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775660607, "uuid": "9e866eb1-3ac2-45f5-831b-cfd805cf756b", "comment": "Malware payload", "value": "69fe3d4b77a8c34c8be35290a2630b6d7ba789a08051afb579b79ef4e9d1f067", "object_relation": "sha256", "Tag": [ { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775660607, "uuid": "a5de50ed-f8f1-4adb-9f80-5240a2b3139a", "comment": "Malware payload", "value": "1ac00553482e627963c78e66a08acc2595519d40", "object_relation": "sha1", "Tag": [ { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775660607, "uuid": "00bb2252-8c82-436c-8960-8229bb0ac22b", "comment": "Malware payload", "value": "e888aa92f1126b8ade56b728545a59365847a67763a9171e1d613935b55b9a08957ee825819d6e444ce630340ba6674a", "object_relation": "sha3-384", "Tag": [ { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775660607, "uuid": "df45873a-2b36-422a-9581-c4d4ae99ef8e", "value": "T145C2D07C886BC9D33CA103C6629739F6F1B92246C656FDD3CAC858414A7705543E4F9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775660607, "uuid": "b9f1e186-55b8-495e-96f9-3990230ba6f7", "value": "768:hWhM3Upe/+gqpD47DkbXwOlRwVR+YL40uNrc7aKMG1N:whMEz31bXNc+rc7EWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775660607, "uuid": "3f81605f-ff15-4a9d-ae2d-eee71fab2d37", "value": 26134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775660607, "uuid": "ff0de6b8-fd63-4231-ba1f-3e76a64d3515", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775660607, "uuid": "1837958b-b954-49b3-b858-2a0923f48568", "value": "Pedido de Cota\u00e7\u00e3o n\u00ba 08042026_pdf.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e64af1f6-32de-11f1-a769-42010a9c0008", "comment": "Malware payload (Ngioweb)", "timestamp": 1775606835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606835, "uuid": "163143f0-5472-491b-b5d6-8178740e3e36", "comment": "Malware payload (Ngioweb)", "value": "68d01525007758eabdc25bde6d5fb4d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606835, "uuid": "d53fb3ee-a951-42ff-9ecc-94910122c5a4", "comment": "Malware payload (Ngioweb)", "value": "6a9a2fd72c6dd58658f09a6743885605c77be428948c72d6a4539e3982e67418", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606835, "uuid": "ff246f85-28f3-4fe8-a32a-57580f0d3a61", "comment": "Malware payload (Ngioweb)", "value": "490a1d81b4c4158b526fed45d262e05831fee3f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606835, "uuid": "58d2f511-a7b8-4124-a017-b8fe4b34b463", "comment": "Malware payload (Ngioweb)", "value": "78010e267560fec5a1612d7dd52f75024fcdd937174161e5fd28c7481a015c3c74c70b6531c0461ab201ae09b9b373d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775606835, "uuid": "fd4071e6-2f77-4fd8-ba59-223e6ba36456", "value": "T1C1C30892F9809F45C6D02A7EFF9D538C332317B8C2EE7406D9155B2466DB5CA0F3AA42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775606835, "uuid": "c73b6ee0-345a-4409-a9c3-23178bdc7b6e", "value": "1536:+wBE/HWUSR2krHiE/BsuF7uKFHZA7Hs1NifBXuyfgBHv+nIIam6WUMNk4TPPrKio:+wAHWz/79Fi0AptuHkepyQqCu8YMYI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775606835, "uuid": "a8693985-bc26-4888-b856-9698981009e3", "value": 128424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775606835, "uuid": "10dcacca-cbfd-4224-8648-22ca3258008b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775606835, "uuid": "024e6b06-7c48-4899-968e-b61bda72d586", "value": "UKRP", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b6d5379-3326-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775637552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637552, "uuid": "a885ed3f-9b5c-45b0-862d-7673b2c845dd", "comment": "Malware payload", "value": "6248bd7affe439dda0c0ebff7bc8c8ce", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637552, "uuid": "0d934d8e-26dd-46ea-85ee-6ddc1d7f1a4b", "comment": "Malware payload", "value": "6bf08a076e1698fe4ea8686d7b17570ac1c1d550eb05efa6b732a3d941d55161", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637552, "uuid": "052de1bb-70db-4950-9bcc-855c5887c621", "comment": "Malware payload", "value": "e12e778f7f7b7ad9134c753e250b43a29c3ea7d7", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637552, "uuid": "2f25990e-7289-4954-a136-e008fb1a81ec", "comment": "Malware payload", "value": "cff95d49e8a3de35cef5c6c91553558c03135b4d07c4a76f6979055b2b45558f3afa2da9503af27db54b269d1f80c10a", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637552, "uuid": "bfc3627a-8b64-4bb8-99f3-6e824c1bd238", "value": "T1EB93496826FC2201E875DF75D3345314CBAFB900AAE382DD0B52529CAD36759DD23B26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637552, "uuid": "eed94182-bb86-43fa-b780-039d9a788e54", "value": "12:8d/b1lG6lG6llr8owfVUVH4l9gFUfO0luJFEKW1GSEz9y2S6OlOOl2:8d/xlG6lG6l6fl9gFf0gJFq1GRzQ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775637552, "uuid": "10cdfc4e-bee4-41db-bc43-bb6e67194795", "value": 93623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775637552, "uuid": "2bad5b1d-27d1-4d47-8622-6850851625e2", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637552, "uuid": "f5085f57-933d-4589-8246-16a3a6c9055d", "value": "Gorschenuk_Odinokie_Zvezdy.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ca8c90a-3326-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775637393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637393, "uuid": "355b7b13-9c11-4b4a-a6e9-a08b4e438948", "comment": "Malware payload (Mirai)", "value": "8b97145fd3fad56f771c272a0eba8e2f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637393, "uuid": "b38b2636-8010-4b49-b0b8-e04db154ab58", "comment": "Malware payload (Mirai)", "value": "6e6425f7d5c70152faad0f80f7fc6e8e6fd90843756de738074924551cbf0e7e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637393, "uuid": "46553bcd-b0db-4c71-87db-be1fdff30c26", "comment": "Malware payload (Mirai)", "value": "17ab46305921056874f18f9e094cacb3127db23d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637393, "uuid": "92673f57-cb30-4ca2-9073-6d88732a8857", "comment": "Malware payload (Mirai)", "value": "197a03ab0bf3eec9b7ea4d14564e1961b15a8535b53bd05675bf8f665bd8e08aed491c74b55c571f78a427449dbbfcf0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637393, "uuid": "3afe8ed3-08d8-47c3-9c81-0391af0f22b9", "value": "T12D04B719AB510FBBDCAFDD3702E90B0139CC955B22A93B363674D528F54E50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637393, "uuid": "d5b41c34-9efe-497c-9db5-50f1f8e8c66c", "value": "3072:nKpzGjeNkSfcQqmav8SqaRVlnYz65eVt:nKYjeNYQqmeqavlg65e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775637393, "uuid": "e4fdc994-8e97-4072-bc25-8160a0babe10", "value": 177760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775637393, "uuid": "1d55e765-ab3e-407d-818c-059de163f926", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637393, "uuid": "1cfac265-6d17-48a7-b716-045a8d58c48b", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b88292d1-3326-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775637682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637682, "uuid": "6d691916-627c-4a7f-9f6c-7045c49d7141", "comment": "Malware payload (Mirai)", "value": "5cc324546fb78c77fdd42355ead60cf5", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637682, "uuid": "7335bfd8-c089-4ddc-8145-863d07f6960b", "comment": "Malware payload (Mirai)", "value": "6eb18475a5b64071d648850e295e157426fb1eac0d80ae6e50e82bc64ca391e9", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637682, "uuid": "9b40f015-e7bb-4ebf-ba31-0144ad2df054", "comment": "Malware payload (Mirai)", "value": "5bbf131bd06b3d0a02a0c83570f2d8846d479721", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637682, "uuid": "7309aff7-6abf-4f83-860d-8323636f9bfa", "comment": "Malware payload (Mirai)", "value": "c9ce81e32e60ad5d17de105756d8a49d04a050407e8068fc4d050a37a79965f202d77243df16c25f7d2b50273bb9dacd", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637682, "uuid": "a78e1a1a-60fd-4e51-8739-bc9375430a79", "value": "T1B5B3E085B210AE45C02672FC71870A9093B27E7B4B5A150B44B3F5B46DBCDD47E0BEDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637682, "uuid": "3d5285a8-e308-42e2-b8c8-4e108a7f1add", "value": "3072:jx63zpjhO5z01nCU375P5wk5SOez7wu+:as5zqhr5Nzy7wh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775637682, "uuid": "a2230f88-ca09-4871-a2e1-2d64fd61833f", "value": 107680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775637682, "uuid": "c834828e-5dd9-4cbc-af7c-dfaf477c7286", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637682, "uuid": "e2750fed-90ab-4204-8178-9472400232a0", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9917bee9-33a2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775690887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690887, "uuid": "5866a269-9d76-4872-9256-4ce8404e0bd7", "comment": "Malware payload (Mirai)", "value": "0bfa051aeffc012584a1f86e2c38d354", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690887, "uuid": "bede8e8c-b5a9-417a-ad34-bf70fbbfce73", "comment": "Malware payload (Mirai)", "value": "709a587f22e2e8b413857817609da3882a678c3a275c31cdbdc8b5f993be039c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690887, "uuid": "c646f169-a4d7-4397-af5c-790947622b4e", "comment": "Malware payload (Mirai)", "value": "e6733d725a0f2f9cd4e595052308b8140de1b195", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690887, "uuid": "83d9268a-82ed-4a3f-8922-69c5b0d9ed86", "comment": "Malware payload (Mirai)", "value": "a95801595a03cd37d27ef7ef7b01db38949e7e0cedb63d7f80d4851498d0372c8de4a64375129167c8e951a14957b061", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775690887, "uuid": "a9f66424-5ff7-45c2-bcf4-797a7dbc9653", "value": "T1FA63A506BF214FF7DCAFDD3749A91B05259C640B21A97B397E34D828F64A24F19E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775690887, "uuid": "7fc9cc7f-23fb-41f2-b7a5-1ed612be5285", "value": "768:QxNCJ0EYlDYhHnCwqsFDwLX3U6ngBhN6PNUpGXS5SyeweVKe0n3oNWpkmPqXitMF:QxNCJBYlCFwwjhwPTXSNxIKzn6CpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775690887, "uuid": "159640e9-d437-4776-8fb6-a35ae5b08bd3", "value": 71528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775690887, "uuid": "d2058a46-84d7-4b91-8895-c6da0951ce1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775690887, "uuid": "dec76ca5-bbba-47dc-bc2a-b663d1afdc2a", "value": "Josho.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff20d8e6-336d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775668294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775668294, "uuid": "60f12af6-354a-4f54-afa6-da85142c6069", "comment": "Malware payload", "value": "4facbaf0649a84defb58b946e3fc86df", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775668294, "uuid": "adef1765-f8ee-4bfc-874d-672cb6cb5018", "comment": "Malware payload", "value": "7205b920b07d462145ebf83640eacd95941fef0da75ca1a44b5cbad4f94d6458", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775668294, "uuid": "9755e90d-fd3c-400b-bf64-00585b0414c5", "comment": "Malware payload", "value": "b54025ec87523c5b171a96c2c6cee2e64d95f55f", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775668294, "uuid": "8d461149-5733-4d35-824e-c9f185a7eab3", "comment": "Malware payload", "value": "f70bbfaf5e68d6c00f9d153cebf3ec2e6a8537dd3d008559c8ff5fa62bafb8bb80145e0d6e95ab422789a4d3dd803585", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775668294, "uuid": "f6108947-9329-4ee2-8fe9-257f1644153c", "value": "T16FD3EBC8499F46E98766783481CB6C4BEFB0A107250CE6F0B61EFA847F655248DFADD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775668294, "uuid": "f55ed479-77a1-4cf6-b532-627c209a527d", "value": "768:HoQPCFLEeQjMH0LHayR5skKhauQUI31wrP2zApZJeFUUxo7qccxEa1tOCG3b+TLe:1PcCHayjskKhauQUI31iuUhCG3b+RBu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775668294, "uuid": "0c3f2b61-10d0-46d0-a306-f8b3da52f339", "value": 137094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775668294, "uuid": "3e35870c-7cf4-46c9-9cea-d4bf82b6dd58", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775668294, "uuid": "937fa8b4-7bb1-4d76-8d7c-597519f3a76e", "value": "Europe_Notes_Draft_21.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8efb2ff2-3352-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775656510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775656510, "uuid": "46f79a60-8501-4ec8-a48c-d824938dd9c8", "comment": "Malware payload", "value": "fbba7c896f716e9a01ec0bff2a661e7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775656510, "uuid": "63199337-dd19-4e55-904c-5c3b1ceecf89", "comment": "Malware payload", "value": "74e2f8cec54161856f0d9432c18e4a2d0744e4ae57c67f12319eac843b6a4498", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775656510, "uuid": "c65cf8d9-c196-4507-8aac-4e7633a4dcf3", "comment": "Malware payload", "value": "f99fa6b68aeaa820960cf8abe1f406f70cc1d09a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775656510, "uuid": "161fdac2-1cfb-4454-bbf4-d2f2f5700b99", "comment": "Malware payload", "value": "46d6d593111c8e66e226c14c4a4051a59f84580f84a1e53e93ee49cdcb7e088e999772bdbf0e1dd1f828f97287ae2754", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775656510, "uuid": "aaaa2d45-f830-4e0b-b957-62c5f8d457dc", "value": "T159A502361B703108A51D2EA56D072BC2EFA5C6973DFDD50ED31A66C8991AFD23003EAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775656510, "uuid": "9d962732-24f2-4660-a4c6-c39de117b46c", "value": "384:NGG720zuppzqGSwVjmCc+++eKsH1z+++JKAdoWwLo9mDJZKsyGG720zuppzqGSw9:u6Bt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775656510, "uuid": "9bff9b7e-d5c8-4303-8037-e97c90e2b70e", "value": 2188649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775656510, "uuid": "10f4bf7d-e64f-4e0e-873f-f0db187b42e8", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775656510, "uuid": "3900a6b4-eb25-4664-9baa-0c999f522928", "value": "QUOTATION_REQUEST034690S-792578.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "011cbf34-3371-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775669586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775669586, "uuid": "18e456a5-c375-4746-9adf-18f782004b9d", "comment": "Malware payload", "value": "060639fd613e016ff1e1323eb818b9f8", "object_relation": "md5", "Tag": [ { "name": "178-16-55-80", "colour": "#48DDFA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775669586, "uuid": "a12fee8f-7582-4d61-beeb-48b363864710", "comment": "Malware payload", "value": "74f71cc4cff80b7fcac8e86f595b8d0e55718efde0c0040e2e2a5b66aeb05e1d", "object_relation": "sha256", "Tag": [ { "name": "178-16-55-80", "colour": "#48DDFA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775669586, "uuid": "d1d64f17-7475-410f-979b-332753bfb585", "comment": "Malware payload", "value": "77777bf07913b1ab02a66b67f92d79a25375e4b0", "object_relation": "sha1", "Tag": [ { "name": "178-16-55-80", "colour": "#48DDFA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775669586, "uuid": "394dfe10-eb68-435b-b53e-65c91d503b6d", "comment": "Malware payload", "value": "561afa899920d4977e908bfe33f3205e9897fd252abe0b817f1d3fc8439f4d5f62182f2054182796a246b6b033c22c4b", "object_relation": "sha3-384", "Tag": [ { "name": "178-16-55-80", "colour": "#48DDFA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775669586, "uuid": "87246dd0-c4ec-4b83-86e1-ec215ff67bb2", "value": "T1E7156D8BFD301D02BD1CBA290AFFDEB4299768B37D9D8B1157A298B2C740274184F576", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775669586, "uuid": "1f464fa1-9dcd-46fb-be15-c812381e88c6", "value": "768:cnRb9O21q6YiVLovrq6YiVLovrq6YiVLovMJPP0YmTS0Tc1eBAvWdcHveQ:6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775669586, "uuid": "1840f5bf-8d3f-48d5-a17c-a708bf45202d", "value": 937604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775669586, "uuid": "263bb411-ed67-48ea-8fbd-52a146d8e3db", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775669586, "uuid": "66e99455-8557-42ea-ab0e-bfb8e2bda6e4", "value": "Task.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7eb0fcb-32de-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775606838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606838, "uuid": "360e618e-d64c-41b1-942f-7b8fa57894aa", "comment": "Malware payload", "value": "835955a3843d45e6e6186e11adbe3c43", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606838, "uuid": "bf8ff991-cf1b-48b3-89ec-d84c74320458", "comment": "Malware payload", "value": "7524f7123eb049207efa4dac91e7d0a4726016d1a992a53468c54a4829658dbb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606838, "uuid": "047b3c8c-9fe0-421a-a08d-355176799881", "comment": "Malware payload", "value": "1c908fb8f31c05d435676f6307a288a4dcec2b09", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606838, "uuid": "78387767-c5b2-4f6d-941d-6b87b15c1994", "comment": "Malware payload", "value": "60076d97d8d0e21f445b6e25bf735ded8750ba3e94c1a268e3eebc84c0ad086e97d6bb49245f5353f945037746534830", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775606838, "uuid": "64acbcfe-cbbb-459f-8f6c-cbe5a411606f", "value": "T183C32A90BE68BC70C0042E3BAE7A875437574A958DE2F058C551E38FFFC76506E984AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775606838, "uuid": "fbe38ceb-0c38-48e2-ae5c-75da508ff6e2", "value": "3072:kk8phEfUPjrVPZSb7Nwk/pFJPkU8aGPx80nb:L8YUPjuDxPkBPx80nb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775606838, "uuid": "4166f946-fb14-407d-8415-07e38e84bd7f", "value": 128424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775606838, "uuid": "46c8ba74-5355-4c89-b23d-0adc2d6f5225", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775606838, "uuid": "953670b6-a6c8-4701-9258-9ec507d69013", "value": "EUTP", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7d259c6-32e8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775611025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775611025, "uuid": "c779687a-25dc-4c1b-bad0-325fa6963c51", "comment": "Malware payload", "value": "86514b834c5229bda84ba8de729a027b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "app-protecao-digital", "colour": "#450EC7", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "cardprotecao-com", "colour": "#6FCA7F", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775611025, "uuid": "d9957ec2-8dfb-4990-9f59-aca2a60e81b2", "comment": "Malware payload", "value": "7748e9b7d04bab6775cd2bb24c86a83b59de9b3cf21567606754e433c74f5570", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "app-protecao-digital", "colour": "#450EC7", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "cardprotecao-com", "colour": "#6FCA7F", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775611025, "uuid": "2eaa3e2d-6701-4090-958a-c03833f91ff7", "comment": "Malware payload", "value": "fcbfaae033538686b302879158edc6160376032e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "app-protecao-digital", "colour": "#450EC7", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "cardprotecao-com", "colour": "#6FCA7F", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775611025, "uuid": "cee0887f-f229-417a-9388-df76ced626d5", "comment": "Malware payload", "value": "a16128c7bbdbb8859b90c1ebbffeeb4d9ad08f6bf18f92ade5ff1849685c34cc694a78d548edcbba98084ab95bfa3eb2", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "app-protecao-digital", "colour": "#450EC7", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "cardprotecao-com", "colour": "#6FCA7F", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775611025, "uuid": "a66b8722-7e9a-4527-9795-f56a9b5baeba", "value": "T1C806E086FB58A92FCC7311324DAA523552478DD68E839B43B858371C687BAD80F5DBCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775611025, "uuid": "9a855b59-5ba8-46a2-86a3-cf2a0f9f7910", "value": "98304:VpT+1oVCwHNOZpJ+gNrZJpk1DX+9YzXx0Q1ij3xJ7:VysHNOL+SM+9aGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775611025, "uuid": "2017125f-0412-47c1-b873-8f9436bd0f7d", "value": 3957811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775611025, "uuid": "5349eaad-b2bd-4209-b411-ceb46782502d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775611025, "uuid": "219fc8e0-14c4-4cfc-9e95-84b88ef4b3e6", "value": "Prote\u00e7\u00e3o Cart\u00f5es.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13e3797e-334b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775653297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775653297, "uuid": "2154239d-c481-42fc-a23f-31944190ebc4", "comment": "Malware payload", "value": "1f53b8c7e92915638295393f6ba1fa31", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "soft", "colour": "#7A0DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775653297, "uuid": "cf62723e-8e53-4aed-bc07-cbb1a2de9f88", "comment": "Malware payload", "value": "780b015105daadf8f449a46dda6a7d502f7c7103d1b1bffab758eedeaa3b9060", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "soft", "colour": "#7A0DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775653297, "uuid": "6231157f-207d-46bc-a465-6f5b16575159", "comment": "Malware payload", "value": "b586b5e18eeae3cc69c3c4fdfcd3307f6555e38f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "soft", "colour": "#7A0DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775653297, "uuid": "85af3f96-0c63-4e8b-bc95-2d04d3440882", "comment": "Malware payload", "value": "2f8b28388e480257027ea0fe89d78f6f76fff79811948243fc66c32c93440d141eec738cb43f32b4b2128983b0c979e8", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "soft", "colour": "#7A0DF1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775653297, "uuid": "3345be99-1275-46a1-a4d5-7794385e48ed", "value": "T18DE533F27FC485B1F5A615BA80E87B9528EAF7851F02CECB1AD119020C747D2E2365E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775653297, "uuid": "61f5569e-731c-4463-a681-e72d0842ccb2", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775653297, "uuid": "aa435c53-5afe-47a5-bee3-775c0c7d20d0", "value": "49152:1j5X4y0WgxpQmuYtq/zMlKs18msXfZGldjpZq7w/13a62YNkrAGwkiLAWo0aTkEY:1j5oScWXT6z7mGl9qk/13xCr6EWs/HvQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775653297, "uuid": "8a8c52af-2c8f-4450-a7ec-04b71857da44", "value": 3238184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775653297, "uuid": "7c5a80df-d6e7-4d91-99cb-b050ce433c3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775653297, "uuid": "a5849bcb-8c44-499c-9761-6e87010338fc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3da2709-337b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775674154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775674154, "uuid": "9bebf16f-fef2-426d-b9cd-af2df93e45ec", "comment": "Malware payload", "value": "16891dd7095b9c7e21e5555c315b921d", "object_relation": "md5", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "c_x64", "colour": "#2CCCC9", "exportable": true, "hide_tag": false }, { "name": "dump_browser_secrets", "colour": "#1E9C0E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "system-fingerprint", "colour": "#5F371C", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775674154, "uuid": "c5a92c67-4ae2-438f-adfc-01a2273e1fbc", "comment": "Malware payload", "value": "791b1cafbe292dd99cac33879701b0c76c0bdec8ef67f9c67448c6911b6dbdda", "object_relation": "sha256", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "c_x64", "colour": "#2CCCC9", "exportable": true, "hide_tag": false }, { "name": "dump_browser_secrets", "colour": "#1E9C0E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "system-fingerprint", "colour": "#5F371C", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775674154, "uuid": "d6a3c9bb-7867-4635-bff3-7d87ae380204", "comment": "Malware payload", "value": "230c60541b4c9bec9558017d817b9862fef57084", "object_relation": "sha1", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "c_x64", "colour": "#2CCCC9", "exportable": true, "hide_tag": false }, { "name": "dump_browser_secrets", "colour": "#1E9C0E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "system-fingerprint", "colour": "#5F371C", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775674154, "uuid": "576afe23-e21d-47e6-9c10-7dfdc5c5b331", "comment": "Malware payload", "value": "5cf2fb6671410c4d357087c939ce981d66afd11f31d27d61c93605b53321ea7e144eb4275e890313081cdd59305ee7e9", "object_relation": "sha3-384", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "c_x64", "colour": "#2CCCC9", "exportable": true, "hide_tag": false }, { "name": "dump_browser_secrets", "colour": "#1E9C0E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "system-fingerprint", "colour": "#5F371C", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775674154, "uuid": "d0bea727-7b4d-46df-80c6-8a5cfa6bb905", "value": "T1E5658E07F3B400EDC0A7C179C5175A17E7B2740513749BDB66A08AAA6F63FE21A7E324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775674154, "uuid": "83d138d0-18af-4c62-876b-5030b0e890ef", "value": "b7e1e242db4af3fbbb65180e146817fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775674154, "uuid": "ddf0b9bc-b804-448f-8fa0-94fe48972a17", "value": "24576:C49/2O+xa+ssgZvt4gc1cG6SqtRyJ1MCl9sYUfJI9+aI4MGJQ7:3uPZgc1c/7yJ1MCxUlp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775674154, "uuid": "b184c7bd-52b1-4e42-9c0f-d486bde2bc65", "value": 1475584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775674154, "uuid": "66a00f51-4279-40b8-bd31-52581ff5b6f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775674154, "uuid": "493b589d-9e7d-48a9-8e6f-53fe1a2ff7c9", "value": "c_x64.node", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27993443-3370-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775669221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775669221, "uuid": "96d600a4-8c6f-499f-b094-a9839e92afac", "comment": "Malware payload", "value": "b139bc6ce807369262d3982ce46ad0ce", "object_relation": "md5", "Tag": [ { "name": "178-16-55-80", "colour": "#48DDFA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775669221, "uuid": "715e20d3-08aa-41f0-99e4-7989a29146b4", "comment": "Malware payload", "value": "7a009bba10f7fdfc958f97511b3c312373723444646fe1833ebb0753c5484b4a", "object_relation": "sha256", "Tag": [ { "name": "178-16-55-80", "colour": "#48DDFA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775669221, "uuid": "d0550f24-b498-4b3f-8e2a-34ee5812df09", "comment": "Malware payload", "value": "4daf0b8ce920deaec18a7eaeae89e6aa6fb1c2f9", "object_relation": "sha1", "Tag": [ { "name": "178-16-55-80", "colour": "#48DDFA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775669221, "uuid": "ff115ace-9bef-4536-8bd4-bf09e27749ac", "comment": "Malware payload", "value": "7ac674812935895dafea4323a322b74a326a64b15c259329fd8d8484db78167040d3083424fa63018b3afe162941ee69", "object_relation": "sha3-384", "Tag": [ { "name": "178-16-55-80", "colour": "#48DDFA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775669221, "uuid": "bc4c597a-0378-416b-892c-96b6c09cf949", "value": "T1B8153AA4EC389E447A1CB931097BECBEDD834877559E13F10BE249B65B04624F61A23F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775669221, "uuid": "c7839f9b-c55b-45ed-9dda-a51761b2a667", "value": "768:QnRb9O21q6YiVLovrq6YiVLovrq6YiVLovMJPP0k8+S0Tc1eBAvWdcHGrhCAXn78:8rhCAX7GP7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775669221, "uuid": "629f61f1-8ced-4b00-8377-10e99f7c5613", "value": 937620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775669221, "uuid": "894d6c8c-8751-49cc-b3a6-56d0781e3786", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775669221, "uuid": "a46fe867-98dd-41db-9e26-df4fb7d918ce", "value": "procesos.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce65c210-3346-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775651462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775651462, "uuid": "224dbbab-6539-414e-80b6-3b7f25073610", "comment": "Malware payload", "value": "718cd50494b1e0c9030cd8e719a5fdf8", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775651462, "uuid": "c46306ab-c1b7-43ad-8485-2b0ad1e429fe", "comment": "Malware payload", "value": "7a0ba428af09861d5d73cb7666648c3eb80a9fbc4f29f45d9ad8242652ac56e7", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775651462, "uuid": "dccc9af7-a659-4b57-8407-f236df98674b", "comment": "Malware payload", "value": "a2ebf374d442260b2396dd2043ea65a6b32e2053", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775651462, "uuid": "2d9a9c07-f527-40e5-be06-3eab9bc4c29f", "comment": "Malware payload", "value": "eaad9769d2b740819dc24b2a80c75385252c6bfc41f040cfe24b42004dd17f9f26a03ce03cdc2b3e261b4e37d8a5dc8a", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775651462, "uuid": "80f2d65e-3f0f-4c51-bd7d-2f69261d4038", "value": "T14B5136142BE91610F3B6AE76987712058D7B3892ED32DA4D005C098C1733E08ED75F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775651462, "uuid": "be48151a-136e-4a8f-aecb-d0daabc5c638", "value": "24:8Ptn2gefAEp8iwXMfl1vfEFF9VSelCZFXqddNXuHY85/9TyPb:8VqS1XMfl9fzvedLXuHd9Gb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775651462, "uuid": "105db263-dc22-4ae5-a5dd-18ff0fa8c573", "value": 2692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775651462, "uuid": "b77d1076-5062-4950-be13-323d26c2e849", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775651462, "uuid": "427c4a7f-179a-43b7-92b2-062df4365d7c", "value": "Document.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "336ea55f-332b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775639606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639606, "uuid": "2fa55c05-9654-4559-974d-1d089f64429c", "comment": "Malware payload (Mirai)", "value": "fd8bb01a2d258ad42c4cffca4309d8ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639606, "uuid": "ebed5bca-a88b-4cb6-8c6f-d616d9183b8e", "comment": "Malware payload (Mirai)", "value": "7b0b1cbfbebfaf32ef4dd331e86acf720ac8c7f8eabe9ea91d86db4e8c7d0aa0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639606, "uuid": "a0bcc787-fa9e-4612-ba9b-6ad2ce28bc35", "comment": "Malware payload (Mirai)", "value": "88f188ebcbe7ddb255ca99c84bae2ae20c1f53f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639606, "uuid": "38306203-4e26-4d11-b6a9-305937c6480f", "comment": "Malware payload (Mirai)", "value": "4c801c33cf621c2163b3c360bce9c56345ce20c9b30aa079da0d306bd72d9cc8e4dc873f83cb2d94c7f418c2f40da2dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639606, "uuid": "014d7b43-87b2-4453-ba3e-9f66334f1ba2", "value": "T16E639E16E4254948C25945B8B0ECCF3A1F23A5D062837EF656AAC3BAE457D8CF508FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639606, "uuid": "bbcfa057-2df6-4d98-a653-b97e79d5d295", "value": "1536:Z/cHRKg2AmFGTxxnKcFS07ir1VKCWnJQfWO4:ZUR52AmgxKc9E1VKFSuO4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775639606, "uuid": "1c04d983-cc20-408d-852b-5613025e065b", "value": 70972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775639606, "uuid": "172d9b49-1c5f-4f54-a39e-6a78130384ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639606, "uuid": "287afa17-b1a0-4010-898c-b5cc5c5b8bc8", "value": "tony.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7f77033-3326-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775637788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637788, "uuid": "0100f965-a3a7-40fd-88aa-0acb8adf83c4", "comment": "Malware payload", "value": "42d164f4c041a21e7dde09d0903a2143", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "hsgeowvi-com", "colour": "#212A9B", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "lkboasprqw-com", "colour": "#1C34F7", "exportable": true, "hide_tag": false }, { "name": "lkhpihf-com", "colour": "#C1C187", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637788, "uuid": "49f9e377-48da-4c2d-a4de-9c8029ef56a1", "comment": "Malware payload", "value": "7baa6b8a52be2dd84b6f533774707e1fbbc7faad3f7a6059063f9804ae1768be", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "hsgeowvi-com", "colour": "#212A9B", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "lkboasprqw-com", "colour": "#1C34F7", "exportable": true, "hide_tag": false }, { "name": "lkhpihf-com", "colour": "#C1C187", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637788, "uuid": "75afb118-97b1-4b5d-8804-12c804526750", "comment": "Malware payload", "value": "778121041bcaeb91e1b6c3115e768d6e531a92a8", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "hsgeowvi-com", "colour": "#212A9B", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "lkboasprqw-com", "colour": "#1C34F7", "exportable": true, "hide_tag": false }, { "name": "lkhpihf-com", "colour": "#C1C187", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637788, "uuid": "f4b9b1fb-f994-4ab5-a064-7a7584d16329", "comment": "Malware payload", "value": "5f05daef2454d970d0be7b5fe0c6b5340adb3f63d9b1331fd59abccad38f4bdbc744846638677edf94f0b920644c217a", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "hsgeowvi-com", "colour": "#212A9B", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "lkboasprqw-com", "colour": "#1C34F7", "exportable": true, "hide_tag": false }, { "name": "lkhpihf-com", "colour": "#C1C187", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637788, "uuid": "a33f3e58-9304-4cf3-b214-4d51b52220c2", "value": "T18BF4B35A89B315A87807D47917EB1B166376C003D40AECB47FCD6298CF8B984D9E738E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637788, "uuid": "7632ad77-e6d5-40ea-8bae-8701806969fa", "value": "6144:GZ5KO/24isO18el3zWBOrksDKRQHu10drJ77O:GZ59/24isOHV7y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775637788, "uuid": "81f3fbaa-14ff-40c7-8520-d88e67696a7c", "value": 793078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775637788, "uuid": "29164e8a-e4aa-48c0-95a7-ce49284b6262", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637788, "uuid": "70dc1a95-69c6-4f9f-8ca8-febc1bb64b8b", "value": "start.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7e3cb58-339e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775689247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775689247, "uuid": "393fddd4-db4d-4a95-99f7-90d3a5eef816", "comment": "Malware payload", "value": "569ea226127dcbb6342300184ce8691f", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775689247, "uuid": "f5220cc8-3b96-4d94-9370-f862ab1acec9", "comment": "Malware payload", "value": "7dfa327d21b976dc26711b09726b2e36d6ce059226223a992ccb9b299dbe15a9", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775689247, "uuid": "6078aa9f-5705-4ac6-87c4-18f55870750e", "comment": "Malware payload", "value": "03441808ae3dec37df9782616b27dadd639d3e9e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775689247, "uuid": "84bd5df2-80c5-4a0c-8f85-5399005411ae", "comment": "Malware payload", "value": "0aede7e79a6a2f5973f1073cd636c0edd81618b87def687ff9b6b028e4a91bbf60930874855aaea1d138e2a68cad2084", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775689247, "uuid": "155b1977-a49c-4f6f-a1c9-1036932ab779", "value": "T1AFA57D52E3556937C4BF12361DF6136073361D859E838B432149B16CAFB72C9AF8EB88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775689247, "uuid": "535fb941-e4ae-4883-96d5-114a2ac8ea32", "value": "24576:xQEfQHjpfQ6+EHw7I/sp38N9Dlu9UXMM6kFlWKKJgz9uu63eg3RU0OlHL:Ov+maQD9fuJgsu63eg3RiB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775689247, "uuid": "129c7803-b06f-4723-8b53-4397fe769bb4", "value": 2138912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775689247, "uuid": "944b66c0-2641-407c-801e-fbde03f9fb18", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775689247, "uuid": "7b623071-3920-424e-b97f-ee910a8f0db4", "value": "Servizio+Clienti_1.1_apkcombo.com.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecf14bcf-3326-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1775637770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637770, "uuid": "69a5bc87-dd36-40b7-b74e-01cd2bd7ec71", "comment": "Malware payload (NetSupport)", "value": "6c0ff7f93fea8f4a396cd85ec275ceb4", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "hsgeowvi-com", "colour": "#212A9B", "exportable": true, "hide_tag": false }, { "name": "lkboasprqw-com", "colour": "#1C34F7", "exportable": true, "hide_tag": false }, { "name": "lkhpihf-com", "colour": "#C1C187", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637770, "uuid": "3e57c427-bbab-4e5c-be9e-ad098ad34bb4", "comment": "Malware payload (NetSupport)", "value": "7e0f11921ec5e9545e74d99c6a3bfb2c2576827bb804e6830ef3a46c885065ea", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "hsgeowvi-com", "colour": "#212A9B", "exportable": true, "hide_tag": false }, { "name": "lkboasprqw-com", "colour": "#1C34F7", "exportable": true, "hide_tag": false }, { "name": "lkhpihf-com", "colour": "#C1C187", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637770, "uuid": "5c61b96d-4eb5-466d-9e74-cae84a3ba0e2", "comment": "Malware payload (NetSupport)", "value": "871928223fada2111027ce30e6880dc997a544ac", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "hsgeowvi-com", "colour": "#212A9B", "exportable": true, "hide_tag": false }, { "name": "lkboasprqw-com", "colour": "#1C34F7", "exportable": true, "hide_tag": false }, { "name": "lkhpihf-com", "colour": "#C1C187", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637770, "uuid": "47fddcfc-0b55-4c87-be41-ce4f19d394ec", "comment": "Malware payload (NetSupport)", "value": "5fd309b64ef1a90f7ec1b1b6fb02659da8779498bf4ce33bfee32494ba57ac8f9cd1b14cc4838913ef88bd489f76f952", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "hsgeowvi-com", "colour": "#212A9B", "exportable": true, "hide_tag": false }, { "name": "lkboasprqw-com", "colour": "#1C34F7", "exportable": true, "hide_tag": false }, { "name": "lkhpihf-com", "colour": "#C1C187", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637770, "uuid": "7b9d5d86-6c17-424e-be5e-6b3784782bc9", "value": "T1ECF0D4FB80A81D37D14305C49D4575AB40C783DF4D5D1E9062DE66511DB5B3D08D500A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637770, "uuid": "03230a81-2846-48d7-adaa-ba537a86f6d3", "value": "12:2huRs9AHN7KGeoiGFxXJ6e0EFptt3V1MLA4bCPs:2huRs9+BvPrZzvt30x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775637770, "uuid": "33a10c58-7af5-4bc1-ac68-9947f96563ca", "value": 495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775637770, "uuid": "3275cea5-fd39-4d96-b5ea-72d8dc88febe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637770, "uuid": "59cc274d-a905-4b3a-ba84-1a158bd75e0b", "value": "032.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c055c1f-32ea-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1775611730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775611730, "uuid": "40deadb3-d6fc-4e11-bd65-dbc76eb99b15", "comment": "Malware payload (Amadey)", "value": "8d1688952f54d26ad86f9b612f45138f", "object_relation": "md5", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775611730, "uuid": "ae8aac22-7e53-4ebb-b161-ba75374ad7d1", "comment": "Malware payload (Amadey)", "value": "7f3a51d0624ebf838a483be1e6e463702f742e21e64548a0de99845270647965", "object_relation": "sha256", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775611730, "uuid": "08eca30c-e85e-43e5-970d-20234558872c", "comment": "Malware payload (Amadey)", "value": "065af859f4fcb2158b953c258ee052bc59e5b330", "object_relation": "sha1", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775611730, "uuid": "1f3c942d-2fc5-4ed6-9cc1-94cd109d9768", "comment": "Malware payload (Amadey)", "value": "1c625c79877f91dbe22a466395728df003c6701a8bb3ce8cb7c53939491ad1dac7794d806b2507b88f9cd635c75cebbb", "object_relation": "sha3-384", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775611730, "uuid": "6f76e83f-2e00-4e23-b3d0-3a68971abc5c", "value": "T15D371227B395127DE07B423689B2D231D6377C1167268D8B87E4295DDF3B2A02E3E712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775611730, "uuid": "a739e63b-5ac3-4713-94a3-01696088363b", "value": "5175da4b99d292f751a152b8e78310d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775611730, "uuid": "6e80b548-8781-4f93-90b2-ea4a5480ac5e", "value": "393216:+Eba1Fdq1B7wgZHsoqEbpibx2x7JFO7nE6p1XioJRa:Tba1Fg1Jnlbpdx7JFOVplioJo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775611730, "uuid": "d54c0258-d10f-4ea5-aae2-678ebfeaad57", "value": 22842880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775611730, "uuid": "b28efdeb-20c2-4cbe-b3e2-307d5de2f9c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775611730, "uuid": "b421558b-2f60-4f54-a73e-b2eb2f10cba9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "090dbcc5-3354-11f1-a769-42010a9c0008", "comment": "Malware payload (RatonRAT)", "timestamp": 1775657144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775657144, "uuid": "2b244cfe-2eda-4ada-a020-5da45a2d2455", "comment": "Malware payload (RatonRAT)", "value": "a5128a9c3dc6cc592ee4a75158925fac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775657144, "uuid": "6a0d17f7-62b6-4290-bd0f-890d4722d54f", "comment": "Malware payload (RatonRAT)", "value": "7f3bd15f28219770ed74d8c46146b78b041c81b0c7f45f254967920b973528e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775657144, "uuid": "71993923-1e18-4b8f-a19c-9c57920859ce", "comment": "Malware payload (RatonRAT)", "value": "14d614ae96df2e20a810ae3b1b539b8ef94842c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775657144, "uuid": "5a8d75eb-57fd-4e44-9b61-39239b3cbf66", "comment": "Malware payload (RatonRAT)", "value": "cbc9d6547fc4bf7923b395a9d6f6ec9e1762424b22d740017afade8c9b03b43e26a5f1b7abc9a757de080e950e4bcb9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775657144, "uuid": "017fab03-97fa-4f6d-8e20-00042d00bb2f", "value": "T135C5011177F5820AE3BF2BB9ABB6145D1BB7B903D67AD38E1948509D0FA37409E00367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775657144, "uuid": "8d055d5a-8c11-4349-862f-2f58c5b12e35", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775657144, "uuid": "be1f845f-a2b9-47ef-aae4-243ae4c14661", "value": "49152:MoDVliNgLmnc/N+ZZXZQOLHM7wRPirm2NnPTKKm77LrwCB6uanh:7DVQNgScVIxpL7oZNn2Km77LrwkFW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775657144, "uuid": "f8b800c1-6bd8-407c-bc14-dddffb9e8643", "value": 2710016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775657144, "uuid": "74bebca5-e81f-4f26-9d6e-160eee25570e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775657144, "uuid": "0aa388cb-d557-4d9b-9609-5f8f28b9554c", "value": "worknigger.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "379e1d6a-3364-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775664094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775664094, "uuid": "a01d4937-b9b3-4fb0-bf9d-43c1fe564e4e", "comment": "Malware payload (Mirai)", "value": "2e61d77c5bbc6f6425e72c816ccaf7db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775664094, "uuid": "19d0bf81-bdbc-49db-8a78-41ed1030b5de", "comment": "Malware payload (Mirai)", "value": "7f8803323cbf24b670ea88a046ce0e3956d5a96606f485dacf86257b09755748", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775664094, "uuid": "257b44e0-2212-43f7-9516-92166b4b5e99", "comment": "Malware payload (Mirai)", "value": "2f35d4ab7f803882dd0df7432b03278404df9fbe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775664094, "uuid": "d3e46729-a7cb-4669-929c-86feaf2f31c3", "comment": "Malware payload (Mirai)", "value": "6aac5ebccea26429d56db87bc800c8cb2f682d5dc437d51bf42238483455689abcb026cf9e8587973b11fbe4600cfd73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775664094, "uuid": "98ad31aa-00e1-48b4-8e2b-78b7a0971fc2", "value": "T1BB830846BC818E11C9D823BAFA2E118E331263B8D2DF7223DD105F64778A96F0E77556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775664094, "uuid": "31f7ef37-8e39-49d8-90c0-24c10387872f", "value": "1536:7on6OecY2dFcrfQ7OBDUzdAd2SF5u0V7nb5HyAKY7BAcEUIUi+DiCbn/p:NOHFIfQyBDUxi2Kg0HSAKIDiCbn/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775664094, "uuid": "b9e994c3-fce6-4266-a9d3-d29dc97af098", "value": 83808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775664094, "uuid": "c522f0b1-c8d9-47ba-b074-7ec927343a1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775664094, "uuid": "6f07bba7-d353-4b4b-9113-a87af76f0a61", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35654e6d-3344-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775650347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775650347, "uuid": "0c8f3502-56f3-4307-ad0f-b4fcfa4c704d", "comment": "Malware payload", "value": "b7db66d418b4623f5db60566e9758f77", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775650347, "uuid": "ceb504b7-787f-4615-b07c-5385a103ec54", "comment": "Malware payload", "value": "80308b089105beeb3b1d3af3d0fc8018fbb27af54f4151a79b73566bba03128b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775650347, "uuid": "570838f2-83e8-4791-af48-197341e5bb95", "comment": "Malware payload", "value": "90fdecbc349b4658eb8fc33243a02efc3afbebd6", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775650347, "uuid": "2f2ed50d-d1fc-4b9c-8329-89fd9dc1c161", "comment": "Malware payload", "value": "aa2127c3d2099b70e5c09bb910d275eceac3c51d351d6458819af290e657985ae3c4c8a8ac4410e4d9ef55b753d855d3", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775650347, "uuid": "0ff9b1bd-7b7c-4eba-84e3-7dc0927f29ec", "value": "T18F939C6031FC2200E432DE72EA606240CB5EF841977382C82AA1737CAC11785EF92F1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775650347, "uuid": "ddbd28df-84ec-4855-8cd8-5128f3bb8dbc", "value": "24:vsFs/GnekLZ9ge0gJFHj1GRzYYpJjwjt/Js8FDm:ECGnekgeHFHj11atUt/+Cm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775650347, "uuid": "40fc45ec-e735-42bd-809c-c6ea72e15292", "value": 93763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775650347, "uuid": "f82f040e-720f-4190-842d-d619d947c057", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775650347, "uuid": "717ae66e-e48b-43ee-ada3-06957493b733", "value": "Gorschenuk_Odinokie_Zvezdy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dfa3916-3373-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775670708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775670708, "uuid": "6a028cc3-7e08-48e2-b314-9a8a494b2868", "comment": "Malware payload", "value": "e5afeeb567e467aea2fc394a494f4221", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775670708, "uuid": "725cc301-33da-42dc-9356-cc144f134b82", "comment": "Malware payload", "value": "80ba3f0bf20a0068fbdde96d21eda37d30d5b995088524e0590bb6913335d874", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775670708, "uuid": "d8d6da51-d6ca-4941-bd59-cdba7f3961fa", "comment": "Malware payload", "value": "06a76879c6d1bc92a99c48b2770bf80a7692b557", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775670708, "uuid": "b4d8645a-c841-41d4-bd7b-27e95581d300", "comment": "Malware payload", "value": "8ad4c3d26a0ab0d80ad694571249721211725a7c9d93cb5ed07845692980eee0debfafd7ed2d721ebd926183d5bc08bc", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775670708, "uuid": "54e3c95e-c5ef-400d-a5ba-e40b1eb526ab", "value": "T16C754B05FED704B6E502173249FB62EF2339AD0A0F32DA87DA447679FA762D61832345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775670708, "uuid": "10a04d83-8849-414e-a312-cc76b094f18c", "value": "5af915f278815e76bad476ef32593028", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775670708, "uuid": "4cceec30-f788-436f-b26c-5f2d470bf120", "value": "24576:e3AtIDqhwxJaUN6Kl8eVFieXKQIUVEVFoVKR0x462hbxnJeXFX:ePpIQVXmF7R04hbxn0N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775670708, "uuid": "752e3b8c-7347-4da1-b450-e5fc6de64e96", "value": 1594072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775670708, "uuid": "a0704726-98f1-453e-8ce5-c0a23815cb15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775670708, "uuid": "0827f039-5aa5-4e12-a643-0940a18846ba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af69b4b2-32ff-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775620916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775620916, "uuid": "9691f17e-c2be-48bb-8c35-b8818d09fa7d", "comment": "Malware payload (Mirai)", "value": "f2ddcf792143b4dcaf591ffeb4966212", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775620916, "uuid": "5cb77359-1054-4764-af94-13d4b4fa3907", "comment": "Malware payload (Mirai)", "value": "81afb159d80bc194654a1f7299df96ae65964e8535f5fcd675a9d5736b047fa4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775620916, "uuid": "fc91222a-b1c5-495d-852a-ab875067ba5d", "comment": "Malware payload (Mirai)", "value": "e156ee67befef37783be481fa371dee923f754b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775620916, "uuid": "d8e03ba1-27b1-4843-b97d-6c182386fede", "comment": "Malware payload (Mirai)", "value": "6f6ae7fd715bbcb3fb525fedb53266c132e36cc14c82f35083a52355a7a087aebc052a7b71b2793e83cf2007b635b2b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775620916, "uuid": "8d769e7c-abea-42bb-bb75-b82b585b6638", "value": "T1DD73B309BFA50FB7EC9BCC374AA92712248D651A35A93F35BD34D418F25B21F15E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775620916, "uuid": "91f64265-669a-4722-bf0c-d0740d251443", "value": "1536:aHJtIFGq1QuT+uDEQhKvt191Yi8ZNFDGm:aHJtIM0T+UEQPi8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775620916, "uuid": "6b6e51bb-faff-4dc8-957f-8eb6a4f51755", "value": 76904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775620916, "uuid": "89fd5337-549f-4322-872a-ac9991ca5f6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775620916, "uuid": "a2460ef5-1e0c-41fb-810f-c9c5b4e40c7d", "value": "jew.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0609cf43-3326-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775637382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637382, "uuid": "3b79bad9-01c7-4a9b-94b0-7e983d289ec4", "comment": "Malware payload (Mirai)", "value": "9cc035496d930afbdd4b04152e9f1c33", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637382, "uuid": "277ea043-a189-457b-8feb-82945215baae", "comment": "Malware payload (Mirai)", "value": "82000aac56754f4b3989d970a0ad43bf73d34d626e9f49da4226a378d3456755", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637382, "uuid": "d98d1700-9b18-41df-b5f3-498ebdee2c97", "comment": "Malware payload (Mirai)", "value": "c8f75d67546b565ee1bd93014a15c1c352e64e21", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637382, "uuid": "3bdc0b4a-2f34-4bbd-83f5-bcb0bb28b2da", "comment": "Malware payload (Mirai)", "value": "2dfe1aa6160eab13d74c72d7b2678246c4b2a7bbb26f2ec32ed8b8c0a3b9ba5c7a3f17f9c193c7067e40b22ab46e845b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637382, "uuid": "a505b559-db6d-4f7a-afc9-fd9e4dd05461", "value": "T11ED32A06730C0A47D2632EB43A3F67E193AF9AC121E4F640355FAB8A95B1E335586DCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637382, "uuid": "8202c15c-abe1-46f4-adad-e130550334a5", "value": "1536:9roGHNTUZN0MIBUiCxfytiteQInJ7abwko7lj0JvAhhHr5+5uQfqIcv788:nmmUiCx5t26wN7lDhLvI8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775637382, "uuid": "df5042f9-24ec-4ebd-b92c-b1ae16214e75", "value": 134036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775637382, "uuid": "37a4ca8d-030f-4cb8-9b6c-da9de8e1350e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637382, "uuid": "f0210380-0849-4452-b2c6-1bfb964636de", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dea29206-330f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1775627867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775627867, "uuid": "fc3ff492-09d4-4d30-8a2c-e6d6114a9deb", "comment": "Malware payload (Formbook)", "value": "76ec5ed59228399e34a2cde4eb3b0086", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775627867, "uuid": "b44d4528-c428-4583-8916-858be10568a4", "comment": "Malware payload (Formbook)", "value": "82024b293b8ce6ac8394123c88e64a48e9bcec2d70b0dd43b8632e54ee6ad45a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775627867, "uuid": "7c85b708-7dec-4b6c-a1d3-95a01cf33773", "comment": "Malware payload (Formbook)", "value": "cffeabbf1ea54f04b6ddca8046f40fa9723ffc2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775627867, "uuid": "1f7f0653-fa30-4ee5-8d94-edfc4f6a9e2a", "comment": "Malware payload (Formbook)", "value": "f885786e3b5b408ef36e3c32d0c92718743cfd4a464ba78ae2c45c51d20b0b92d74f330ac0ac16b71fd7a64c9ad612e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775627867, "uuid": "50448748-0f9f-4637-9377-7f4890244f0e", "value": "T16A45F1413227DC02D5E78BB00DE1D2B417F26E85A412C267CFEA3DDBBA29B5569C4783", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775627867, "uuid": "0a9ab0dc-11c1-415d-99db-dc86f52bbb13", "value": "24576:H1uYSJJSHwzBI/KGA/ZqG/PigOdWegadAxZolSlBqptBl:VPqUwlQKGA/giOGvNqpL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775627867, "uuid": "ebae76da-b8ef-404a-a4a3-c19935d7864f", "value": 1235968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775627867, "uuid": "82234278-0dd0-464f-a644-e6c2c0cf2633", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775627867, "uuid": "bdf1dcf3-f1cd-46e0-90cf-b7f8c1feff3f", "value": "RFQ 0420.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2af55580-335d-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1775661067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775661067, "uuid": "dbef690f-fc24-4b2f-a669-aed55c6b7846", "comment": "Malware payload (PureHVNC)", "value": "166f11e6c60500ccbeee54ee73b09267", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775661067, "uuid": "fac044d8-d73e-4114-8641-7b5b68d7d951", "comment": "Malware payload (PureHVNC)", "value": "86602755df14c2e08cb921aeaa18bc1d6d1e0075d47791354bfa848aa50320f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775661067, "uuid": "c769c601-5f17-4de7-9a65-c77addd1c5c5", "comment": "Malware payload (PureHVNC)", "value": "a9420edba8358587f8e1c42dbebdd6170eec132d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775661067, "uuid": "be4f15c0-da1e-4d75-a39b-a6a1b93574e7", "comment": "Malware payload (PureHVNC)", "value": "3ae7bfeac7a7acb81d4d9c93ce4a9def718da25ad6164129b7ac251dd453cd51a63c5a1302d7c85a28578ee94a7d8592", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775661067, "uuid": "449f7dd0-4b65-4aea-b7c4-2ea8cbe9e4c6", "value": "T1F46502452214DF02D9A75BF86DB1E3714BF4AC95A022D213CEEA7DDBBE39B406805783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775661067, "uuid": "3bb88b08-8081-46f1-98d4-70a123950a70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775661067, "uuid": "8c9e5de0-bab4-4c40-b325-93754854c233", "value": "24576:9SJJSHwG8sDwJxqyIEbHqO6N5BqXWeATnsrVGON1ynv4RsaXSaTTsLIchdBIpc:9qUwG8sEJ62qOy5BoOuHbynv4R33TReO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775661067, "uuid": "952f443d-08be-4990-ad04-c03f1639ea04", "value": 1531904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775661067, "uuid": "563d44bc-3ef9-4a07-976d-92eefa2da2a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775661067, "uuid": "42f12453-baa1-49f5-acf7-e8b3db9d1dea", "value": "166f11e6c60500ccbeee54ee73b09267.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb2775eb-3367-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775665711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775665711, "uuid": "2d91bb9d-73fa-4f03-9a1e-3bb547c0a95d", "comment": "Malware payload (Mirai)", "value": "dcfc6a48cd9af388ff88e8903f9ef1bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775665711, "uuid": "d0483836-7c1f-41d6-a71a-4575d7de173a", "comment": "Malware payload (Mirai)", "value": "86788963c42e265889fe6c38422d304b9a1efe8b7bffccebc7cd2399279d4cc8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775665711, "uuid": "ca346b1b-178e-46ba-99e9-aa3afb83c4d5", "comment": "Malware payload (Mirai)", "value": "fb42f93f2e17e869062b67bc7fbb9b92b64d4c74", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775665711, "uuid": "cc2c773a-d78c-4bab-903c-fb40224b3750", "comment": "Malware payload (Mirai)", "value": "ccd4bdfe4532dcf5539a290aca1141d1ac45bbeb01498b3db22e215eb8a927e87a3863bd481bc09cc063e248f7ac90c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775665711, "uuid": "70b5a87c-e7ff-421c-b60a-528426d63805", "value": "T10B73F746BC918A23C6D423BBFA6E11CD332573E8E1EA3207DD116F14378A92E0E77655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775665711, "uuid": "34cf6280-9460-4255-bb3a-029fdabf2ba9", "value": "1536:9PwVhcamm1xdjytr95fFAg57zNoDhB1ixykPkMp+IU5T:9PSmm1x6HfYEoHMp+N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775665711, "uuid": "12bf18cc-e104-496f-803e-b87cc3b1ed2d", "value": 74748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775665711, "uuid": "f98ce618-721a-4098-ba4a-f1740a6047dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775665711, "uuid": "a020f0c3-7b5f-4b54-b257-59bbb56867ca", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd271632-333d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775647568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775647568, "uuid": "b3c71b4f-deda-4df0-bd97-5056f2fa525b", "comment": "Malware payload", "value": "f892bc1f36676fa3d5aeec255146bf3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775647568, "uuid": "5ec59d42-1716-4145-b1d5-43788a5ff271", "comment": "Malware payload", "value": "879a58f749670bfbc4c47f1373d7939eb6a222138af158fe40ff1f9b3d850bdb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775647568, "uuid": "9687ab2b-27b9-4ca0-b716-5301117b2443", "comment": "Malware payload", "value": "153fbb923696654694db31104fad1959cb680927", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775647568, "uuid": "a70f694d-bb1a-4a40-b66e-7b398f0b612d", "comment": "Malware payload", "value": "0d037a3117f8d3db5f3606284357db8b9fab9e2db1ca7034b2d16a9977dc439506e58b025663e18e6f5eda33c0c83d76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775647568, "uuid": "480aea90-73b8-4821-8664-2a68336bd949", "value": "T139F60131764AC86BD56621B02A7C9AAE911CBD364B710CC7B3DC7D1A17758C32633E2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775647568, "uuid": "9c5e7957-64a5-4f6c-adf3-4b5e9e352e87", "value": "63ed59597dad42eeec3f01fae0ba2a2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775647568, "uuid": "42213d26-2fbb-4a55-90c3-0c5323cce339", "value": "393216:VZNVjchuWAR4qmAWsgc9C/TvFJmlxhluJBcZXaanP+/K:3NVjchuWARCEp9CpMlxhlCitnP+/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775647568, "uuid": "61d92fac-1319-4de7-888f-842e4c128771", "value": 15782880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775647568, "uuid": "4a0d27f9-945c-48e2-a597-66e9165be505", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775647568, "uuid": "d3a73eec-a368-4dda-94fb-3dcd938080a2", "value": "PCPrivacyShieldSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b2e6b49-3367-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775665362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775665362, "uuid": "e0ca93a7-14da-4776-a7f9-4fc4adfffde4", "comment": "Malware payload (Mirai)", "value": "050b6a9c9cd7c147f60baeb525d64475", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775665362, "uuid": "9774e0e5-9e13-41f2-b126-5f01b5ed0307", "comment": "Malware payload (Mirai)", "value": "890e97abba3798a90a2cdfab468bc4ce9ed43d168d42085a8fd5efa4e6eed429", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775665362, "uuid": "e11475c5-258d-4904-98db-c227d892164f", "comment": "Malware payload (Mirai)", "value": "a923c8b0da11a15ea74b83367f10cc465f285e1d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775665362, "uuid": "e104e135-eccb-4d78-94b4-d3f319c8d612", "comment": "Malware payload (Mirai)", "value": "724e41f00ae52bfc5823593d043ac7495123141f0b2ca9b50f0e1e67194c330f9a2a79eed674c520edfb01e450fb7f16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775665362, "uuid": "0875bfe1-3f7f-44d4-914c-8ef6801db9a8", "value": "T14C93640D3E318F7CFBAC863957F78E21924933A526E1C544D16CEA421EB064E742FBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775665362, "uuid": "09e438d3-a34d-42c2-85c1-2cbe7241df43", "value": "1536:Km81p57mJoXIyI8Xt3Whsp6rmJKc0jnKZC0WfIrO9Ho4AoX:i1HyJoXIcQap696C0WwrOdo/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775665362, "uuid": "1c8326fa-dd91-41af-95cd-7c6e223dbb7d", "value": 96408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775665362, "uuid": "a25cb52f-2077-4176-881f-82b0f16e7fe1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775665362, "uuid": "9cff0984-9e7b-4ae8-aa9a-b32bfd3a811b", "value": "db0fa4b8db0333367e9bda3ab68b8042.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a0f4a34-3315-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775630141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630141, "uuid": "e5cda34c-6dff-44a6-9657-212c75ef2c0c", "comment": "Malware payload", "value": "56384415d5b4ca91916e41b8755d53cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "oficiospolicia-com", "colour": "#4B94B2", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stalin-Fabrico-Loor-Romero", "colour": "#7A8459", "exportable": true, "hide_tag": false }, { "name": "xx-kak-is", "colour": "#B502AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630141, "uuid": "795cd005-1b6c-4b14-9eb5-595279312da7", "comment": "Malware payload", "value": "8994d6ba13561a3fca2fca333213a65b7173103c646416508b6755d500ad52e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "oficiospolicia-com", "colour": "#4B94B2", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stalin-Fabrico-Loor-Romero", "colour": "#7A8459", "exportable": true, "hide_tag": false }, { "name": "xx-kak-is", "colour": "#B502AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630141, "uuid": "aee30a04-677b-4dc9-a083-9f3a6cbd6d8e", "comment": "Malware payload", "value": "bd5e640117d90f94bbe4a93f2f8f30cc6ef63a6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "oficiospolicia-com", "colour": "#4B94B2", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stalin-Fabrico-Loor-Romero", "colour": "#7A8459", "exportable": true, "hide_tag": false }, { "name": "xx-kak-is", "colour": "#B502AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630141, "uuid": "57e3b3d3-03fa-4ff5-addb-2ccf91e86218", "comment": "Malware payload", "value": "5d3bb8b38403232df1ecd2245139af47c2f19683c6539e9b1cf75036c7fc015fe0e6468afc7fc834f86bb1802bbfd463", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "oficiospolicia-com", "colour": "#4B94B2", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stalin-Fabrico-Loor-Romero", "colour": "#7A8459", "exportable": true, "hide_tag": false }, { "name": "xx-kak-is", "colour": "#B502AB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630141, "uuid": "71371d34-b1dc-43ca-827c-a2215ffe42a1", "value": "T1D718333BE18A6579E06E2D363572E210943FBE5169030C1B96FCB04CDF356B11E3EA96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630141, "uuid": "87a82a33-dbf0-431b-ac1b-155dc195a186", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630141, "uuid": "f2ff0094-054e-43c7-8ddd-9f76c9716cfa", "value": "1572864:3W7mT8Psdhx+WQXmyAj+cCWgAv3M5J5ilWJ0bsbvmqEN4BkF1EZDOsLh:KmgsMPXmr+cCWBv3KCdb4p8sLh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775630141, "uuid": "b6ea27b2-84a2-46a8-abea-341acd4eebe7", "value": 84950408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775630141, "uuid": "8626df3c-1a17-4867-b672-57741b8e6c11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630141, "uuid": "0903711d-7640-4acd-ab0e-890ee88f6e37", "value": "8994d6ba13561a3fca2fca333213a65b7173103c646416508b6755d500ad52e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87573ab3-338c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775681408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775681408, "uuid": "fa59a05b-9572-4a38-b8af-8ac04eb74060", "comment": "Malware payload", "value": "8f225e1d533a481e184525e2312a290c", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775681408, "uuid": "8aaa5014-9e1d-4ce5-b05e-ecc4ffcc9d4f", "comment": "Malware payload", "value": "89a7fbc3291922ae7a510754b04eee9113af888686d391619c5329333fcb20c5", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775681408, "uuid": "2ebac2ea-39c8-4800-a91d-e818e050f86a", "comment": "Malware payload", "value": "86daef074a4780442cd9b93a29c2edf38559e018", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775681408, "uuid": "cb7e63d1-26bf-43b8-8fff-e8f3e9fe2212", "comment": "Malware payload", "value": "3773f62a101c1fa74e64b3750dda9fcea80f9a6fb01b5fe2c8a7ef9d9c5ac3857b1e65a1d8710265ae80a7fc7df5ee74", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775681408, "uuid": "432f006d-4dfd-4724-bc25-ee7334cedcc3", "value": "T1F216332A5B56D4FBE0299C738D53E60C1927371588713265BF209FCFAF271A0E2462F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775681408, "uuid": "1e4b1efe-8514-4ddf-8ba0-a1a9f8ecd9cb", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775681408, "uuid": "75cfd558-3d94-4fef-8b55-e2ad0b93f70d", "value": "98304:NsqhjqRZoIiNPPuzgpKHDEXhnPa9L9U6EvrhsdhLsbt:3ARZoIEPBLhrhaFwt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775681408, "uuid": "32b55d95-2d35-45cd-9d72-ec744237e179", "value": 4242412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775681408, "uuid": "0ae269b6-a15c-43e1-92bf-fcffe0d36acc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775681408, "uuid": "f1028f86-3a15-4cf8-be04-ccc0ee091d99", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1822f16-3360-11f1-a769-42010a9c0008", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1775662554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775662554, "uuid": "7a43a769-502a-4b03-9a66-e242cac17cd6", "comment": "Malware payload (Socks5Systemz)", "value": "b7fa71e1cc5b065508a7762d531808d2", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775662554, "uuid": "bd86de44-b5c4-4591-96e3-51f937d3d5be", "comment": "Malware payload (Socks5Systemz)", "value": "8aa42959d2690b4de03604173870f4302df2a953060c068431020bd3e637ff44", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775662554, "uuid": "8dff1a54-1a47-4860-9e94-b8dd54f51386", "comment": "Malware payload (Socks5Systemz)", "value": "2b3a6abe6ccd5ef0688c461c248d5d89959fe347", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775662554, "uuid": "78d74520-c473-4ac7-b63b-35fe6d266880", "comment": "Malware payload (Socks5Systemz)", "value": "32fe744719084dfa40402dff25fd7c341092c3c8a5f640f025d1c39c13b11f3450b90d5bb45dcadefe2eaac387c4e0e4", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775662554, "uuid": "62c5d186-f02b-4b9f-b560-74d8789bf78c", "value": "T10BA43B41B3319092E8D35EB057638B755EB01E082D54B72C87F17B2CE9A1F6ABE0DDA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775662554, "uuid": "f2338ae0-b791-4845-9b81-f6d83389b0c0", "value": "928d0699bc8c6e79f702e49744fd94fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775662554, "uuid": "8f545ff2-e2af-4845-9a52-1bac0bfb0cf6", "value": "6144:a1rcBBo/qPtPmjnASClAJIU15LsMUGtImjC7BidE2/rShWiVkg8yEWrJgWy8PesQ:nmTnCdNlG6yE4WhjkaEwMK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775662554, "uuid": "4409f57c-2e24-4a94-8c08-efaf69e3733d", "value": 485376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775662554, "uuid": "e0a1b3fc-581c-4d6a-af64-353ab39014ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775662554, "uuid": "ec1b3686-2083-4c73-ab1d-df18f8e069b3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4329692-3338-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775645513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775645513, "uuid": "ec0a0cf9-246d-4aba-8066-9f05e7e8c286", "comment": "Malware payload", "value": "bdc3befd090420e398624097e08382d5", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775645513, "uuid": "37b710ed-214f-4422-b582-07949e38ffc9", "comment": "Malware payload", "value": "8abba35cc6efcb85ea18e70abad2c73901d9676a13d451e1a5135a0a949a7a1c", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775645513, "uuid": "6ec9b29e-2327-444c-8b9b-cdc7b001b58f", "comment": "Malware payload", "value": "f4b4b2b1108ee5b9145f0a664b83d2178e23c11d", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775645513, "uuid": "7aaa43b8-22f7-4248-b4bf-02b7894e7814", "comment": "Malware payload", "value": "1d23cf39a09f91a320b9f0a4d6294ebdf195108862e4ba1f28a72cc39bfdc54388fa3c833244a45167ec196f6e983421", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775645513, "uuid": "141d97f1-38a5-4f07-805c-a667c0464310", "value": "T171D321CBC99AC4EC971F602D455FAE02CE4EA513191DC5B2FADDAE853F12C7071AA9C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775645513, "uuid": "f6891608-07c8-4a0f-9690-8b6d6bb89abe", "value": "768:RrNSFzt7pYZyu7o8OG6YHb9qrOVZyK4b12wu6JW7slL9z+sbVj/f4ZrCRlDw1PRf:nCYNDouSwoMHNd54aXMupQyxI5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775645513, "uuid": "7f58ee37-0121-4f19-98fd-0de55008f5e7", "value": 138522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775645513, "uuid": "fa7bfb24-1e1f-4cf8-afa3-038023f0aa24", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775645513, "uuid": "a2216a52-be3c-4d6f-ae69-76d47ccc86d7", "value": "Logs_School__32.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8668e66c-3316-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1775630726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630726, "uuid": "e932d4d7-190c-481b-a93b-2b2b2d51d225", "comment": "Malware payload (ValleyRAT)", "value": "89e11f8b8f81a0a111bc99ba631ca85d", "object_relation": "md5", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630726, "uuid": "2c0ca211-ab3b-44bd-b43e-6f19c80d1582", "comment": "Malware payload (ValleyRAT)", "value": "8b3a49e89932a7c371ceca9ecbc6c0151e38dc97c191f7a0aa92a8baa8b6e8ab", "object_relation": "sha256", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630726, "uuid": "b5a0ab6e-ffe2-458a-92c3-8cbbbfe64770", "comment": "Malware payload (ValleyRAT)", "value": "a2634bc3f63241c85c0c2eb9f2bffcc496ee72af", "object_relation": "sha1", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630726, "uuid": "d199daf2-64d0-46ba-b264-876967b38536", "comment": "Malware payload (ValleyRAT)", "value": "fc7b2a0916b5aecdc12f909c2b3706ca9271c3df52a1934840725ec9c1d3bbf8de82434f72d5aa6b0c27302562813965", "object_relation": "sha3-384", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630726, "uuid": "e47d3d6b-6bc2-4ccb-8dff-def56e4593d2", "value": "T1FC263356E1850329D273C2BA009B0DA82015BD8C8303C53B7979F5569B7A89DBEF3DED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630726, "uuid": "9e8dc2ab-d191-4aca-b849-bd3dcd488dbe", "value": "98304:rZrzi607pGXxse0JtevmB6ZkRdRg4Uag3LCl+Li4e4rS8:9vMmsze2Rdy4UaoCsLTS8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775630726, "uuid": "dbebba76-fb2b-415b-ae14-85b394ae4f0c", "value": 4710400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775630726, "uuid": "71943ff0-a786-4d47-91d6-4dcdb7a50285", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630726, "uuid": "ffaaed39-da1e-4827-bb96-37f18b2821d8", "value": "\u70b9\u51fb\u5b89\u88c5\u4e2d\u6587\u8bed\u8a00\u5305a.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed11f38f-3325-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775637340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637340, "uuid": "6482f012-742e-435b-9c4f-91f172cdd74d", "comment": "Malware payload (Mirai)", "value": "f380c3dc962ef56514c18d20c38c5513", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637340, "uuid": "fb69f6f3-0816-4de7-be84-e816581f7a12", "comment": "Malware payload (Mirai)", "value": "8d098c57a6aa58a9eca8e34ce7c2c6ad68ef3316f9046c367d71162987eff551", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637340, "uuid": "402aad86-dc1e-4f8f-b21f-e7c65396eba7", "comment": "Malware payload (Mirai)", "value": "c6aca84fc5559a047064594423b2c609552d7f91", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637340, "uuid": "47e639be-814d-4a55-a3c3-d3ecf2fcc28b", "comment": "Malware payload (Mirai)", "value": "75ae8f33b7e49635c192436b1b688c64f44bc3f90ec9d27d506ade52c81c1a97fd0e1535a8589d238d7944f3aaf95dad", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637340, "uuid": "197544dd-2ee6-454d-9e54-82a921c0ce4d", "value": "T1A6E329C7F800DEFAF80AE33748570905B630BBE115921B372257797BED3A1991963E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637340, "uuid": "54335d29-2985-4e34-982f-7fe07f9d3c57", "value": "3072:KmzTDH86Jn78rCdV5jAti2id2ow9+aVvjbitLLxGyMYE9j:K2TDH86J5fjAtiHde9+3L4yMP9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775637340, "uuid": "d7824b19-ae44-4489-af9e-501c9940106a", "value": 150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775637340, "uuid": "c457f114-5549-47c2-92a4-6083578d5c61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637340, "uuid": "32ce788f-4155-42f7-9ea0-da9c16eae267", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeb67481-32df-11f1-a769-42010a9c0008", "comment": "Malware payload (Ngioweb)", "timestamp": 1775607171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775607171, "uuid": "26bd6956-60ac-4cba-b4ad-71120da9eb48", "comment": "Malware payload (Ngioweb)", "value": "310c9a2f84d67af11e1a85bbef1fc23a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775607171, "uuid": "961a81ce-9fdb-4644-b013-ae75f370ea37", "comment": "Malware payload (Ngioweb)", "value": "8de4542b0cfef62851ecb166feac5ff4b0f58951e83f0e914ffe7dae90e6fed5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775607171, "uuid": "b91d56d0-01b5-4f87-8745-4f01f3284adb", "comment": "Malware payload (Ngioweb)", "value": "84eff6126c4d5baf5810cb3fecdc7d0daf85954f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775607171, "uuid": "e685540b-20d0-4ed9-80d0-70251fd6cf1b", "comment": "Malware payload (Ngioweb)", "value": "cd3603869831567fb4a831e8f6c3b955bc99282d3527d3f201f5a3e22431dfeaaab1367eb6a7088c85060eea8280d828", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775607171, "uuid": "e358a64d-afcc-4ea5-aef5-5e187a8e8223", "value": "T11DC31892F9909B45CAD06A7EFF8D538D331317B8C2EEB106C9155B2436CB58A0F7A943", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775607171, "uuid": "8775ed0b-21b9-4f00-aac9-bccd1c58f88e", "value": "1536:w0xuUCuAdeywHCB+Dyc4sLOtApGwJV3TkOo7POA3F+G6NKBOImM9kguCnAArwxYS:w0hCqywiBeCwzk/OrGvJxrPfo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775607171, "uuid": "322a6415-713a-4b99-b363-4b850f179032", "value": 124320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775607171, "uuid": "d547197d-c8e5-4a92-aa7c-9d5c0d885c75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775607171, "uuid": "1259218f-9206-45f8-a93c-4651ea7b32b4", "value": "YIJF", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ce822fa-3329-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775638763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775638763, "uuid": "ed5ce6b7-508a-432e-bf8b-626342928b7f", "comment": "Malware payload", "value": "f0039532b1ee743cfbb3fbab0c2121a2", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775638763, "uuid": "260fc302-7cad-4bfd-9c53-24e59a91eb03", "comment": "Malware payload", "value": "8df24453414b49fcf2f5b3880cf3b3eddf9eb1728d2e387c2f420e863ae80588", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775638763, "uuid": "1226a8e3-73e8-4f47-bced-e4d72a7eabd8", "comment": "Malware payload", "value": "ab26a4cf509126b0a8c510b869b0a971ba846947", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775638763, "uuid": "6808401d-7eaf-42a9-a5af-b52e30d766ba", "comment": "Malware payload", "value": "45288966781b6588864e41cb45eefec5a09578119e708ea567a76e55a3f5a87d1cdf8066e9030140e06c4b689215fa28", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775638763, "uuid": "f07ea4f3-15d6-488a-8f6f-e32b1175a4ab", "value": "T1C054E083B7279D6ECD7792760E45433626BB6A12C913A307FC60072C68B72D56F08BE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775638763, "uuid": "280110ae-623a-4de6-98d9-77ee31323b6e", "value": "6144:2K3LuzbcbumnYKd5lYJJ6CRGsjmJTrtHofBlfb6sxrvMgQL2u:DLuzbciI/lYJJ6wjTfBlzlxrBQL2u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775638763, "uuid": "fc0ec2af-7022-43a9-9648-c83be2ffc483", "value": 289201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775638763, "uuid": "4d57779c-269b-4d1d-b2b0-2712887284de", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775638763, "uuid": "c890ac6c-a866-4aae-9086-2b2b84a5cf82", "value": "8df24453_95.214.52.209_616_20260408-001001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47fc9095-330f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1775627615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775627615, "uuid": "4f9163ad-3986-4e14-9b5b-9b802e06a006", "comment": "Malware payload (Formbook)", "value": "4506abb8fbff722201018e3c4a6e6718", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775627615, "uuid": "563dcf66-6685-4420-be7e-81a70f4a441a", "comment": "Malware payload (Formbook)", "value": "903ec037859ba0e1d5c456ffaeb9f1a5c4b111e6bb4e5d62f583a7bc68d88f09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775627615, "uuid": "21a82385-ac70-49eb-95e7-6dc44eb55138", "comment": "Malware payload (Formbook)", "value": "87138e6bdce9b16526080c976bb3b0902b80aac7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775627615, "uuid": "dd2316c2-8510-4f5e-9a98-0921b373ffc3", "comment": "Malware payload (Formbook)", "value": "b3d10cb6a7cea1aa05fe37d5d96f9a7e069c1691079e71afcf23391bfbf3022a5bf0be43b628cc98ea35d6b98f847bf5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775627615, "uuid": "4a4a3b8c-b734-41d2-b724-c8684fefbee8", "value": "T1193512583689C403CD84977665B1F2784B7D1EEEA920D2234FEC7DB7F962F924809386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775627615, "uuid": "cefe0cfd-1869-4bea-905f-e55e6c6beab2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775627615, "uuid": "ffbc6c81-4ca6-4431-81d5-89bf21818dee", "value": "24576:vFdgmtbeMvO6ESpJcig/oRMIVx/n3TBHHyUHTrI5aOH:7eMmwpKdIVxFXHoUQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775627615, "uuid": "406e1f7a-900c-4b94-be3a-e5a87a527d83", "value": 1153536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775627615, "uuid": "58e00db1-7c98-4bb4-b9a7-41226106f264", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775627615, "uuid": "90118bbc-b34c-4663-af1c-22847f673530", "value": "5439286090.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0427fe7e-3327-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775637809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637809, "uuid": "d2334043-2851-425e-910c-ea44098ffb1d", "comment": "Malware payload (Mirai)", "value": "01ae5e6960076c0c97147423c5f26bf3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637809, "uuid": "936f5f01-5002-4a43-85d3-748cc22952b1", "comment": "Malware payload (Mirai)", "value": "911cef66ae56f99dab8c119cbb9cb500f082a60f2e839d70b795369ecd2770ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637809, "uuid": "9aacd6b0-ebfb-4297-83ed-bfe78643df86", "comment": "Malware payload (Mirai)", "value": "11b5a9e7d506d38781ffe7a6494d81b459aaf0dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637809, "uuid": "b177e733-25b7-4e63-b517-34d9687bcf83", "comment": "Malware payload (Mirai)", "value": "5cb48f454d7d2a636cd78ef45835ccedeb89c9ae87a138b5e1b8f98c7b699e319282d9cc6e33b3b8553c6adaaf83804d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637809, "uuid": "46c97374-939c-46be-86d1-8dc2e94f952f", "value": "T141F33B47B7208FB1C368967109B3CB67A6E6269216E19985E66DCD107F3035C6C3FFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637809, "uuid": "e159ad8d-bf56-4d60-8ddc-d5c5c3895228", "value": "3072:93VJgTdgahP/2o/ZrTheIsnjCWRXFm4UpM1wLxpPNNOziH8fam:9FJMgWPZr8IaCWReS1WpPeF7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775637809, "uuid": "fac7a5ee-23e7-4a0c-af5c-7b008d8386df", "value": 166976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775637809, "uuid": "388a142d-6094-48cd-9cda-9bba2e9f175b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637809, "uuid": "5a92e2bb-b2cb-443c-ad07-7f77c7eae252", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b61969ed-3326-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775637678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637678, "uuid": "5de099ab-2764-49bf-ae9b-89a3cc0d76fb", "comment": "Malware payload (Mirai)", "value": "75de88b5e113bb9c57c89a7d654cc430", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637678, "uuid": "c68879fd-cb43-415f-b75c-de9fa0726854", "comment": "Malware payload (Mirai)", "value": "9133da50c4671f22fe5daa372632885d59a7d33ec2638d6b818b40533503634d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637678, "uuid": "af5b7118-cc71-419d-8ca1-efccda03875a", "comment": "Malware payload (Mirai)", "value": "1a73e8dbed7ad05991af6fd2b31ffa7c2ea166c1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637678, "uuid": "20f1e280-3206-4990-b08d-7f2c9a6de337", "comment": "Malware payload (Mirai)", "value": "9747947bfeca896558ac234703a608323fd5e6f5faf2fe705b96f6efe0e71dfb8e3fb028a2ca8f4cd57aac6e41efb493", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637678, "uuid": "f3f1809b-dda8-4318-b977-81f637ef4f25", "value": "T195148120FA0663B1CC731A34A79A2E5A6E7704559FEB26312D1F533CDE628509B31F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637678, "uuid": "bf2c8d4f-55f7-422b-90ee-501cf48d75d3", "value": "3072:IcHZcggt1NJmeDQBwnKUDMaVsb3pjr1lCRIUKG:IcY5JpMByVs9jSXf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775637678, "uuid": "3628a46b-89dd-41e8-b0c3-4e55eb4ac76a", "value": 205416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775637678, "uuid": "a60d8a37-b521-461d-bc6c-254afdfd9a72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637678, "uuid": "8659e29f-6286-466f-8a44-6d2e4d4c33fe", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca0ff2bd-3321-11f1-a769-42010a9c0008", "comment": "Malware payload (VexxStealer)", "timestamp": 1775635564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775635564, "uuid": "fc917c48-882d-4916-b513-c4b74f5ad4b9", "comment": "Malware payload (VexxStealer)", "value": "ec128d6e20d6f02cdf8741af95962169", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VexxStealer", "colour": "#10C996", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775635564, "uuid": "e554cf6c-0a5c-44c1-b46f-4c6e8fb31da4", "comment": "Malware payload (VexxStealer)", "value": "91eb02ddd9e77d735f97aa976eedb44abcff01bf6f7028cd04535dcedb99fbd4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VexxStealer", "colour": "#10C996", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775635564, "uuid": "e91a9e09-e451-4847-ac9b-3087e9ed18e3", "comment": "Malware payload (VexxStealer)", "value": "47fcd001fa2d3ee7321846cee0dd4b249a464ea1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VexxStealer", "colour": "#10C996", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775635564, "uuid": "64036bf2-5064-4666-a3fa-47be36539cb3", "comment": "Malware payload (VexxStealer)", "value": "b6dbc9029b996ba9d51fd9b823c8d0a79ccd16bdea8c3618b44a2bb6491a1eaed46c91f1dca03d516ded5c72a9af06bf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "VexxStealer", "colour": "#10C996", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775635564, "uuid": "310358c1-3c0a-4fc4-af51-3374450e73e3", "value": "T124C512872FF52CF622A3D76E165BEB76D6025FB1847264CF30C20BD7534A9064B86A07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775635564, "uuid": "b87cf4b7-11da-4899-b9ec-fc04ebdbf0e4", "value": "24576:5Rywm3ZXD5mRaEjIwslHbvGTZLOcbpf3Vh+425gVMNyuaN0G2BuBVlHAE2Ldbb6A:iwmJERJshlOj3rz2Fgf2BCVjGX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775635564, "uuid": "61f0d96e-27a3-4b14-b7f5-fba80fad4f04", "value": 2545502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775635564, "uuid": "e6fa898a-79e9-434a-aa44-5239ae943e3f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775635564, "uuid": "7fd8b264-f255-4386-9a2f-15770408b01e", "value": "9fe80705f1fc37d5.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d21719a9-3383-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775677668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775677668, "uuid": "d013bf66-8f0f-4182-82da-f700ebaf9c68", "comment": "Malware payload", "value": "382289bebfa0f1215017c1bba04115ea", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775677668, "uuid": "f7571d9b-3261-458a-a38c-a91be589fe70", "comment": "Malware payload", "value": "92707708e5a81495251ebd6f962cebdcc9e2bd2b210b16838b31501d1bed2aaf", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775677668, "uuid": "a12f110b-3dd4-430b-9b78-75d6b4af8e11", "comment": "Malware payload", "value": "b940c50c209fa4f60c4a1b4e6daa01d2ae3532b7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775677668, "uuid": "def5e0b5-b91a-4f64-b7ce-3d97322d4323", "comment": "Malware payload", "value": "6c59a130aad21c4028523ee34b752b5086a097f2a3543e2f6a9a455ae711911c34a2c935852603256c49202498aa3ceb", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775677668, "uuid": "27f0eef4-a58e-4cb3-993b-7bdd4fb10640", "value": "T1E112EA8276C9D906E029BAB6CF3BC7888751BC649F97830F34A67B0F29B0C804E59755", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775677668, "uuid": "d45030c3-b54b-4eb8-a541-c6a68ffb2160", "value": "96:1REudfQ14udfQ5OdRlcCM0clNSdmZ8PKIuWwO2cWJWi:8ulRulSIaCtUNSdmZ8zurFcyt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775677668, "uuid": "ccf5faf5-556e-4004-9605-6ef806f80283", "value": 9216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775677668, "uuid": "355a7908-a2af-4143-bcdf-43ffc0042aad", "value": "application/x-ole-storage", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775677668, "uuid": "3f448f0e-0ca8-4fca-87cc-4a126f760114", "value": "Ole9142.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01dd82a7-3336-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1775644247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775644247, "uuid": "1c29e277-54f2-475f-9580-b7c08231cdc2", "comment": "Malware payload (SalatStealer)", "value": "4c1b0a582936fb2d1e246b0dd56c7428", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775644247, "uuid": "e74ca0de-1686-46cb-b9c2-3b896ec0b011", "comment": "Malware payload (SalatStealer)", "value": "92ec547c8088c16ce334e793d587e7e1b4b4e1d44460dd02f67302d9dc9b1969", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775644247, "uuid": "65d0534f-eb54-46ff-8431-ee90e85a5987", "comment": "Malware payload (SalatStealer)", "value": "9ba59db3945e38fcfcaa70a58321d28b018a0a1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775644247, "uuid": "c9e1bad2-7f34-419f-87e3-150a14cdb126", "comment": "Malware payload (SalatStealer)", "value": "95a15a14bd0d412a5ec3864d1d6e043d55b18e605273d5c9e838191d3c25b1c8f6cb2a1969d2cfc1218555297cb3ec79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775644247, "uuid": "c4a75864-d3c3-4d41-8f41-3888975b7b04", "value": "T178C65C11FACB54F6F9036831416BB37F23315D048B28DB9BEB583B6AF877691186A305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775644247, "uuid": "1734bfcf-bcaa-4a8b-b4d0-01b14554883c", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775644247, "uuid": "4a2815fa-2bdc-4693-ab22-64af11250c99", "value": "49152:mpXZKft05HtyvruRo9JBDRHCTdU391KX1NbNV4L6d+NTPeGFPbQuhHEPAw8sWe8p:WZ0tkRorxxCO3ukFJFzAocf47eEl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775644247, "uuid": "54c69e76-9900-40c5-b437-04ae4ea357f5", "value": 12570624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775644247, "uuid": "6c40a11c-3585-4b9a-a121-73151c535bf0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775644247, "uuid": "fb341231-c1ec-42df-b672-10cfcc3ac485", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e780a0a9-336a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775666966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775666966, "uuid": "254306c4-fc1e-4c89-92a2-19817094202b", "comment": "Malware payload", "value": "9210d45827b893c515e961d3008b4fb8", "object_relation": "md5", "Tag": [ { "name": "BlueHammer", "colour": "#694307", "exportable": true, "hide_tag": false }, { "name": "cve", "colour": "#A81113", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775666966, "uuid": "cf1f3704-4071-403c-accd-bc53f2ca02d4", "comment": "Malware payload", "value": "93008c42764b74b759678fd376abd90696f74af408600727b6649286d8424270", "object_relation": "sha256", "Tag": [ { "name": "BlueHammer", "colour": "#694307", "exportable": true, "hide_tag": false }, { "name": "cve", "colour": "#A81113", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775666966, "uuid": "3e372307-4fbe-48fd-af9b-a0d2859e2bb0", "comment": "Malware payload", "value": "a6ddb1c5ad6a1e16c0f92fc2c967dca3c979a2cc", "object_relation": "sha1", "Tag": [ { "name": "BlueHammer", "colour": "#694307", "exportable": true, "hide_tag": false }, { "name": "cve", "colour": "#A81113", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775666966, "uuid": "b8fa0c0e-1a48-48bc-a297-d94a39dd5296", "comment": "Malware payload", "value": "5c2a987ba2c59430031fe37af605e124a3d8749f4db2402776a8d8daf8ffcfcaee9cde201d4fb72971557201dbdfdfdd", "object_relation": "sha3-384", "Tag": [ { "name": "BlueHammer", "colour": "#694307", "exportable": true, "hide_tag": false }, { "name": "cve", "colour": "#A81113", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775666966, "uuid": "2172aa11-2d2b-4cd4-8a5e-928b4cd76ab7", "value": "T16B843A16F74120F9ED3BC13E865B8565AF62BE390391C78F121442165EB3ACA1F79FA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775666966, "uuid": "1619dd00-84d8-4c2e-a9eb-bc28cf27076f", "value": "b29e03e462b5c6f15c11504694bc3422", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775666966, "uuid": "adf83b58-4cf3-4afc-bb86-8b3a9da17e89", "value": "6144:9Y7pQMlUKsL6AS0r2EmuPbrDM0wpGvMdCa6uZPNrDM0wpGvMdCa6uZPCh1LE:9YFQMlUKsJr0uP0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775666966, "uuid": "955b68fb-b33a-449c-a02d-4bcf4ce25fad", "value": 388608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775666966, "uuid": "29eb9072-04d1-4842-b72f-e9883fa51d46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775666966, "uuid": "83442dba-6c4b-4fbf-89fd-53bde5f834e5", "value": "FunnyApp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8336ec3e-33a2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775690850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690850, "uuid": "332b6d50-08dd-4cb4-90e6-e2cffebe3aba", "comment": "Malware payload (Mirai)", "value": "8af7b6d92cb7def7b814a0d2a33f76b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690850, "uuid": "a157121f-16a9-415f-987c-f3b4497a396e", "comment": "Malware payload (Mirai)", "value": "9456e3e227781f53f244346aecbba6f4577e8cf238b0f44cd584b5974c59b229", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690850, "uuid": "b6ea920b-fedf-4379-a06a-cb2538831345", "comment": "Malware payload (Mirai)", "value": "ec036b2f243aa57c93a7cbe122f40d54b8885376", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690850, "uuid": "f5ddf137-3f73-4172-8971-79424d93de88", "comment": "Malware payload (Mirai)", "value": "17a9341ba08e37bb59e2a38cb8978946f7518c5d0fe72eefaf0e1ca9c0f8b0d479acc381cab441f130461b4bdd63d3b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775690850, "uuid": "f1d14edd-a8c1-471b-9601-4d046c22d157", "value": "T17E530985B8819A25C6D113BBFE1F018E3316576CE2DE73129D141F647BCB95F0E2BA0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775690850, "uuid": "aa90c04d-8e09-4c80-b8c4-3ab013d0c7ae", "value": "1536:wdnIYoZXnYkTAcASlquASGAFzVLl1kHQwOcL/IBikcKJKWx:FFnRUcvlqBuhLlUQcKJKWx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775690850, "uuid": "3a0c0893-1654-4ce8-9660-572c74f98af8", "value": 66688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775690850, "uuid": "1700dca7-241d-4be7-8972-439e8fbba456", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775690850, "uuid": "c5182f4d-7ce7-49d3-bce7-50635d34e0ae", "value": "Josho.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84a5811c-3363-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775663794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775663794, "uuid": "d67ecc75-d203-44a5-9d6a-30029272cc1f", "comment": "Malware payload (Mirai)", "value": "ee02b0011b5eb72b91fa0c226ccddb7f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775663794, "uuid": "e2183e88-0754-413d-8316-ef708e49dfef", "comment": "Malware payload (Mirai)", "value": "95c80388c46fcb614247786f38d757df07554a96f094a7abb0b9934b5f43a310", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775663794, "uuid": "31515b32-5ce3-484a-9e88-cf88ebc10bf0", "comment": "Malware payload (Mirai)", "value": "7de68b30a0c6eb658b672c4d64658b2d3b82c5df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775663794, "uuid": "72aea19c-dc2d-4a1d-b300-28c64326dc99", "comment": "Malware payload (Mirai)", "value": "d34708958320c3fe62d4e3eed8dc7068120bd6a65bfbdcc5d7d83d5835260113acd03dcacde18517a840ab45f7a4b8b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775663794, "uuid": "859f59b9-a5a2-497e-944a-8ed383d97435", "value": "T113E35C46FA808F13C4D5277ABAAF42493322A764D3DB73068D189FB43F86B9E0D63515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775663794, "uuid": "dc795a45-d270-4829-8481-04d55f98b59f", "value": "3072:vSziFXtZ8QT0u9tHyUsh/2x9ytp06S/KaM/9Z9sIl3:vSzKZHT000Ush/2xgtlS/7M/9Z9sIl3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775663794, "uuid": "1de28ba5-d4ed-4bb6-a2a5-9f3574718be7", "value": 148397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775663794, "uuid": "ef9d51c8-ddef-4dcc-80d1-6328ef9edde7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775663794, "uuid": "f90d3dcd-027b-4b05-b274-56abc22aca36", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e3bee4d-3374-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775671004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775671004, "uuid": "5203ec07-9aac-44f9-8a9d-326823e2dc31", "comment": "Malware payload", "value": "bff1e6c7ec8d15c2a41624c0cd3cba0d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775671004, "uuid": "d7e297d6-85ee-4ad9-a710-c8c7c3e9fec6", "comment": "Malware payload", "value": "9766b48c68fcd4bf7a7cbe6a0a32417d0a2e0ea2b7ae002c4030436059f5b913", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775671004, "uuid": "a59428dc-79d2-4325-955a-26c7d4afaa11", "comment": "Malware payload", "value": "efd6eb6cbc78b67f1107857dfa9cbc979979b327", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775671004, "uuid": "c5df6342-74ca-4f30-8e79-5f0267a7ee06", "comment": "Malware payload", "value": "76f50771acca81010c63c4e4cdb284a533f401170523c4ba750f0e93cdafe9636069040a71f7672468db1a1c86bba97f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775671004, "uuid": "9885292c-7fbd-4828-b797-2b316b719861", "value": "T1E09597081FEF84AE35A37E5145E0526B5A7BF6BB65718B8F048103CD07B3608525EFBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775671004, "uuid": "84f41854-9eb8-4e4b-a87f-217d90ab0393", "value": "12288:lq/EGTL5jUOE2Xp6jRpr2XFQewA8wVbYYj44/EzQ:lqMGTVUOE0CrmvVbzj44/EU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775671004, "uuid": "39e7deb3-0922-4658-b859-e1ddcc9334b1", "value": 1889010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775671004, "uuid": "e3bc271d-b102-4c0a-9fc0-b7bea5833b61", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775671004, "uuid": "8f22d8ae-03e1-4d6d-8b5a-5bc58fceee5b", "value": "33333.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c08c16ca-3326-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775637695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637695, "uuid": "5e8aa7b3-d749-46b4-8519-8a707de95690", "comment": "Malware payload (Mirai)", "value": "e345fb109968e09120d63fea4370f166", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637695, "uuid": "4bd9c3e0-6409-4f75-b08c-0ebcc45db7da", "comment": "Malware payload (Mirai)", "value": "980eb1f6edb56757e2f39d4b4468e053cd25e5ab53be8e7ac45f0a42b046f7bb", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637695, "uuid": "6f00579b-eb9d-40ca-96b8-8cb474637fe5", "comment": "Malware payload (Mirai)", "value": "27961d61338b5c8d9952f8f675b05234cf953427", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637695, "uuid": "207e9798-d3c7-492b-93e2-8e88df837690", "comment": "Malware payload (Mirai)", "value": "2de8dcd0a674f234e65ac3297f03fc9cedee27cf0ad95195f11e64e63f4b7afc46daf04b480829dd70db21fbf671b19e", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637695, "uuid": "cf396035-05c7-41e6-b722-ab783eecaa41", "value": "T1515302416A7CE93ECED3C5390F6841B686C999A49453901F43CD7DF48A06C68FAEC5CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637695, "uuid": "d7f9eeff-bdfa-439f-a68a-073a04f6f3e2", "value": "1536:0dcqm5iERozq3p7o8FwOA4zCKOFGUfKbeH6UhV/kORevRAQ+:0aHJgMo8FwOA4zUFGUO3UhSORJQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775637695, "uuid": "033cd510-867d-4e8b-b01b-a90224f3822a", "value": 63936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775637695, "uuid": "8c9abda8-02ff-4ec0-a510-b3b71a0dff52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637695, "uuid": "c010d671-7db1-4d41-a1a1-5689647ecaa9", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fdfbda8-3352-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775656431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775656431, "uuid": "134a02e5-a743-47e5-9d57-f6b70827bb01", "comment": "Malware payload", "value": "cf6c0214e60511d8c01ba66848e9766d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775656431, "uuid": "728b9182-4d25-4a78-81bb-da4424cbe2cb", "comment": "Malware payload", "value": "98554dc5049ceaff62420c497a8db8badd5ad0e439b683546587743698603d66", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775656431, "uuid": "3efcf047-8b9f-4a1d-9938-6023a90e129c", "comment": "Malware payload", "value": "817fe2654597eb36606b4d2392dea426758ce97e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775656431, "uuid": "7658d7be-6261-4e53-9d49-1661e4d3d0eb", "comment": "Malware payload", "value": "83f35766ad1d52d7c1810dea8f8b91e185641199e3dbb21fc3407f5b825d55034cf7bff8bb730b054075b8bd26a7f023", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775656431, "uuid": "f97ef76f-8475-44d8-8b6c-5089d7b852c6", "value": "T1E5E59C0BBCB109E6C4AA92328D3652967B71BC440F3253D72E50B6782FB7BE49DB5704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775656431, "uuid": "c6f42262-d9fd-4b74-bbd1-391a4c55f4a8", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775656431, "uuid": "e951ccab-a0c0-464a-9bd3-06a435775014", "value": "49152:vqmM+dGW8k+UgoczPK1q5tjndRkcSApg5X3nZQxG+8BFm0+:vqNWeWoe5z+O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775656431, "uuid": "591d81d6-1194-437a-a16a-a7ed0735ad56", "value": 3200000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775656431, "uuid": "eb76360d-e089-4338-bfda-96840886f189", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775656431, "uuid": "49ac2f4c-5c30-4515-a661-5e7fdc1691a0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b005c48a-3326-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775637668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637668, "uuid": "b357a068-eef0-4389-9f6e-8121ffdfd8c8", "comment": "Malware payload (Mirai)", "value": "61a4f3af555b6e8d057001bb65a7a878", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637668, "uuid": "90c9da9a-5e0d-4ee4-8e73-b764dd99f505", "comment": "Malware payload (Mirai)", "value": "9922ffcc191ce5aa9253ee12787ff1cdacfd734c2f7466c2f7ed6ee519c9e3fc", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637668, "uuid": "a4737a70-b3bc-42ae-a308-9830feb93a6a", "comment": "Malware payload (Mirai)", "value": "e4da38d92b351c56b939da0ed8e896b67dfc04b5", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637668, "uuid": "357b0a9b-4080-4054-95bf-46379f62a11d", "comment": "Malware payload (Mirai)", "value": "a9e403faa902d06379b7be628513ff1228ef79e3c7d573a98529af229abf736595f46932b0b6dcaa8f61ad2837d86d43", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637668, "uuid": "45ba76f0-736b-4988-a190-ae8a14a8cdd4", "value": "T1B0631246FFCC5F9CACD927F807B975DA2391E03584B741F81AE6498881AFAB011D98CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637668, "uuid": "274d4d5b-a379-46c3-a5a1-a0d885d20a3b", "value": "1536:A7MbwKNGjjH+Xq34n/q8Zu41zmX3sD6WqMATrPH:A7Mbp2L+Xqdfoz2s1wrPH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775637668, "uuid": "09752e26-a637-4cfb-b704-1434a6e1cadc", "value": 70860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775637668, "uuid": "6fbdf8ff-6eb2-4ee0-ad2d-c574ac0d5e9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637668, "uuid": "c255c179-6e35-4855-82e5-7a9583311b3e", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e4734a9-33a2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775690868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690868, "uuid": "23222704-a8d1-4469-8500-a954f0546350", "comment": "Malware payload (Mirai)", "value": "3022c5850d438c49353704e53d82296f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690868, "uuid": "b42ac53c-bdcf-4802-b146-1b5b42bd268f", "comment": "Malware payload (Mirai)", "value": "998317e2b3335257462c2eac70aeedf289157414787266ae1d6a381d4bc68c48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690868, "uuid": "77d97256-83ef-4b9a-aedb-3cb4d3b09ec5", "comment": "Malware payload (Mirai)", "value": "f357dfb1c2549bd57d7f6b8ffe3a76bce3729072", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690868, "uuid": "ddc41b02-5338-4119-8634-afbcc6a442a3", "comment": "Malware payload (Mirai)", "value": "834970bb5fdaf86b7b31a68c7985339521cebd57c300a2bf7c1ab6e5859cb256f460aa2bfee0689aefc7742c13be9690", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775690868, "uuid": "4d925414-0802-415b-b425-6e84d8c138dd", "value": "T13A338DA6D5BDEDA8C1544AB87D258F389B73E00086533EFAD644C65A8047EECF1593F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775690868, "uuid": "17747900-8983-4212-840c-03b5fc9aa519", "value": "1536:5aR5ewtQZBt8GdcPs3q/aKlMLEm0DOFCn:5k5eDH2P+qiK60CF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775690868, "uuid": "6f8a96c0-931c-47b6-bb16-17f951ed3deb", "value": 51336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775690868, "uuid": "fe517800-698a-47f6-a68e-010e98bd7672", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775690868, "uuid": "ecf48180-1b64-402e-903c-5942a9538342", "value": "Josho.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef59bccf-3364-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775664403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775664403, "uuid": "f999c609-d1dd-429e-bd05-80b1b0f7aae8", "comment": "Malware payload (Mirai)", "value": "da469f51f84614d53da7411558b426b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775664403, "uuid": "4cc26d4a-fa5f-4c7d-aeff-e7de654dd601", "comment": "Malware payload (Mirai)", "value": "99be3e90783b168d17c5f8b873d6155abd988815a4efdf20006d6380c8a2a178", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775664403, "uuid": "3ea39497-5e2e-418e-8c5c-5a6adbe1c254", "comment": "Malware payload (Mirai)", "value": "4333c917264b10a6ef1ed3f84702dc875f08e4d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775664403, "uuid": "425c7c49-6c12-4b77-b10d-a12abfdab527", "comment": "Malware payload (Mirai)", "value": "36a42c03e24005ebd0d3942d0f0132e2e86451a29a2d015a07064c7f3cac61b4e30f5ecee9d11d2fb9845afa9e77fe70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775664403, "uuid": "3ba2b144-1498-4253-944d-0936c9ff2122", "value": "T185732AB41A96B27CEDF140B8F85720D624A20A1C3BACD2E3A5C7503AFF75B0C7169D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775664403, "uuid": "76a61187-e69b-4ed3-95ae-9c6bd4c8e617", "value": "768:GgUWix2EZgU/5h2hZg+OTvKZg0Kn13NZAf+/W4LzLU8JIoPiWs4ldX2ZvB:XUWdEZgTAjTg23ZAf+/WSJJXPih0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775664403, "uuid": "9b90e83a-d4ee-4882-9368-6c1415a340b9", "value": 75132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775664403, "uuid": "2eb89245-96e8-44d7-99e9-228220cce8ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775664403, "uuid": "7c92297e-9357-4b82-8b78-54e4c9e2073b", "value": "db0fa4b8db0333367e9bda3ab68b8042.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe5037e9-332b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775639946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639946, "uuid": "39fe251f-92ab-45ea-ba01-fa173542c79c", "comment": "Malware payload (Mirai)", "value": "a48ad952128ed68fc274363bd4063648", "object_relation": "md5", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "drifter", "colour": "#FCE0A1", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639946, "uuid": "4d415888-226f-4bd9-b2e6-af31e1d78624", "comment": "Malware payload (Mirai)", "value": "9a28696774d9ef6754540633daeef668767df5efa1804138abd35e1a6b31523e", "object_relation": "sha256", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "drifter", "colour": "#FCE0A1", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639946, "uuid": "f6d7c578-c77f-4cf3-901b-6f6020935d34", "comment": "Malware payload (Mirai)", "value": "acb83c46d6a2014d96ce74a98255b9b2409a8b08", "object_relation": "sha1", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "drifter", "colour": "#FCE0A1", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639946, "uuid": "abda9032-caf8-4089-b84b-d638b5f3d108", "comment": "Malware payload (Mirai)", "value": "0ef84e524ae4a1057a58c11231dc423d04317db49bce3b5c5c17e8d0c995ec3e2fce114046cb70886363c23a444dd4a0", "object_relation": "sha3-384", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "drifter", "colour": "#FCE0A1", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639946, "uuid": "bf6aa23f-ae54-47d5-9891-751e51202e41", "value": "T1C4743B65FC819B51D6D16EBEFF2E824933130B78F2DE7222AD155B34A3C785A0E7A401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639946, "uuid": "722521cc-c211-4238-88b7-5be09773479f", "value": "6144:vLJtdJ9R2fkhHNeLc/WcTDCqGkghoRO45DuuygWe9OiFwBld4z/tRpZ4wgZOyapD:TJnJ9RukhHQLcO+GXoO45Duu9We9rFwo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775639946, "uuid": "7491353f-b32d-4888-a439-d71411c5c736", "value": 338228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775639946, "uuid": "e30ad55d-e575-47d3-9ac2-6cd76618360b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639946, "uuid": "28a5123a-cc83-4d78-8d6d-a2aefbd24336", "value": "deepfield.so", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2f4ea8c-337b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775674180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775674180, "uuid": "9abc210d-b374-465a-8e1b-fbc154644471", "comment": "Malware payload", "value": "0762b9d73229f854d0e9d40dfda0d510", "object_relation": "md5", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86", "colour": "#9A8E4A", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775674180, "uuid": "f9349469-6532-41da-bd3d-aa4b9e43f383", "comment": "Malware payload", "value": "9b6531cd6e4acf0546fa6df72b74874523e65338ff2605c748c70f0569771a2b", "object_relation": "sha256", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86", "colour": "#9A8E4A", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775674180, "uuid": "ba5da1a9-0251-4d51-9390-5d78beaeeb1a", "comment": "Malware payload", "value": "3c558856361c4a0f26dac0e5446e0498a8776e3e", "object_relation": "sha1", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86", "colour": "#9A8E4A", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775674180, "uuid": "8c4228d9-a087-4151-bd4a-c527026cb60c", "comment": "Malware payload", "value": "4f134191a679781b3dc1c179258cb63af567062ff713ad40705273d4f074955134826b1dcda4f280bc2f5aafe7478aa9", "object_relation": "sha3-384", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86", "colour": "#9A8E4A", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775674180, "uuid": "eaeffcac-9e5c-4f9d-b278-ccf0664d2f60", "value": "T141756D43E2A620ECC05FC170975B6722F93174055B38BDFB92D0D7352AA3E906B7AB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775674180, "uuid": "c1ffd296-7a3f-489d-b461-e6a9b5f37168", "value": "b712b3f1f6f5dde070c523d4407e5a3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775674180, "uuid": "897303dc-979d-47be-98ae-303ac072fa8a", "value": "24576:ids9Esxlce6k91UOld2LMxmeDozCMZyFF4TEymOCUwPP3uP:idaEglcAHNaYczY3yL2PP3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775674180, "uuid": "026475eb-961b-4432-b39d-22670704fc35", "value": 1566208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775674180, "uuid": "8121b622-99c8-4f2f-a3cf-4b8a52111fb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775674180, "uuid": "c30010e9-5e9b-4d2f-a769-f6bb554e0616", "value": "f_ex86.node", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74261a9c-33a0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775689966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775689966, "uuid": "34875062-29a9-44f5-9eb0-25a60bb960d4", "comment": "Malware payload (Mirai)", "value": "4dc3ec5bf3e0c1ad0f72a77b33a24847", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775689966, "uuid": "e22c2bb2-e662-4939-b82d-0adb06294848", "comment": "Malware payload (Mirai)", "value": "9d36aecf683aea4077b365d5136374eb3a58b79e208f86a8a5885d7534b33ea6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775689966, "uuid": "373a811e-72d0-46fe-9cca-766092ff9001", "comment": "Malware payload (Mirai)", "value": "f53d7c1284b40f74dca6efa4488a39c3fb8cc2f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775689966, "uuid": "3aed65ae-8dd8-4e81-939b-3f5978a73778", "comment": "Malware payload (Mirai)", "value": "95e39262391de8ce652ae56b7c4d1ed67d9193cb6ef5d79897908a383628fcdd39908474883e84e40cc977764770c357", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775689966, "uuid": "f8404b99-7da0-41ab-8ed4-08031c754db6", "value": "T1C7044B07BAD1C9FEC487C1F44BEAA5369D31F81E1539719B3794BEA15F0CDA02A1C620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775689966, "uuid": "1d4ffc6c-a86d-47f6-ad6d-8fc779927814", "value": "3072:Otm11asN8Xhm6AMOf8nSjaZX9WotW+5reIivW1J1FkMuMevNSDd4An9DD9O:Otm11asN8XQ65Of8JBVMILhISX9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775689966, "uuid": "fae17350-7337-4a8c-83c0-70c0d4affdf0", "value": 182896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775689966, "uuid": "fa3c9a3d-5bb0-43dd-8945-3165886a3fa8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775689966, "uuid": "1e9b84a0-a1d7-4980-9b35-9c10cea20bf8", "value": "nx86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d100ed5a-32ea-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775611953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775611953, "uuid": "d8fc0c13-334a-4da9-8cb6-30b89265ed1e", "comment": "Malware payload", "value": "c87db14b102d98e6e225cfab157c8868", "object_relation": "md5", "Tag": [ { "name": "177-136-230-88", "colour": "#346922", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775611953, "uuid": "51f014df-2bb4-4245-a8a8-db2cc1f799cd", "comment": "Malware payload", "value": "9ffdbc990c92e9564bbf8dd727c2540f60aa18868c463e81e361069ad5e53938", "object_relation": "sha256", "Tag": [ { "name": "177-136-230-88", "colour": "#346922", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775611953, "uuid": "8de78dfb-8ced-4367-91e1-af1fab534e56", "comment": "Malware payload", "value": "7878fc9ffd3996be6bb1320d3933346d5d297f57", "object_relation": "sha1", "Tag": [ { "name": "177-136-230-88", "colour": "#346922", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775611953, "uuid": "106e027f-d180-4276-b8aa-b5118b2525c6", "comment": "Malware payload", "value": "439e63f45225f0fa35d78b91d233773e19a358b5c6b728371ed15693173f994b792b1734f51f86f76ddeaa702344e9df", "object_relation": "sha3-384", "Tag": [ { "name": "177-136-230-88", "colour": "#346922", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775611953, "uuid": "2ef0871a-a4f4-466f-b9c8-51a306acd764", "value": "T1B011E10651C58367AB2B90B1D6123A12A19EF24E043DA840EAB3A055DD5538CFBFCFD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775611953, "uuid": "d1299dab-da47-45e1-9979-4a6d4d55c5b3", "value": "24:ppzHO3I8MhyCiBH2ynlVvEUujuE+8VUrA:ppCI8KqLPEU8r+8QA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775611953, "uuid": "e2ebc12b-d727-43ce-8f17-7097e93b6c50", "value": 951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775611953, "uuid": "42184efc-7ffd-4dba-a705-2d41779e733d", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775611953, "uuid": "0251dc78-123b-4553-a59a-cf782cba7380", "value": "9ffdbc990c92e9564bbf8dd727c2540f60aa18868c463e81e361069ad5e53938.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1e5e70a-3316-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1775630879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630879, "uuid": "9ca7a977-2730-4a6a-a0d9-cae9d8f16ea1", "comment": "Malware payload (a310Logger)", "value": "f3ebf7e999ee97c1e38b7f332fd2f402", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630879, "uuid": "b0c41fb7-c656-4c5d-9140-1ca4b5cd745a", "comment": "Malware payload (a310Logger)", "value": "a096b7182158dccde74c67e8cebdb52d8bccd250ffbd4890f35cfd56265f09f6", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630879, "uuid": "88491516-8b24-459a-908b-8d0162f02d57", "comment": "Malware payload (a310Logger)", "value": "b31a38feef3dd9e48940544c003905af97b661ce", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630879, "uuid": "e44dd93e-9ba3-4f41-82b3-1fdfecfb62a6", "comment": "Malware payload (a310Logger)", "value": "4230a848c6b0a502d8f8fd95e01124c1b1eb6690dcca89d1d04a8c7412b9ab146ff7aaad687edf606b71ad40dfb5c587", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630879, "uuid": "8aa0f422-917c-41dc-b23a-b16164c7c2d8", "value": "T1AE55CF027381D062FFAB92334F5AF6115ABC79260123A62F13981D79FE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630879, "uuid": "a9f2443c-8860-409a-9ae4-d3bd36bfb658", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630879, "uuid": "c8f48ca3-3483-4dbb-a580-0ca59183cb3e", "value": "24576:H5EmXFtKaL4/oFe5T9yyXYfP1ijXda6y0tavJ3Vy0IU4w:HPVt/LZeJbInQRa6mlI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775630879, "uuid": "ab38c712-59fd-43bd-a9ba-4e8a65918ee7", "value": 1324032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775630879, "uuid": "6fed37d1-b6fd-48f9-a32a-6318a73af7f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630879, "uuid": "db19cfb4-0218-449e-a16e-1b0cf53733ca", "value": "BORU F\u0130YAT VE TERM\u0130N.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd0aa271-3337-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775645018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775645018, "uuid": "f98823b5-522e-47db-b0de-e5f83fe32246", "comment": "Malware payload", "value": "da46700f967806d147cd56a94366cf32", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775645018, "uuid": "64d7fc41-9d6d-44b9-b012-611de87ef0d2", "comment": "Malware payload", "value": "a0c3dc8c6d5772befd3f5885703bdf0e9c756986af7185dbca7f44a9c1500808", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775645018, "uuid": "7a19ec43-7f8d-4b00-91fe-98fe97ed8048", "comment": "Malware payload", "value": "84db5b61adc1f973b758665b6782d3d8116297d2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775645018, "uuid": "c0faca59-d300-4874-84e7-4120c48f24ee", "comment": "Malware payload", "value": "b3d4c75bef355161e337f96ae4bfe1199d4743eee9875010026bb5bb9c3c95c07421c7ea43a1f4b57953fa9dbd51fc68", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775645018, "uuid": "afe7bae4-b505-46b0-9599-4dfb093900b7", "value": "T1F8D43BEC31ADB6265EE342F5106F1507B2782823580C8860F121EDBD37B999951BBFED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775645018, "uuid": "45533ea4-3949-4296-91d2-b40c24b37d66", "value": "6144:T69o4f0ENXYoJTwiZ+N30pzozzGql4erLnQEsDFx6FuPuuNp1m8LcgigN2kI/:mZfxNXC930pzoZlzo7IFudN+9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775645018, "uuid": "6af9d946-a325-4c47-9f13-4cafd2a87c97", "value": 612446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775645018, "uuid": "90091c3c-fbcc-40e6-85c7-344251a3b412", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775645018, "uuid": "0171229c-219c-455e-9bb2-629af21b00a7", "value": "signup-worker.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a15fb3d5-3307-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1775624329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775624329, "uuid": "1d4136d0-c74c-4d63-aa0a-0d6f015787c1", "comment": "Malware payload (CountLoader)", "value": "a4dd1fde8a19b7af35e0355459efbbf4", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775624329, "uuid": "8f84e316-72f9-427d-9b77-7cf8024d6497", "comment": "Malware payload (CountLoader)", "value": "a13d177582320fd9879c6bfe56907a59693deac07139fdbffd874b05e4c2fdbd", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775624329, "uuid": "bdcdc8b4-61ce-45c6-98c0-4bc6becc084a", "comment": "Malware payload (CountLoader)", "value": "5d44f15e795c5e9f694695c6e2c2a7f57a874f5b", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775624329, "uuid": "34ff8c04-fe11-4dea-974e-cc3decccdbb2", "comment": "Malware payload (CountLoader)", "value": "3749be1d0025476873095cad6ad157a86347b7b47aa4588f7a9993eabdc790d4b83217ea593cb4661bd7908d0c5d3f57", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775624329, "uuid": "55c15150-abd6-4121-a3fa-db78434d4b0c", "value": "T1D2D30E8989EE88B58B5F6468151F1C038EDDE523031CC9A4BBEDEF583F216B035BA4D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775624329, "uuid": "13affc3e-968a-41ed-8a23-5442a0c86ddd", "value": "768:mMM0EbIhejIgRGQffGwAPegdMMHhJsbxxTQiDU6W6f6D6e6uxQIDx4pLPkTTVKOK:mCEDjp9kLmxugFWL5mbgbQKTTS9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775624329, "uuid": "4d32a9d0-2fd0-473c-84b0-67b0027fb40f", "value": 134223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775624329, "uuid": "b76da43d-6a35-46a9-9e52-3b48aa3f511a", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775624329, "uuid": "4b85b3de-7c42-46cb-91fe-d91bde7d5b92", "value": "Europe_Config_Backup_63.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a21936fe-32ff-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775620894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775620894, "uuid": "93f99fdc-96b2-491c-9beb-f448f0174db7", "comment": "Malware payload (Mirai)", "value": "fa27c733599fd3496cea9521148da541", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775620894, "uuid": "84e802bb-5336-479d-9d32-a0ad694ed91c", "comment": "Malware payload (Mirai)", "value": "a2f32b1077ec80d80bdd22b3bf5a18a950687e2f24c9949af97a4b7068a3c939", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775620894, "uuid": "16efcc5a-c3f3-4725-b49a-98f950589946", "comment": "Malware payload (Mirai)", "value": "4c82df8c299df3058ff3228cfe587697009df8e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775620894, "uuid": "1c9d6d68-c753-4ac4-845c-d5ae571382b0", "comment": "Malware payload (Mirai)", "value": "276923b8bdf6c17ca6dd6c1cc320ce61b6b2934c6ff9665c507db395cb6cf27a1fbce1156d2c6648d0782c74e6f59542", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775620894, "uuid": "60a65255-4ab5-44b0-b20f-4bca27a49259", "value": "T15E436B256A7A2E17C0E4B4BE22F74754B2E1665E25E8C61E7D330E4FFF21A50A0436F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775620894, "uuid": "b477725a-3f57-41ea-94bd-e34b13dd4823", "value": "768:Cuopf8bQPAZqRU+fECeU6tq9bXV85PnXIsf0lkgUI7O+qoSJ/t:CuOoQAqRU6ECeU6tSbXm5PX5If6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775620894, "uuid": "c0c832b7-d9e2-40ec-b8d2-15c0afd5bb63", "value": 59664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775620894, "uuid": "edfac375-f5ac-4576-93bd-c9b6361a7fb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775620894, "uuid": "ed41c72a-eb45-411f-b5e8-4bc2c0f5bf96", "value": "jew.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65099d4d-3334-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775643555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775643555, "uuid": "1adb94cf-c904-4527-b133-05dea3762608", "comment": "Malware payload", "value": "2862d70d255a8a2ba8d6853345adb1ec", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775643555, "uuid": "9c869fda-536e-47a3-b35a-8c596ed27c41", "comment": "Malware payload", "value": "a396f6cf157009f23df13a3c36fe0fa8abc10a5e543a773a13990d09647108af", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775643555, "uuid": "99b1c4a5-00fd-4a67-af1e-f0824721f6d6", "comment": "Malware payload", "value": "2fd09d90b2b7513c72c72e017c102955dced9402", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775643555, "uuid": "ee034989-a97d-4c7b-adbc-4c278fa84435", "comment": "Malware payload", "value": "6de12d0942a72e2c13cd6ab46068f1319daa4fe3445ecfdeaf6a912c8c18da8700f38d4a5629f955c7f07f5794252db0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775643555, "uuid": "3f067607-8f4c-4c62-9ae1-85d1393ac6f3", "value": "T132137D6566913C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C19A9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775643555, "uuid": "1ca67739-f1b7-47ad-a46b-46e75b88c360", "value": "768:bMXRWNGxVO9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bglxJco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775643555, "uuid": "742c15a7-afaa-4421-ace6-1e7ef609e889", "value": 45534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775643555, "uuid": "e0d00c47-8ea5-472a-94f7-85c4f39639e4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775643555, "uuid": "ba2cf388-651c-41fa-994d-5535bf1e1c9c", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2588d09-3325-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775637322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637322, "uuid": "5ab19c84-e479-4ddf-bfc3-535d492c1ffc", "comment": "Malware payload (Mirai)", "value": "787ddaad058ff2cbe39703f6b35cc1df", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637322, "uuid": "6bec321a-a9ca-45e6-b30c-d7f46ff93620", "comment": "Malware payload (Mirai)", "value": "a592f3c098817827d060960a67c6dc349a939a34318e31f75d4baa8fc1418f06", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637322, "uuid": "7d6c096b-83a7-4bd6-894e-cf6c5705f0d7", "comment": "Malware payload (Mirai)", "value": "e9690fa166c3037d4d163b41df80d2a897d68f79", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637322, "uuid": "cd7788c7-51b1-450a-8e81-0734ce65fba9", "comment": "Malware payload (Mirai)", "value": "18ea094cb8d4bb0f4a9b4869f088ba220158dda7deb8f45b3aa928a4844ddaf2d9e12da4cd1bab118e253e868bb71160", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637322, "uuid": "245d56b9-7df8-4200-9b9c-94284dcc31a1", "value": "T1C1E30B46F8814B12D5D111BAFE1E128E37131BB8E2DE73029D246F647B8A97F0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637322, "uuid": "213c19e9-d721-4a2e-b372-1b3501d51bb9", "value": "3072:DHea4CHoUjnwJIXMb6Azz1az/AWdYV8P4KLi:zePCHoQ6IXufzhakr8P4KLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775637322, "uuid": "1c4e3a55-2e7f-4647-9d85-9855062096e6", "value": 144156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775637322, "uuid": "4b16f0fd-f040-410e-867a-ac5121b9b51e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637322, "uuid": "c66f459f-3e05-41ff-991a-1b9d06b8f43e", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ade53d89-3365-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775664722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775664722, "uuid": "002ae01c-5518-46f5-9da5-c1340d4d48e1", "comment": "Malware payload (Mirai)", "value": "77f0aee3932dd2cec5b976aab563e3c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775664722, "uuid": "fc166fb1-992b-4229-aaf1-50f59f016770", "comment": "Malware payload (Mirai)", "value": "a59c8d133818201c35771685508a515b60f153174378d7cc22166375f4d73a81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775664722, "uuid": "170476d0-da32-448d-9c60-f157b8ae024f", "comment": "Malware payload (Mirai)", "value": "324362ea9f0eaffe03f5c5403b0df9d507f733c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775664722, "uuid": "9f68fb24-0204-4677-a1b9-0a0b48214b8a", "comment": "Malware payload (Mirai)", "value": "0cb199ed92c755ae22ddc97f4141d8a8c92be98c5504d03f6cc1bcfb8dcac71ce89b7ba2d541f52ad33326c51a4a9f84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775664722, "uuid": "7351ae62-39d9-4e8e-87b7-1de96c672dac", "value": "T111635D0277680E03D5621EB4293F17E093FEF99021F4F5892A0FDB5A4631E77258AF99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775664722, "uuid": "ec420339-823d-438e-8359-123b2193e528", "value": "1536:UyDcVX+l0BmAqVnOC99w1GcdKeJBhFIMpM:UyDDKy1OKeBFI/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775664722, "uuid": "1ec120fe-2cce-440e-a32e-0878733beeaa", "value": 70752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775664722, "uuid": "576274c8-bd1a-4e59-b13c-50f4bd64cbad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775664722, "uuid": "8ebd4664-0895-43f6-9fa5-c015a6a0a31c", "value": "db0fa4b8db0333367e9bda3ab68b8042.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a669115-338d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775681843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775681843, "uuid": "e5ca3ea2-fab3-4634-8836-b594efa33e44", "comment": "Malware payload", "value": "cc673802f905538a558e38af501a139f", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "stawel-terrae-rest", "colour": "#4F4D1A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775681843, "uuid": "714034e8-6220-4179-9904-7e247b792c76", "comment": "Malware payload", "value": "a5d754d941c88f2fe76a0f2a95f1773641222748288825c7f3cc276365635585", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "stawel-terrae-rest", "colour": "#4F4D1A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775681843, "uuid": "7d30902c-53f2-4a83-b913-7881b16c1bd2", "comment": "Malware payload", "value": "c435ad16c13455bab656d435ae56bbf9f5285e3e", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "stawel-terrae-rest", "colour": "#4F4D1A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775681843, "uuid": "32750338-b7c7-4599-90ab-8146fd7e1245", "comment": "Malware payload", "value": "f91ca65b92e5021a1659adc4245e05e97b962cc212d73602b60914ea9cf020d018cf94c968691adc9926350d0b77ce48", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "stawel-terrae-rest", "colour": "#4F4D1A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775681843, "uuid": "db9105d1-b169-4ca0-9d7a-791eb095a980", "value": "T1B6915E6612B516BDF883B42451482F42E16C6BFE3203D1578C2F9EE1DDC61455E7DE4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775681843, "uuid": "40d7aa27-c7b3-4994-9d95-6eacf826cb8e", "value": "96:znN2Q0cHmtwLqqLmE8j05yQEUzpCM3q/isvVTo6ApxrKyAw9TCHb:pp0cGaOqH605xEUdCaqaS6cb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775681843, "uuid": "0a5d7489-b665-43ba-90ac-e6c1bfdcfa5c", "value": 4582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775681843, "uuid": "86a904a8-6999-4195-abd1-ff1634d01041", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775681843, "uuid": "97f1538a-bb35-4b33-a286-873ea3f4fa86", "value": "09000769.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cd4b7a0-3326-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775637394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637394, "uuid": "2dc3e149-1190-42de-bfdf-d58c4f2bea50", "comment": "Malware payload (Mirai)", "value": "669d11ade50b57d935ca637e028d41f7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637394, "uuid": "a3b1584b-6f1d-4ee7-a96a-b0d1de9e49d4", "comment": "Malware payload (Mirai)", "value": "a72cc34b1661970b7609bf4478c773ff42a98a74e92ef92d6875e5d725a3a6ad", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637394, "uuid": "6a9d6e4f-a12c-430c-9f94-4bd8e644977d", "comment": "Malware payload (Mirai)", "value": "7aa719e7692f3a119848f93ca3cbc013e2858828", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637394, "uuid": "4c4baefc-ccfd-4d5c-840f-d6de64cab5de", "comment": "Malware payload (Mirai)", "value": "7a8697c53a199ccbc3bbe8a09025a2e40e139ec94a4393598471d09073ef78ff697a6a87b5e99cdd14e96875add9fa08", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637394, "uuid": "a625e76a-c8fa-416e-bc1f-d8051444fb8b", "value": "T109937CC0F683C4F6E84305B1507BE7379B32F1B9101AFA43D3699A72DC91951EA1AB9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637394, "uuid": "e4878821-1391-4590-a292-041097234586", "value": "1536:W/QCZaxGdvts3i5JPhoeIxPu++ALtgUIKqI4FrS4LSd:WYCZa8dvm3oJPhTIxP5htSKfUmDd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775637394, "uuid": "4a311584-7500-4c6a-a349-e0d5d4d6a0e0", "value": 89992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775637394, "uuid": "d4724687-5f10-4705-b39f-0de94cecbbe2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637394, "uuid": "a782fd78-324e-4816-a91f-5c3454a0d67f", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a8c51d1-333a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775646141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775646141, "uuid": "12394c8a-d1b8-49d6-a2bb-3477d5b0a4ba", "comment": "Malware payload", "value": "ce0ee61d12ddca2025da616e606a50fb", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775646141, "uuid": "5087eb95-81e5-4fd2-8231-cb39635c4e2e", "comment": "Malware payload", "value": "a79396d637aa5c5b44b0dfad1a2b063a622734d5c1c2288b465c850b9c04a80b", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775646141, "uuid": "3d641951-a662-4fc1-945d-7319202f68aa", "comment": "Malware payload", "value": "b64dc65fb922c1543252876fe680243926bb5105", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775646141, "uuid": "9bbf3c7d-d9f9-4cc4-b306-ec324192e24a", "comment": "Malware payload", "value": "10340a65cf92b87d5a3c6b818231536a38b3f4dbfdbe4b095ccfda2961dc34e5c660782cc6da53a9503923489ca78681", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775646141, "uuid": "b069a734-0715-4dca-9ada-7091619b2a18", "value": "T171C16D1451DF1BFCA1F2BFB512A6E02B80A0B6711F55E55F31C0F8B118987B543E2643", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775646141, "uuid": "e740741f-84b7-4721-8cde-b2b6456c5da9", "value": "96:NqUPuWL/TK8xFYn21ssJdutPiFgWJS5Nzk5DVGVNRSTlM9MilMJ:MU3LbQn21j6iFv+zk5D6NaEMia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775646141, "uuid": "caa6bb84-57cf-4418-b655-36ea77470ccc", "value": 5949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775646141, "uuid": "e39933e8-3f6a-4945-92e7-49fdbc53b1ba", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775646141, "uuid": "21bbe23e-69f5-455f-a7ec-b432491f8787", "value": "d.o.c-08401.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa404638-32ff-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775620907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775620907, "uuid": "7893f533-9947-4ebc-bbb0-4833181a84dc", "comment": "Malware payload (Mirai)", "value": "e3b5b5cc2d68f099bfbf212a5124089b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775620907, "uuid": "087e545c-555b-43df-a036-78ac7b222b23", "comment": "Malware payload (Mirai)", "value": "a7a7d5f87857fe69f130b48c0ab793c86469b12ad8e905ee2f82a2bfa9e0859f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775620907, "uuid": "c25e63b2-c678-4eb0-a383-66f4036374a6", "comment": "Malware payload (Mirai)", "value": "10cef08df45f41d363ff75d75b31ac5ca95900a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775620907, "uuid": "cfc82af6-1de5-4955-897b-9b9eceb8529e", "comment": "Malware payload (Mirai)", "value": "74128a29d636ea9a8dd79987000f780f4d06636ae3a3a09032e3d05084a3fb054474c9707ff69ace4ff35e6c7a055d80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775620907, "uuid": "678ffd5d-975a-4217-a486-620619a62ecb", "value": "T1A043185178D19A16C6E423BBFA6E40CD372563E8E1DF32178D212F1177CA82F0DA7A91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775620907, "uuid": "c52f8cd6-27fc-422a-8e12-b58ba5822b69", "value": "1536:saEJMzL7BC+nfbXq/5XqbFJ9WhKvriEALd2:saDD2/kJQhYbALd2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775620907, "uuid": "debdc0cd-bc21-4331-95dc-3e5c135f6a88", "value": 59988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775620907, "uuid": "13f79e9e-f43d-4a13-bd0a-b6ac96d616ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775620907, "uuid": "5ae90211-1f59-4233-b056-bfb0f645836d", "value": "jew.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9593596-339e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775689223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775689223, "uuid": "26dfd921-e4e4-41e4-a3b7-b988cd8b6632", "comment": "Malware payload", "value": "b6af9024a0709e85a5b767b79fcd3187", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775689223, "uuid": "16fe25d9-b0eb-4eb9-bd89-66c5d7184fda", "comment": "Malware payload", "value": "a82591b195a32c8ad049ff627367c2a63d67c7f7324e3c335c993a7bbd66477a", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775689223, "uuid": "03f7ff64-dbea-4985-a22a-ace8be938b66", "comment": "Malware payload", "value": "792d83066d3198c20cd4f1a276033c6882176095", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775689223, "uuid": "162cac4d-4574-40c6-91eb-6981137e1bf4", "comment": "Malware payload", "value": "d733a6f0d969f62b1c1afe40ba8e2fe13ff7a0b2a72f1d44d8d6b01dc53714ab08119d596b40339b11aeb580c321f7b4", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775689223, "uuid": "ca69c88c-43ae-4328-84cf-af05d9c457c9", "value": "T139957D52E3556937C4BF12361DF6136073761C859E838B432149B16CAFB72C9AF8EB88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775689223, "uuid": "8229176d-41ae-43cc-bfe9-b1c2ee2ffc59", "value": "24576:GQEfQHjpfQ6+EHw7I/sp38N9Dlu9UXMM6kFlWKKJgz9uu63eg3RUl:fv+maQD9fuJgsu63eg3RY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775689223, "uuid": "84fdc1a2-164a-47b7-8e1d-d8a2fb589ca3", "value": 2040898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775689223, "uuid": "62fd4fec-324e-468a-ac00-5a561d330d9b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775689223, "uuid": "1038eb79-080c-40e1-87fb-3e38dc62a220", "value": "Servizio Clienti_1.1_APKPure.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5be5e0a-3325-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775637328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637328, "uuid": "c86e0b1e-7ba7-417f-9c2f-b2ef0a3783e4", "comment": "Malware payload (Mirai)", "value": "860b88563a41bb87476faaddabf38240", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637328, "uuid": "6f9333ce-be73-4cac-b8be-a9a22aca10d9", "comment": "Malware payload (Mirai)", "value": "a85f23d430683af6384f4149dda248eb936a8e3b8253427244768bacab185a36", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637328, "uuid": "73855cae-d80d-4e3e-b4a6-52da76e34694", "comment": "Malware payload (Mirai)", "value": "01ea096e04cb62014e4dc25a376d19852abff1e9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637328, "uuid": "4f728f73-1685-4db2-9227-c1f52a051bc8", "comment": "Malware payload (Mirai)", "value": "c0d5d003adbd56d2f3a86581c8b2349ec9f01033c82def5f984716764944bf98678ccfecf81c0ec471cfc79a1b2f3bab", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637328, "uuid": "ce9df574-f30a-42cc-b146-a8e9eab87177", "value": "T147D30945F8504B23C6C611BBFB5E428D3B2A17E8D3EF720399256F60378695B0E3B546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637328, "uuid": "32422693-87fa-4483-b3c3-7c44b3cb974c", "value": "1536:wKdzElm18uZJNb4A4Fa8eAZHk4VB7fzTTfHh+gYSvvqeqZfB20ly+wyw6RNP8TGf:wKp50XU8e947LPHh+zS6thBZ6xKR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775637328, "uuid": "5a9bf74f-8066-404d-9a6b-135023a585bc", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775637328, "uuid": "cfba2156-d937-4215-ba5c-2e01b6dd590f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637328, "uuid": "5f20a6e9-3e1c-4ccb-be98-7cfe37b969bc", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93b10271-33a2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775690878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690878, "uuid": "f3086e88-df1a-4b3c-8c6a-4d22d1e38554", "comment": "Malware payload (Mirai)", "value": "a118ed4be3b2d3c6bb2d44e0168c47c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690878, "uuid": "f51b2aef-1a2f-4d79-a20f-3aa6cfad07c3", "comment": "Malware payload (Mirai)", "value": "a862b6e0829a1f70369e6b63c93e7189f7474c7efdcdbd9f4f2dd94a8c225cfa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690878, "uuid": "b2a8cd33-5923-4e81-b35c-3f77441bc3e0", "comment": "Malware payload (Mirai)", "value": "2f7021871c5b15f0dc671b2210bb94371f977a31", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690878, "uuid": "c6431061-9977-41f0-8c1d-e2623cc826ac", "comment": "Malware payload (Mirai)", "value": "6eececb2d06eaf1a352ab3e98a54bc9092edd4a68cacf9ce9c96fea6dc81ff46da4995f451ef838b519b13b3efb7e729", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775690878, "uuid": "b798ae5e-f292-4210-ba7c-564de30f1290", "value": "T1164309C17881A626C7D05777FA6F018D37199798E0EA33538C296FA07B8AC1F0D6774A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775690878, "uuid": "0043656a-832e-4061-ad3d-34f942ad5bfb", "value": "768:N1c82KhvRRTdj7tsq5sebD07B8drbonjxDdSYGSq/EanRP88UapvTLwCVy/rCxH1:Nb24Th7ttujxynRPNU8ShW+15RL+Sr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775690878, "uuid": "5c51c70e-f08d-46da-b01d-0f15815264fb", "value": 56584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775690878, "uuid": "8ad2dab2-0ddf-4f03-8b93-f4923cef2201", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775690878, "uuid": "4aa38e3d-af3a-4fb5-85f6-8f5fd13f5b9e", "value": "Josho.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2f1161e-337b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775674233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775674233, "uuid": "62f2e7e5-3113-4e0c-a4eb-7d7c43a4adc4", "comment": "Malware payload", "value": "78fa7885f52cca32e5587895c6d5bb2f", "object_relation": "md5", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ext_sideloader", "colour": "#5765BD", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false }, { "name": "w_node", "colour": "#C4D305", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775674233, "uuid": "50edfdd6-2ec6-4973-b865-57f7a983abc4", "comment": "Malware payload", "value": "a8aa971911908daa82dbac12943d1aa615f05136da28f47fc9e9fa762f03a236", "object_relation": "sha256", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ext_sideloader", "colour": "#5765BD", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false }, { "name": "w_node", "colour": "#C4D305", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775674233, "uuid": "8e8edb48-a381-4801-ad73-ff9b9aa2bc05", "comment": "Malware payload", "value": "bc6a1c1c5028053a618371017ed03f55d9e01213", "object_relation": "sha1", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ext_sideloader", "colour": "#5765BD", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false }, { "name": "w_node", "colour": "#C4D305", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775674233, "uuid": "17ff4807-7727-4af1-950e-6845ddcef738", "comment": "Malware payload", "value": "586af5cbb6835eeccf42ac0184969cfbc1a44e8b26bbdec9758a3bb03dfa9247660bce087d8de94e5af2192f06ea720b", "object_relation": "sha3-384", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ext_sideloader", "colour": "#5765BD", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false }, { "name": "w_node", "colour": "#C4D305", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775674233, "uuid": "c984f448-e4dc-4bdb-99a6-f9063fa89b94", "value": "T1D325BF83D293915CE51AC171972EA273F537BC458B29AFE76390DA272633BD0273A710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775674233, "uuid": "216c6f9d-cfc7-47f3-87af-12b2d0b6efab", "value": "5119aa243ba31aa561ba123ac413a1c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775674233, "uuid": "c63612fc-6e6c-4605-a022-57a54798d287", "value": "24576:aSpTZKSUbuHe0wEgLG+PzY5bsY5b5Y5bG:aNSUKHeLEgVYqY7YY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775674233, "uuid": "f9aa3857-7c4d-4437-8643-6a734f9a2b47", "value": 1018368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775674233, "uuid": "199b2e6d-1861-4a79-ba32-5aa45ca04228", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775674233, "uuid": "c7f38578-26e6-4d0a-b42f-2d1222035db2", "value": "w.node", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d832d856-3314-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775630004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630004, "uuid": "00ed50c2-1d77-4767-a03a-7368ae5d5a74", "comment": "Malware payload", "value": "7bf4f5b6e84507663bb6cae7a8c42782", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xx-kak-is", "colour": "#B502AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630004, "uuid": "32a4cf43-872d-48bb-b538-fcbaad0aad8e", "comment": "Malware payload", "value": "a9d54be55518f7ca5ecc551ad23660e70229f8e512944324ac27aea72ac89c18", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xx-kak-is", "colour": "#B502AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630004, "uuid": "51835635-19ea-4d96-8ead-82716f7af983", "comment": "Malware payload", "value": "4f0b1a9120050ca16023046945a1da2f7e2b6095", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xx-kak-is", "colour": "#B502AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630004, "uuid": "03265d52-0f74-4dbd-8a85-1c8870ea368b", "comment": "Malware payload", "value": "7ea29803378125fa4480c1f9aebfa52bceb780f6daab5aa84c58f17bcd742700856459168dd00f2f33957dc1b626aaf8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xx-kak-is", "colour": "#B502AB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630004, "uuid": "16571ca7-7152-4273-9446-57953b82b887", "value": "T1A863B03155011412A93B8AD4EB93A78AFF219003C20582587F9C5253BFFA985DDB3EFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630004, "uuid": "c425bb3d-cbca-4d04-be75-65899c1fad38", "value": "1536:U8A3S7UNUumWh02+leNQX3eNlZxFsAsobNHsnhjUYlNb9fY+Y8YNY/YFAYKYFY8q:pLTuXW2SX3m0obN6lNb9gjZmALHOZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775630004, "uuid": "cdc3a409-50b1-4915-beb0-2d36185cc499", "value": 69577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775630004, "uuid": "5aaab66d-c8f1-498e-adc7-d12ffa8af58a", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630004, "uuid": "312f909a-093a-443e-a139-be34be0793d9", "value": "a9d54be55518f7ca5ecc551ad23660e70229f8e512944324ac27aea72ac89c18.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3d94b58-3318-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775631742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775631742, "uuid": "aa3b88cc-eac3-47ad-8c43-a1687198dbcf", "comment": "Malware payload (AgentTesla)", "value": "3c891e1c7e2ac7cd293cbdcf79134069", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775631742, "uuid": "c946a101-64a4-4404-8056-1f21c04cc821", "comment": "Malware payload (AgentTesla)", "value": "aa1c03bd201e6b66b2d4d1916b7919e281df065d7ef66f5e38fb8aeeffbb6cab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775631742, "uuid": "ac702ae3-215b-443b-98a2-18021841f4cc", "comment": "Malware payload (AgentTesla)", "value": "5047714426ce38c0eb0bd3aeb775c8025232e51e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775631742, "uuid": "40a748e2-a0ba-4717-a1ba-485fec9946a6", "comment": "Malware payload (AgentTesla)", "value": "7931afab9db0f3c17cd8e2406b106a7ba58b3c7bbfb18b51c22853c98988e56e3a339df5c7e8ecc3ed61b2bd58442f48", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775631742, "uuid": "d0f7c45c-6d82-4b31-97d1-aef7021d1d32", "value": "T1CCB5017EDF841981C271B495DD6365977B8EB22A6C023FBE73097A240F5A0C485E2BF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775631742, "uuid": "0812a31a-35b4-4b67-ac25-d9b6855cfab1", "value": "192:mTdOOJH2YO9awxwGyIONsOE8gdzI2VcFHi0AbXVtOpgQOkYOOyO8AVHCywbdbHOT:mTLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775631742, "uuid": "b6dd27e9-b17a-4f26-a0b3-5ea942cf6009", "value": 2355557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775631742, "uuid": "00a48f57-def6-4afc-a610-443bd76defed", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775631742, "uuid": "baa7cde4-dac3-405a-acc9-8089c09ea6fe", "value": "Produktanfrage TCCA9002952026 40-Fu\u00df2-Container RMB-PROJEKT.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cd2884d-3363-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775663754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775663754, "uuid": "c8c296ea-c138-4925-a486-c220d46e8695", "comment": "Malware payload (Mirai)", "value": "1d3f4e269215cee31cb0854e44e1dbb7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775663754, "uuid": "700d52f8-79d5-44bc-81d3-3f154baf1dfe", "comment": "Malware payload (Mirai)", "value": "aa738308687d1238a50e4373e1958d579cb6d30cbe4f4d23ccabf07e428cd36a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775663754, "uuid": "9a11e285-a174-4199-bd49-d52b72eda5ae", "comment": "Malware payload (Mirai)", "value": "983a178c2ba4f688518916ac0a3cfb273c008509", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775663754, "uuid": "5766284f-589d-451e-90d9-ce94252698fc", "comment": "Malware payload (Mirai)", "value": "3618f22a49a6a1aa7ed821390f126c5fd7358887124f76445287fba5c2d1d46a4994a0dc63ce1bc4f07dcb4adc54d859", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775663754, "uuid": "2958d35e-292f-481d-9b91-c4a753a79f90", "value": "T160539EB3C4295C90C6A94139B9E9CE382B53B10492736DF55D1A8FB6A407EECF1093F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775663754, "uuid": "8beffd38-b42e-4322-bb1a-ad0c21346a62", "value": "1536:s/MM0k1EvamwtYBbLridkodwhniUpo3SQCmL:sUMvqvR3vGUiUpo3SQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775663754, "uuid": "614bd6d6-0193-49d7-8f09-a3de55c744fd", "value": 66580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775663754, "uuid": "96bbe7a5-c07f-4e4a-9278-1b27f970b6f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775663754, "uuid": "18ba3f4b-6f38-4c26-b5a9-0374d147997e", "value": "db0fa4b8db0333367e9bda3ab68b8042.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c4ffc64-332b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775639594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639594, "uuid": "f11c51d6-8b80-4130-852c-4fa93d8b34be", "comment": "Malware payload (Mirai)", "value": "d94c094b684de3b45575c6456b110bf9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639594, "uuid": "ff44ee91-565a-4484-b09f-48fe82df2bab", "comment": "Malware payload (Mirai)", "value": "ac4bbd489ab2fde846694040f50805444173ef6d45c7f4a68344af53c5930d81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639594, "uuid": "481a8ce9-734a-4917-9c1b-0a8a35b33831", "comment": "Malware payload (Mirai)", "value": "7c0a17deec42392ef3159650059ee6de83172db3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639594, "uuid": "e6cde503-13be-461d-9d00-5b10ad56d153", "comment": "Malware payload (Mirai)", "value": "4523ef50c64ba0a973c7b60b52c325a010f41a47b24b133495471b15b0e5ec75a4f581dcbd7ce8c4af4aa08684964169", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639594, "uuid": "56e81917-f266-489c-857c-bdd11bf95c96", "value": "T1E9836D21F979192BC0D4903622F74B27B2F257CA21A8871F7D710E9DBF615803A47EB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639594, "uuid": "5a82bde8-5d10-4ed7-9dcf-016210d9b16a", "value": "1536:RGW+GghrOvrpocFjJbmM8TX28ptQKYm5wP8aGhOtgRJi:IGfETFpuKYOyNWRJi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775639594, "uuid": "a39611b6-046c-4133-bbc2-32bea008e160", "value": 83272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775639594, "uuid": "5f86c29c-9607-4033-a633-282fe53a1919", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639594, "uuid": "370c94a2-b285-4981-b5b5-dd1b0250e2f3", "value": "tony.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d99026c3-32de-11f1-a769-42010a9c0008", "comment": "Malware payload (Ngioweb)", "timestamp": 1775606813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606813, "uuid": "c021d4e7-bb49-4e25-b630-9a97ecb6e411", "comment": "Malware payload (Ngioweb)", "value": "d8361574b8b46dcb48cac656396c4f7d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606813, "uuid": "48bcef28-0578-4024-a2bb-abd8e7f48fb9", "comment": "Malware payload (Ngioweb)", "value": "acbb357150d464f678cd23159fca36575c8039f82ef9f276ef298361f8415dd5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606813, "uuid": "5fe29b23-140c-4230-bd0a-709ef0bfd199", "comment": "Malware payload (Ngioweb)", "value": "80f09ad127f1b53ab29346e7c3b421e57806edc1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606813, "uuid": "2d4bcc1d-af00-4765-bdb9-bc8101d9711d", "comment": "Malware payload (Ngioweb)", "value": "a3476169892d0e72cac2fce4448e5696cdb67dd46414346952ad51a10ef6a3f3afe5a9764128139a4cd7206f6f307447", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775606813, "uuid": "517f5bac-903c-4da6-9558-8a1927075ab1", "value": "T176C30892F9809F45C6D02A7EFF9D538C332317B8C2EE7406D9155B2466DB5CA0F3AA42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775606813, "uuid": "c9c2c23e-16fa-4896-837a-532711a9014c", "value": "1536:+wBE/HWUSR2krHiE/BsuF7uKFHZA7Hs1NifBXuyfgBHv+nIIam6WUMNk4TPPrKio:+wAHWz/79Fi0AptuHkepyQqCu8YMYI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775606813, "uuid": "ce6a4b61-ca22-49f6-95aa-d0cb24b123c3", "value": 128424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775606813, "uuid": "9fded5d4-cafb-44be-93dd-5e86e69e499d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775606813, "uuid": "d663854a-53ce-4689-8e25-bd6af295d244", "value": "MPSX", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b8841a1-3326-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775637472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637472, "uuid": "4dc58584-61cf-4c70-930f-d290016dc20a", "comment": "Malware payload", "value": "04a198c73f0533187d6c257b92350e9c", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637472, "uuid": "eac07698-1bda-4db2-a095-aadfb11405dc", "comment": "Malware payload", "value": "accfc9c7073236a758ecba63d2874140a0c8d9ba0c610606ba1fc4b3d96c944e", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637472, "uuid": "f7ae14b2-c51b-4600-9f9c-e6893539abfb", "comment": "Malware payload", "value": "eb5f50b0c1536d21ebdeb10bb8f09fa3ba294113", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637472, "uuid": "a3be3ba8-1a7b-4716-95a7-d2d3b2659836", "comment": "Malware payload", "value": "b9d2d13c72e3bd61637a6dd92537c6f5ec2aea52a03682235e009fda524271cd8f94619ee249e90a82eff6d64a9305b3", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637472, "uuid": "36ac9d43-16c3-44a5-b5f4-7d415c132129", "value": "T16156022CB03F3BAB46868FEFCC2663A1E9A658C21D068075FED6554F403DEED0636594", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637472, "uuid": "487176cf-8c92-4269-b7ce-dc050464e47e", "value": "49152:Xwjy2tJETgHySyEA7Rr5LcPI89hbkiyxqfLitN5Vz7E0tCiNMHeSX30pMtrNt6/o:e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775637472, "uuid": "28288ec1-193e-406a-bdd6-54da4cb56945", "value": 6405964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775637472, "uuid": "c9d8b970-6fae-4481-af2a-cdf1b6fb6125", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637472, "uuid": "14112b2b-09ee-4bad-be9c-899fe0c6c98e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "296e8830-3326-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775637442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637442, "uuid": "78f624fc-e9c6-4e46-9633-a487dfcfd60b", "comment": "Malware payload (Mirai)", "value": "b2003fad93976db7b987268068f107c3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637442, "uuid": "eafd4270-5dcf-4dfa-b398-990ce4a6a08c", "comment": "Malware payload (Mirai)", "value": "afe91b9f33203b2d30e57d8d85fa72ad2ca5ac814e32b0ed8aabd68a975f5581", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637442, "uuid": "44260e84-b811-437a-965d-db30efd25998", "comment": "Malware payload (Mirai)", "value": "05d3bb014b0e5ab4591cf07e525d42b2ad4442c2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637442, "uuid": "36805479-5fca-476c-a49d-6bc760022c24", "comment": "Malware payload (Mirai)", "value": "e8e3199302e7585ba4931b604efb5140922f38d983eda9126a164c1d5a9ea3f9067a1e34fbbdd68da44127ed1cbacd60", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637442, "uuid": "a1c3ab08-7b8e-45cb-b27b-74db6d770881", "value": "T1ADB35BB3DC26AF98C655D074B0B08FB92F53A59482471FBE19B6C2B44443D8DFA05BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637442, "uuid": "d2005cbf-44d3-4322-b190-c5b7d84d97ce", "value": "1536:WTW/VCxsHZusS2Li62C8vqKTR5/PPVGAto2WszrW+TNe7F:WytCxsSx62NFT7VG92WcrbwR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775637442, "uuid": "03d6e8a8-ab81-40e2-bd34-feeb245b0d15", "value": 117568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775637442, "uuid": "0f0f276e-743b-4269-9c7f-1fb2807def97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637442, "uuid": "836cf1d4-97a1-4b2c-b735-74d52dd9ee07", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a973b20c-3352-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775656554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775656554, "uuid": "d0d60276-63b0-4b9e-be2e-fd21ac0f21a2", "comment": "Malware payload", "value": "0191cc16d9034be9c86a66ac4e25bbc9", "object_relation": "md5", "Tag": [ { "name": "RegPhantom", "colour": "#BF6582", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "WHQL", "colour": "#5CA41A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775656554, "uuid": "4f2ec94c-d6c8-4b96-9ae1-2554e8d43b04", "comment": "Malware payload", "value": "aff7fd6d82804cb0da355c640a7255ecd5550f2b877a6d7b2f62dd4a66745e27", "object_relation": "sha256", "Tag": [ { "name": "RegPhantom", "colour": "#BF6582", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "WHQL", "colour": "#5CA41A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775656554, "uuid": "f0ccc39d-d80e-4e78-94c4-b492e4f6e73f", "comment": "Malware payload", "value": "f032276479e9c0ddf5ab4cfbc64d6d2740790701", "object_relation": "sha1", "Tag": [ { "name": "RegPhantom", "colour": "#BF6582", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "WHQL", "colour": "#5CA41A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775656554, "uuid": "f944298f-5c41-4dc7-a6e0-eebe5ebbfab7", "comment": "Malware payload", "value": "8d118a942e531d39c71fd029d300ff52d6e82554c3be4ea4d9ffe682833523252b29a04efcb3a717134144ac89436ff6", "object_relation": "sha3-384", "Tag": [ { "name": "RegPhantom", "colour": "#BF6582", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "WHQL", "colour": "#5CA41A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775656554, "uuid": "e19a09aa-99c6-4cc4-a11b-758bd4422f83", "value": "T13F823A96926410C2CD7B9C714269EA573C3872C74B11AAE395E8F8A90E537C9F33C32D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775656554, "uuid": "d9338599-5c13-4273-ad71-3190237ea448", "value": "067344e74a94d10c4b6c68e781844584", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775656554, "uuid": "454cf5f4-0e9a-4f90-a1fb-a72a3821bf38", "value": "192:MNHuToZX+pgYcHX+o54wPghXDEwXEhYCMqTHINFPKBWX01k9z3Anaruf:MJWGOpg5BGyh3tTH8KER9zamuf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775656554, "uuid": "131b959b-3d65-463d-b5e7-b9eb008d3476", "value": 17656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775656554, "uuid": "7b183a12-1ae6-422a-acb1-ce63d2f38ffd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775656554, "uuid": "2f9d95b5-497c-4e5d-aabe-aac18cd7e797", "value": "eRHXCXyiYYujFUKA.sys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c346aa1-337f-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1775675859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775675859, "uuid": "a46a1400-e460-41d5-b63f-8767feb913ee", "comment": "Malware payload (ACRStealer)", "value": "2332fe2a6fc8aa5ad21c29e55f5470ec", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775675859, "uuid": "84188af0-63fe-4572-a62e-cf54bfc8ab56", "comment": "Malware payload (ACRStealer)", "value": "b098d781dba14c92ab537385844c437a0e7f4b1bf2cc58cda56d18308e5d1204", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775675859, "uuid": "6fd2841a-c280-4dbc-a4fa-9e09ba86b148", "comment": "Malware payload (ACRStealer)", "value": "4dbcca32056caa1352a9117f6efb17c7ec30e825", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775675859, "uuid": "c53a1655-d7b8-4a05-addd-97ca533d3435", "comment": "Malware payload (ACRStealer)", "value": "a9b7a94509dbeffe427330fe771e143e6302240cedb9df23ce824ea2b3a23a125560bda31842fcb435a3d5521c368328", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775675859, "uuid": "c9ff802f-5d58-47b8-9de7-5c7fba3a69fb", "value": "T1E3065C07ECBD8CA9C4A9A135843361467F347C801B7163D72AD0B6A92F73BF0997AB15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775675859, "uuid": "a624cbc2-f428-45ac-9bb2-233066c9f1c6", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775675859, "uuid": "4f842eba-b42a-46a3-955a-b917d19656a2", "value": "49152:oM9/5mHRYH86vNda83jNqYhxjL1Qc19nOa6VM:oYZTNbmUnq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775675859, "uuid": "0fbcd3d1-6296-408b-81d9-3b25098af039", "value": 4016152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775675859, "uuid": "8a57e611-edce-46c2-b49c-7f2367723121", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775675859, "uuid": "2d02f320-0d8c-4bb6-ae6e-5e31ff402a5d", "value": "SecuriteInfo.com.FileRepMalware.97992885", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0607ac57-332b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775639530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639530, "uuid": "02257690-e882-4034-be4a-d9727bd0cf2f", "comment": "Malware payload", "value": "91dda52679e307efd773c0e0db3d2e47", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639530, "uuid": "cb54d268-27fa-4106-a9b0-0835076874f3", "comment": "Malware payload", "value": "b1043a69568bd1183b774e3b95552847449811c7dd8c725b1de950d64f9d4c98", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639530, "uuid": "02cd25e1-9383-40c2-bce8-ae3665227f62", "comment": "Malware payload", "value": "4c755062399c4aed73d65d2d4d01a35f42fbd1db", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639530, "uuid": "3e58980a-8154-4bb8-92f6-186edca92641", "comment": "Malware payload", "value": "174ea3d5b3e9ba04e73529c390b04fcafc58a1de6f937ce8a6c530f52b4582e614e512ba80a11fda7b34c040d87c97c7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639530, "uuid": "88ef0968-75e8-4bec-b469-4745768e16e3", "value": "T15B3423E7EE10A2E48F75B109346B7C3180335A623431B453D649AD4BEF415DA9B9FCAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639530, "uuid": "67cd0fed-da67-4144-be32-ce73fcac88a7", "value": "3072:2pwDBTSCCFHIIR/7ONCgqwG5H3B1dBG40Rm+MDAFlUM+KMgxz5Kirn:zVVCBDONq1L036magZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775639530, "uuid": "eded1a24-5098-4f9f-bda5-ac40d6f88ce7", "value": 230483, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775639530, "uuid": "067331bb-f8a3-47af-901f-0c082b9bbf32", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639530, "uuid": "3dbdf17e-8c90-435c-a1bf-3d2c20d9b4ff", "value": "drifter_f3a8eae3_upload.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad5f5770-32ff-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775620913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775620913, "uuid": "f8aad309-c8bb-4a99-9a71-71300dfe456e", "comment": "Malware payload (Mirai)", "value": "6b68397b3494b6c2ba60eac9a52f8518", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775620913, "uuid": "b389f485-3418-4b21-892b-99b0aef27eda", "comment": "Malware payload (Mirai)", "value": "b13cda91c5c2dd0216d95d3c6345a243e98314bb63e81c3f1509317e1a2f1a0e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775620913, "uuid": "adca5dfa-2b5c-4e16-9421-b390f2171753", "comment": "Malware payload (Mirai)", "value": "cf2c23de121fdb37be1c918045a855b6062ccd37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775620913, "uuid": "2d1859e3-5e7f-498a-90d2-30362973c0f5", "comment": "Malware payload (Mirai)", "value": "3104890d4ec31a1a2a2dddce25e2bef0dea5ad7d133ac8efc4ffa30b8dad58423f347c0bbe7755fc01ca657edd03cda2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775620913, "uuid": "9dbd3093-6891-415a-813b-08aeea61bd37", "value": "T18D338E76C42EADD8C6458734B82A4A740FA3E10891E76EFA5B8586A54043FFCF61C3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775620913, "uuid": "9cb62c3e-78de-4c78-8615-cb0a176edc48", "value": "768:Er9Q6eGyC75erUUeOiwwtNp40Zdi/FyGoMuJLk3XCmlolN9aXCxj:EcdC753UlwtNEFyGoMD3X3qlGXCxj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775620913, "uuid": "e8e89383-017b-4fa9-a1ad-1d784268bae6", "value": 51924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775620913, "uuid": "afd229f1-7305-4f8d-92e5-a12a57ad499c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775620913, "uuid": "9154daf1-9baf-42bf-a4a7-26fdd52dcba8", "value": "jew.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8ae403b-337b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775674243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775674243, "uuid": "af7cec59-e18b-4aef-aaa2-f0aaeb49464e", "comment": "Malware payload", "value": "26d9ace775c38f2aa2ae14b31f7e8665", "object_relation": "md5", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ext_sideloader", "colour": "#5765BD", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false }, { "name": "w_node", "colour": "#C4D305", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775674243, "uuid": "ccc15329-77b4-4d9b-9f86-e01175468572", "comment": "Malware payload", "value": "b40fd232b465f00947113abfa284fb7dee0565f2fa5c3be2e347eb0de04c37f9", "object_relation": "sha256", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ext_sideloader", "colour": "#5765BD", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false }, { "name": "w_node", "colour": "#C4D305", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775674243, "uuid": "abc078d8-e3b0-453c-9950-12a6ec8f3cf0", "comment": "Malware payload", "value": "fae5b28e6ba6fb5098950bbd7ad8ba9dbe73b698", "object_relation": "sha1", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ext_sideloader", "colour": "#5765BD", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false }, { "name": "w_node", "colour": "#C4D305", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775674243, "uuid": "090a640b-8596-44d5-b40b-822d9a76f296", "comment": "Malware payload", "value": "572de63b510982118dfe4d089755fcb7082476bb0386abb09a68be516aea0b2026e67cc604ea41f55f8723e1c86c53e6", "object_relation": "sha3-384", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ext_sideloader", "colour": "#5765BD", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false }, { "name": "w_node", "colour": "#C4D305", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775674243, "uuid": "c9e12b92-f729-4f48-8250-543e6ea6de67", "value": "T1CF25BF83D293915CF41AC1715B2EA273F533BC458B29AFE76790DA261633BD02B7A710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775674243, "uuid": "ff27d806-9452-432b-af38-19be537257ba", "value": "5119aa243ba31aa561ba123ac413a1c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775674243, "uuid": "12525073-10c7-4484-be66-4e1935eda9fe", "value": "24576:y+pq42TwOEe0JRh+w+2Y5bsY5b5Y5b27:yvTrEeiRh3YqY7YI7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775674243, "uuid": "e9952579-d422-4466-ae49-09d97c6370d0", "value": 1018368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775674243, "uuid": "de86e07f-83fa-4316-a95b-20f9d92f2936", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775674243, "uuid": "15b9f50e-b58a-4bad-8735-07c2d20719eb", "value": "w.node", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "404d236d-332b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775639628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639628, "uuid": "2e41ec66-b21b-418a-a18a-bc7adaaab5ed", "comment": "Malware payload (Mirai)", "value": "9e8ee2048f0c8c260c8d3f986d9c2a56", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639628, "uuid": "31877764-a81e-4c65-9058-37db102abd5c", "comment": "Malware payload (Mirai)", "value": "b4215e03eed730273339840ac8bc453c3859204a337647cdb5a6a2259d7228e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639628, "uuid": "eec365b3-8f14-40fa-933a-a7d77fbd36aa", "comment": "Malware payload (Mirai)", "value": "452986eff7f7f588a1fe2cec5d6d33f5bf4ff4e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639628, "uuid": "8d7dba69-00f1-4fb6-b585-8c38a36a9ee2", "comment": "Malware payload (Mirai)", "value": "72fc468cee7bdcd80ac90c5f634242c628768fe5c5d8582013a15b610ea5cd0954b6f379b221c8e4ad4a07edef671a7b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639628, "uuid": "1f2cac70-2c36-444a-b1a7-5bdabe6702ce", "value": "T112733A5BB98080FEC496C03883BF7A36D82375FE1378724693E4FE256D59E601E29D94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639628, "uuid": "5e535d25-fc50-49c2-b6c2-c5c0da4c78a9", "value": "1536:FAVbLhjW/Egg838u3lX8tc+q3VMmxGqnbUyoP+:FAZLhy/F39lX8tq3VM7qnbUFP+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775639628, "uuid": "cca957ca-19bb-45c2-8461-512f2c1926e3", "value": 76208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775639628, "uuid": "7916ceff-6202-40ca-9eae-0cbab6cb3b0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639628, "uuid": "bde5afad-fae1-4adc-a02e-5f4d3c5433da", "value": "tony.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e68dafb-332b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775639624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639624, "uuid": "d4457a92-9219-4644-88a1-0790998fcba1", "comment": "Malware payload (Mirai)", "value": "a6a7d2dcd8f32eaac206e0e460479388", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639624, "uuid": "415765c3-a46b-4947-ae76-d90953a9faab", "comment": "Malware payload (Mirai)", "value": "b491c524f6f8c1788b8bc00a0bc94cde9b35582089dc25d413ee3f78b9dfb3d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639624, "uuid": "6ba3f7e1-a35e-401d-93ca-431218834c58", "comment": "Malware payload (Mirai)", "value": "d396fa929dc9d55b4f024b29f706ad050fd5edbe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639624, "uuid": "b03c8d5f-f239-4f56-8190-2bdfb5e4313c", "comment": "Malware payload (Mirai)", "value": "9cfba87a52eab71ba8aea28d914c9f0ddcf4baf7932c83b7e994938d50438e21016e586cb81e71533dcea8b536fd0069", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639624, "uuid": "de754e92-4cbe-4d44-8bf5-04a9e29ee0f3", "value": "T19A231986FCC28A3BC5C01336FAAE6A4E3721E3E5D2CB76178D245B2176C611F1D66D80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639624, "uuid": "5e8c59a0-2fe8-4247-9e79-4ea70b0fa4c7", "value": "768:C2qKscV/uFCzpG4ECBUVVYLZQQqn/FNA8BdJ75BN+wbmoO:eFHGpGRCBUVOlQdNAy/Rb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775639624, "uuid": "83e7341c-d60c-4c82-8967-1fd7f90f51e0", "value": 46328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775639624, "uuid": "6f585fc6-f0b1-4312-9e1b-05ee475c972a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639624, "uuid": "5081f04d-e054-4e0f-9d36-f444ad7a2bdc", "value": "tony.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2406d304-331d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775633567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775633567, "uuid": "fcaa7457-8c26-4a61-baec-48c99eff3ab2", "comment": "Malware payload", "value": "f2b7100cf0c24abd9b675137986921dc", "object_relation": "md5", "Tag": [ { "name": "Millennial-Media-Inc", "colour": "#BD1501", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775633567, "uuid": "7668f86f-e125-4dc5-98f1-d2e2abc7c51a", "comment": "Malware payload", "value": "b7d82f70c56d91d17a1f8b6a872522ed286be1be2c0e43b9e02b1ddd28b6a7f6", "object_relation": "sha256", "Tag": [ { "name": "Millennial-Media-Inc", "colour": "#BD1501", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775633567, "uuid": "0078f5e2-838b-4788-8259-0ddd7dd87e8c", "comment": "Malware payload", "value": "c699ae22ac40494522dcd5c2d4c8a8647ef56271", "object_relation": "sha1", "Tag": [ { "name": "Millennial-Media-Inc", "colour": "#BD1501", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775633567, "uuid": "074685df-15ca-414e-8f39-101c61698eec", "comment": "Malware payload", "value": "78140e3f7f528efc9db5e315c0602d2cac0893f5153847d3c368010441d4b1842d58f1857acb01960076447ad4886052", "object_relation": "sha3-384", "Tag": [ { "name": "Millennial-Media-Inc", "colour": "#BD1501", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775633567, "uuid": "f3a56c0f-4a22-49d3-b561-ff39dcc12ca5", "value": "T15A57334274CA8833E96F68355F378B1846BAB8710A71C06FA39C454A2F73791A735BD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775633567, "uuid": "41e367e7-be7e-4179-988f-ef41877d1d05", "value": "786432:A/QMFQAlGY7KELpTCKHtw4P09wGoz00a/HEAB:AIPAIY7KEVfHtwY09wGf/kY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775633567, "uuid": "41c68cca-9a38-41ec-b3ca-c6fce2fe6e41", "value": 28325376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775633567, "uuid": "ec428695-61a8-4ba2-8c15-25ba30997caa", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775633567, "uuid": "5ca6ce89-6d6c-4b52-a8d5-b51cd71d6986", "value": "b7d82f70c56d91d17a1f8b6a872522ed286be1be2c0e43b9e02b1ddd28b6a7f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc866a28-32de-11f1-a769-42010a9c0008", "comment": "Malware payload (Ngioweb)", "timestamp": 1775606818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606818, "uuid": "218a6aaa-8c8f-42c3-be84-804ab8a7816c", "comment": "Malware payload (Ngioweb)", "value": "b610896824fcddf861f9956cadac2f00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606818, "uuid": "0d919ce5-17dc-4fa8-8a66-8cc7f156faee", "comment": "Malware payload (Ngioweb)", "value": "b89e0bddab26ae722e8af161ab726eb7f25232f00b3cbdc0e6cad665513047df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606818, "uuid": "70451d2c-8f1d-4c46-8424-31ba438f7446", "comment": "Malware payload (Ngioweb)", "value": "c232d546951c8815d206069c9e7f484932ca240b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606818, "uuid": "86353a73-99f6-47cf-a5c8-00e4d55480c8", "comment": "Malware payload (Ngioweb)", "value": "b69e32ec5089a3aae2d4953b9181b662693980717d85fd249fefe2ff1eed52c98c85e6628aa7087a02fda52d5217553e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775606818, "uuid": "26b10cc6-e90f-454a-b4a1-d8547c622f06", "value": "T1E2C3F791F8509B55CAD06ABDFF8D538C331317F8C2EE710AC9149B3476DA98A0F3A946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775606818, "uuid": "c240af59-b192-4634-a6ba-874371159f1b", "value": "1536:uY63yECoeUkVbVVIi8HZ/SFcpZ1dGUKjoGvDJ9/FHvBy3BL/OMNkQTHUhwzhOglm:uRzNxw8i85/QSn8LJsHHUoOUwJJsumM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775606818, "uuid": "37531962-c789-4af3-927e-97ab4ecabf9d", "value": 129120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775606818, "uuid": "7d1eb38b-d14f-4a63-86ca-de9c5c79b51c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775606818, "uuid": "c596f667-2e51-4c4c-85cc-ec1226469709", "value": "HVAH", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "957a62b8-3349-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775652655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775652655, "uuid": "b58565b1-06d2-4d77-aee1-6fa2ed4d341d", "comment": "Malware payload", "value": "0db2449794d0832a6827a5747116c3f6", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775652655, "uuid": "6f10fcd3-af7a-4890-beee-e1351332c605", "comment": "Malware payload", "value": "b8d4751c6222e4e387bb46a343bc2427035e86245e1d3e7ad073cdc16fdc59c5", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775652655, "uuid": "120a5364-9a36-47ca-864a-f24ec479c850", "comment": "Malware payload", "value": "1c7e7eaf7aebe167005f36266f6f2e6c83b86e71", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775652655, "uuid": "23d58abd-45f5-49e8-a4e6-f95dd9c21c03", "comment": "Malware payload", "value": "52add1561c22913b41861412e267cfe0b21922c7190c853020f6f80069bdf48647b9012256cf497d0eadc7929d3a7143", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775652655, "uuid": "2669658a-520a-4dc1-bf9d-f94aa1902497", "value": "T1DA6733DCAC728753F0A5C936C7B2D7A8C7977E249946AA673124313A25F3FA13372064", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775652655, "uuid": "5ccd9bf1-32b4-4f97-9cd5-df1124925646", "value": "786432:zDvAQHSfi39IRnJD3IrK7wfSK+T3RE4L//UeDR:zT9yUaFuu7wfSK+UeDR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775652655, "uuid": "52b19480-8d9a-43b4-8d51-93a713ce7c9c", "value": 30040064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775652655, "uuid": "bebe7484-59cb-4b79-bfd9-cc4148291974", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775652655, "uuid": "e9b9eb0c-833e-438e-b3d8-6fd0b118253a", "value": "if Situation.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c3385e7-33a1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775690409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690409, "uuid": "488d77c9-ffde-450f-b1ab-658b3c4b57b6", "comment": "Malware payload (Mirai)", "value": "a1f4450e7ec98c8da748eb0179d53025", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690409, "uuid": "beadb9d8-7cd5-4d50-a739-087be5ecae2b", "comment": "Malware payload (Mirai)", "value": "b994e8c0a191efd1511bca15f2d08db4457eaa49f163de90bf577429b7cfcc37", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690409, "uuid": "3f059b6a-a744-4172-9ea0-eb2b5b6e32c7", "comment": "Malware payload (Mirai)", "value": "3878213d470f33367ea8f2bd5fbb012c2158c0c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690409, "uuid": "a69abb9b-c457-4b96-ae9a-f80685d53913", "comment": "Malware payload (Mirai)", "value": "e5ebb757625e0a4853f7b433dfd612d15d3ec25a1207f2d83e9ea0be53c96f517e263acd0d4b493b751741d825597ba8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775690409, "uuid": "c1a20ce4-3e6a-4cf4-b971-f1dfd233a963", "value": "T145041802770D4E07E1432DF4263B0BE1839BBD6228F9E584744EEEC957B1DB26116E9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775690409, "uuid": "6c5f6365-9485-4bc4-b8cb-668515e4126b", "value": "1536:+61NlhEIxcRJB2luHcu72fVbxSd6ifIjvQ83z2uOjXKp1VvRqr5rPW2vAimWQ593:h7yhRf2IHcrfFx5igkOz0KpBqr8fiAl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775690409, "uuid": "316e136e-b4d5-4d74-833d-efdb7b2946f3", "value": 180904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775690409, "uuid": "a3791742-2a08-4ccb-808a-58583c34eaaa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775690409, "uuid": "ea0ae001-b3bf-4a90-b2ee-8fc0c3207c68", "value": "nppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aa05a3b-3316-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1775630679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630679, "uuid": "4f74ab14-b533-48a2-9dff-8a71e44452e8", "comment": "Malware payload (ValleyRAT)", "value": "f0a8527f9acea407fbc6aa98989cded9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630679, "uuid": "ba422a58-da58-45b0-9c1f-cf626f436905", "comment": "Malware payload (ValleyRAT)", "value": "b9b396a790992342395afcc8619fc71cc876a6043b9444b91a8c676ad032994e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630679, "uuid": "292c7b56-4f83-4ac7-b0eb-381f953dc406", "comment": "Malware payload (ValleyRAT)", "value": "92af235b90fb146ca1c7e1d17ac2fb01d4ed910f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630679, "uuid": "f0039a2a-5f35-44a7-9fb2-d78883025aa7", "comment": "Malware payload (ValleyRAT)", "value": "b80b6cfecdb9ca22bfd0de5c3455419a705563613972621211606174e7ac1045557cc9535eebd0ebdead00a1fe01eca8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630679, "uuid": "36981d5e-5287-43cc-885a-da34566e31c3", "value": "T101D58E317701C4B6D95202B0ADBDEA5F816DBD218F7414CBB3D82F6E55B19C21B32A2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630679, "uuid": "12746d28-d6eb-43d2-a274-d3748cb1b1f9", "value": "244ba207fde35af99c81d0ba5cd58cc3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630679, "uuid": "02003fc7-c5f8-4395-94c4-98c70df54664", "value": "49152:DZBATAK7IjnDreSwL934vsDEuJUNFiAcec8uOqiqHUzj23P2:DZuTWDretDEuJURtzqi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775630679, "uuid": "1174209d-fa53-43d3-9094-1cc88779a519", "value": 2845184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775630679, "uuid": "2076da99-bd10-493b-b91f-dc5ef7ea9db0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630679, "uuid": "2a87c272-14ca-410e-a057-ce46a6b233f9", "value": "\u70b9\u51fb\u5b89\u88c5\u4e2d\u6587\u8bed\u8a00\u5305 (4).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b16d858a-32ff-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775620919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775620919, "uuid": "3113f01b-0922-454d-8b98-1bc475e23c09", "comment": "Malware payload (Mirai)", "value": "366f7ec3301027136bd55ff1087976d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775620919, "uuid": "e3780c76-7a30-4414-a33e-a3fe62daeeff", "comment": "Malware payload (Mirai)", "value": "bbc3247d89c0a9d67f6b33950848112748225ca0159ee6cd295dce79d0ecb625", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775620919, "uuid": "7a5bc088-3aba-4a6a-818e-01962820c07c", "comment": "Malware payload (Mirai)", "value": "45470198f83be6a2557f116be9e34bc5e372f4a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775620919, "uuid": "a6e57cd1-7557-4983-91ad-7ad602293d39", "comment": "Malware payload (Mirai)", "value": "75373148dc352cd5d291e8652114388e77782489bd14ad6c122548e04ac824e521433a49ef70233d583a04b420b00013", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775620919, "uuid": "fc023979-5ac5-4bfd-ac36-278a0bcef4ab", "value": "T19C630852B8C18E15C5D813BBFA2E018D33126768E3DFB2129D116F147BCA92F0E77A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775620919, "uuid": "9684b5a5-7670-490c-8868-98ea626eb8ef", "value": "1536:StnER4jL83+4/ZZM0mA8w7lR5vzq91dO0nz/IziSX+1/K:t4jo+6ZZBLbRd29P2X+1/K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775620919, "uuid": "a3f1faa1-bd07-40c0-ade6-6837b52685c0", "value": 70960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775620919, "uuid": "c81b9f21-8e69-4173-85e7-063e1177bed6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775620919, "uuid": "6ec23568-a14c-4eb6-9232-a9a4f3740132", "value": "jew.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "890da4e6-33a2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775690860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690860, "uuid": "8fba2bb1-f5e8-4082-aeb5-9a66e18d5dc8", "comment": "Malware payload (Mirai)", "value": "cb9c970d590c80c688124428fde5bc24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690860, "uuid": "eac21c23-ef58-4b56-a6e5-f910c8fcea3d", "comment": "Malware payload (Mirai)", "value": "be3995c86165b045ec0756f6b0a862f8c2a1c826e0cb8d618382cedf88113638", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690860, "uuid": "4e63cb20-3350-43f5-aaee-0edd90ae694d", "comment": "Malware payload (Mirai)", "value": "6c03ee15cadd293451352c8306d40426d0b7107e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690860, "uuid": "2d3e3541-cfd0-4f13-b3ee-4efc4d4af933", "comment": "Malware payload (Mirai)", "value": "e5e615cd49d38a09d25c6abc9f8502a43ae472268d4c97cc4b78dad9afa646456b7b6efb7af889f68c21fef7a2e78f40", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775690860, "uuid": "ab7eb8b5-29a0-46ef-8038-c23df3c10618", "value": "T1F063961A3E218FBEFBAC863847B74A219658339622F1C5C4E15CEE015E7034E745FB98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775690860, "uuid": "56d279d0-2c9c-4685-83f9-ba6421da1825", "value": "1536:AHNFnXDuPq/SyZBp9tkI0v6bqfg/Kkz73o2x8zW:gNFXDKGr2I0SWYz73o2Oi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775690860, "uuid": "2f86abff-d337-4412-8424-09bcd3cd2486", "value": 69080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775690860, "uuid": "e2a822c6-bfe4-4c93-8ace-376774064b63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775690860, "uuid": "47fbebee-70ee-469f-a05e-1c720a6d1df4", "value": "Josho.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9960bf68-333d-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1775647508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775647508, "uuid": "9802ca1e-2469-474e-94e0-df90829fc86c", "comment": "Malware payload (ValleyRAT)", "value": "47185b07b184d34895bf265fee06d469", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775647508, "uuid": "65f9ed44-c2e5-46ff-8570-ce96bfc63cde", "comment": "Malware payload (ValleyRAT)", "value": "bf961d1076e38262ffb9cbb52afd4b1fa5254c9f38de5e43ae97bd382dcf2151", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775647508, "uuid": "2702b4d7-e1ae-46c7-86d0-c542490cbafd", "comment": "Malware payload (ValleyRAT)", "value": "0456a5938714d392aa2ae989987c40420a3169b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775647508, "uuid": "62d62238-0fc3-4007-a668-b0790da6c89b", "comment": "Malware payload (ValleyRAT)", "value": "5cdcc82202f81e672df14cc1ee18f1f8ad4fd5744c226b5fe5661f8670d9d5612bd8a48d82990b0217ccf10b9aca1ab5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775647508, "uuid": "de2eef05-ef9d-47ab-8ae2-4da7de09de99", "value": "T1467533623B7296ECE58BEF34F050289D71C0CE279FA55E0B7A4CE1AE15395CA12E7134", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775647508, "uuid": "2a8cf2be-0a3c-4e8a-a1d5-a91d6d50362e", "value": "3557dad44152ea1cd59f57bd1470e8f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775647508, "uuid": "17094f3a-6224-4256-9d93-1f80c6b7ec66", "value": "24576:xYhD3Wb8JcOzXvhrOKd+w0rD4fCJoJQDEcG6IQRFglO5ryPI9EN:xgDbJ1pBd+wSDCCEQDEcBDl5ryQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775647508, "uuid": "660acd9b-4365-4141-98ca-e6ec57cb3e4f", "value": 1573376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775647508, "uuid": "01f6cf40-7303-4a59-8421-1fb38d697102", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775647508, "uuid": "0214e107-7aef-41b9-943a-ec3185da8069", "value": "@\u6240\u6709\u4eba\uff0c2026\u5e74\u7b2c\u4e8c\u5b63\u5ea6\u8fdd\u89c4\u5185\u804c\u4eba\u5458\u540d\u5355\u4fe1\u606f\u516c\u544a\uff0c\u5927\u5bb6\u81ea\u67e5\u4e00\u4e0b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09732ea1-3347-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1775651561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775651561, "uuid": "5b6b4968-9de6-4afc-b5cd-48b1f06be681", "comment": "Malware payload (Formbook)", "value": "d68e346787c4cecc363ab7c96001a74d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775651561, "uuid": "6e9f8463-63ba-4c79-8d9e-b8d015e5e35c", "comment": "Malware payload (Formbook)", "value": "c35e59265869e3830a9d9ae580618f1b944c6bce5925903339d313aa03f70459", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775651561, "uuid": "b12b24aa-1454-4fd6-878f-b4bd526d0c7a", "comment": "Malware payload (Formbook)", "value": "a72695767a86f5ec8e2536e305a59e33c23cf29b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775651561, "uuid": "289ce315-f4ad-4c6e-ac0e-c1dc51dca011", "comment": "Malware payload (Formbook)", "value": "53dadf9a9f7d67f5c6cc5d2d19ac57c99d7ebe5ac258c1c18c0deaa7aacaa645efbc8e8f989255c5f11f5c22a3ca7e19", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775651561, "uuid": "b185ea97-2e02-4ec0-a8dd-90a36b6ffa2e", "value": "T12CC60504D36D947E81DEDF4EC575A1D0998E20AA598DDB2E301F82383E05FA7A7864CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775651561, "uuid": "6b049cda-d301-4c76-9a10-cecf1af1118b", "value": "196608:7pp/JMux+bEOoIAuvAmFQPIgcNa03sgoXIcAnDp5qqMLs44p375xs/4VGFHVXyPU:lDz+bE2AzmFuIgqaGsgo4cKoqMLH4B5Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775651561, "uuid": "0b184077-65cd-4715-b2fa-bf12f8944ac3", "value": 12318381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775651561, "uuid": "7f4fd66d-d1bb-40c9-8fa0-bc688023e318", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775651561, "uuid": "e1b44d97-177b-4e77-87d4-ff6ff58b4180", "value": "rnek_sipari.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8732600a-3363-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775663798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775663798, "uuid": "bdd69d73-67d5-48a2-86c4-4ed81054c118", "comment": "Malware payload (Mirai)", "value": "baf658ccce1e7ad7ee2f7418094521b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775663798, "uuid": "15a25037-8fc0-4dff-94ce-4a38de71edb7", "comment": "Malware payload (Mirai)", "value": "c3943d777a30ff7ff17f10d2b8a0fbb72fdcc9c53aacd5600f5b7a889cdda132", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775663798, "uuid": "d89154da-02e2-4af6-9db7-2e41e0f0d0fe", "comment": "Malware payload (Mirai)", "value": "3f370161c9cf90fa6c374fd5c634e09c4d694ecc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775663798, "uuid": "e2a29bae-7ebb-4f3b-9a4a-a4ddc94d6536", "comment": "Malware payload (Mirai)", "value": "013b1e005a1655c2795803ed3ce9deaeb4c77691c7a8b23deca36259fa2abf00e1c9d0cc5d66b2d4788ddb7034348ac9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775663798, "uuid": "55d2115f-4ecc-42b1-8775-9f410a1dde08", "value": "T12D731782F98B45F5D907493060ABF63FDA31E579407097ADEF4EAF34DE23A01921624E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775663798, "uuid": "17792a0c-fe1e-4eb1-820b-e224b3d7637b", "value": "1536:0/8IhWh7Iyvz7EydD3cXEq/AxPuKI/v44x/uGWKp:0/VWqyb7EydD3GdYxyw4x/T/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775663798, "uuid": "c4dd0167-44a9-468c-99de-52a1117ec2dc", "value": 74512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775663798, "uuid": "588a7f0b-3dff-4399-82cd-26b8653fef62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775663798, "uuid": "a97d4f3b-e771-4e7e-aee9-9e8c713e496e", "value": "db0fa4b8db0333367e9bda3ab68b8042.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25be46a4-3302-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775621974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775621974, "uuid": "bb4455c3-5625-4ba7-a3a3-f4a843f2d18c", "comment": "Malware payload", "value": "8912a40520758cf37f1d396cf44898e9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775621974, "uuid": "00dfc6c5-bee8-40a8-b4b4-2cc18812f1af", "comment": "Malware payload", "value": "c3d6e88189e762ade746c397e9e4d06894b9fbcce3693de91e9c4b1d960f98bd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775621974, "uuid": "d46c1394-9bc9-4b1f-b1d0-d57fd0f9e0d0", "comment": "Malware payload", "value": "954f2af43f023882275dd9bdde4ca472d4682972", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775621974, "uuid": "926db872-4a26-4c90-9236-6cc88f441e0c", "comment": "Malware payload", "value": "f638a7800dfbfa91f7ed63409daaaf633fef2e16380557a6e1fbe8c09c7dfa4e526fe43b18c59ddc0881f4b8df21041d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775621974, "uuid": "fb9e7122-31da-4c5c-8e49-650e79099d2f", "value": "T188136D6566913C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C19A9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775621974, "uuid": "d70764ca-52b7-43ce-a305-5e7d61024941", "value": "768:bqXRWNGxVt9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bWlxoco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775621974, "uuid": "4f84fd54-3262-4ea3-8595-39b50f8336f8", "value": 45526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775621974, "uuid": "0cfae16e-8aa4-4b38-8f1b-26dbc79e783b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775621974, "uuid": "4c40658a-5b04-4043-867b-6e3b48a29ad3", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25201fe3-335d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775661057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775661057, "uuid": "f34ece43-f66f-412f-af26-9d199969069d", "comment": "Malware payload", "value": "8456f2079e040678cd8bb6be1db26a57", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775661057, "uuid": "8f153a95-a040-46e0-a778-70f68dadf613", "comment": "Malware payload", "value": "c41f09b3991b02973b52a5af79e782f21b5696eef7b556c97fb73f80dc373a2c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775661057, "uuid": "791d9f13-af5d-4924-b1be-b8252cb66345", "comment": "Malware payload", "value": "eb3c1ca2b24c3d7a0ed35fcd14ecf06364b537fb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775661057, "uuid": "3339e82a-81b2-4c4d-ba55-46be65210130", "comment": "Malware payload", "value": "4263de9212c349c1ccc01cca4c531292cabdc21602c2bc4a70ec1ebc00888ba03404e94f431016bedea37725ba7c8e62", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775661057, "uuid": "8f96244c-7132-4d6c-9169-7d919c056d44", "value": "T19206021189C87FB5CFEC561C80FE160AA3F04E8B5416798DFB33BD4AAFAB6445217189", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775661057, "uuid": "39169893-76c0-4443-9bea-a18d93ef94c7", "value": "49152:I3ZjwRXP6W+RyJpNVKidMsRDw6tvlRGNATVJ:f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775661057, "uuid": "904cdf2c-9193-405a-b7e8-67a262a0b314", "value": 3843959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775661057, "uuid": "d7737adf-0708-40ae-8585-3f47c29ce93f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775661057, "uuid": "9d44947b-5209-49ee-aa86-40ce4872d0a0", "value": "Fabitrade offer request #07159.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "216c5f1e-32f0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775614235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775614235, "uuid": "e37f947c-ba87-4488-805b-34a161e244e4", "comment": "Malware payload", "value": "2137866321601bb1eed0dac46d2208eb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775614235, "uuid": "f31d80aa-ccdd-4454-8671-d6a5ec25c7b5", "comment": "Malware payload", "value": "c44e26f74ce9876b57dae188103453d6904101044c723e5a99862146a2c49f0e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775614235, "uuid": "0194bde4-e560-4f5c-a407-741655d5a016", "comment": "Malware payload", "value": "28b1e1ca6007bb49a442a9c0aca73ad88f9ae20f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775614235, "uuid": "fd35f9f6-fc6f-4ac7-ac4b-9c21b3180698", "comment": "Malware payload", "value": "7afd91a3cd4f47ede55bf2a5f0acf5e9dc637bf14e5b49d8bcf9e3e30c1867ef34439cbfadaa42fe7de1b0dc0b37d375", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775614235, "uuid": "52e11d36-c8d4-4a54-98e0-24ffb8649742", "value": "T19A2125F5B3206A34754B882D737AE9A48B435D3B082C3B87F48DCD205B5C49DB244B20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775614235, "uuid": "57b56025-eed1-4753-b53d-e0824d0611b0", "value": "24:PHQXuCSDfCuiVDNn1eyuCKIquJZp5HpuCSAzcYpuCSAemp5uCSLr:Qu/DfCuiVDNFunIdJZpppu/AzJpu/AeD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775614235, "uuid": "e9899ac6-a946-4c66-be3c-bed71d2165ec", "value": 1117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775614235, "uuid": "1e381354-4dcb-414d-a1fe-01c9ec9c64e1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775614235, "uuid": "15ce237c-60f1-4e7e-ab70-11c9a0b1965f", "value": "bot.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eec7990-338d-11f1-a769-42010a9c0008", "comment": "Malware payload (CobaltStrike)", "timestamp": 1775681716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775681716, "uuid": "148088d1-fda8-49df-845e-4dfb6b079614", "comment": "Malware payload (CobaltStrike)", "value": "eb1e6248e0dcc033a2b2bd7c9116af03", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775681716, "uuid": "325988ae-1388-49ef-9efa-c6fc281d634b", "comment": "Malware payload (CobaltStrike)", "value": "c512455e6c8f91b294d5a2dc6d7457bf28f2424098bd6659e157857399802f90", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775681716, "uuid": "7d7c5b25-5980-4062-a4b5-c991bf0c472b", "comment": "Malware payload (CobaltStrike)", "value": "533a51121417ab9d20be35ef54ef2eaf0d8b3a4b", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775681716, "uuid": "11c210ae-9936-4d02-913e-71589aca269f", "comment": "Malware payload (CobaltStrike)", "value": "cd2832c1d961025dcf4719c0edd1855a425febffceb8b45c60a31dbdfd9d0e93f8c05a2db2fbe731a71b4584acb4973e", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775681716, "uuid": "1e1bca94-c2ce-497d-b5df-be388dda2c7b", "value": "T1DF92D93FE71368E9C106D5B845FB3732DCB279B385E6931E1724D2B42E102A46EAA610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775681716, "uuid": "4d489e42-11e8-443c-a6c6-9745c2db143c", "value": "147442e63270e287ed57d33257638324", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775681716, "uuid": "ad5453ce-e468-43bc-b904-520373ec5073", "value": "192:0V7qaCF6Op1t2dobVXujRDcBaXWQjwOT/2q6E7ZnWF8qa1Dojjgi:mqaCF31cix+Dc4zjkEVWFF46gi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775681716, "uuid": "dbd9c95c-d38e-447d-93df-9ed8ab6b09de", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775681716, "uuid": "51ed2ae4-74ee-4718-af48-cbbdf4cdc776", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775681716, "uuid": "8c2f9c1c-c451-4a47-9bdf-f12eb2b341a6", "value": "c512455e6c8f91b294d5a2dc6d7457bf28f2424098bd6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb691802-3326-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775637687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637687, "uuid": "77a55dbd-31f7-411b-84d8-07a0f2d73ed7", "comment": "Malware payload (Mirai)", "value": "30168ea2e2a547c183b239e2c668687b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637687, "uuid": "2690ddb4-3777-4229-9860-4d40265d6e2e", "comment": "Malware payload (Mirai)", "value": "c579757d3487fd0c66c9001bfe4d7275fc9589ae86418f359eb2dbb3577cd387", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637687, "uuid": "de664b6a-1dcd-4be5-ac58-78c25d33d8a9", "comment": "Malware payload (Mirai)", "value": "b6aa6b3f580eb3179c15d6b4e3c6694f2a24fb55", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637687, "uuid": "e31f5565-58ad-4ceb-b7d3-8c3fd53bce37", "comment": "Malware payload (Mirai)", "value": "66109b9d478735e1017486d3084b35d5582ae1b7fc0c1955c71cad99ae3238e5a4fc92e3bd3822327c63f0c697df5f8d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637687, "uuid": "4a4d95ec-7ea2-4395-9177-685e0ef01f0d", "value": "T15073127221A6EEB2C5F2403263437D8A7D23C8BA037456BDBD79976FB042E119C0D65E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637687, "uuid": "488d6174-8689-4bd5-8231-16c8630707a6", "value": "1536:H8zRnwvX0/jMQwZuOPFPijvDMwhQi1rYGhQZ9zWmHlo6ord:czRnwP0bMQ2RijvDZZ1rYGhG13zSd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775637687, "uuid": "f65e3483-ce2d-4b93-b55f-6ce309e6750c", "value": 74780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775637687, "uuid": "af0db0e8-8ba7-4a59-8ee3-53a1136e4177", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637687, "uuid": "a7c678b3-a9dd-4b82-a4cb-134fb143de8c", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad1e5150-3334-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1775643676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775643676, "uuid": "62063020-4c62-4746-9607-2c608f9aec7d", "comment": "Malware payload (RustyStealer)", "value": "d525e1d8f93439a6e5cd87d54ac82b4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775643676, "uuid": "c9ea3394-bdd7-4344-ace2-5fd06106b0d7", "comment": "Malware payload (RustyStealer)", "value": "c580825ba33b3d197d74c7ab72d19f5741cd5069d6ff18ca3373c421e6450365", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775643676, "uuid": "86353899-b848-4d9d-b0be-a79afc3760a6", "comment": "Malware payload (RustyStealer)", "value": "3b0e9add7e9300b2da73a423c0df226c91c50e28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775643676, "uuid": "d2f71282-f8b7-44b8-bd97-cfdad6f2ffaf", "comment": "Malware payload (RustyStealer)", "value": "f07b15976f775a11c915980e2fbb65bec4fe635b934a7687c19cba97be361f945abdc7ab1402087166fd81dc6f31a2ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775643676, "uuid": "2eb5f60c-5e34-4885-86b5-911920828ee9", "value": "T186C5120466BFABF5F674CA7406414F7C08F2656DB056429D3F8A33E97FC90B5832A298", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775643676, "uuid": "5c84e947-34b1-4daf-be2a-6302096d00f5", "value": "82fd9f56b5f7529d49a0f63b8ee9dd8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775643676, "uuid": "c38aafc3-29af-4dd8-b5d2-cef8e2eb16bf", "value": "49152:hBU216H3WBiNkK8RV3ts7zafCpHENtJXRksN5exK9PI1ca2NCH+dWY:f6XWUNkhBAcJhlN5ex6PI1ca2NNI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775643676, "uuid": "441c4f91-21cc-406c-b93e-0b91daed794f", "value": 2698240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775643676, "uuid": "77b37499-acf0-477a-b4df-f359bc4bc5de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775643676, "uuid": "aed0b5b1-007b-4efb-b761-e66486af9cf8", "value": "Xenostarrprer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "402ff573-3317-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1775631037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775631037, "uuid": "ecc50f28-08d5-480d-acfa-272b2cd15666", "comment": "Malware payload (ValleyRAT)", "value": "a16be7d105608808ed40761a1a33dc1f", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775631037, "uuid": "e0e62a77-85ce-4ca1-956f-b41288be8eed", "comment": "Malware payload (ValleyRAT)", "value": "c6d11a362a134273a3241c2ff19ef8d8dd6679af50c4b0acaea60ec8f62c51aa", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775631037, "uuid": "9a567fda-a63c-43d4-a97c-d15e71a92737", "comment": "Malware payload (ValleyRAT)", "value": "585d98121001d7318a9f3ad837db9660c00597e1", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775631037, "uuid": "fe31f67e-0e53-4318-961d-1dbc4dadbe5d", "comment": "Malware payload (ValleyRAT)", "value": "1c917868b554f0df20fabe385e3233ca693bb265bf71baa161da1da9ca0f326c86d465ec115939f96d43803ace335183", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775631037, "uuid": "8e12de7f-5037-41a3-a7d2-107a228af2e4", "value": "T15CC53343749CD527D2E3A372CEB3661819B8EF6A4EBC467839D8B51EBA7405323813C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775631037, "uuid": "7513427d-ae28-4b91-9c9a-f97c83a3464e", "value": "49152:I+owiF1p3wGtWkOfWfgvqzhDjJDjV1gIY0PDAAWj4gFO1JQ:IPwizp3LMkOfVqhj9VeIhAAvnQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775631037, "uuid": "f8c04407-871d-4aa9-85e8-ca9499ae2131", "value": 2617344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775631037, "uuid": "5ef3f819-5877-434b-ab55-858d16c07a36", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775631037, "uuid": "4ce707a1-16a3-431b-99c8-6df4595492b3", "value": "\u7b80\u4f53\u4e2d\u6587\u7ffb\u8bd1\u5305.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3dc3bd0-32ff-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775620897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775620897, "uuid": "5eee28a8-bfbf-486d-8ce8-8846bdcdbd97", "comment": "Malware payload (Mirai)", "value": "b3f846ba1d4fcd5a82f5dc525897be18", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775620897, "uuid": "edb82e40-7410-4b58-8009-a2dd08c3fd3c", "comment": "Malware payload (Mirai)", "value": "c8f2f20c79a68a6f715c74fcde576d845c445812380818733460d357ed11791f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775620897, "uuid": "f32fbb04-1f92-4cf4-8e25-95fb24a67435", "comment": "Malware payload (Mirai)", "value": "12012f06e97fc6eff1f8f2b6a6bb6a2cbfa25728", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775620897, "uuid": "5480618e-f33e-4ba5-8abc-2f42ab720ada", "comment": "Malware payload (Mirai)", "value": "1402652c43aec7eb47e30af2606353965cdbd181795a049e95f8b5041e631d22d83d7a4a2ae73cb8e3d07398a3b3c91d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775620897, "uuid": "70fdbdda-ba5b-48e9-80b0-f56db5d692cb", "value": "T139D35B46EB808E03C4D5137ABAAF41493322E754D3DB330699185FB43F86BAF0E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775620897, "uuid": "86805f01-6730-4b4d-8f1e-de031a952125", "value": "3072:ho9lg+zhz3sJu1NHLL8XmiC/glLCZTVHHlOM/9d0Yj:W9lgahz3sE1lcmiC/g1CLHHcM/9mYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775620897, "uuid": "bcab3dc6-4c07-40cf-94f4-943a810586a4", "value": 131898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775620897, "uuid": "ce64ed80-5a07-42ef-a02a-2b37eddb188d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775620897, "uuid": "0f812957-7c92-42d1-b604-ffa9502a8f91", "value": "jew.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb02e497-3331-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1775642437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775642437, "uuid": "11d73ac4-a649-474c-8a57-e52d7fff6be1", "comment": "Malware payload (ValleyRAT)", "value": "9e92fc8ac8e578f93582645d499ad198", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775642437, "uuid": "9a97ccd3-8929-4425-a08a-ba2874093b74", "comment": "Malware payload (ValleyRAT)", "value": "c8f77835cbe25f8935d2d5a72bc6ca6cb10c449cb2b507d5c781ba983ecf69c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775642437, "uuid": "dc2a5d8a-b1d7-42f9-b50d-9ade9915b4ee", "comment": "Malware payload (ValleyRAT)", "value": "558c5bd1a7b85e6b2aeb9d91e18c2566545439f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775642437, "uuid": "f5d508c4-187a-488d-90fc-199620159710", "comment": "Malware payload (ValleyRAT)", "value": "1b863e78e8457d9688f6de974774626e592029d90447732f0739e88fee5dd9965e96a7fe589f5533964baddaac3e6e73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775642437, "uuid": "0603f677-8150-4aa6-99eb-a0b11785be87", "value": "T1DC74B003A2EC3CEAD0768275A77743C6D72EEC5513A1C69F02D002969E3E693793A7D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775642437, "uuid": "76b950d0-a76c-49d1-b5c4-d46c4a0e5917", "value": "13f3c1e33fd6792e7cb512ddb889dd46", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775642437, "uuid": "5f3d7611-4b98-4d10-b239-3f78df65d690", "value": "6144:3CZohuFpe8damq5Xey207pw7QRj9z5sc7653gfQ:ioUFpe8kJXe/0ekZ1v653gY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775642437, "uuid": "99d91535-1325-4572-a1a0-41beb8ac7188", "value": 368128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775642437, "uuid": "dfe92218-282f-48d3-9348-8c2528460c71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775642437, "uuid": "abe57910-0b6c-4e1b-ad6a-41b5d9ccc7d4", "value": "c8f77835cbe25f8935d2d5a72bc6ca6cb10c449cb2b50.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a118bc73-3352-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775656540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775656540, "uuid": "d727d081-1121-4934-87e7-d6e29e34bdfc", "comment": "Malware payload (AgentTesla)", "value": "55beaa03d4012b3e26e381a7f3885b37", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775656540, "uuid": "5d41c02e-b6d2-4745-852b-f5444072f32f", "comment": "Malware payload (AgentTesla)", "value": "c956d0c57e03a0eddc3b6a4dcbea2e47164ddf5b7ea0cc953d5875f6e9a699f1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775656540, "uuid": "59b3cb47-b0ad-45b8-a412-5d0baf67e96b", "comment": "Malware payload (AgentTesla)", "value": "7af7cb1b3817c9b59f5ce796868e25dbdb56200d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775656540, "uuid": "f06273b5-266a-4173-991d-79382d1570c3", "comment": "Malware payload (AgentTesla)", "value": "6da05cca75d5adca8fe0a4f6758d9ec9e9efff4ee33bddcbe2adabcea6bd5e76cccda9dd7570d72c971246bdb370ec87", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775656540, "uuid": "7219a27a-a1ce-4b7d-a475-1c4a190372df", "value": "T10655025489C43FB9CFAC5A2D40FE260EA7E0498B5016A989E773BE0AFFB7504511B1DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775656540, "uuid": "b4e7cf58-a537-4b72-b1a2-06318b1ab00e", "value": "24576:coesbmHdNGmtDSx1RvIIDwZMtRBqXgISrfK/18A:coOu1fjz8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775656540, "uuid": "6b0cbc59-77e8-44f6-8535-fdb3bad433ea", "value": 1385390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775656540, "uuid": "97ee97cf-276d-4b6d-be5f-ccdc515ede81", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775656540, "uuid": "2019d421-0ec7-441d-a61b-8a790bf5d49c", "value": "Purchase Request_2026-04-02_FIN_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7554d572-339d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775688679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775688679, "uuid": "0e6cc7e8-62de-4134-8950-f93292f56d50", "comment": "Malware payload", "value": "f293ff37dfdd9ca28e4194fce20083cf", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775688679, "uuid": "1d7c1503-cdeb-467e-97d4-84f5936887f9", "comment": "Malware payload", "value": "c9c7753af46daad3461031a3d1a579898aee718cd47e0439089c651a2f6fc620", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775688679, "uuid": "f7613910-3a04-4984-95f2-6e8ca52c34e1", "comment": "Malware payload", "value": "48effcfd789ec42098f90047d25b7d6b0eaa1b99", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775688679, "uuid": "0ed61cb7-f735-4778-8259-85761ebbad78", "comment": "Malware payload", "value": "cd6dea26404f9145e81a76be380a6bf8332904648ff5b428591b6e8a67470f6cbe76af82e052932f49b55cfe926a5818", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775688679, "uuid": "767d64f4-f576-4872-a0f4-75683cacffdc", "value": "T1EF137D6956857C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C49B9CD219B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775688679, "uuid": "803cd7fa-1aa8-4d68-ba3a-60fa1cb71078", "value": "768:bj+X9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bj+gco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775688679, "uuid": "16e56d6b-e85a-4698-9df4-699b106a9653", "value": 45506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775688679, "uuid": "78389094-1bb2-49c4-a275-f201017d1109", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775688679, "uuid": "45f27304-92a2-4037-8fd7-77ae3c53a4d0", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74dbba92-3369-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775666345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775666345, "uuid": "44b41d67-a76e-4b1f-ab04-c2918d8f2d7b", "comment": "Malware payload (Mirai)", "value": "63ae6eafb3dc148b1716db6106f3f039", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775666345, "uuid": "93b5be5d-42b8-4355-916d-2b540bc04273", "comment": "Malware payload (Mirai)", "value": "caf4993a9aa7c39adadddb8523f10a47eac229e4c50610c876dc32a3d0a17bcb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775666345, "uuid": "b6434719-82f5-405f-ba9a-c2b72213c0cb", "comment": "Malware payload (Mirai)", "value": "db273e27249aef0817be294f71b0796b807c8094", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775666345, "uuid": "2f532a7b-ba94-4ea0-ae08-beeb85d9cac2", "comment": "Malware payload (Mirai)", "value": "b2758b71401dcdcb21837992087800e66450865092084e4fcb4aee9ba3bb2eadd373d560eb847addc59bed7dbb710a1d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775666345, "uuid": "568610a5-8f62-48ce-b2e2-55e75934eed8", "value": "T13E6302BC72EB8034A0DDF5322A4F21303331D766E46F53EA3D89B5EDE2524980957E68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775666345, "uuid": "c6ee3902-8a42-48f0-a66d-fefffade6638", "value": "1536:0ltrI7mDmde7Lletk8cghgLFPjihgulh6DoIVp5wS7rPn:0l+YmdkLMk8c5PdulIz5wS7rPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775666345, "uuid": "389ab32d-46fc-41ce-a202-c4911dfcbb2d", "value": 70848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775666345, "uuid": "ef29889c-bc1d-4e92-98be-f974237a0def", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775666345, "uuid": "c8e3a4f2-065d-44e4-bd39-f6b87a1d0f93", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d99c824-3323-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775636133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775636133, "uuid": "cae2ba89-238b-410b-9dbf-4f866a457508", "comment": "Malware payload", "value": "4e6da2ef12a8e49e24e730cbeac15010", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775636133, "uuid": "6cd423b4-9b2e-44aa-9f7a-cdc24b037562", "comment": "Malware payload", "value": "cce0185ccab845319366df7279644a7778db031e046f4f3af61d6df24a0751dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775636133, "uuid": "f08a2bb2-06e3-4616-967f-74e17fd2db73", "comment": "Malware payload", "value": "a03d0856703dfc8fd383d498bc23766ff178aab0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775636133, "uuid": "18adf4d4-addd-4d5f-a536-54dda3d9eeae", "comment": "Malware payload", "value": "101a77059e8751eec4b34907c176fde6980b277dd7a7972657b8d1a39bfad255e60427675fce9443758ec7cc008a03b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775636133, "uuid": "62dd15f5-b8f7-4bd8-932a-b2840596f464", "value": "T1AF873A43F8E21DA4D4EAC670D1658167BAB23C2C1B7C23DB16A0F7241F3ABD06A76751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775636133, "uuid": "210c2b17-319a-4be4-95e7-9af8ee00d852", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775636133, "uuid": "5aeb570a-5a13-4694-9d14-21be2fbeebeb", "value": "393216:bm3eddFLgSVI+H+O2VADT3SYDw4MBTtc:bmWZ9VIhO2VoT3SYk4MBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775636133, "uuid": "654d6ba8-73c4-4750-a527-e042a051731f", "value": 36937728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775636133, "uuid": "5f8b2600-a807-4229-b888-15d0e2eb864c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775636133, "uuid": "d647d926-ad86-4ad5-bf7b-78af4087e24b", "value": "update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2d04622-3368-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775666019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775666019, "uuid": "cb9c05eb-2a64-4542-a5d1-29a613fe3439", "comment": "Malware payload (Mirai)", "value": "ac681541759972f7d86851cddad6e97c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775666019, "uuid": "666b19bd-3d7d-4e7e-91e8-c8a40e4bf5bb", "comment": "Malware payload (Mirai)", "value": "cd338c544751e08030dafdeab1049f44159b26d36f857fd042d99a151f4adb99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775666019, "uuid": "d8a5a372-fee7-45fa-a964-75a881c928c0", "comment": "Malware payload (Mirai)", "value": "52b9f19d19cc63c88ff2fe8a406a60d41953c3bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775666019, "uuid": "7698ec44-6259-4b13-b312-aaa653db5c6c", "comment": "Malware payload (Mirai)", "value": "709f9372d072475e5e06e73ef66f685d464287551586423a6381701b13984e20909e32bdaf7a44a50c4f7776ce44e56e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775666019, "uuid": "4ee61db6-1f79-494e-a949-7b36db9b54ab", "value": "T1DDC3F185FB636991D0A342FDA4C00AC387912E318BA217480699F774387DDFB1F69DE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775666019, "uuid": "626726a9-0ec2-4bb0-97fe-5b0f9e9629db", "value": "3072:SBdQK+TG2nIjnRdZaUXUSgkLCCVwHWiEiBtbMMTnd:eMQRtXU9kLCP8ifbxTnd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775666019, "uuid": "f103fa22-4c54-4812-ab20-c25d3d66877d", "value": 127816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775666019, "uuid": "3f5f1d23-3758-4add-b15e-b879a7ce9a78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775666019, "uuid": "4d1d46b4-9b11-4bd2-9a11-2f5832b77833", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d80cdb28-32de-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775606811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606811, "uuid": "4b6227f5-a320-4178-8d8b-18267c95bbdf", "comment": "Malware payload (Mirai)", "value": "c90055e53507ef4e0e50ff032dd2117b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606811, "uuid": "e15d4559-5e6c-4fb4-8b4b-39214c2db658", "comment": "Malware payload (Mirai)", "value": "cd6ab1ae78b810d0840c64270a6506a753befecad64eace6c1101e2a2713574f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606811, "uuid": "e1b72dd9-e313-4a14-8d30-0c8c52a80677", "comment": "Malware payload (Mirai)", "value": "522ba23b3c3563e4f14277de89d77731d48f25ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606811, "uuid": "f0565431-03c1-4f7a-8278-a1ab80851b7d", "comment": "Malware payload (Mirai)", "value": "1d9a7e92278fddeb2a7b20e4dae407aafd48660922d0b289a222af90772a3567475c677886eb9fe14d7a907f01e427b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775606811, "uuid": "619c7110-bf2c-4c4b-b2d5-989affd8e574", "value": "T11A14D70A6F618FADF679C7354BF74A24E7A862D613E2D545D2ACC1101E203CE5C1FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775606811, "uuid": "08893475-a75d-47e6-ae53-a45bcb771a44", "value": "3072:7fltNgPsnpXTGOsydlx1hJTxC1cfFR2WaWmr6rYji:Ng+VGPynx1hC1cFa7r6sji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775606811, "uuid": "33417928-d9c5-406d-9f75-e8d5a52add7b", "value": 205024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775606811, "uuid": "5126289a-e946-4cc3-83b1-99bc415c0584", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775606811, "uuid": "dfe32a46-8835-4e17-8b43-bbfaf9cf4231", "value": "WZQU", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f0e6fb6-3366-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775665019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775665019, "uuid": "bc9577c2-246d-4f73-a359-e0011fa01fc0", "comment": "Malware payload (Mirai)", "value": "c442f2c55e915f587243738262b1920b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775665019, "uuid": "659a35ce-00de-4abc-9f6f-093f02fc1624", "comment": "Malware payload (Mirai)", "value": "cd7a0e9a4bc0929cbe721b5a1db2d17cb45c3f50d42be0c091729bc360306999", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775665019, "uuid": "e7dcac70-8220-4f44-99f4-fe2911fe4372", "comment": "Malware payload (Mirai)", "value": "c2d7368ea88f27370f61a4a806774027da40a901", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775665019, "uuid": "288b74aa-f7d3-419d-aacc-9166bf6ad5f8", "comment": "Malware payload (Mirai)", "value": "dc129e3c6e1150d0f3c0f0d61e42e728d463cd065a1c380bebd5ad2c5b2de0d24e46084bb8998f25fa2a3119f405c143", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775665019, "uuid": "153fae52-9b26-49f8-9842-7e939ce6bd29", "value": "T19653AEB3D4285C90C6A94139B9E5CE382B53B10492772DF55D5A8FB6A007EECF2093F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775665019, "uuid": "ecae96f0-66d9-4d9c-bf17-201e864ecf4a", "value": "1536:s/MM0k1Efa2wt4Bb7bi+oNwBnCUkI3pAC2L:sUMvqfh3/WkCUkI3pA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775665019, "uuid": "c95e7314-6eda-4216-be1e-701b596a2b56", "value": 66564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775665019, "uuid": "67f2ebd9-d520-4eda-9cf8-efb46569124f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775665019, "uuid": "bfee4db6-d2ec-44f7-a49e-314e59f3d548", "value": "db0fa4b8db0333367e9bda3ab68b8042.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "131dbfe0-337f-11f1-a769-42010a9c0008", "comment": "Malware payload (Heodo)", "timestamp": 1775675629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775675629, "uuid": "99fea66c-68d4-4ab6-bd03-a0283a294b52", "comment": "Malware payload (Heodo)", "value": "e629f89fcb0f0b5d61c9fcbfea9ea274", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "UNIQPREM.file", "colour": "#C4EDC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775675629, "uuid": "d61212b3-1c82-4aa2-951c-dcfe76e91159", "comment": "Malware payload (Heodo)", "value": "ce3575f1d6e6202543cf5983b57c9d1f1d63b9b9d821ea102f85e9b57856e7dd", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "UNIQPREM.file", "colour": "#C4EDC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775675629, "uuid": "cac03343-fa56-432f-92bf-510093aed6b9", "comment": "Malware payload (Heodo)", "value": "d3afd0ba5d74f54d92bcecee682be67efbe7c1c5", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "UNIQPREM.file", "colour": "#C4EDC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775675629, "uuid": "e316c032-ea02-41e7-b795-8a471a090e16", "comment": "Malware payload (Heodo)", "value": "1d209cb1963d258e776a3169f8213f2d76e1f17e4759f2dee7982ce7be5531aaf4b558dc46760bc730bb5dfebd95405a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "UNIQPREM.file", "colour": "#C4EDC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775675629, "uuid": "14dee7c7-0664-4403-8893-3cb314586aa6", "value": "T1C3463302ABEB11B8F2762D355DA5CC905D777AE515FED8912DB0C80E04BCA4A9C39F83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775675629, "uuid": "7fd5ba45-52a7-4ff4-91f8-ee7edf374c18", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775675629, "uuid": "cc27d7a2-ee4f-4601-9797-d27b359258bc", "value": "98304:vO7Xr0otIEmp5YWrKQ+mTrFpaRte9FOAulX4d:vA7VtI9AcT+0FpUwd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775675629, "uuid": "d90b7b89-aecb-4aa6-9648-6ccce61a80ab", "value": 5807231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775675629, "uuid": "2bf239fa-961f-4093-a377-cfbce754c443", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775675629, "uuid": "76d90cd3-1999-4677-8062-71a3e8f75095", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02ae6041-3353-11f1-a769-42010a9c0008", "comment": "Malware payload (RustDesk)", "timestamp": 1775656704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775656704, "uuid": "965b6e88-e66e-4f08-bd84-8c498e2561d5", "comment": "Malware payload (RustDesk)", "value": "ff8505309831284bff66a1cfd5049dac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rustdesk", "colour": "#17A0F4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775656704, "uuid": "8c4ea669-6018-4c37-95b5-99c4a28c5d18", "comment": "Malware payload (RustDesk)", "value": "d01148808fbeefa22cd4541cdaaee8bc1f74e3045302115dc5b08b99ff93dc9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rustdesk", "colour": "#17A0F4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775656704, "uuid": "391ebdbb-c8e7-4265-8438-2823afcdb07b", "comment": "Malware payload (RustDesk)", "value": "93aa31051cd1bac3bb2ffddb71f93330dcab9d89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rustdesk", "colour": "#17A0F4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775656704, "uuid": "53aa3f24-9440-4bbf-bd98-7f2b188d383f", "comment": "Malware payload (RustDesk)", "value": "6ca2ff3fdcd4d1cbfaf6b07d342d27f5727677116ff5b1e1c71039eb437c46f01268140a85e03ba3813fa81cb5bbdb8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rustdesk", "colour": "#17A0F4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775656704, "uuid": "8845c451-e184-4111-be3f-8d0677472a73", "value": "T134E6F121325EC42BD56109B05A2C9EEA912C6E351FF168C7B3DC6E6E17764D30633E2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775656704, "uuid": "2e9c966e-5f07-4ad1-940c-34b8f0c53cf7", "value": "6d5e13c0269946a5a10390c178d8e9a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775656704, "uuid": "210ad75b-b449-4d91-8964-98ba88186a2b", "value": "393216:YaJ1HSHwSmh3UhzxrY+hyBGih0bRjDHfTczLcpyPjGm6hkDf2B73v:hJ1HSHwSmC+hERffTczLc+Vj2B73v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775656704, "uuid": "3342f397-e83b-4cb0-b6a9-568e6bb7b26a", "value": 14058976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775656704, "uuid": "066e2065-e809-4baf-a290-1421bef83257", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775656704, "uuid": "d705b60b-f0e3-4ef2-8442-265529239767", "value": "MSTeamsSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64784149-3389-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775680061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775680061, "uuid": "0bff4a35-4aaa-4304-a9af-782fcd82c024", "comment": "Malware payload", "value": "d5f060e1a5714603131ea27fd07d01f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775680061, "uuid": "41a5a430-3df4-4069-9391-1b15b074f2ca", "comment": "Malware payload", "value": "d1141527eda59ac84ad2a56869db08c7e236bc0cd8ba606b723b123911239ea9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775680061, "uuid": "881bbab4-35bc-43ae-bdc6-09bef0d4c4ed", "comment": "Malware payload", "value": "d4263f66b2482c32750978f58d2331e15739f68b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775680061, "uuid": "e62bf3bc-7897-4901-b85a-577e6fa33800", "comment": "Malware payload", "value": "91263af2c21e08095953e835005af55b01b6f30fc9fe77df7c24ee0d61eb14f9789768f89c767c59d5d37d4f7f109d11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775680061, "uuid": "693c54c6-8bfe-4983-bc2d-f116a186c86b", "value": "T193E24B09A7ACD22EDAAF4E7D796206111771E7511103CBDA1DCC34FEECA77448621B8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775680061, "uuid": "11b3eb0d-0653-4394-8c4a-bded6f835ca2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775680061, "uuid": "1206a731-63b3-4fd0-8824-e92c10330e9e", "value": "768:omQZqx1lYcTYbFyf0cRPw19wB1XbYC1ekJV:o0lY3cRPLbpJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775680061, "uuid": "1cf74405-14bc-4b23-9480-aaccea5393c9", "value": 33792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775680061, "uuid": "f2e7cb23-4713-4adc-a956-baa6bfcca13d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775680061, "uuid": "6779170a-d8d5-490a-a29c-1ff9117404b5", "value": "microsoftceo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4b25b09-32de-11f1-a769-42010a9c0008", "comment": "Malware payload (Ngioweb)", "timestamp": 1775606832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606832, "uuid": "f7fda7f0-e35e-435a-adda-0b7a5b86f964", "comment": "Malware payload (Ngioweb)", "value": "397aba52f8fbce51521758597976978f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606832, "uuid": "9976f4d3-5950-4135-9990-d772517e32be", "comment": "Malware payload (Ngioweb)", "value": "d328a8df797e9a5c3c2f282b014f7cf538e141143a3054cdb542ca360d43b624", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606832, "uuid": "7de8ee24-ab6b-4792-828b-5b7460c0a2a3", "comment": "Malware payload (Ngioweb)", "value": "7b7359d43ae064707e16d58df4737f24ff7e6be4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606832, "uuid": "c409fdb2-e315-4dfb-b05e-ffc1839c9bf4", "comment": "Malware payload (Ngioweb)", "value": "cd72a15df5a0db257b7ad4b8294b81ac1d9cc6c5a224016153116a022646a2ba7b59f8ea771b062f2c4340e106f6c634", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775606832, "uuid": "e519a16c-afab-446c-abb9-cb066d5cc919", "value": "T137B36B07F9C444FEC4D5E1708B9B8217E537F0D452387BAB62A98E622E26F305B2D790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775606832, "uuid": "1962ddf8-0e2d-4839-bab2-9696beba6682", "value": "3072:YCpskAEtwyUzLrglUHz05jo+00lOpoEOMYJKx:YCqkAEhUP82ARRshYM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775606832, "uuid": "23e857c4-4cc0-4d8e-958d-9ff9d9655a23", "value": 108024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775606832, "uuid": "6435e928-56c9-4456-a668-bd6a43456a7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775606832, "uuid": "2bd78761-0d46-46fe-9354-6972cda6d7e1", "value": "YJPA", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fca4367-332e-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1775641076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775641076, "uuid": "10233f5c-9b38-4371-b47d-8bea870cfa99", "comment": "Malware payload (NetSupport)", "value": "7d60d78db2c86ba4871eb03b94e9b27c", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775641076, "uuid": "ec923057-aff2-46ae-8cd9-18f2283e569c", "comment": "Malware payload (NetSupport)", "value": "d38bf86953ccbdf85f3f371cc196abc43d415d5ea19751181551a0e530662083", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775641076, "uuid": "b6915259-bcfe-4475-976d-6dd14a889650", "comment": "Malware payload (NetSupport)", "value": "0280af015f5fc882ac11a4942df0e0383c17b8b4", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775641076, "uuid": "e4ad8e92-e9b6-4217-9f15-e16e720d1ce8", "comment": "Malware payload (NetSupport)", "value": "7421c654bfa22ebeb1f47f54f353c3e1c0657d344ad7ea4fe9059f8e658a23f0bb4f4007a2b99338606a9d0d8d3536df", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775641076, "uuid": "d46ef489-ef56-4c60-89d7-76a4eecbbe2b", "value": "T127A0112A22280028AC208338000E08A8A20002082020A0822BA3282280A222CC303023", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775641076, "uuid": "595f7db2-28f0-45c8-b243-9376949e80a9", "value": "3:VSJJFIGthMLkCmw3HFMSXwA8SEwKOqLVT:s8GLMLkloH2StKOqJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775641076, "uuid": "6cde878b-e7c6-455f-bf94-cbdb43c6307b", "value": 81, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775641076, "uuid": "b673024f-d108-4173-9573-1f733aedcb48", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775641076, "uuid": "e4749cd6-c208-4892-8571-fc2b57568094", "value": "iridia.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4b61064-3326-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1775637783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637783, "uuid": "c54ef3b6-2008-4f08-87b6-33a73efafc9a", "comment": "Malware payload (NetSupport)", "value": "12bbf1d3bb23cc5bf31acc9c8fcdc003", "object_relation": "md5", "Tag": [ { "name": "5-188-86-165", "colour": "#DE80D8", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "hsgeowvi-com", "colour": "#212A9B", "exportable": true, "hide_tag": false }, { "name": "lkboasprqw-com", "colour": "#1C34F7", "exportable": true, "hide_tag": false }, { "name": "lkhpihf-com", "colour": "#C1C187", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637783, "uuid": "f590eeaf-ddbf-4832-8c2e-99cb1a257a41", "comment": "Malware payload (NetSupport)", "value": "d3bf48ab0badab57f98d2d83ebf5094e568c24a3c22706f1a62f377d0738c262", "object_relation": "sha256", "Tag": [ { "name": "5-188-86-165", "colour": "#DE80D8", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "hsgeowvi-com", "colour": "#212A9B", "exportable": true, "hide_tag": false }, { "name": "lkboasprqw-com", "colour": "#1C34F7", "exportable": true, "hide_tag": false }, { "name": "lkhpihf-com", "colour": "#C1C187", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637783, "uuid": "771edcf4-8583-432e-84d2-e68effb0fa58", "comment": "Malware payload (NetSupport)", "value": "6f9f5f90ff3ff4f6e59311e0358075aa1db859a3", "object_relation": "sha1", "Tag": [ { "name": "5-188-86-165", "colour": "#DE80D8", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "hsgeowvi-com", "colour": "#212A9B", "exportable": true, "hide_tag": false }, { "name": "lkboasprqw-com", "colour": "#1C34F7", "exportable": true, "hide_tag": false }, { "name": "lkhpihf-com", "colour": "#C1C187", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637783, "uuid": "62f9e5e4-0c69-4a2e-b839-37e8daa48b34", "comment": "Malware payload (NetSupport)", "value": "ae29ad2f5553392720facdafe089c74bdd4470be252f1f32a8b87db9494d08b8b14007a9bd9307851c68804025ed2593", "object_relation": "sha3-384", "Tag": [ { "name": "5-188-86-165", "colour": "#DE80D8", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "hsgeowvi-com", "colour": "#212A9B", "exportable": true, "hide_tag": false }, { "name": "lkboasprqw-com", "colour": "#1C34F7", "exportable": true, "hide_tag": false }, { "name": "lkhpihf-com", "colour": "#C1C187", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637783, "uuid": "5083131a-7ff6-430a-ad45-6518518d4744", "value": "T136A5339A9A0D88DFC55B4F74C00B5E1AD73E3A40F1AE7080F6724252CD89B9F57B8719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637783, "uuid": "b9521740-cfe3-4092-8497-9251b3ec6d9b", "value": "49152:enWKcquaKYrp7InMVnJTmm3F+WVcBdj3b2+3bw/0JBAThAnE1N9R:e6quPS8M/VYj3b2+30/wBeVR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775637783, "uuid": "1fd2656c-bebb-452d-892e-29a858a31080", "value": 2201574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775637783, "uuid": "ce7b1b15-0ebe-410f-8b28-e2f908b72085", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637783, "uuid": "1f124693-20a5-4535-ba3f-80717ca1a68a", "value": "gggs.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94a362b6-3374-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775671122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775671122, "uuid": "c52a4b62-0356-44f6-aa4d-0f38ad00e8f6", "comment": "Malware payload", "value": "4b8564239e5bc3c95a894b6c14c4e1ce", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775671122, "uuid": "13fb4167-4ceb-4320-8588-b39afc740642", "comment": "Malware payload", "value": "d6775349cb389f4c7a15478fef2c83baaf24540e28a57a40bd7d8e0fd24e65fa", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775671122, "uuid": "2acba931-333d-4897-8b8c-25d412e2b7b3", "comment": "Malware payload", "value": "1f9aa8da434307ba9699f46cb1b4781b24dbd9eb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775671122, "uuid": "83e2d652-8464-40fa-a443-9634286069fe", "comment": "Malware payload", "value": "4ea7f719a2c2d4fb4ea6af38f09f8e4285435b8195f5767e2b911003545a68670129a99addcc04c0d0d9f53e474456d2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775671122, "uuid": "e830519f-8deb-451d-9988-7af14c9ff877", "value": "T1CF154C7DC87A5851BE3155B804BB89FCCC6389AB3ACD87D053D228F71B4D9A3681B472", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775671122, "uuid": "3fa1236a-371f-4b90-a239-a42aa2de1f3d", "value": "768:pnRb9O21q6YiVLovrq6YiVLovrq6YiVLovMJPP0acketq1h3IU87:Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775671122, "uuid": "05aae5de-c1b1-438a-b6bd-c8780d42df16", "value": 937540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775671122, "uuid": "3cf9d879-8900-421d-9cf6-16b2e72a7000", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775671122, "uuid": "d5820176-1f5d-47a5-8179-9074aeb8c79f", "value": "sostener.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad90ee7c-33a3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775691350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775691350, "uuid": "05118b20-76b3-40bb-a0c3-ecacc40c04ad", "comment": "Malware payload (Mirai)", "value": "60bf28b73e43bfa50ffee496788775bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775691350, "uuid": "19fe582d-c820-4d58-bdc3-781609be0916", "comment": "Malware payload (Mirai)", "value": "d72769153376557c9fef0be797771a3dbf2b748e229459ea42eb42f24a4ba1fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775691350, "uuid": "af6a8024-d11e-4e45-bc3b-b4a4281ac8a7", "comment": "Malware payload (Mirai)", "value": "6e27c979b4548996f657d47c13a2096c1a995a5e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775691350, "uuid": "db65c677-5dc5-4c10-9ca6-c81986f1d5f9", "comment": "Malware payload (Mirai)", "value": "35e86851fe395c1f52f93b95ceae996ac4aa3f64719e8ebcf0aae1a2dffaf0910eee18a1499d6bfde4c00abe22687b67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775691350, "uuid": "b92ae6b5-b3cc-47af-b7f6-d6713a977761", "value": "T17A04D742BD518F13C6C722F7FB9E41893B166B69D3EA71029D257FA0374A8DB0A37211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775691350, "uuid": "d8774c9e-5f56-4f37-9d9b-827ca037ce69", "value": "3072:SydR7KCI98YA5F54jseoTpZETwTftD/OJa:SyDKwYA354jToTpZKwR/OJa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775691350, "uuid": "e7b9587b-3ff8-419d-8fb7-375a088363da", "value": 174076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775691350, "uuid": "9169fbfd-7933-4d72-b580-d9e330715713", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775691350, "uuid": "1b76d6cf-e932-4438-b4f4-56e3fac70f21", "value": "narm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d103de9-3311-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775628428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775628428, "uuid": "6ce338f4-061a-409d-84fb-8b3e4df2ac75", "comment": "Malware payload", "value": "16c2add30c1d28912c4ea077cb41bdcc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775628428, "uuid": "5c67f96c-4401-4420-8737-4905333d4c5d", "comment": "Malware payload", "value": "d92becd8c14d050bacbd2b3ab40cf24f30a9f68eb3c5a2b12fc246e84ccc07d6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775628428, "uuid": "0bd17c49-789d-4904-b4ef-d8842134f352", "comment": "Malware payload", "value": "9604132c5d204aa5233679cf9b21bd4263287fe5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775628428, "uuid": "c96a2ac0-70f0-4a3c-8c6f-7a4031f0ea2e", "comment": "Malware payload", "value": "1364871b14c7cb9446b41b99cad961fb84c566ac7e7451793a29beeea8c70fb30db1d8fabc5de860ce9ec27106472d77", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775628428, "uuid": "65335dbf-89eb-4390-9fee-313a7982fc09", "value": "T1BA94B03ED578002F92EFE72A5593440AD8116B2B2B2DBD0534FF76EA3E15842F49253E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775628428, "uuid": "4919b3e3-7409-4b52-b5fa-d6d2eed5bc81", "value": "6144:eKJ+ynl41ypuGS21dO/mM31NRxnCFYGb37xpLaNjrPbdq10RbZc+:eNil41ypuGS4UlNnAYO/aZXJFi+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775628428, "uuid": "e54b85c4-a26b-49de-a05e-f5802bb54d03", "value": 413606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775628428, "uuid": "d4a838a7-615d-4ab7-a413-b1e36a94520d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775628428, "uuid": "51ad1e2e-e36c-44f6-bd3b-4f49969085af", "value": "Overdue Balance Invoice for JAN-FEB-MARCH_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb505733-3326-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775637686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637686, "uuid": "b2950bb6-ac3b-413c-b1a1-df644baf0fef", "comment": "Malware payload (Mirai)", "value": "db7bffd119d821d8872f9baed78d1bb6", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637686, "uuid": "fd20879a-f1c5-43ef-8ead-f27af4907840", "comment": "Malware payload (Mirai)", "value": "dacc4cc34d6426e7017bc17158f7aad9cee56345bdb36fd7a86ad477e8ccb1eb", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637686, "uuid": "15ab0f95-7143-46c5-867c-72f14c5019e2", "comment": "Malware payload (Mirai)", "value": "e4dbb32feb58c6f594f2d9b3c73f23e9c20ac369", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637686, "uuid": "5cdfa537-132c-4268-89b6-7740914e3139", "comment": "Malware payload (Mirai)", "value": "c1d4a25397119bf733af4c0d9187a2fbaa60383bc236db0b9a6cd2fe88fe9721148a6b4849d7143af83ba7a2c0b98f99", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637686, "uuid": "094a384a-a9fd-494c-a373-b9affb8573ba", "value": "T18AD3BF21E4006DD1EC2129B578BA96B80350EE700BDE1582EFFDF95E747BD9438AD2A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637686, "uuid": "2ae2d801-ae89-4a69-8a25-4572a7f08b60", "value": "3072:PnicTtkAg7FSGp+VJE6AqUjq+c7zAbpb9/xn:PiySSGp+PMmT7zMplp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775637686, "uuid": "8cbb101c-e681-4bde-9b1e-373df17a44ce", "value": 131664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775637686, "uuid": "88cc3bad-9930-41a9-837a-241e3fefeb29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637686, "uuid": "fe4e3ec7-0ae5-4e8a-bb10-92f44cfcd1fb", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3133324-3326-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775637780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637780, "uuid": "bd87d09c-6195-4d67-91b3-ac982b246f79", "comment": "Malware payload (Mirai)", "value": "9fb181e55a781d0315907f81f2cb69b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637780, "uuid": "40dc8438-faae-4c3e-8ff3-d920fe0a8ab4", "comment": "Malware payload (Mirai)", "value": "db2c50b9b8187d9ecab7bc5e5edb851185d610df5949fcd05365a43850879432", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637780, "uuid": "ff854cf0-5a0b-486c-9335-d62b48f905f3", "comment": "Malware payload (Mirai)", "value": "a31410bca4dabc268a6c3e352478c68f717463fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637780, "uuid": "46d64743-a287-4be2-85a1-a2adac5ea2c2", "comment": "Malware payload (Mirai)", "value": "4717f31ce3f513234a7e93adf8cd07e5c9bbe94fe369be851bdd9c0260e0328aa9fe9066cbdc09d609287eed7219e1be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637780, "uuid": "fdd1a8e1-ab89-4836-b4df-28b5c595668f", "value": "T122C35B82E6A2D0F1E68701B00557F3E68935EA305416CEC6EFA93D71EC717829D9BB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637780, "uuid": "1683252a-fdfb-4b75-b43c-01a777e15a31", "value": "3072:3atpsoRNjmj1VGCr75MoS9SrPwVrx5tiyPw:VoRNjmj1VGFVrRiy4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775637780, "uuid": "19d8aaea-fc5c-48c3-ae21-9a2a3aecca33", "value": 123472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775637780, "uuid": "f7ac765e-2e63-4642-9037-7b732147954c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637780, "uuid": "97bbd9af-f27b-4c63-84e5-911e7cbeff82", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3bd45ac-3351-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775656169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775656169, "uuid": "35d3e6c7-b001-4e9a-90cb-b2bbe10e6aba", "comment": "Malware payload", "value": "ab396cbccd9b6ec952bed57f3b6c39f3", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775656169, "uuid": "b443ffa8-0327-42d0-851b-4c0fdc1a28c1", "comment": "Malware payload", "value": "dcd07d7958cedb0a30f93f3100580aa41f06d3d6b6c3439a4f28710d500a9777", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775656169, "uuid": "ca0b7886-8995-47be-a441-fbe351335ca8", "comment": "Malware payload", "value": "e0eb9db5790f3922bc33887e3e159e61e96c7cfc", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775656169, "uuid": "1b4c0e4b-eba1-4bfa-aa91-00f8b912e4c6", "comment": "Malware payload", "value": "e25fa85d53db9d1c1abcea703937e981540a7481fbb32e06d9ddd576ec690c00f422a3741bfea6cf496c5f1472637bea", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775656169, "uuid": "d18ec10c-2402-455b-aace-8409d0d76777", "value": "T136C1622BA504A5768563D4BA4023C9198E44E143D250E87E7BECC88AFF5D3F902B5FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775656169, "uuid": "ecec1d36-3c16-48fe-bb24-d4a26419421d", "value": "96:eeW+NwHfjp6rF8WgcNndv8IOQUZ41puvy8sixMrF/N17DFlMr3zTtNAoW4:DWCc6rF8WgcpdUIdUZ41puvy8sixIF/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775656169, "uuid": "b68a4b19-0673-4d2b-b6ea-29c9499b26d3", "value": 6044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775656169, "uuid": "34d6982f-0ea3-46e8-a553-e47501f3a8f4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775656169, "uuid": "774d38d2-9a54-405e-bf89-519c7bb581ee", "value": "Buldog.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c888b90-3389-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775680074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775680074, "uuid": "48820aca-7d6e-4610-a249-336c69413857", "comment": "Malware payload", "value": "65298354a0727b944b18b6be71e5a88a", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775680074, "uuid": "562aeb2f-00c6-4351-b69f-cc57adce33b7", "comment": "Malware payload", "value": "dde0fff0ab74f113c9472daaef794d9ebb6251d57c0b2095046b5f5fb58dd98c", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775680074, "uuid": "9adaaa42-cc4a-46fa-8d48-4053dbb729a4", "comment": "Malware payload", "value": "ebcf04b107ea109f625c9cd24e283f4826233323", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775680074, "uuid": "40b8826b-8f2d-4cc0-a4f9-9bf0163a9ed8", "comment": "Malware payload", "value": "85d8926c608b4e3b0cfd8e1560ca04feb69b537005b888d27a3693835ec0d043c71d339b8e66a309273f514549e2e566", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775680074, "uuid": "70c1fd81-1e32-4edf-8423-3dc986db4133", "value": "T1C9D15C0B813F847E7DC734E935EA8EA6FF48968000F44D5959C0FCD8578E98592F89D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775680074, "uuid": "41acc407-a91c-4e8b-97f3-54567d325aab", "value": "192:rLvZLnnEkiClHgcPXf4BUzefZofVfkDQEDkZ:rNLnnERQdPP4BLZofByQEIZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775680074, "uuid": "867515d1-67cc-4c5e-9a32-ba6ff44c3ba4", "value": 6220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775680074, "uuid": "1b624de1-9fdc-4bdc-ad86-c63132f3ecbf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775680074, "uuid": "f6dce966-031e-4f95-87eb-04b3de572882", "value": "document.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5e3761a-3321-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775635637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775635637, "uuid": "e507e3ca-7f6e-486c-82b4-bf3d0cd5c7ed", "comment": "Malware payload", "value": "5b4d7b21b4716618f0933c58d8c789ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775635637, "uuid": "0c323b56-0a77-4704-91d6-9554abb8d3c4", "comment": "Malware payload", "value": "e00a34ef9b1ca10371bdc756b22ff87f67dc3478df5e1c22eca61bba35ae4284", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775635637, "uuid": "7b73ea42-da53-4c1b-9182-37051d79bed4", "comment": "Malware payload", "value": "dffb9f3e7733b5296b4926270b795b2e49af9fc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775635637, "uuid": "99a30b65-caf8-4ec0-ba10-4021884dba76", "comment": "Malware payload", "value": "46fce8afe9fae80f8b136359c3a0e199beaea36c63ad5cda0b4cea1751343dfdd72335a911fed1bc36a4fa84f20e69ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775635637, "uuid": "5ac0ab65-269f-4fb0-8091-2ed4e4787d66", "value": "T17C560286C491416DDE779F128C63CFE7F638AAAB890B366176587C800B49B9CF1C5B31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775635637, "uuid": "a14aa1e1-ae47-47fa-b676-150383455146", "value": "3ec40ef258012a6a096f45d9e8821282", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775635637, "uuid": "a45e123f-0e53-4184-ae81-6e92a9c4c00c", "value": "196608:B2cFnbOVTuyOmTDU0rHPmBHTb49pvOhv6hDP4rbgyRxPq2R:ciCgyOyvm5Tb4/vOhYz4HgyR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775635637, "uuid": "51c863fa-6411-49fd-b7f1-a1591b84f413", "value": 6448640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775635637, "uuid": "77d3cd66-5166-4e6a-b0b2-ec6e7b5d7ca7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775635637, "uuid": "e131dd07-12f6-4d69-a808-3c7f50653374", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07072469-331b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775632660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775632660, "uuid": "0b2286a2-db9c-4892-8e00-21f4ecfdf721", "comment": "Malware payload", "value": "9849a2eca0975f9724a8befb5183b045", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775632660, "uuid": "51ef70e3-2ab7-48a3-bc24-27666db4fbd3", "comment": "Malware payload", "value": "e02d7ac10ebc6e8c58c274b69ff019db870d5fc6a57666fa7998d36d3bf0dd7b", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775632660, "uuid": "81287195-49ff-4d19-bc90-6e127a2e7afe", "comment": "Malware payload", "value": "9305710e97328fadde800f691dc5037f2387ddaf", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775632660, "uuid": "69abcb6e-acf7-424d-b7a1-e8cbe20daf41", "comment": "Malware payload", "value": "0d72827ab1199b63ea54b1d33d19bee9b4c7638a0683769d0c1684914a4512f93ed06e0a5fd2fd15ee94f460658d2cc4", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775632660, "uuid": "8c9317d6-5878-4ba4-97de-b7eaa730aebe", "value": "T1C46402B79BC87CBDD48D01F75463B134B29A1C479A39F466A9030BCD9DAA10D058A8FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775632660, "uuid": "273caf4b-0dc9-41ab-8f78-5524be8159db", "value": "6144:PHxktl5lNXlEMsBkUK1pownvPo1zxFG/t0loDjfFgf39tHY2mE/z2ZPn6N46L:Zktl/NXlQBkUK1DvgdbG/+oDTO9teb6j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775632660, "uuid": "180b8424-6c41-45ff-a684-380ee58dfb8a", "value": 330428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775632660, "uuid": "23ef0a2f-3e3d-4903-b80c-23340b4255c4", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775632660, "uuid": "2ffc0fb4-55a8-4c24-9bb2-8e5a74d19f59", "value": "RFQ-OUR REF. NO 139-AMJ.03.26.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8a1169a-32e4-11f1-a769-42010a9c0008", "comment": "Malware payload (FatalRAT)", "timestamp": 1775609416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775609416, "uuid": "6cd16dcd-be53-46e2-8edd-eef82433f43c", "comment": "Malware payload (FatalRAT)", "value": "14bf08c29163fc92f0c1578e457f09e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FatalRAT", "colour": "#A297E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775609416, "uuid": "9517b4d5-2811-47ca-9f09-91c566040ea6", "comment": "Malware payload (FatalRAT)", "value": "e1b4c8df3cd7a51d8751b3c3c8b143b5feee7eb1e4c786b4ffecc370a60856ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FatalRAT", "colour": "#A297E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775609416, "uuid": "03e10ad8-3d51-4667-97b7-992a082d1d2e", "comment": "Malware payload (FatalRAT)", "value": "3d8eee3abf606e27acc9262f0fd65b9545fc7da0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FatalRAT", "colour": "#A297E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775609416, "uuid": "3ce1c359-aac8-4344-83ad-2e4db75dd791", "comment": "Malware payload (FatalRAT)", "value": "2cd43ab74721eceadc80c0c2cb8e79b211ab70b204f484312b63dde2ab73b9540e2f3478b6967dc6ab839f06076043a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FatalRAT", "colour": "#A297E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775609416, "uuid": "329180f0-4e13-4c09-a1e4-d3a939eea032", "value": "T118F5223315542085CDE4C935CA3FFED1B9F653668942C872A8FAE1C61D1BAE9E703983", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775609416, "uuid": "a8f0a5d5-8ac4-4f93-85b1-0bde9e06e3ff", "value": "9b201090749bae06a761156dbad9c4f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775609416, "uuid": "455a6ae2-5730-475e-856b-ecf7c2b80aeb", "value": "98304:qI7yduloUXpSKHdIost7RlMhRW3GgW4umZc4:qFuGUXbdFst7RlMIGgBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775609416, "uuid": "b67e0ae9-8264-42f1-9869-87002bcd1067", "value": 3514368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775609416, "uuid": "bca3d9d2-b5d4-468b-93ba-bea260d9e642", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775609416, "uuid": "8e93d2e3-42f2-4d42-a2ad-8fc64aaa604c", "value": "e1b4c8df3cd7a51d8751b3c3c8b143b5feee7eb1e4c78.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ad1e69c-3375-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775671482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775671482, "uuid": "ad239510-5787-4dc0-badc-dd527ff04ecb", "comment": "Malware payload", "value": "abf1f8d376c06f6f6124a6829986714a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775671482, "uuid": "85fbe5fe-9a87-4a47-b4ed-fae0d8870b4b", "comment": "Malware payload", "value": "e2dd74e1f664c0ede1d3d8412669e26a5b6d0f026f1d3e64965c17a677fb27c1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775671482, "uuid": "a79f5d8a-109a-4e11-ac3f-c86db2e8049e", "comment": "Malware payload", "value": "631688c14b08d127c3444e27694a0bb61a5f4316", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775671482, "uuid": "c0dfccd3-8a00-4300-9fc5-f6639118daab", "comment": "Malware payload", "value": "adeb662f0a8a39bb91b2866fe0c26968b136156cc3a6e655527993638337d6ee2685ebfda707d3734a7c7ebe0bea1007", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775671482, "uuid": "04e6db4d-0cc2-4b58-8d54-d7c79e4d120a", "value": "T124D43977423478D2ED0BB3B5BBCB367BFA84B9382170E4955A0257294DF46B2DE0421B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775671482, "uuid": "cbdfad9f-71af-4419-a4ad-56a5a018fcf1", "value": "6144:plSfdQV7gERhqo32F+g8wzq8VBwZfyvXOwUH5Su/D7i0gtpp6mYSzD11RDFQZY:pA07zqo3k+g8wzqaBwFyv+9fMp6y1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775671482, "uuid": "77e02891-8e88-45c6-8def-9bae8df3c239", "value": 639600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775671482, "uuid": "c3f0650c-479e-4986-8cbc-ec4419577e55", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775671482, "uuid": "b292c3b3-373c-4c91-aaf7-d77d1f057651", "value": "WORK200", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e09f6e4a-3371-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775669961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775669961, "uuid": "3f2195cb-d37b-4a06-b84e-0201a0df24e0", "comment": "Malware payload (Mirai)", "value": "6858bc49ec84bdf49b25a4455bf44157", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775669961, "uuid": "eeabb427-8f4f-415f-b647-76f3378ba57b", "comment": "Malware payload (Mirai)", "value": "e2f116aec33ad3ba36c2eb8f270d10b24c117f5303cb0a32ec188472a707a1d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775669961, "uuid": "cecbadaf-94f0-461e-908d-dfc4204bf39b", "comment": "Malware payload (Mirai)", "value": "1fa2ffbd0c9a66ddba391cce8a5d3e2a83c7327d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775669961, "uuid": "e6ff8916-a691-4057-a988-ebdbe98903d6", "comment": "Malware payload (Mirai)", "value": "e99d637a17f0330bce08e19c27e93cc67e8d59bf16826e950a9451c665bd3edb848ff7328b6675419469497f0187d2be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775669961, "uuid": "e9b7b2a9-5bef-4d63-b93e-e1a6e7423e2a", "value": "T1F9634A43B84580FDC168D57457BF763AC47230BE1338B2E637D8BE122D06E611E6E99A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775669961, "uuid": "9875ca0e-c6f4-4e9a-b986-c79d34b2fffb", "value": "1536:Q+laCEgTbg+Dh7zl6HEaqP+eWXZI3hPnarH4TCjw+LF9K:QUasbg+VZ6kaqP+eWXquH4TCJLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775669961, "uuid": "f5a32325-d56b-42aa-bf34-783d207cf1f7", "value": 71616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775669961, "uuid": "59b8ed58-631e-4c81-bbb5-b47f9ec5b23d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775669961, "uuid": "fc20e48c-6b57-48f5-a887-bb955e245830", "value": "db0fa4b8db0333367e9bda3ab68b8042.x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71e1cbb1-33a0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775689962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775689962, "uuid": "850ba213-bb1f-4bf4-a94c-8b54046e6514", "comment": "Malware payload (Mirai)", "value": "c963de8a729a1557d9559c623518f13a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775689962, "uuid": "2e882bbc-00ab-4166-add9-6af887d8beb7", "comment": "Malware payload (Mirai)", "value": "e37f3a3fd6f0baac3b548e25172f2ce4ff8eb9e85ed59f6363254d71bc873da8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775689962, "uuid": "a2f0fd6a-23ae-4bc8-956e-17df4bf492bd", "comment": "Malware payload (Mirai)", "value": "034f98dab299c1196837004211bd1aa375d70fdb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775689962, "uuid": "ca0011aa-23c5-4431-a347-edbd5cf6d5b2", "comment": "Malware payload (Mirai)", "value": "211cce0e315ba246ba091d296759d09880fbb0c62b772ce6478761a7f1b2d14dc696952ce2c89a857d5e460859f70819", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775689962, "uuid": "0993ad77-74b1-4812-951a-afa6c3f91ad1", "value": "T1B6F33A41BB43CAF3D40304F051A7A73E8E31FC2A4437D5A9EB68BEA5DA175C1A216778", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775689962, "uuid": "026420b9-def0-421e-b3fe-8b785ebd9d7c", "value": "3072:BQ7ZRH3nG9EpSOG8Cwhp0RgQVNyDsmdVv1b:BQ7ZRH3nG96zZuFAVv1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775689962, "uuid": "9310d5ae-9303-4273-9aad-b752b54b88f1", "value": 161072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775689962, "uuid": "0ccd89c4-81b4-44e3-9211-3a7f942d4380", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775689962, "uuid": "64f9ed41-0913-40a3-b73e-f1bd0eec36aa", "value": "nx686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff6a5c17-3324-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775636942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775636942, "uuid": "ea0571b7-064c-4eb5-a43d-1511f0be3ae0", "comment": "Malware payload", "value": "3fc84656ce7f4c02eeb71e2c9cb29ee1", "object_relation": "md5", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "Sidecopy", "colour": "#84635C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775636942, "uuid": "0660bb65-5b5b-43d8-928a-593543709969", "comment": "Malware payload", "value": "e3e7e4dd4aab46fe3095655d1db8287e1e696160c1c4dcb301299589a095bf1a", "object_relation": "sha256", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "Sidecopy", "colour": "#84635C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775636942, "uuid": "c33d80dd-082e-47a0-b8ae-c4429f7f74be", "comment": "Malware payload", "value": "f08c491e0d6814f233177308193b108e34140808", "object_relation": "sha1", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "Sidecopy", "colour": "#84635C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775636942, "uuid": "70d7e09d-3ec0-4a04-a586-ab9ccf9e454a", "comment": "Malware payload", "value": "c8b3e942d8d895a482c08669105dc88839620894b0d86d938accca6331ab667f9b40953603e245fe634270ecb9d0f865", "object_relation": "sha3-384", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "Sidecopy", "colour": "#84635C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775636942, "uuid": "34bc1829-4382-419b-9416-2644cb6f1508", "value": "T1972533E7A076A3E0CC4186EA817F5B2158510E61A1DAD625927DC01FCAE6CF9FD28FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775636942, "uuid": "cf1b145b-61a0-4b29-b4b5-8874f7bbee39", "value": "24576:ehmpB5o/iuo7bDDHHDkc2tlmo9d8BSgcI6VTf3xF898wnMH8:ehmr5o70HH6f2wg1qTvxYMH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775636942, "uuid": "0e7fb4fc-c8b0-4e5b-bb8f-20b18cc6521e", "value": 1010125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775636942, "uuid": "6cd15123-0e6c-46a5-9547-9d2af2e8a8c7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775636942, "uuid": "58af6586-854a-4352-896a-6490ee96e523", "value": "c83d1f5f-5396-4fb9-b616-524126c3e1ad.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "470bfdc0-3316-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1775630619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630619, "uuid": "38ef5f78-24ac-4862-9170-cb6b0bce31f0", "comment": "Malware payload (Vidar)", "value": "a7368aae6005ea66527763cabd7cc80e", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630619, "uuid": "a2ee75d3-a28f-4c59-b5a0-7b7245d5822e", "comment": "Malware payload (Vidar)", "value": "e525580984668787035cbf64143cbccda605bbd3bc688c714bdb6045034b4a3e", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630619, "uuid": "225c0c2b-c5b9-4fea-a254-566a6feabc31", "comment": "Malware payload (Vidar)", "value": "046e3fe86099bda65e5ab3807a2a143aac12e42f", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630619, "uuid": "618beaeb-02ad-40d5-a432-67581b907b60", "comment": "Malware payload (Vidar)", "value": "c9ad03fe54df960ef7fed8fa54a64753c28913dfba62b88820c9dc2400f959b1881180642639c971cf6f1f7bd10a4490", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630619, "uuid": "c7b36f71-8fc8-46d6-a962-62cf181def23", "value": "T1A1957C4A7CD048BAD4AA933288F691927B72BC191B3233D32F506A783F77BD05875764", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630619, "uuid": "036d7ed0-a03b-401b-a4ae-0de3faa7347c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630619, "uuid": "889ada82-30b3-45fd-8a95-26931913bac7", "value": "24576:h9p7m8EbASFhkY7LR6GxtU+A61S601R232Fn/U27qGRWcbg:h9py8EbBLRnxtU+A61L0nf7VE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775630619, "uuid": "6a909d8e-5e41-4580-abcb-24646a596cf1", "value": 1882240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775630619, "uuid": "45f4910e-2a27-4ad9-be2e-9492d57ec9db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630619, "uuid": "27a1a7e2-832e-4273-9e59-e639218e6ff3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc746d91-337b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775674196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775674196, "uuid": "5c11e0e5-1ac4-47b7-ada1-ce3152012959", "comment": "Malware payload", "value": "0607de24474c0b854eff74266d3798e6", "object_relation": "md5", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86", "colour": "#9A8E4A", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775674196, "uuid": "872382c8-e636-400a-8d55-f0edb3dd8d66", "comment": "Malware payload", "value": "e56dfb687fc9f6a16be92701c162a21fde4d8647e583e64f953435e2fc90d67f", "object_relation": "sha256", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86", "colour": "#9A8E4A", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775674196, "uuid": "b9e03745-affc-47f1-b97b-b8ae850f3317", "comment": "Malware payload", "value": "512beb3fa659a1daf62149101139c81ed125c48d", "object_relation": "sha1", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86", "colour": "#9A8E4A", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775674196, "uuid": "06d74bd2-f96e-4263-918b-3c85248fae72", "comment": "Malware payload", "value": "a09e7620a5ded0e9c190caab4fb03723914f3bc89326ea1de36a55da26d94d0871c6874435da4ad7fe390bb6f7a4e26b", "object_relation": "sha3-384", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86", "colour": "#9A8E4A", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775674196, "uuid": "aa422876-0e4a-42a0-b1f8-6d941bfef994", "value": "T1CD756D43E2A620ECC05FC170975B6722F93174055B38BDFB92D0D7352AA3E906B7AB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775674196, "uuid": "380de76f-8a7f-46a4-a2fe-88b27a430f55", "value": "b712b3f1f6f5dde070c523d4407e5a3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775674196, "uuid": "abaab32c-c212-42cd-be11-ca43db786e63", "value": "24576:gds9Esxlce6k91UOld2LMxmeDozCMZyFFpdEymOCUwPPLJP:gdaEglcAHNaYczYyyL2PPL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775674196, "uuid": "5add44d6-864d-45b8-b92a-d7b15b982e80", "value": 1566208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775674196, "uuid": "baf6428a-0610-4303-b319-9895f84c4d9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775674196, "uuid": "98231ca9-affe-4322-bb30-66523f04cac0", "value": "f_ex86.node", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16d232ef-3365-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775664469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775664469, "uuid": "122dba50-593c-421c-a518-0852db0b9a0f", "comment": "Malware payload (Mirai)", "value": "4fe34a4fd0e88f52c94385bddc861b15", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775664469, "uuid": "2d2f1d2f-7f82-4ee5-aceb-e6f3e47eaa3c", "comment": "Malware payload (Mirai)", "value": "e5b1e4df9068539bc211d5a4807087a5b6bc25bfe846fa31bde89c1c11be3dd6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775664469, "uuid": "58bd77cb-515d-4930-81c3-07f1a3477e52", "comment": "Malware payload (Mirai)", "value": "953e1d5491572b112ba825dc10b63de16d825231", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775664469, "uuid": "5b1d90af-253f-45b2-8fb5-dd753ce4a74e", "comment": "Malware payload (Mirai)", "value": "15f93df90a8467d35b3299e72cc985f018ae303a882e4333ff81bb1514bec631c4e9d654f245afa165e25f5a0b9bf0cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775664469, "uuid": "98687839-1a01-4b6e-9abb-dcd664174a11", "value": "T18D9384497FA00FF7ECABCC374AEA2B45248D651A21A83BB57934D418F24B25F15E3871", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775664469, "uuid": "26fe327c-1bd6-4b85-9c24-162670f55afb", "value": "1536:N7oLX7L3E5BIBslZpITQ5/0R7Ns3ZZKiUDdK:5oLXfaBI8oI3Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775664469, "uuid": "00447019-5660-4df5-a77a-a9de0436e244", "value": 97224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775664469, "uuid": "d00683ee-c496-46e3-b848-6396b457da10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775664469, "uuid": "a0035426-b84b-4712-bfcb-5efaa105e30d", "value": "db0fa4b8db0333367e9bda3ab68b8042.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5d3a2d2-3343-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775650106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775650106, "uuid": "0d4e8ef1-b905-44db-931d-3b7e7dd73c01", "comment": "Malware payload", "value": "dea0d08ab365338f53a090b784f215de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775650106, "uuid": "c1f0275e-31a7-4dbd-850b-2456dfaf41a0", "comment": "Malware payload", "value": "e68dcf3bb3741524ae1c5849bb201ce1abf4a1e92ce74aae8c18a04e7678e31c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775650106, "uuid": "622557b3-6ec0-428f-a094-3c4fbedaae4b", "comment": "Malware payload", "value": "26ee715d6c3af6cc189bd33ae13be5719b5eb7a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775650106, "uuid": "f930d5a3-1964-4de8-8a3f-2a057392f54f", "comment": "Malware payload", "value": "cf6d87c34e46c8e04c571617a7214f5e33dcc69fa4b5b31343bb7c118a2f9ec3fcbefc7669ba0578d51c7ceda178cd0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775650106, "uuid": "472148ae-aa75-4fb4-b86c-9d51efff2b6f", "value": "T1D7165A31769AC137D56F07B02A2CC7AF51797EA12B7344C763D85E6E19B08C29232E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775650106, "uuid": "81a30a21-bee9-4cca-8e4e-d3540bcca528", "value": "2565cbd2a560c6b3554de2985322d883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775650106, "uuid": "5b21f31a-46f3-4009-9dbd-306cfb0bf3b2", "value": "98304:+ImZBk8XXSSRr2aVFuHIxXVYCjSTBpMV391Anq+s4veHjPMNa8:+/Z0YXJ02sXeH98", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775650106, "uuid": "e3b05041-8ac8-4b43-aeef-6c0a493aad92", "value": 4341568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775650106, "uuid": "a1cf0b24-c1eb-4985-ace0-19ae7ab85439", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775650106, "uuid": "fb2f67ca-fd64-40e5-9086-a63296f67406", "value": "Updateeee3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdf75da9-3326-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775637691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637691, "uuid": "bfc2af32-4a41-41b1-955e-d46f533e1005", "comment": "Malware payload (Mirai)", "value": "9bdded28efc46bdf0a148883818330f2", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637691, "uuid": "4e017d6e-3d58-4e43-92a2-15d4615962eb", "comment": "Malware payload (Mirai)", "value": "e70c66f0b2ad4d32f8b777c312349227df89888c25057068a9a2909de095f66d", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637691, "uuid": "a7d2045e-12ec-46b4-a62a-a81ed9bab11f", "comment": "Malware payload (Mirai)", "value": "5a058566ca7ecfed4f3c49555ab20cbd9b6945a8", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637691, "uuid": "624cce31-3701-4dbf-8ddb-d543b00829fc", "comment": "Malware payload (Mirai)", "value": "7e7e0ba915ce8eb9f041580569dd04a45aabeeef201e5bada2156229b093e30bef8de6af4beb3390759c0ef025203860", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637691, "uuid": "d8f5eb13-6dae-48dd-bd55-547668049364", "value": "T1D2D3CF32E0086DA0DD2117B43476597C0340DEB40AD59243EFBEE5AE28B7DA57DEDBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637691, "uuid": "b738ebfa-1533-4bfa-92b2-c060704f2fc0", "value": "3072:jNOFV2mOAc6NBmjOd1CVOHVv3WDxGGRhaUNhkv0Z76:xOFgpOEoVv3MXL5NhGO76", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775637691, "uuid": "ad0418c6-d6f3-4def-8c66-2bc85d928c69", "value": 131656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775637691, "uuid": "0c984f15-9fd5-402d-a872-b0f34979ff89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637691, "uuid": "7408604c-c90a-4bf0-81ca-358cf511ba4a", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72ed0cef-3384-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775677938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775677938, "uuid": "c85c3997-5558-459f-9ecb-99b6600707aa", "comment": "Malware payload", "value": "0efdbb0dd2fa07c4dd634470e42f0cd0", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775677938, "uuid": "cfa568ee-a270-4ffa-9f77-c0b15da89134", "comment": "Malware payload", "value": "e72f632eb412f9df5f581f5de3ed0e721ebc0b1d75d70b6531723a37c9929cf9", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775677938, "uuid": "44db43e4-7b1b-48c6-8871-4374431ea7c8", "comment": "Malware payload", "value": "2e8b3ced9ceb19bd26d940f4ad653498b7526d4a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775677938, "uuid": "817ceb33-4cd7-47e5-87e7-f0dd3843d864", "comment": "Malware payload", "value": "0a733dff274160a55573af2ee611f1949862209448900e92bd75fe0fc089d82f3c802c5d7a24d6189f5b3e770eee058d", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775677938, "uuid": "f06216ed-37ec-4a3a-bc8c-6f7c7e6c75fe", "value": "T186D2F1C9F57C4AC6F9317ADE0486F7C8E1854129F01A5D7F9354A3D68A28B510B33F48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775677938, "uuid": "174389b1-e93f-401c-a837-a64e7bcc33e8", "value": "768:u31VZNjWmM+4r/3FxwcWqsU92SVBMSOhNaoWtK9dXx:u3ZNH10JWF0/VBs9dh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775677938, "uuid": "be098459-a60e-4284-bfd4-29a766e267b5", "value": 30613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775677938, "uuid": "2b269135-977c-40d8-bde8-c8f90adc7cbe", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775677938, "uuid": "53c153f2-d119-4ab4-a70e-7ae806e15543", "value": "REPORTES.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb9081be-3316-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775630842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630842, "uuid": "42eb1c7e-226d-4b1e-80a4-78e04a66f00d", "comment": "Malware payload", "value": "f2d4deca2c8a5c8c7b6636b0749ce62e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630842, "uuid": "70b9baaa-0c0b-4b62-a8b4-6fcc48084bca", "comment": "Malware payload", "value": "e7b8e590da8e33c3aa2690d44ff7c841f6032c92ea67d4b80fecf8bd9840290b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630842, "uuid": "5220395d-c224-4006-b249-8401d01a2219", "comment": "Malware payload", "value": "8c5a07064201fc62287af23f64d60f1ee79c634e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775630842, "uuid": "b18d419d-f119-48eb-ba88-186b83bc3b74", "comment": "Malware payload", "value": "21c3b5faa9c41a4822ca4ff3215952f4b21996bc9c430ee32e40b007ee094d4174f3a9830d72423980cbff6b964ba049", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630842, "uuid": "67a110ff-4ef9-4ec6-bc05-eaaf8eb82826", "value": "T17FD7CF43FC1615E6C76884B9C8AA06577774B840272FABD32B10B734EDA72C46E7B394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630842, "uuid": "420ee0fb-6b93-4512-97d7-faee391de291", "value": "cece05d62228feba4389b57bf9b54ded", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630842, "uuid": "3fc5e002-b523-4d40-8389-5dcfc54cba5f", "value": "786432:oX/hNEuHVfp1uVS+w1F/uAO8R115eYX+RsXxtlYefrEFCptnrpHkbdb:4/hNE0BUwPY2B/beCptnlkbdb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775630842, "uuid": "ed8ce33e-c87e-4fd1-b0d5-a4f805753060", "value": 62629637, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775630842, "uuid": "0b200a39-3694-40d1-bffa-359ee044d792", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775630842, "uuid": "4984a946-e061-4fcc-b28c-e335b69287f4", "value": "\u70b9\u51fb\u6b64\u5904\u5b89\u88c5\u4e2d\u6587\u8bed\u8a00\u5305.II.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c447fa4-3381-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1775676638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775676638, "uuid": "eca5d89f-c0a8-4b3c-bcf9-474c7f387854", "comment": "Malware payload (ValleyRAT)", "value": "8639de1014ac3c7230f128ec77d1cd00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775676638, "uuid": "8e30d750-750a-45cb-b2c6-17c4fe84cf68", "comment": "Malware payload (ValleyRAT)", "value": "e8bd02f671b2724d44c54babae21b99f6702622def7a26bffabd2c2aded35758", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775676638, "uuid": "f8441a05-52f9-4b04-95fc-6eb0a93a89d9", "comment": "Malware payload (ValleyRAT)", "value": "b417952ee03a292d4084b2dde897b851f25bd926", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775676638, "uuid": "419e3332-8b99-49ac-bda5-5c0f0b7b42dc", "comment": "Malware payload (ValleyRAT)", "value": "c9ce80edd3330f67ab120cb02ae78d5353d502e6d47b78432afce34b622e9e65e176d833472aa0e59a680a51341c659e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775676638, "uuid": "bc214cd9-b854-4491-a227-942026a42656", "value": "T1CA74F443A6EC3CEAD0769274A77743C6D72EFC5502A0C62F02E042969E3F253792A7D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775676638, "uuid": "55a449d1-a283-4fb0-941d-2877efc6ae12", "value": "13f3c1e33fd6792e7cb512ddb889dd46", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775676638, "uuid": "ac9e76e9-d7a6-470a-a3b9-b42572670db0", "value": "6144:ct1ohH3syj1VZ4P+R4cUT8RBfKEsWfm1G4Y1r:ool3syZVZ42RUYtbm1G4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775676638, "uuid": "3c3c9ad7-fb9e-4f39-bf06-00981c37f889", "value": 364032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775676638, "uuid": "9f120597-d8e2-47b3-842a-7762cefa607b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775676638, "uuid": "6e7e6b44-ba30-4338-8b01-6aef005b49db", "value": "f04accc7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddddc3cf-3371-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775669957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775669957, "uuid": "425739c8-d4e4-4104-b27b-ac8a904b4fc1", "comment": "Malware payload", "value": "3204193d73b298f6e777b5a48dd89265", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775669957, "uuid": "230edfbe-544a-4419-976e-ee0b1d121212", "comment": "Malware payload", "value": "e8ddf1da6037b90925bfb0f955b39ab774909261e921e068855ce06e55fa5b2d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775669957, "uuid": "3b84126f-9bca-4fab-af82-a5177c1ac7d2", "comment": "Malware payload", "value": "890bf816fae86d99b0fd527626c6a44e451a57f4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775669957, "uuid": "49861747-ba22-444a-889b-b53b0e8a36eb", "comment": "Malware payload", "value": "8ea09b07611d3ec5d1856c60707c3ef3e93e384ecc8c4798236604af07d3384aee8dcb61650b643ca706e1dbe18aa94c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775669957, "uuid": "99bfb632-b6ba-484c-8336-1ecaed4fe109", "value": "T1E2137D6956857C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C49A9CE21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775669957, "uuid": "d3d4c936-6747-47f9-839a-513115d2b535", "value": "768:bh+a9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bh+Pco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775669957, "uuid": "881e7650-45c2-4985-b711-42ca9913c2f6", "value": 45534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775669957, "uuid": "b1339957-b96c-4809-846d-f78c7fbb3147", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775669957, "uuid": "30349ff5-e10a-45d5-87a6-d915b93d1983", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af4b1c76-3335-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1775644109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775644109, "uuid": "e91e9a0c-5f5c-43d9-a85e-b8463759ee86", "comment": "Malware payload (Smoke Loader)", "value": "71602557586a2b6396e0f200df51fd0a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775644109, "uuid": "e87effe1-9c24-48d8-8c73-238b49f3d968", "comment": "Malware payload (Smoke Loader)", "value": "e988ca8a7d50b0de660ccfc1a647dde08de2e304d6fb15d9ab4eaa13eb459b11", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775644109, "uuid": "76063fdf-b9ad-4179-9f44-a296b603f32b", "comment": "Malware payload (Smoke Loader)", "value": "fcb7f855d5b6243650a962c450ad667ececa8f8c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775644109, "uuid": "2905e073-f798-45dc-a0c8-fb5d573f8552", "comment": "Malware payload (Smoke Loader)", "value": "7972a24815957a4e550e2a97bcadd5b116ec4001aa7ad99c21465c50d31e50cd5b1e177a299b04d696c2fb7aa6e00888", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775644109, "uuid": "0b53cc18-1ef3-4b25-8c5c-85467cd1c5bc", "value": "T13465394B7CE108BAD06AA33288B652D17B71F8191F3223D72F50B6783F7AAD05975724", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775644109, "uuid": "55165cb1-093e-4bd4-9575-496cb71d19fd", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775644109, "uuid": "9e0d96a1-9924-4247-9891-b20e94ed167e", "value": "24576:z472UdhUzlsqcCgZhFZpd1EzEVdUmOVUomGiWPrhm:z4ldhzdUmOyoxlm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775644109, "uuid": "73d4ded6-6ab4-4332-bab7-3aa675c47590", "value": 1465480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775644109, "uuid": "93a06fe6-4961-4199-89cb-499e5e04276a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775644109, "uuid": "c193c0d3-b202-49a7-9e71-93945abb3c1a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb3c47bf-3314-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775629982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775629982, "uuid": "b6b90906-b70d-467d-b7d0-f9a3429a9434", "comment": "Malware payload", "value": "406b9403380b0c047747b3e2177f3d64", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xx-kak-is", "colour": "#B502AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775629982, "uuid": "3a118b58-cbbd-4313-b546-46f5e176c616", "comment": "Malware payload", "value": "e9f17f3c82f9855014b5f06c2d154c8ba947de0fca42a1f51bd34673947c129e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xx-kak-is", "colour": "#B502AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775629982, "uuid": "cc0f09af-e738-4876-80d1-5eb61e4c5300", "comment": "Malware payload", "value": "eb3dffab6abf619ef6b009d6948383ecc9afc175", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xx-kak-is", "colour": "#B502AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775629982, "uuid": "53819985-48da-4bc2-8b5b-ce0a22ee3d7a", "comment": "Malware payload", "value": "ebddfbed84bd9f51b5455e56b8342fd73fe5a8ceb5c331c1a3e05a6628889760a778a0d11d356fcd681d7dfbca5b4131", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xx-kak-is", "colour": "#B502AB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775629982, "uuid": "91d72b18-4576-4cf4-a05d-d6dd1c62aed9", "value": "T1B363BF3154011456A9378BD4EB92A78AFF295003C20582557F9C9253BFFA984EDB3EFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775629982, "uuid": "06395ccf-fb28-4113-b8c3-b014ae5375e7", "value": "1536:XoA3S7UyUumWh02+leNQX3eNlZxFsABobN0snhjUYlNb9fY+Y8YNY/YFAYKYFY8q:4L+uXW2SX3mpobN9lNb9gjZmALHOZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775629982, "uuid": "3daf0e6a-e5c7-447c-bd2c-46da5e9756ab", "value": 70028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775629982, "uuid": "e10fe184-42e6-4fcd-a841-3a2b222a714b", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775629982, "uuid": "9a78afdb-32ff-40be-9ccb-4c5781b01a46", "value": "e9f17f3c82f9855014b5f06c2d154c8ba947de0fca42a1f51bd34673947c129e.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5a7e239-32ff-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775620900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775620900, "uuid": "2fccf7ac-dc72-4ea0-befa-c7bfda838e59", "comment": "Malware payload (Mirai)", "value": "c80ab9a5c59382f9a36aa677df7e2159", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775620900, "uuid": "154dcc81-4310-47ae-9db3-2c4f12ee483e", "comment": "Malware payload (Mirai)", "value": "ec21a411fbedbc59c981f88d9524d038a55db2778d1b3dc02dc92166b02b8345", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775620900, "uuid": "941aa82a-c2c3-4c31-a66e-44a7e2e6c8e4", "comment": "Malware payload (Mirai)", "value": "31a0d3c7f5d896ed2e5d558adb31d0e8c635e860", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775620900, "uuid": "d0966f59-25d9-495a-876b-25c02d582738", "comment": "Malware payload (Mirai)", "value": "c84bf7c0543ef1a6d16fb894381064066a0168f5f6fd6509a8d072c36ea8d2bdc5e65e4ba4cfce0c59b8938c0fd556b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775620900, "uuid": "e87128a4-7a7e-4b62-92a8-b98f5ce597cc", "value": "T1E373A70E6E259FBCFB9C823587B78F21965833D626E1C644D15CEA011EB034E741FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775620900, "uuid": "42780cb7-5715-4636-abe9-7b304222ac16", "value": "1536:zoVvPLWTs7ys6XcniEyNMV3sDmTRdVSabdza3TTLbwXmP5w:zo5WTm6XouMV3sDmTvVSabQ3TTLbwXmC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775620900, "uuid": "b5cfe0a6-5554-4d2b-b5b5-1392df641fe6", "value": 75976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775620900, "uuid": "abb7100c-1c80-4cbe-bd9f-476d64137bf9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775620900, "uuid": "43d1b85b-d8ee-4780-b600-f095a6dbff7b", "value": "jew.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34085985-32fb-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1775618991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775618991, "uuid": "7fe9eee1-8b9a-4a9c-996a-7d9176fca8b6", "comment": "Malware payload (RemcosRAT)", "value": "4dbfb3214de2057175f4b72654fbf89d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775618991, "uuid": "2a0fb49a-2d6d-4dae-97bb-e13d9388f0c6", "comment": "Malware payload (RemcosRAT)", "value": "ed9a7ce6b426f53742a6560e62179e97ca96043d6e166c91d199319a56b5ada0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775618991, "uuid": "395a112f-a60a-479e-a855-7975fbad18c9", "comment": "Malware payload (RemcosRAT)", "value": "6cbff35cf8dcc9e2ccb2ae7840c3bf3bd66c850f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775618991, "uuid": "5b6d2418-74ec-4c94-88b4-bb26af49c8b9", "comment": "Malware payload (RemcosRAT)", "value": "e8d79cbb3240630b3d7853c151653bc06f04c923bbe58971385ec2fb3296fa52393214130cacf85d149a50cf838f0280", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775618991, "uuid": "a6bfbf23-9145-4755-b13c-71d5e8951685", "value": "T1395423264410DAC6EBC3612D75B893E3987BEF765FA70C40D016868E4DBAC8FB2617D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775618991, "uuid": "3228dd99-8563-47bc-a36f-41d1bd1c50fa", "value": "6144:/de1zBZwwtr5FxxSi0lnNtlCMdiTbxkDOJGXncS7M9om1Q1X:/ANpOi0lnNfCSexkDOJ0ZuLkX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775618991, "uuid": "d0b1c8df-1fe7-458b-b88c-19b3ca20e975", "value": 289008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775618991, "uuid": "9803ee1c-40f5-48f7-8202-901ecc6e44fb", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775618991, "uuid": "c99d5fd8-7b3b-4c15-93f6-06194ced6bd4", "value": "Slip pembayaran.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a04708b9-3332-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1775642795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775642795, "uuid": "114537d4-24f8-4fae-8ad4-2b02cf2da581", "comment": "Malware payload (RustyStealer)", "value": "4a1a3af55309ff99df85adc5538c24cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775642795, "uuid": "ec3fb134-3d58-4b6f-9c9f-01e72ed42350", "comment": "Malware payload (RustyStealer)", "value": "ee9bfa52df98577a2c62a5cde920186c609c4d5cc6938a10aec841aec5dedef6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775642795, "uuid": "a8eab27c-02fd-45cf-8463-f7b73f49a58a", "comment": "Malware payload (RustyStealer)", "value": "8e1492a6529b34466a2eb6455986ff195c4d75ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775642795, "uuid": "89c7ac66-446e-47fc-a6ee-978a36ae03af", "comment": "Malware payload (RustyStealer)", "value": "2c88957300346330bcfcb5d855c9a3150d49149c71ccf1764430ba921b81b0407d38a76cebd59bb35b590c354819b423", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775642795, "uuid": "4117c8a6-4892-4d98-9b63-217a94d109af", "value": "T174C512D86F1C94A6EC895536797C39731F094C9496B8FF28380C88595BE631B6C333EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775642795, "uuid": "8de7daf9-91ba-48be-af87-95f5694e67a8", "value": "944a358417389f0d0bc02b5eede0017b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775642795, "uuid": "a4717509-74e6-4716-b7b8-a6578dbf3f8d", "value": "49152:xqf8YLxiLz6D97/cON40NSgDWRp/aZUqje9KH5QzERR2hls511NKF1qQVta6:xtCxiLz6DrO0NNQpCZU2eo5QoH2kHXI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775642795, "uuid": "7f53b981-a853-4c57-b8c6-3666e7a583af", "value": 2699776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775642795, "uuid": "c40cb94a-8ec8-4a8e-96b7-a7a45f5971ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775642795, "uuid": "8b2737cc-d301-4533-8509-4e652900e291", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a99f4ca2-3326-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775637657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637657, "uuid": "caf54078-8825-462b-ac7f-aced3d27b63c", "comment": "Malware payload (Mirai)", "value": "a2801839c55283b0e87aa3ffa8a02369", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637657, "uuid": "061affd1-9436-4961-bcae-348d43ddd747", "comment": "Malware payload (Mirai)", "value": "f19c0ee393a58fda080f361e659673e9f0334534ede70d7acf4dc9bb3932f3c5", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637657, "uuid": "2f1eef33-aaa6-4e72-923e-d0d3906fec79", "comment": "Malware payload (Mirai)", "value": "b04e76d66ab2dce8e6440507ad4b33a65e823215", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637657, "uuid": "83e5ca9f-df58-486c-9b96-d73e639f9f0b", "comment": "Malware payload (Mirai)", "value": "2618120d33dca756f3df40944c5875e46ec88d81e66bcb1db1ea2296f7561f2daa2353a6821684e55f77de024b6dd6ff", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637657, "uuid": "c284306d-007b-4a13-929e-c0b0b5f38354", "value": "T1866302CF6EB02F16D0D8A2B5303825E5D839EDCAE243CA98C3E1A79B4735176518C757", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637657, "uuid": "6cfa0a4a-2934-44fc-a79b-ed0a2396d6ca", "value": "1536:saxZLmYKVDNSl2y08yumeJyGYVmIMzWTN0:saxZLmYKX+t08jmeJhYdN0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775637657, "uuid": "f1841f2a-84d6-42e2-ada1-5d8b5eed3e64", "value": 70460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775637657, "uuid": "bf1f5324-a2ea-43cb-9803-0fcd8a1f60c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637657, "uuid": "267a352c-e9c7-4e5a-ba9a-bd5ab73875a0", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d29bc175-3373-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1775670797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775670797, "uuid": "0986c8f1-8784-4532-8c40-da567bda36c3", "comment": "Malware payload (njrat)", "value": "2cbd959c38fb466998473f8e5c2110f7", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775670797, "uuid": "8d38cca0-0306-47e3-8d12-4d8bfa985d3b", "comment": "Malware payload (njrat)", "value": "f2c42c7641fcae4a61d7e6c183b06f9f828bd337f08ecba9f97033556540e52b", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775670797, "uuid": "bd1b8547-4411-4355-a0ef-17c436e57f09", "comment": "Malware payload (njrat)", "value": "5f4743958bfcd27ea81a1dbefb2910d3bcd45733", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775670797, "uuid": "c103c44c-f754-4a17-aae6-702d3c3f4f10", "comment": "Malware payload (njrat)", "value": "77d3e50317aa75115bf4903a3a6448ab050e0209a7d89350e53ffe39fed514600d182025b18ddb6017957f7553938479", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775670797, "uuid": "42ed19a5-90d6-4d97-a6f0-35e282cf123a", "value": "T154B533314A930924FC55A4B71BB3E2930E4DF426FD87424E6168E9AE7317E7279293F0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775670797, "uuid": "869ed0a9-1d81-45a5-8039-57d468c5b83c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775670797, "uuid": "48b377b6-194c-47ff-83bb-dab9d9e3a4cc", "value": "49152:k+DQS54uk9F8ktHgkcC7GSdHKC88Ro3m18m0Ar:k+DD4t9jTRo3q8Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775670797, "uuid": "c7cb1cec-014e-40cd-abae-8266da61958d", "value": 2468864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775670797, "uuid": "251e5311-d079-4d62-945a-1644f726f726", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775670797, "uuid": "416b2661-0015-4de8-b2c5-f1e828dad746", "value": "chromedriver.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34bf80ce-335a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775659795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775659795, "uuid": "c732f7d8-344b-4328-a4e6-9b634bd0459e", "comment": "Malware payload", "value": "3bef37ffadfcb0a553eb0cfa5c9a4975", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Program:Win32/Wacapew.C!ml", "colour": "#5BDFAF", "exportable": true, "hide_tag": false }, { "name": "Wacapew", "colour": "#8847C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775659795, "uuid": "2e9b6b5b-a4c9-4a6d-b2ca-1956f806bac1", "comment": "Malware payload", "value": "f3432499bb2716d0aabcdd186e890adbe5d4b9f2dc3a89b02b08d62440d8e0e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Program:Win32/Wacapew.C!ml", "colour": "#5BDFAF", "exportable": true, "hide_tag": false }, { "name": "Wacapew", "colour": "#8847C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775659795, "uuid": "f41acb69-a3b2-4fea-911c-dcfeef414bb9", "comment": "Malware payload", "value": "eda16de8cf098161960597c6560e83be4a51765c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Program:Win32/Wacapew.C!ml", "colour": "#5BDFAF", "exportable": true, "hide_tag": false }, { "name": "Wacapew", "colour": "#8847C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775659795, "uuid": "8413033d-61fe-4d45-bfb6-b76e4b031230", "comment": "Malware payload", "value": "98fae21adb2a0a1f8331f93c5cc16508c004042441a33075395d59a6f22d75eb934a37f86306261f6362c65b9b322887", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Program:Win32/Wacapew.C!ml", "colour": "#5BDFAF", "exportable": true, "hide_tag": false }, { "name": "Wacapew", "colour": "#8847C5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775659795, "uuid": "2d218421-ffa4-4a20-8542-94c075ee1ada", "value": "T1C208F143F81215EAC76C84B9C5AA06672374B840673FA7D31B50B728EDAB7C55E7B380", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775659795, "uuid": "b21cb0e6-ec78-4e11-80d4-180a61e3ebe9", "value": "cece05d62228feba4389b57bf9b54ded", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775659795, "uuid": "d4ae4604-f32a-4b08-82e9-a1c9763360f7", "value": "786432:x6wm6tjZdHVfp1uVS+w1l4uda87H6xOjW1vn0HuywiFZdvWO91A8HuDkePOPnwbO:wwm6tjZvBUwoOHbiIWgBH9MgxFNvcbFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775659795, "uuid": "66c9fecd-1980-4962-9867-f50550ef6c51", "value": 79291845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775659795, "uuid": "8a2624db-cae6-46aa-b053-dcca80a6b04a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775659795, "uuid": "dce6427f-c499-49d4-8a94-0ef3095533e1", "value": "venroy.11.2.19.widovs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43899bea-3329-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775638774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775638774, "uuid": "c8774f76-a858-49d6-a5d1-8569bfbf07a2", "comment": "Malware payload (Mirai)", "value": "2762bb5eab4e5f967328ed7dae622a47", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775638774, "uuid": "fb6cb333-3491-4cf4-9c84-1183b223b04c", "comment": "Malware payload (Mirai)", "value": "f3a8eae364304931a8b79aa085ad10d8155a94f3f2e1fd460fa045a5ef5f07cd", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775638774, "uuid": "089c8595-8f84-4b31-a472-178e597350f4", "comment": "Malware payload (Mirai)", "value": "1d4200d616061548723391c1ab13e17b87924ceb", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775638774, "uuid": "1edabee9-de60-4aac-b689-636cdcedf565", "comment": "Malware payload (Mirai)", "value": "f72842f875f9677eba99cf8a1eb158fe2c4fce92b41e6df12cef8f10c942c6e58ad32d7c196d0d341107cdac18b1c2bd", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775638774, "uuid": "bd1ceb8e-e9e3-4000-9464-59a7bdfc3f63", "value": "T10154D083B3279D6FCD7792714E45433626BB6A12C903630BBD60172CA8B76D65F08BE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775638774, "uuid": "9be48bc3-b1f2-48f0-b5cc-809c2867124f", "value": "6144:Io7LkuzbcbumnYKd5lYJJ6CRGsjmJTrtHofBlfb6sm+vBpYf:N4uzbciI/lYJJ6wjTfBlzlm+wf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775638774, "uuid": "3d2914a5-9401-449f-a077-c8adde0ed15a", "value": 282438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775638774, "uuid": "42c89966-a21d-471e-8932-e32a83976c2b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775638774, "uuid": "d8849b3d-377b-4f09-abc2-02411c61257d", "value": "cecbot_apk_616.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "298afc69-332b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775639589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639589, "uuid": "9eccd447-d914-4e70-9c41-f0f0ab9a59d2", "comment": "Malware payload (Mirai)", "value": "614bd7317ec2a201fb1a41179ada7c52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639589, "uuid": "7279a0e2-086d-464d-90cf-6fc15928d089", "comment": "Malware payload (Mirai)", "value": "f3fa09535f3e98300c1037eee9b3efb97a655bf7a172f974e9c3923e7527703d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639589, "uuid": "b583d06a-6839-4f14-a5a3-18d70c97a41e", "comment": "Malware payload (Mirai)", "value": "4338b5b3825a4fe5a39ae9478c9b487f98166c64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639589, "uuid": "8b3f276a-1ca9-4881-b427-d524db9dbae7", "comment": "Malware payload (Mirai)", "value": "48517290acb1f03a5680c3bcd005fd092835818269ad199636c3ee77e9274454b97df46432f07bd6fff6067c986b4b71", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639589, "uuid": "9a4283db-7a93-408b-b8cb-9731ba61ef15", "value": "T10103E1E3827F0934E47E59F5150F1654F5A3249768034F3E56ED229F8A9FE407E63A20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639589, "uuid": "2f658a9b-a684-4c0a-b369-b1646afe1321", "value": "768:abDhk8dq1h+GFvkjsmCn688/70YSSQk4ZpJx072PI:ab28dgpFFvxYYnO2w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775639589, "uuid": "9ae1b5df-3caf-43c6-86e1-3af28a636486", "value": 37820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775639589, "uuid": "4e283d14-a77d-4b16-9cb6-99232ba3e191", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639589, "uuid": "5937e141-b76a-4182-9502-54db17594cc5", "value": "tony.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "708ccbad-3363-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775663760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775663760, "uuid": "23aba501-c8bd-4257-afda-8d0a8e1033a4", "comment": "Malware payload (Mirai)", "value": "86cff723870eefb34175c8dc596e5099", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775663760, "uuid": "45819509-1bf3-4ffe-b12b-bcd4f32a189f", "comment": "Malware payload (Mirai)", "value": "f4df0e01516f6daa70d94eec1324e103e4115df17bd651fc4db65b1650b02251", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775663760, "uuid": "bd981db1-03ab-4942-bdb6-a4e2df2f9259", "comment": "Malware payload (Mirai)", "value": "5266d1f5da619e19e784e3e75d6e51e8b0245ecf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775663760, "uuid": "fc042f2a-f30f-4053-bd55-cc64b6c39c3d", "comment": "Malware payload (Mirai)", "value": "f0286fdda236b5daaf6076854a4d6592bac7b1bfa0416d9811086d47f3620504470856b3e774e2e84f4c07ea39d2b9ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775663760, "uuid": "ffcba0cd-3234-4701-8e01-4859f69fa200", "value": "T163E2F198C2904EE9C436513BA25F136AB4D57428B36DD0A7FAC818FAE37F00B696CC44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775663760, "uuid": "f3e01ac7-da82-425e-8c5c-3dc68be2c911", "value": "768:jjVUXpS9RP1d0G/Ku9MCGy02rRnrRnwEx0j3Ku9QQUBMTK4:jR7lrp/8yhRdw0lB0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775663760, "uuid": "a771b7a5-5393-4336-9c03-1e1adf242b8b", "value": 33072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775663760, "uuid": "8c45c02b-ca75-4971-b005-3a18e53707c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775663760, "uuid": "3af1a5b7-2000-409a-9e2d-489ab250b040", "value": "db0fa4b8db0333367e9bda3ab68b8042.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcd12719-32e9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775611490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775611490, "uuid": "e669fdbe-0303-4ef7-a756-17f0708603dd", "comment": "Malware payload", "value": "5b0601def99eaec0c764718fd79173c1", "object_relation": "md5", "Tag": [ { "name": "177-136-230-88", "colour": "#346922", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775611490, "uuid": "50899ece-b06a-47d6-b8c5-a9a24a3cc1d4", "comment": "Malware payload", "value": "f6f82ef33f3b3c2c42fbcf6cefd8c3a729f95086c242957800bd0f62f18c1b9a", "object_relation": "sha256", "Tag": [ { "name": "177-136-230-88", "colour": "#346922", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775611490, "uuid": "e407a93c-68b4-4c58-b00d-f85bcf8149f3", "comment": "Malware payload", "value": "29c22497ff4033bdf2fdfe6a5d04d8ad65f7ad3c", "object_relation": "sha1", "Tag": [ { "name": "177-136-230-88", "colour": "#346922", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775611490, "uuid": "fa2a665d-402c-483f-9826-4e6bbc589260", "comment": "Malware payload", "value": "83ff84c220b1f52a8aec71a9ff68269cd3f5349f5a58b2bbda1f52ca412f6ff924a4159482df287bf5921ad88682e3f5", "object_relation": "sha3-384", "Tag": [ { "name": "177-136-230-88", "colour": "#346922", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775611490, "uuid": "829af678-0a68-45b8-8070-0e655bf2d954", "value": "T1B8E62325A38BC526E64C0277F93EFE6E043A7E67033001E776A97D5E58744C2677AA03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775611490, "uuid": "77306918-765b-49c3-884b-f4110923e6c0", "value": "196608:YxFTgjQUNyTlTwdIvY3bx+4p9anpkBLpU1/Ajs7dGNd6R/s:ATgfNu1dYrhkn91gVd2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775611490, "uuid": "c2757b30-ec21-4da3-b201-7e3bac77261a", "value": 14309888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775611490, "uuid": "fc5dc7f1-f7f8-4253-b32c-d36bbf72fdf5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775611490, "uuid": "b3f4d0c8-e0e7-4b45-9627-954ba582ae29", "value": "f6f82ef33f3b3c2c42fbcf6cefd8c3a729f95086c242957800bd0f62f18c1b9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0da95975-33a5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775691941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775691941, "uuid": "1b2f7fea-bc1f-49d7-bdfc-de98358f9cf3", "comment": "Malware payload", "value": "c58c232dd8ad9a87a188647b82fe804a", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "antiddos-protection-net", "colour": "#3CB326", "exportable": true, "hide_tag": false }, { "name": "ChromeStealer", "colour": "#2EF335", "exportable": true, "hide_tag": false }, { "name": "jmn-la", "colour": "#8F5854", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "NDA", "colour": "#2F516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775691941, "uuid": "bad0c37a-f239-40c1-9c32-9e4949655eaa", "comment": "Malware payload", "value": "f84b26b0c7a836059fcd7847304ba6708964c5cbaf237b68f006b37ad8dc02f7", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "antiddos-protection-net", "colour": "#3CB326", "exportable": true, "hide_tag": false }, { "name": "ChromeStealer", "colour": "#2EF335", "exportable": true, "hide_tag": false }, { "name": "jmn-la", "colour": "#8F5854", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "NDA", "colour": "#2F516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775691941, "uuid": "0efc1288-ccab-45af-ae86-a1cc23ee71c9", "comment": "Malware payload", "value": "edcba97662791de443cb3fb15c7ec058c33f9141", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "antiddos-protection-net", "colour": "#3CB326", "exportable": true, "hide_tag": false }, { "name": "ChromeStealer", "colour": "#2EF335", "exportable": true, "hide_tag": false }, { "name": "jmn-la", "colour": "#8F5854", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "NDA", "colour": "#2F516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775691941, "uuid": "8c9e4632-6869-40cf-9d29-753a2f67ffac", "comment": "Malware payload", "value": "8419e457a48f731f2a5309f58219e889d573619bbf069da1b6001593af2ee035c21f2f37e1ff09b2952b5854f32c58e0", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "antiddos-protection-net", "colour": "#3CB326", "exportable": true, "hide_tag": false }, { "name": "ChromeStealer", "colour": "#2EF335", "exportable": true, "hide_tag": false }, { "name": "jmn-la", "colour": "#8F5854", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "NDA", "colour": "#2F516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775691941, "uuid": "37b75c7c-e871-4294-8186-47414d0e4238", "value": "T153515C3D32210872DBBB50F76DCA5258EF38AE95E2950F1CB08A91190616FEA0F50408", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775691941, "uuid": "f5934b20-8160-41f2-8dc0-d9319635b72f", "value": "48:aoV3D+Ou8zBVDp5iqph5Fqo2TQdfuIOsjuPZZjaHfN4x6otdOKT+3Gbe:aoNKOu8zBVz756Tx2uPZKN4MITsGi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775691941, "uuid": "1ccb7c7a-8857-4e8f-afde-598cd5ccb405", "value": 3050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775691941, "uuid": "638de6c9-5259-42be-b586-59ffe0feb47b", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775691941, "uuid": "d5123413-7dc7-4627-9745-a8055356faa3", "value": "5af5b5811080a5878938f71713bac22e930a18cb47166d3ced9733e6f0c6e28e.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db18efcc-32de-11f1-a769-42010a9c0008", "comment": "Malware payload (Ngioweb)", "timestamp": 1775606816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606816, "uuid": "0d456054-2226-4b16-93bc-9d9fd9df7dc5", "comment": "Malware payload (Ngioweb)", "value": "e381d5a1e8bfd89acb4ce28198175ae6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606816, "uuid": "1dc21a86-bd6f-41db-b289-44f6a319cd32", "comment": "Malware payload (Ngioweb)", "value": "f85ee1500347ab1ae9061973abf387be54a98ad1259f5265965d5b067c170923", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606816, "uuid": "8e410d26-bdec-4bfd-8608-bfad7a96a0b9", "comment": "Malware payload (Ngioweb)", "value": "46f6447d4144ce6bd752f29b75d167b7d3dc15c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606816, "uuid": "4a608be9-0c99-424e-8009-e6eeee779409", "comment": "Malware payload (Ngioweb)", "value": "1b0638c6fd7d2928fae26b9019e8eb4c2e099e2b54a7582c27d46dcc186bdb0e7878a4d744180d910a77aaecc1140a93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775606816, "uuid": "bbffea73-3d98-4d89-920e-68d29b57ad25", "value": "T143B37D21F9C445FEE1945E300B0FE30B8539F4859525FBEBD2E88FA26926E11173DB92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775606816, "uuid": "1ffe8670-015e-45a0-972b-5d092b797f8a", "value": "3072:OsoTfJB7wpIi82aBRKuJrLhP2+tjoZyP8k2K:OsoTRBsyXRj3B32K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775606816, "uuid": "534e27f5-2814-43b2-ae5f-5d655e6720ae", "value": 107776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775606816, "uuid": "05024313-28ab-45e0-a52a-f96ccf7b23e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775606816, "uuid": "9c30b14f-fe4a-457b-afd2-09e5954b913f", "value": "JXQJ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ae0346b-338b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775680931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775680931, "uuid": "14bec971-8ac5-4519-bc6e-7dc1f322ff50", "comment": "Malware payload", "value": "3efa12130439f3b64ac2e50ec5bbfab0", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "plafel-webtreinerauto-autos", "colour": "#B28E13", "exportable": true, "hide_tag": false }, { "name": "proronsar-webtreinerbr-autos", "colour": "#E16BC4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775680931, "uuid": "445e45bd-ef05-46ba-9ccc-cc785f069a6a", "comment": "Malware payload", "value": "f88d597200e44ffddf0e4d0230cdc42437a436b3d62b676d7dfac000ef72b2ed", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "plafel-webtreinerauto-autos", "colour": "#B28E13", "exportable": true, "hide_tag": false }, { "name": "proronsar-webtreinerbr-autos", "colour": "#E16BC4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775680931, "uuid": "0586c092-c1d6-446c-a517-a6e81b39f478", "comment": "Malware payload", "value": "af1553070910f3f6767ec88425cbbbd6a4d5d43a", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "plafel-webtreinerauto-autos", "colour": "#B28E13", "exportable": true, "hide_tag": false }, { "name": "proronsar-webtreinerbr-autos", "colour": "#E16BC4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775680931, "uuid": "efaabab9-2205-4529-a728-8dcafb5012df", "comment": "Malware payload", "value": "efec2cce63de51e36e42727a28a3a039745bafc6b28775c0b808bf9503d25ca2b3973428ad668d8412b967ac090cf553", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "plafel-webtreinerauto-autos", "colour": "#B28E13", "exportable": true, "hide_tag": false }, { "name": "proronsar-webtreinerbr-autos", "colour": "#E16BC4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775680931, "uuid": "7e185ef2-a2e7-4782-8503-d0e0244bfdc5", "value": "T18AA18FC8E1B5D194C437CC67C7266760E9E02779E35936CE59746322C07309782E0E0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775680931, "uuid": "4515e839-5f33-4312-b3f7-f1bfb463ba51", "value": "96:dBdKzuZignSYkqQ7SzKRj+/VTHFz17oxhzdqY:dBdKFVRqQwKjeFz17wzgY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775680931, "uuid": "644cf41a-fca3-4750-9255-a799c27163f0", "value": 4643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775680931, "uuid": "764e7e09-9dad-4b5b-bc01-4df810502c93", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775680931, "uuid": "60802cd6-6799-42d5-84e6-6f52cc04c60c", "value": "254186535_PDF.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e964ac71-32de-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775606840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606840, "uuid": "9a92e6d5-d38e-4dd8-bd4f-1c38bd229097", "comment": "Malware payload", "value": "c28ede49e0f16539a1fd6e3c5e588287", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606840, "uuid": "c1100d7b-34f1-4397-b771-4294552c2bfb", "comment": "Malware payload", "value": "f89836639ef62ae6f317f834fab00e166ef668772b021e5e468969bd66aa4ef1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606840, "uuid": "b87fe5b8-0670-424b-8e9d-cf34d9d55aef", "comment": "Malware payload", "value": "23c9aefb3cad032b6d4e08bede636caf4abba6f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606840, "uuid": "985a3cf7-3355-470a-afc6-2ff1805e3ef9", "comment": "Malware payload", "value": "47a8cd10b664c7231bf55fc1ea21d04c3808de50cbc2c51f34e2be8a85e05517001f796eb086976f76715083759c2e4b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775606840, "uuid": "2d3b9a8b-b652-4616-9759-5b01bd77f9ee", "value": "T165142A11EF1AAE3BCB6416F185371B60C79548A50474E6217B013A6A1FB373F68CFE98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775606840, "uuid": "7670a35a-9d3e-4779-9ce3-fe54d3ea9ff1", "value": "1536:bGWj+hWcNbEMfVG5diumMRLleDd9BUFLuRudbEuPlh1gwQ/SxhdxphUAo4T:Kg+cy2Iu7eJ9BUFLuRG4uPlhHthhhW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775606840, "uuid": "83360c54-89e8-45ef-97ab-8995fe583ae0", "value": 198200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775606840, "uuid": "51e70f6f-49f3-4064-a594-9ee865269fa6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775606840, "uuid": "8ff70fbb-d2ca-4353-8491-e261c3c70d4c", "value": "AWMJ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aba62126-32ff-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775620910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775620910, "uuid": "ac847a4f-d49a-4143-bfd2-9eaf9678f436", "comment": "Malware payload (Mirai)", "value": "966cf73c0bc8c0785f458ff5d5ed35b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775620910, "uuid": "3a091c07-0fde-4b50-8af9-64da6b3d5b1b", "comment": "Malware payload (Mirai)", "value": "f920aa1c33eda029b26fcda772873a48757c6adc575f69197b1972cf8bd0a0eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775620910, "uuid": "3a1dc211-f7ef-4341-bf3d-451fe8b1b9a8", "comment": "Malware payload (Mirai)", "value": "d812d08aa09ea65d4f2459c2af6ffb3ab58874e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775620910, "uuid": "16792361-9eb4-4a8b-8b64-ae1bd69aa063", "comment": "Malware payload (Mirai)", "value": "225c34603b117833d1f41e830a695a7f909436d11fd0438312751b8dbd9d11a58650864bc2db42da587c58b697532701", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775620910, "uuid": "c06ead73-dacb-440a-af45-5d064d115353", "value": "T1F133D79178D15A2AC6E423BAF9AE508E3321B3E8D1DF7217CC241B047AD552F0DA7B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775620910, "uuid": "88bcdaa3-ad76-4698-aa12-024b1f8c97f9", "value": "1536:YGZh1mxMBEfiJo25+J+KEwrKdqnKKUWhK9RP:YGZ++tS+KEwwKPh6B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775620910, "uuid": "2aaa3748-f93e-4dba-9f2f-673d2c9b41fd", "value": 51172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775620910, "uuid": "3fb63512-98a3-47de-84e9-c16b06b02ede", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775620910, "uuid": "214e68ab-3abf-4895-8362-c8950bb20370", "value": "jew.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63893d8d-3356-11f1-a769-42010a9c0008", "comment": "Malware payload (Arsink)", "timestamp": 1775658155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775658155, "uuid": "c0fb0bfa-819c-4071-83fb-db2288846e97", "comment": "Malware payload (Arsink)", "value": "2685d453bbf1bac620c368ea2dceca6c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775658155, "uuid": "d8e6fcff-4671-47cb-bc6c-352072fc4e55", "comment": "Malware payload (Arsink)", "value": "f9b00165598a0600d53064b2871477fec3bd62549a69328c4bdd39467af2d48d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775658155, "uuid": "78fd5489-26cf-4bbd-8be8-4cc5d0634a7b", "comment": "Malware payload (Arsink)", "value": "459c66c3aa3b4b41494b3a95a3bf33f707e2bd9a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775658155, "uuid": "0b882da0-b331-456f-9e53-17f3316cbb04", "comment": "Malware payload (Arsink)", "value": "4e6b94403a8817605c1ab8a9da350f617cd91a87f2855400da0e637ec4d3cf2d9b9c14ca82fd781caab08f7b2ff84482", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Arsink", "colour": "#096866", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775658155, "uuid": "db2f2068-5975-41d0-bc26-a41740610e9c", "value": "T19E3523423375AFE7C5A28934537D92D6547B7EEA5136172934AEBF3073B4A381203BA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775658155, "uuid": "4436adf4-4ba3-4199-b4f6-d594c3ccf7f9", "value": "24576:KqE9VFrpjv5k9QDk3ERJoztuztFztAzt7ztsr8yptgPvM3:KB9JjRAQIETozMz3zizJzY3mW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775658155, "uuid": "7f38d62f-3df5-453a-9f94-33f01f0655cb", "value": 1123464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775658155, "uuid": "ca144b52-c97e-4106-8a78-18cec315de72", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775658155, "uuid": "a7e3d995-1d3a-451b-a6eb-b83b51a670c3", "value": "base.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc228224-332c-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1775640319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775640319, "uuid": "084df5e5-f93d-4a53-a9df-cff638944b51", "comment": "Malware payload (ACRStealer)", "value": "6f4aa4d9ed66b7bc6f29b7f2b7844258", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775640319, "uuid": "f12fc569-2d59-404b-af61-c442382658ec", "comment": "Malware payload (ACRStealer)", "value": "fba804be8dc1f275d1ea8a6701b5a1b27c02b3cc9776cd80f13c37f8fa4fe157", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775640319, "uuid": "4d15b4ae-2e3c-48de-be49-ba58dd212ca0", "comment": "Malware payload (ACRStealer)", "value": "dd9027a90f6b126c33cc6133dc2aa6932b299568", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775640319, "uuid": "68e78521-acd5-436b-a9b8-c6f8134df986", "comment": "Malware payload (ACRStealer)", "value": "4c2eea750e12dbd5fdd1560a240b89d2726ca6f4f1357e3408f020deaa1624d50eb905abf0f58024a9277a13b9bf77f6", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775640319, "uuid": "dfbb70b4-aca5-4549-91b7-275903ed49a8", "value": "T1B0065C07FCB94CE9C099A23484736147BE6178405B3163D72BE1B6682F73BF0A97AB15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775640319, "uuid": "e1c4a21d-dcae-4f66-92d1-204ad3a3146a", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775640319, "uuid": "d2d40d6c-9a95-4211-b954-6a6cf1e8e414", "value": "49152:va60fnauuLEgIYxn7WOAfIIQ2MIjUGUQc2dYY:vmTfrpr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775640319, "uuid": "9f359c04-4dd6-45fa-9632-e4bac4cd9f60", "value": 3860464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775640319, "uuid": "fd4f8b51-ea08-4ca2-bda7-33f582d29c0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775640319, "uuid": "8832d17e-5f64-4682-9062-92411379eedc", "value": "SecuriteInfo.com.Win64.MalwareX-gen.58188876", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4fc6673-32de-11f1-a769-42010a9c0008", "comment": "Malware payload (Ngioweb)", "timestamp": 1775606806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606806, "uuid": "0b77c626-dbe9-413a-8eb7-5701b430a2d1", "comment": "Malware payload (Ngioweb)", "value": "f2f1efa13a1580c7a6d0a61698fdcc02", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606806, "uuid": "8b0a2d50-faed-4beb-8187-903823895d0f", "comment": "Malware payload (Ngioweb)", "value": "fc43bc3a09d3d47a1fa0ed5559d8d98468c07e768daf9bf1f806984b342e4aa0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606806, "uuid": "89540b1c-651c-465a-8ecc-d1c7c44b2b71", "comment": "Malware payload (Ngioweb)", "value": "7b328a46138a1de183dc9ce5c8c2a68d1a451188", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775606806, "uuid": "e451077e-bcc6-423d-8ad7-cbf1bdde3d04", "comment": "Malware payload (Ngioweb)", "value": "2f7ca86adefb99e706ce084aa88e48361419c758ff7c2dc825fcb94152f03caa374d549176f438b1bdcc0ff0aaccf893", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775606806, "uuid": "3229b5de-4834-4613-8dfc-02b5738419be", "value": "T182B37D83EBD7C0F1EC960A761117D72B9732A829646BEF8BF7991C11AD91302421F379", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775606806, "uuid": "1b3cd107-4280-442c-9fc5-79e9cf6ef9e1", "value": "3072:/hFPZ+jsiDL42RwWHsCOQ4pOla8ZuMjSoY:/nPesiF7MgBlHuMO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775606806, "uuid": "83ead92d-989f-4dd1-9264-0d86163c9d29", "value": 111916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775606806, "uuid": "6148fe7f-85c5-42a8-b20b-d85fa7fd42d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775606806, "uuid": "b7ca2d02-042d-47e6-8420-c587fd5b5982", "value": "XSDX", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "115e8a74-3327-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775637831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637831, "uuid": "ba737847-ec5e-4882-b5ea-b53cb581e3be", "comment": "Malware payload (Mirai)", "value": "69418b13314fb26876a609cd9d54c695", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637831, "uuid": "5e048333-4211-48bf-8c29-2c9657e5ec9f", "comment": "Malware payload (Mirai)", "value": "fc5c57ae0c66ea7582e8fea937f533ceaea1c83ff51a75e4f62d4ef6e1930447", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637831, "uuid": "e929e332-f421-40dd-b284-3480bfc3ec0a", "comment": "Malware payload (Mirai)", "value": "b54ec434a52d273853a58e1f2d432d0fd523d66a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775637831, "uuid": "6077fc05-2f1a-4d81-b8cd-8d32b555f231", "comment": "Malware payload (Mirai)", "value": "6278d820b1c67bb52476a0b4da2c16b58dd9e48c9c03ad4f197ab6af69db0cda423c5b735288fa15c7f7938a3a96ec2d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637831, "uuid": "f06af10f-2a8f-4af7-962f-3506306cf345", "value": "T11F63410ABF611EF7F86FCD3706E52B49308C641A21A83F757974E918FA4A10B54E38B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637831, "uuid": "550bd292-224e-4bdc-b811-b68d4d3335a7", "value": "1536:nxo6M86eAtqV7lf2VNufYuI0Kck6n2MFiwbZn:K6MjeAt8792hulKV6nkwbZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775637831, "uuid": "d5d3e0a0-a214-42c8-8885-0d935eea78d4", "value": 71480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775637831, "uuid": "9ef4a8bb-4a9c-4584-92ce-2c963bdfca10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775637831, "uuid": "d1ee7647-8a75-44a7-a896-69580f2c6b18", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c3cd2e9-332b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775639567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639567, "uuid": "6eaed345-f282-43b8-a483-33b63bbc3dce", "comment": "Malware payload", "value": "0b108d266257eca22e4380c7ce91ca5e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639567, "uuid": "750e70b8-86ab-499e-91f9-2e3ffc4bfdd6", "comment": "Malware payload", "value": "fcd496dec276a30903fa94d453e872626d98dd25e6b2e34482a332e2e2f1e29f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639567, "uuid": "f00980c7-4cdc-4210-8998-0650b0566b56", "comment": "Malware payload", "value": "961284122e33efcadb4dbd3e3c48a27e507479df", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775639567, "uuid": "e10aa50a-2c2d-469f-b06a-8b752c9c06d5", "comment": "Malware payload", "value": "8eaad90f999edb5b3cdcbe75888d119199232db0dc595bc348b5d9cdf234d3d685e3d5c131c316c916865f53169bd775", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639567, "uuid": "94bf1134-1c85-481c-ba98-47c25728752b", "value": "T1F3342394215905C24A91BA5148F7AC3EA8831E62D5CFDCD39CA2841F6D6CBB01BADCFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639567, "uuid": "f2c5c59d-dfc5-463a-b801-21b506729da8", "value": "6144:YNpHew1k7IVAam4QcXFwwvloSxtTv7/HRPH:2pHew1kTam4QcXFwwvloktTv7/dH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775639567, "uuid": "1062a9c8-2849-4258-a325-b9d349e04ee2", "value": 230449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775639567, "uuid": "6ecead55-0f89-48a7-9a54-b8f40ab00a01", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775639567, "uuid": "bed7f171-84b2-49f3-b1d3-9d25bc8e1d46", "value": "f3a8eae3_flat.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "963640b0-33a2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775690882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690882, "uuid": "65dc01d2-a2ba-4027-af0c-8e659562744c", "comment": "Malware payload (Mirai)", "value": "f95c4fcbcc805903e2712b4440d9c9ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690882, "uuid": "ef77c835-3436-4db0-b4b9-55e3eb03cc3a", "comment": "Malware payload (Mirai)", "value": "fd47d510225f93555ed1c3454f9d2fb299f08d9845cba08a096be501e3e1e084", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690882, "uuid": "3a4ff223-63cf-4ed6-be7c-38e5c8928aef", "comment": "Malware payload (Mirai)", "value": "1a057e94fd0634f8626b7b19578d08d01f5ffbb2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775690882, "uuid": "071f5cf9-3452-4a75-91c5-0c545faba4f0", "comment": "Malware payload (Mirai)", "value": "c7af82ff83ef124d8ea87dd56049901f0fd745a822d1cf00115acf5d4eb8fea6243969c07de0b6a54829dcf6bb9c0f79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775690882, "uuid": "3d4b8ff4-16b6-468d-a8ee-0719a4830e8f", "value": "T1503329DAB402AD7CF89FEA7E80160E0AF221235510530B2B67BFFDD37E321549952E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775690882, "uuid": "309466ef-83cd-4f69-9bea-def1649a9551", "value": "768:7MehvKgc46P1FmWQc7/JgFHdIp8LujWeXzpUGRJTPOMdL88pIwk:QIK34GfmbBF28Sjp1UGRJbOMdw8Dk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775690882, "uuid": "a4d934f1-49d5-46c3-b859-8367e94293e5", "value": 52800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775690882, "uuid": "ee36aefe-1acb-4968-8760-a706f013748d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775690882, "uuid": "c802a51e-a99d-4d9a-9f7f-03f4c895cc54", "value": "Josho.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f89ce3e-3342-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775649532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775649532, "uuid": "84d7aa80-23aa-45f1-8555-6c73084775a8", "comment": "Malware payload", "value": "81650f69e3275b3d6b43381dbd2cd0d5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "oficiospolicia-com", "colour": "#4B94B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775649532, "uuid": "3ea4c3a4-9541-46c8-8eae-d6dc69665b93", "comment": "Malware payload", "value": "fd5aabb5877a3f8fa82d4aaab61ad53083d8aad916b88498f58f4061a1ea244d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "oficiospolicia-com", "colour": "#4B94B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775649532, "uuid": "e481ccc1-ce2f-4e86-b52c-5266e667ae16", "comment": "Malware payload", "value": "8fc5bf8068e1016d0d8c5995c949cc71e8a4e673", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "oficiospolicia-com", "colour": "#4B94B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775649532, "uuid": "4efe46b1-520f-40eb-97f9-75b843b9d215", "comment": "Malware payload", "value": "102744daf8ff34f2639ba6eaba115ec49e31aafcf359ab742e0aa81d5b88efea81d6ff66e2f2ce754cb17fc943aa14bf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "oficiospolicia-com", "colour": "#4B94B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775649532, "uuid": "9944115c-cc76-4d13-b24d-75e6a74ed06f", "value": "T1D882EA88D9F6592232F3A21B1A9B9903351151036706CA897FDCC6F49FD6784B8D3BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775649532, "uuid": "8a6f8178-c978-4d2c-a47b-4d705fd207c1", "value": "384:sB+WfCrRG1hE01lkKLWButX5R7nr+HQ9rEYLQ:7Z4h11mKyul3n6HQ9rEYE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775649532, "uuid": "6809a6cb-f96a-4e8e-a082-75c1363c6939", "value": 19265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775649532, "uuid": "92bbdf30-3283-4aef-a18a-3d47bdd8c067", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775649532, "uuid": "35f26bee-a3e8-4ac9-97be-759bed71263d", "value": "fd5aabb5877a3f8fa82d4aaab61ad53083d8aad916b88498f58f4061a1ea244d.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a72fd63f-32ff-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775620902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775620902, "uuid": "e1cfd751-88d8-466f-af75-97ef079d8700", "comment": "Malware payload (Mirai)", "value": "1fc5ec7ee0f2f52bf109ad47ea10e388", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775620902, "uuid": "374cf46a-9401-453b-a740-fe2048e63375", "comment": "Malware payload (Mirai)", "value": "fd73471e429a7108e0d55caaec27d4a599f2942a513c785eea303bc6eb2d1952", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775620902, "uuid": "e1105a50-7b8a-4dd1-b0e7-962392e96608", "comment": "Malware payload (Mirai)", "value": "33e6098ab6decc159c610e5e5a266c171b624c74", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775620902, "uuid": "1ef9b8e2-962f-47ee-aeae-87ad2d7cead3", "comment": "Malware payload (Mirai)", "value": "df1d0c841d5c531e3edde51d3eb7b32b1b17d437b78eb44114b1c6f0211d5ba257076da4dd1975530594ff713af258ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775620902, "uuid": "1450a111-4e5c-4593-84a2-262b2fba3f84", "value": "T109431A96B801AD7CF94FE6BE94234D0DFA21335051930B2B67A7FDD36D321A86E12D42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775620902, "uuid": "c0091274-33ac-4db8-8f30-ea57bb4ad02c", "value": "1536:oFMAMFlwZA9UwTrPE3wqyIE8WhibBqKpnzJ:zTFlwZSUwTYlfqjKpzJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775620902, "uuid": "620f0104-17b7-47a1-a2fc-9ee915c435d3", "value": 57088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775620902, "uuid": "b6597672-4931-49f7-9fb0-6ad2c32a6ffc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775620902, "uuid": "276938c8-10a5-41b2-b60f-43893a73ae98", "value": "jew.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a79128ac-3392-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1775684039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775684039, "uuid": "cdd5db3b-8402-46ea-a546-02d6491d1fd6", "comment": "Malware payload (ConnectWise)", "value": "ef4fef77520e8903793fef6c63256e1d", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775684039, "uuid": "b8bc85ca-994e-43b2-a052-0c3b6d1e0ad2", "comment": "Malware payload (ConnectWise)", "value": "febcfb36c602a9b9e37076ae29b0f8a650cdba5d263b458729ce27fb1e443218", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775684039, "uuid": "b56e928e-63c3-42d2-b1b8-79b4a6a3b190", "comment": "Malware payload (ConnectWise)", "value": "edefcf4a5f1297bd54e239655819e5d34735119e", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775684039, "uuid": "e9e5078b-3d3b-4e36-a913-692bacefaa93", "comment": "Malware payload (ConnectWise)", "value": "699dc0718da5319b2f3f646f436f54d980ac29de10fbb7ad641b51af6c75fdb8432485bae4840c12f6982779e8fc18bf", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775684039, "uuid": "12ecdefc-69a1-40f2-a82d-efe0dc94519e", "value": "T18DD622136BF89E67E0B1DB74FF365464A7277E055922B1EE1214790E2F70A8089A3337", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775684039, "uuid": "60f714c4-0b16-4bf0-aa50-2c9c05bbbdbe", "value": "196608:NHxcp9ym3nltDUJVTHxcp9ym3dHxcp9ym3xHxcp9ym3wHxcp9ym3gHxcp9ym3ZHc:/GplpEGpPGpjGpeGpOGprGpz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775684039, "uuid": "9a9f713a-6e86-4901-99b6-ceb930226f64", "value": 13541376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775684039, "uuid": "6ed83195-8bc9-488c-984f-8c51f6faa916", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775684039, "uuid": "91443202-42fb-4de6-98d2-b3731e3af158", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }