{ "Event": { "published": true, "date": "2026-05-06", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-05-06", "timestamp": 1778112181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "32e72984-0fc9-47a9-aff7-b0a7e7874ad0", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4a2fbb5-4929-11f1-a769-42010a9c0008", "comment": "Malware payload (XoriumStealer)", "timestamp": 1778057970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057970, "uuid": "7cf5bb8b-68af-4158-a05d-915f014d8103", "comment": "Malware payload (XoriumStealer)", "value": "b5538a56e7a86b8d3be84449dc5a59e4", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "XoriumStealer", "colour": "#EE67D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057970, "uuid": "688e832d-cdc9-4a42-847f-c0069b5a44d0", "comment": "Malware payload (XoriumStealer)", "value": "00c8182b41a952378fc4c9acc4e0a9f31c5570b126618e4a9f162ea5f634ca62", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "XoriumStealer", "colour": "#EE67D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057970, "uuid": "7e52411d-6bb6-4ba6-8525-bea0d868ddaa", "comment": "Malware payload (XoriumStealer)", "value": "0b6b9784bccf45648d60dcd8b32645867042da85", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "XoriumStealer", "colour": "#EE67D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057970, "uuid": "109eb38a-fb13-4426-96ac-6dd97a1668b6", "comment": "Malware payload (XoriumStealer)", "value": "5c8f5d5240efe14c2618aae28396f363e88eb0f25520cc5a39d86b7eefc9d5156fcd80855a08f5dd2b31cbd1bf9f034a", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "XoriumStealer", "colour": "#EE67D6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057970, "uuid": "e4a3a702-22af-42cc-bf35-000535188f19", "value": "T18A34AE82B204D54BC53D49BE90A2E87465297EBD8886D9E17BDC3EEFF433B005902D67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057970, "uuid": "c68c835e-bc23-4af0-83f9-3efcdf36b2df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057970, "uuid": "417cd189-9b44-43ec-971a-85af5e1b2fd5", "value": "3072:o0lY4effZ0Q2I/l9RH8cHhoh+lTn9buR6PQQ04L+IefCvJHXZvbxpn:cZ0Q22WcRbz0wHXN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778057970, "uuid": "5ac43682-e13e-4df5-86fd-18b852a6d886", "value": 238080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778057970, "uuid": "5bf8dfb4-7fbc-4ff8-8a8f-c1ac187c7913", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057970, "uuid": "b10bc527-75f7-48e6-97c5-c0f060a85a44", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5b0e4be-4925-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778056280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778056280, "uuid": "2a11c20c-7e2d-47ac-bfae-d6ac7e5a1810", "comment": "Malware payload", "value": "32af97a5c0eb4836c25080e4fb5a8d77", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778056280, "uuid": "de0adc24-d24a-49c7-b6d9-e6d326826d83", "comment": "Malware payload", "value": "0245f09eaaf22ed607f02e845f78619d037221d04024c02ae92d6944c627981a", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778056280, "uuid": "add17bde-42cd-42ef-aa2f-bd7ac4fbfac5", "comment": "Malware payload", "value": "cd3407565031408628f07b3fe8347db795fbf3f9", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778056280, "uuid": "bfde7c79-bca9-49ba-8dd9-c0153d629e9e", "comment": "Malware payload", "value": "0981674d33f06feb663123e2fdb56712c5cd8a6191000b7133dc94cd2a0886ebc1abe0ad403233ea1834162a1d5a460b", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778056280, "uuid": "d17df986-abab-4b6e-b3bc-10386e8895fc", "value": "T13FC63321FACA5950D8F78337C97281AA607ADD745F13CA677909733E203B6E8970A7C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778056280, "uuid": "9c2b7d9d-1de3-485d-8166-e3b19efdd451", "value": "196608:EVVSDVO0ETS2RB+sxmxVe4tiQXknw4UKoFISvyFuoSrlxPLQ+uWDtOvU2G6fYHL0:EvSBOfbaVimYr7oxyFuDjPs4DtOPG6mg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778056280, "uuid": "de991e7d-6789-4e9d-97a0-aa3683457718", "value": 12306061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778056280, "uuid": "2b2dc17a-230c-488b-a8c6-067faf41e2d0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778056280, "uuid": "96055640-78ee-484c-91d0-1c04941ca585", "value": "iMobile Lite(3).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06764d03-4981-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778095393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778095393, "uuid": "ff22fcf6-bd05-42c7-be8a-5ab5de98bc49", "comment": "Malware payload (Mirai)", "value": "663ccb10aa7167d1b603be4e7e6daf03", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778095393, "uuid": "31ccf4a3-748c-4dd8-bdea-a307329db9de", "comment": "Malware payload (Mirai)", "value": "0310d6380578fbb72f208b15c3dd11aaf19a1971ff47941a163fff1aaf492721", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778095393, "uuid": "0d975475-db21-4f8d-87a7-a9c99cbdddb7", "comment": "Malware payload (Mirai)", "value": "d8961b7bcfc0aab38da7ca7089f7f5dec2451c35", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778095393, "uuid": "c7ea3c61-33a0-4fd8-8882-5779acf8837b", "comment": "Malware payload (Mirai)", "value": "db24acb867b2450884b0ee2c81aa8621ec5f19652a84d422b4b097fbd4f115cddaf3587526cb0141bc6304fdc24ff9e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778095393, "uuid": "8e0b2e41-2736-4776-a999-edcf1d59fdb5", "value": "T1155302430BF6DAA1C5B9F13DBE19D9B9F2115ACE148853978284BE0301F9B9C95B8262", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778095393, "uuid": "dd783f03-18a1-4087-ab60-4969a3c53d9b", "value": "1536:7G3RpoiTjosq8zBCmc+89bG8Z9F5/APtNj6nouy8ryp:7G33oojosq0WH/CtNuout6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778095393, "uuid": "b27ffda9-c5dd-4ba7-b342-05b9c61a4df1", "value": 63764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778095393, "uuid": "59a55a02-895d-43ff-b3a5-c46082e8c11e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778095393, "uuid": "af707d04-1ef0-4849-bbb9-f9fa55252469", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05664024-4928-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778057166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057166, "uuid": "dee67780-a009-4b36-86d7-20e2f1867bc3", "comment": "Malware payload", "value": "68ea2905e05580595cc109157e48d9e7", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057166, "uuid": "6ca9991f-b78e-41dc-95f5-63ec2bd5a490", "comment": "Malware payload", "value": "03239b548d97f6ca493b851de41dc9563267cea385e390a45debc133edba59d8", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057166, "uuid": "7599e306-3caa-4ef0-aa87-b3d51ed56fdb", "comment": "Malware payload", "value": "e9fd8b35d7cb93a247a06a21e1a37499dc2bfecf", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057166, "uuid": "ca944319-4f2d-4885-87f3-7448f0f1ed62", "comment": "Malware payload", "value": "65101c477986e228ca12f088fea519898eddd4e5aa6582dea6dd6de82fbdd366b8b68de7a55c091cbfdbb491951099f8", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057166, "uuid": "56e355f7-7d47-42db-926f-31f4d05deb15", "value": "T143E6124BEE58C85AECF65336FE32032338261DA84703C5BF61A9B63D7E735C24A91591", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057166, "uuid": "1923ba32-2ef9-4516-89f1-d04ed7c03c55", "value": "196608:FSGI36F2UXiVYAucDXA/eYUNSEmSHnisETjsGR4lEpc9tv+an6HWN0tEiSSm8FJq:PFfAZD8REmCmTjsGR4aipv6HLE+FJj18", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778057166, "uuid": "59def346-2fc4-4c24-a385-c930fac573b6", "value": 14680884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778057166, "uuid": "4fbeaf6d-0d5f-4686-aa05-0ac4f0bd8022", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057166, "uuid": "9f9b4d32-49b1-4ced-ace2-5bdc2b842009", "value": "iMobile Lite (4).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a472dc8-4933-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1778061925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061925, "uuid": "3114795a-9018-4ee7-8b89-6cd5f25d2263", "comment": "Malware payload (NanoCore)", "value": "975fae5c3658fc4b93000226d4642c09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061925, "uuid": "8a0bc89e-55c0-45c1-b2d2-8a0c02dded3e", "comment": "Malware payload (NanoCore)", "value": "038303e39c727ab3e4b93e005b7e66948f059cbf67544fbd7678c8a677775adf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061925, "uuid": "2eb3e292-44d5-4412-848b-e7d5ae251617", "comment": "Malware payload (NanoCore)", "value": "6d956c945eb2dbff2dfb605f5d5f51eb2a399898", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061925, "uuid": "c89be16b-5255-4811-9287-906e1a4b7cd9", "comment": "Malware payload (NanoCore)", "value": "2def7194816d8494253570be19f52fa007bb6d2e6f705c09f53ec0da4195a84bfcccaa2f8a954864b589b84e12740166", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061925, "uuid": "0e854c0b-66ce-4b72-9070-8a4f48ef3140", "value": "T17D14CF163BA88A3FE2CF8679601212129379C2E398D3F3DE18D455B79F667E50A071C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061925, "uuid": "3002dea2-7633-4c24-9a29-ace398cfbc79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061925, "uuid": "dbe25c30-7570-4b2b-8621-7e635977023a", "value": "6144:MLV6Bta6dtJmakIM5qR/4/hpQBhhVLy7Ak:MLV6BtpmkhR/4/UBh2H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778061925, "uuid": "2d1454b4-6232-4763-af03-95f3379abd0e", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778061925, "uuid": "525ba793-df68-40a6-aacf-7ec1154f0442", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061925, "uuid": "243472ac-0f49-4d09-9357-0d47395fef23", "value": "hotro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f6229a9-492d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778059330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059330, "uuid": "f203c70d-08da-4ce3-ae9d-16f7499070a4", "comment": "Malware payload", "value": "9aca30f2672cb5a5f88a1751701841d8", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059330, "uuid": "a6043bff-24cb-446b-a817-c8b88309b8fa", "comment": "Malware payload", "value": "03a1882dba860beb0697f3ad5444a6b0b5ac3b4b54d7a28dc1f7f11c5ab63a54", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059330, "uuid": "5b01c6df-d9e2-4a34-a580-a654edb7800b", "comment": "Malware payload", "value": "5fbcadd42481288e23a3e0bb6a487b73ac32f64c", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059330, "uuid": "41a94686-f9a2-4344-84f7-7c787ab6daa3", "comment": "Malware payload", "value": "72c54d8513ec26b061434ce027c569bd0f0e17ea39488ceb02f15baa8a5292853bd10e56d1643339726fc3f7efcf9e1d", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778059330, "uuid": "9c3e189f-ef3b-450a-b516-87bed1d2711a", "value": "T13EE6124BEE58C86AECF65339FE32022334365D684703C5BBA595BA3D3DB36C24A815D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778059330, "uuid": "2ca9e198-a23e-4fc2-b308-8c267affadd7", "value": "393216:mT1Eqg/J2t/sgWsuh/L2duUL2N1Bfc2px3WkLKGM:m+VK0L2du+E1i4rRM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778059330, "uuid": "016bbed1-5703-477b-8259-80fde15538fd", "value": 14701371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778059330, "uuid": "2937cccd-8b3d-4ba7-8c88-f0138e59a3d7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778059330, "uuid": "6bf4378f-cef5-40fd-adb1-d5ba2874f27e", "value": "iMobile Lite (13).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c268bfac-492c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778059201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059201, "uuid": "e2c2aace-36ee-43d6-b05e-b1bd5d3ef7ce", "comment": "Malware payload", "value": "1b5c78314e947ddf81cf9a59cd2a3029", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059201, "uuid": "4f66cca3-4de1-499c-9871-bf4ba979a513", "comment": "Malware payload", "value": "05e1761b535537287e7b72d103a29c4453742725600f59a34a4831eafc0b8e53", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059201, "uuid": "ecbb4723-fd92-4bf2-978c-0b6b0e6b5fbf", "comment": "Malware payload", "value": "38c2970b855d1f15bcd695cd2a5873394be5ccb4", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059201, "uuid": "19111aa6-e06c-47ef-a1b4-ea3ca56db016", "comment": "Malware payload", "value": "fbb7b9f53593cbcca22af9cf46447af3302d5c7b86c524638973245eb41cbe71f1fa325c71deed54010e0b11a5620318", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778059201, "uuid": "34e82841-72db-4983-a541-fc3592f86a2a", "value": "T15C362357C5C992E8D4A34B30268B13EA74D0BA4989FDC81D3AC76C42BF11CEB464A5F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778059201, "uuid": "499408b2-3457-45f8-82fc-5c59c4bb112f", "value": "98304:8tWy/xdXmuJ+mcSkKi6xPbBCguDTRIaOG0wvgIBn2YRURm8INbO65d:8xvXmu6SvPoguDTRHOG0wv4YSRQNq6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778059201, "uuid": "af4cd594-c1c7-4b9c-8b58-f860a668faff", "value": 5246536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778059201, "uuid": "dd4c2dd9-fd47-452b-a26d-59dcd6e920d0", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778059201, "uuid": "73fe7431-d123-459f-97bc-61f8742497e0", "value": "com.apple.cli", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6dff44c-498b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778100037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100037, "uuid": "f77cc6ff-5dcb-4ac8-94ac-15cef7e430e8", "comment": "Malware payload", "value": "d2e66932dd35f1b8dc002dc4f134eda6", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100037, "uuid": "b384f18b-6724-40d9-b371-5c462aaa4560", "comment": "Malware payload", "value": "05ed7725dd78d20c8fe5bf1a130fb095571f49d56efa0529b8cc0be0a6a1a97f", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100037, "uuid": "a940648b-d479-4d3b-bf1c-7aa96a1cfc0e", "comment": "Malware payload", "value": "a850acde9677a9fd6e4fc4806836ce13b05f12d9", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100037, "uuid": "1b466800-b9d6-4042-9e6a-1b32be4d053a", "comment": "Malware payload", "value": "8b0c45e425cd8baddc3430989c94fd6b5c5c3bdbfb2c3f9ab181ab3f4de457a5eb60ab6c72121a5214bdd3add40a55fb", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100037, "uuid": "e80735b3-4007-4d22-a39e-52902a725210", "value": "T1B9512F16B3A107B5623044E2881C570A58F1E2FB3A6644D0D0F3C39AF27A2963C6CB78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100037, "uuid": "048bafea-4e19-48dc-b872-2466ced9e469", "value": "48:e5t2nFAZyNdhIWp1pGA3HR5HY/bPNj4pDDSRwGM3mZXNW:ef2YQ8WPBhmk1DawGfTW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778100037, "uuid": "77157514-a348-4dc2-a1cc-2c0acd552c5f", "value": 2694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778100037, "uuid": "3bc7f4d7-d3ce-47d2-b154-8d39e14e36e8", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100037, "uuid": "c31a4c18-eff4-4a27-ba6f-0f5c04174c5a", "value": "NDB_09131305.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2dba9e1-4958-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778078153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778078153, "uuid": "7b52bb48-3bb5-43e1-a6b0-9d1bd2ce1628", "comment": "Malware payload", "value": "2403d743c37f20e5c992518e0841a3a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778078153, "uuid": "b11e997e-c589-4804-9935-2bf040cbfe58", "comment": "Malware payload", "value": "07d696e59d20a6ecb212e3b8c53ed8d4f81489ce7250d2d2a059251f3355d610", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778078153, "uuid": "9c10fb95-690d-4c12-aff1-47273229e6cf", "comment": "Malware payload", "value": "4729bf248c5ec1530158485dce55ba0cde1a8063", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778078153, "uuid": "23be0ff2-2896-4578-8ec9-0fdbf4400b02", "comment": "Malware payload", "value": "856e53550d6dde40f2cd3273e5041dfd0c1788938fe7ff969a7a470b2f9997152fd99541a85dd038f753da621736ae79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778078153, "uuid": "80aae7e6-5da9-459b-bc0b-96d9b76ea782", "value": "T13FE302CBB6C4C712D4DF0B7062221E5022F8BF598960E38B69D4ACAA073B35557D7F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778078153, "uuid": "b50e9a00-fcf8-49af-a768-129789162ec0", "value": "3072:S7geq/IJy951dFNifVteZffJ7pjf5Lo3tGTwk1tXH0fiHABGbzGD:ShqA018fVt0RVjxCwkChH0uyGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778078153, "uuid": "ede4e206-ac12-454c-879f-7307171ab22e", "value": 144384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778078153, "uuid": "212bcb4a-a5b7-46cc-9349-7cb8a96c4fc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778078153, "uuid": "2942ad56-bfb8-4e7f-91ae-e254676196da", "value": "07d696e59d20a6ecb212e3b8c53ed8d4f81489ce7250d2d2a059251f3355d610", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09318940-4992-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778102699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778102699, "uuid": "0783241c-0c21-4982-8649-83b34ef9c24a", "comment": "Malware payload", "value": "665fdd6c68c2e89cca517044a7fa7619", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778102699, "uuid": "dac9cf8c-73ae-4f92-9615-4151ed49bb52", "comment": "Malware payload", "value": "081d9c3b28a61091021fcc409f9a61e9968c50c35d6a90ef1e8168411d27de68", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778102699, "uuid": "555fea13-8a5e-46d2-83f0-0f5c2899e0db", "comment": "Malware payload", "value": "32a67c3e92899ad4adaff5d683b820554b2dad5e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778102699, "uuid": "1bfc335c-4dd3-4ddc-bf05-a1b5e8bc27bf", "comment": "Malware payload", "value": "b5dcbdaa715e068487af5ea95e1eeb4671932861124013369b05ef5e59db5046cf7f04eba8da4011232db2674db91079", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778102699, "uuid": "525eb778-0d10-4b3e-9225-02e6db2cdd6b", "value": "T1DB33E881BD82A916CAD94377FA0E42CD371173C8E2DD3227CD167F51B7DA52B0E9A062", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778102699, "uuid": "4ab12506-6d95-42e4-a926-c370a3f0d842", "value": "1536:N2fWfezp8F0l96+9KJ0MMome8fGFCUCwbZnn:jfmpd6oKqMMQ8fR7wbZnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778102699, "uuid": "8f5f9dbd-dd36-4639-85f0-6a1afdfc88d9", "value": 50728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778102699, "uuid": "d87322fa-2264-4096-ab61-3690156b8687", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778102699, "uuid": "74dd944e-eea2-4804-b6fe-0303203dddc8", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54ddc910-498e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778101108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778101108, "uuid": "cda27c85-f82d-4476-8bd8-f022968bd5a6", "comment": "Malware payload (Mirai)", "value": "bbb49ce537eb4d6b37b1685a1f837ab0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778101108, "uuid": "762cd91d-7e4e-4b14-91fc-936fdc7cedaf", "comment": "Malware payload (Mirai)", "value": "08cef1cbde609557921b3cc435761ae42d3c58726c7022f89ff2db703093c14e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778101108, "uuid": "79d9639c-efba-4c93-9eee-c4e0d1d45f3b", "comment": "Malware payload (Mirai)", "value": "9e52e40f80cb7bba8fba0bece84bac102d386e43", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778101108, "uuid": "ee9083ee-a91f-4ba1-af2d-d498105f09ac", "comment": "Malware payload (Mirai)", "value": "4d8c19c6a11b87494dc986eeab665ccf7d1547dee2c262838b965e05c9a6098a6de85c3062b2f5b8dee6c7f4213f8c3c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778101108, "uuid": "77e09806-3f08-472c-851d-3ecd84e80777", "value": "T155245B46EA818A13C4E517BAF6AF018A3332A764D3DB7306D9146FB43B8775F0D63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778101108, "uuid": "d276a653-af9c-41b8-8e94-fd2f68a8de6b", "value": "6144:ZZhjapjJ1eai65uWaqgXICAfEm3DM/9x4L:ZLSfeai65uWaxYr/A//8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778101108, "uuid": "c3a28ffd-9c18-457d-91fd-74ce8867d808", "value": 218571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778101108, "uuid": "70926466-a9a4-479b-b777-ffc04d5e7592", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778101108, "uuid": "a8e05b1c-7a50-4468-a358-76320d9f1281", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b7c0c7a-496c-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1778086623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778086623, "uuid": "ebb34233-d653-485c-b6ad-e0f92b5b9db8", "comment": "Malware payload (AgentTesla)", "value": "c069747c875136b399dbff610a0729b2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778086623, "uuid": "88e58bbd-04ad-4089-9d78-4ff3a9578221", "comment": "Malware payload (AgentTesla)", "value": "09783fa659755aba97256704aaf284df35d698ee9aff8cecd0eeeabe3a576a89", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778086623, "uuid": "662ed68c-7f6c-40be-96c0-d0c47501a3d0", "comment": "Malware payload (AgentTesla)", "value": "a54b0c69246419a399a571e1cbcf62ba48435673", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778086623, "uuid": "4abfc3f3-b55f-4944-9bf2-37b617942407", "comment": "Malware payload (AgentTesla)", "value": "1490ba3371f1fe86ccd2cbfe841b11cb2f2ae9f0bb82feea1b52855f02bde492e3594d1d7297fa54609c7615a40d1fec", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778086623, "uuid": "51a60b07-a26e-4da0-b7ed-374904b9fe93", "value": "T19535E0D43A2AE70ACD924A749A34DDB54AB50DACF501B9E39FDC3F5BB4AC0506D0CB42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778086623, "uuid": "43d2bc9d-cd5a-4eb3-8078-59b6919e3c10", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778086623, "uuid": "f52876ce-5d48-4c42-b9d6-5ab605553a8c", "value": "24576:ka/+gP5Xnll3qv981pDO133BSLmvibIvIxgeFYw8llMRUrs8zZ5:kamAzye1p4YSvoFYDMRqbV5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778086623, "uuid": "c505434d-2eec-470c-8bc5-18d6ef808844", "value": 1118208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778086623, "uuid": "1de05033-7190-4ce0-b7f1-93ee6842c07c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778086623, "uuid": "194e1bb8-c8f7-41fe-ad6c-2f91857f9f0f", "value": "Factura de pago_FAC-2026INV0507B_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a1438be-498d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778100660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100660, "uuid": "eca2c622-ea8f-4d08-89d7-aa9fc8daffaf", "comment": "Malware payload (Mirai)", "value": "e6ed1d5fbfaf5f36441b7a068431fadd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100660, "uuid": "c69158fc-2ebc-46c1-abf9-1410adfed1d9", "comment": "Malware payload (Mirai)", "value": "0a0825e702cde82f682ac2e208d6ec0bf0f5503f0868f4466aa787086a377edc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100660, "uuid": "733312cd-6314-4844-9ef9-af5f990ce2ab", "comment": "Malware payload (Mirai)", "value": "d62365d5da3eb113bcb0fd4168f77589f67c9870", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100660, "uuid": "b0c27192-0ddf-4745-b4f6-1beea453e716", "comment": "Malware payload (Mirai)", "value": "c63f70bba195e9375a072ffea16d561bb4e433e9b2c8f97eaa186769005d40f03200912bc5f3b126ba5884b009307fcf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100660, "uuid": "200ad86c-3ffb-4ffc-bbf8-e68557dfe1ba", "value": "T1A5330252F40AF9B0EDF04834D0AA52035F630DDC76FA717658527359A28A424FC0F9B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100660, "uuid": "b759e8d0-a24c-4f06-9fa7-704d9d2d414d", "value": "768:iisgxWsI7kH75dAeMjRPN7KLnUOdH4/IfFYyggYH4pEAAiosu+3PAhJs3Uoza:qbkb5iljRPN7YH40FYngiviqOOUza", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778100660, "uuid": "1e15c199-daa8-41b0-9979-57cdcf8a4460", "value": 50860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778100660, "uuid": "625c867e-9062-4d2f-9721-8c2a17922323", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100660, "uuid": "3f904b94-9692-44ae-b650-b0733f45f56b", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "784cc1e4-4969-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778085276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778085276, "uuid": "2bd4fc6a-03af-43dd-bf7d-705c3693b413", "comment": "Malware payload", "value": "9d2b277ef0fb48ed21610cb9a5e882ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778085276, "uuid": "3e34fd3d-b543-460a-af46-59d2676349d3", "comment": "Malware payload", "value": "0bda7cb7e1a78e9f100f7e032074a328bf1dc8103adcc30cdabb2f1668698349", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778085276, "uuid": "c4efb776-8800-4442-ab1e-0a7104dd2269", "comment": "Malware payload", "value": "c57468d5ccb770aa8626150dfd3b3fcff7ef297d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778085276, "uuid": "bb830f4d-5a7f-47a1-97f9-56c1f4300d1f", "comment": "Malware payload", "value": "8daacfe7f9fb87ea9b5a828d7046b488ba74d951fada2719853e5cc45fd17b923f2292f6404a042234896a1e798bed83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778085276, "uuid": "bb0e310d-2acf-4bfb-956b-5f06b9fd505f", "value": "T105265B1AECFD4CDAC4A9F13484B36202BD61780057226BC71AF1A7641E677F09AB7B1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778085276, "uuid": "d6408593-6317-463d-8bf3-dbea9792958b", "value": "295508a30bfde4960a7bfe1622bd78fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778085276, "uuid": "afd4d4a5-183b-44d1-9811-077468d348fa", "value": "49152:6M92u/UTL47yXzZFSdZvsf8JkILL8GxgwWDe3ijKczQcTiDJGJo1qPUeYj:6MswbRW1DcFZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778085276, "uuid": "836356d1-6e71-46b5-85ea-963d83d9b96d", "value": 4587520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778085276, "uuid": "6c92c3f4-956e-436f-bdda-f21adfea0cfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778085276, "uuid": "1b2ea6c0-b3b7-4f1d-baeb-c440e9775d3e", "value": "SecuriteInfo.com.Variant.Tedy.962679.44121672", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6a23a9d-492c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778059235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059235, "uuid": "f9821484-7e3c-4abc-ba49-92627a1fec50", "comment": "Malware payload", "value": "04c363279a99091985158a69d498c1f5", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059235, "uuid": "d0de17c3-3d56-43a9-a342-98ff30bac97a", "comment": "Malware payload", "value": "0c0e0a6947e5ebfafba721e539646634e50c63b94dbf2020467c7e5223d1a639", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059235, "uuid": "214c5be9-be0e-4022-906d-b9b5b9c7f883", "comment": "Malware payload", "value": "fcf0da55bf955d5f13fa60bb9ccb8cc9ec9a125f", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059235, "uuid": "b6e6a104-252c-452e-b386-89ae8616c43d", "comment": "Malware payload", "value": "1984908452b3052c3a6f0818833cfd5fb30a77cc3939ae4d78628dfc9ba38fbbc19f83db0a885da42b753748b4c476c2", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778059235, "uuid": "936d016c-e5d4-4e15-9c6d-6b1902b1d75c", "value": "T1C1E6124BEE58CC6AECF6537AFD32022338225D584703C5BF65A9BA387E731C24A915D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778059235, "uuid": "2d0825d0-fd74-42aa-839c-935b7b3bc95a", "value": "393216:2L0NMD7g7t/oACM7Ll0aRLwPZpbRWVKbAL3:2wNMD7grP7fRUN0KUL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778059235, "uuid": "9dad84f5-cab0-4be9-bcd8-28e086a6378a", "value": 14689067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778059235, "uuid": "76186ce2-cdac-440b-81ca-edce76cf61e1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778059235, "uuid": "16e60d3b-8272-4f59-b426-a7315c8e8968", "value": "iMobile Lite (12).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfb6f3f6-4926-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778056646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778056646, "uuid": "5a3c323b-f8fb-4526-ad2a-ee4b65027d34", "comment": "Malware payload", "value": "f8921e037dbbd4f464fd57cfdfa9a031", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778056646, "uuid": "93ad3bd9-5204-45dd-bc63-3ca416129c04", "comment": "Malware payload", "value": "0e7b445d14584dbbab197cddc29ef90899863d003b2d1a7ea2910cf882ab75a1", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778056646, "uuid": "60eb1b14-f303-4c00-b81e-b060a8e17153", "comment": "Malware payload", "value": "2b09f443e01ce4fb9299eecac47e10360ff75fd6", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778056646, "uuid": "171dbda0-4ef2-47e3-a058-400e4787476f", "comment": "Malware payload", "value": "d641f62af1a1db3900c772bc9ef978bf4eb5e2b51494906fe4df3848efd23d0884285d86bd5d711b9402b01e3d58d0f7", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778056646, "uuid": "eddf5f6c-30d7-4eef-a03f-04bedd1d0abe", "value": "T1DAE63356F9D96B40C8F7C336897289A6A93ECD551F038207A859733A307F1E083D6BD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778056646, "uuid": "3f4e1cc7-0789-4a69-a67a-5b1e400b525e", "value": "196608:VSEth74dxsUOtAYHolWWAXDVnZdBIt0YRE+21g4JTX9dCTJkMoLmujFPh:V/bNADlOXDVfBISYRE+L4JD9KWLmMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778056646, "uuid": "eee9cbc7-bba1-4433-856a-f0721f9e396b", "value": 14026386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778056646, "uuid": "b4c821a9-c4aa-4e07-a4e3-45773e8709b0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778056646, "uuid": "a8859012-1e27-464a-879b-25d445712ed6", "value": "mParivahan(20).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64f8b595-48f5-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778035422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778035422, "uuid": "eb896e60-7f21-4636-bbb8-fd5f9494f70d", "comment": "Malware payload (Formbook)", "value": "285451b1ad0b931ca92ad6a218bed591", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778035422, "uuid": "f25cb641-a5ce-438b-aa29-076a4dec72e0", "comment": "Malware payload (Formbook)", "value": "0ee024b38ef1d942f1f31d79c68c130dfdbd692e906e64ded40a98acf1e0cef9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778035422, "uuid": "af5c5916-fa2f-42f4-893b-58f4c6b05ac3", "comment": "Malware payload (Formbook)", "value": "689fc67f86e56392b5cbd93d3808f058e0237957", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778035422, "uuid": "8e50931d-f0ca-471f-9d02-7a9db20b0405", "comment": "Malware payload (Formbook)", "value": "43733b082960d2c40261c0d6cfd4a6837aab80bddfbf2ede5d5bd437c44e2d6ccac93d8d97d2c0f7ef4f4bc3664cb011", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778035422, "uuid": "2ef69e3d-2190-4d51-8fd1-6595cce1e8b3", "value": "T162351248221ACE02C1A65FF51931E2B42FB85EDDEA11D203DFD97EEFB8797D40845286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778035422, "uuid": "6203985a-4315-4514-a07f-be8986df5e10", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778035422, "uuid": "edd04300-49fc-4049-b427-82f257890cdd", "value": "24576:BzZ5FgKqFAqK6BrJL3UwCcUEyAptmLwbDHWUFgp:BV5CKqFQo1PH3ptmLWHWUO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778035422, "uuid": "135abdc9-ac95-4e1e-bce2-f75a1f77bfc4", "value": 1103360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778035422, "uuid": "649e6995-86a7-403f-a44c-5e441e956590", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778035422, "uuid": "347ec92a-0375-444a-b58a-68b6dda38842", "value": "NVT SEAMLESS_PO0626.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b8a9615-4922-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778054841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778054841, "uuid": "237a8209-2db9-426b-8862-5c5927d00c46", "comment": "Malware payload", "value": "ad40c74a535525d8b7ed13272152fa61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778054841, "uuid": "b86f919b-49f8-435d-83c5-1c2fc02255e1", "comment": "Malware payload", "value": "1085fdaf43b39813e5cceee5c81f1e484c3ed9624e224227fdb8a9202706323d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778054841, "uuid": "c55d215a-3f30-4062-a68f-ece02e07c572", "comment": "Malware payload", "value": "d2f5d0b181f2bf4ee813c5c3c254bb21dc952661", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778054841, "uuid": "6dea9b15-e6c1-4e53-9b21-93faf34fe7e0", "comment": "Malware payload", "value": "18578ca987706ce0dd7e619f3e4bccf107bdd4d52d5481eb0c1e28be8a3d39e8261998a2e725e15913b991b361242357", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778054841, "uuid": "2895507f-cd36-453c-bd63-2e6fc7687b97", "value": "T128B32801F742EBB8E68308F5087ADB64FF354D1B023088EBF7D166B4B8A1A9154E755E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778054841, "uuid": "bf9d4926-dbab-42df-b12e-440835d2a2ac", "value": "1536:NVrNxG8giUnvzkgJaWdOFkRCfni290e7vmrAcWA+WdObWrzxe/T7vqfFzLRrl+3p:Np68giUws+knSlGldL8/T7vqfvAzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778054841, "uuid": "a9456940-3b9f-4611-96b5-e7ef8c7dd0d7", "value": 114768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778054841, "uuid": "67eee661-1f63-4841-89f6-2d88987149a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778054841, "uuid": "50c088c7-12da-410e-aa6c-c02d7858d24a", "value": "1085fdaf43b39813e5cceee5c81f1e484c3ed9624e224227fdb8a9202706323d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e96f165c-49a5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778111235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778111235, "uuid": "a0d7a386-3422-4df2-bd5f-484265ef04a8", "comment": "Malware payload", "value": "ed56a741332ec6d47001c3093fa36963", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778111235, "uuid": "86511c6d-b58d-4caf-9471-d62d1369f853", "comment": "Malware payload", "value": "112321f11dcfaf9d00e472c2787ac3a3fe2bfaecf4dcd4d705c1510fb3077422", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778111235, "uuid": "d6453806-5ba6-4fb5-aa56-b3deed23f3fb", "comment": "Malware payload", "value": "94a67b9d793709ce0eecf53874d6f493ab4c5913", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778111235, "uuid": "fe3d7790-a957-4a7e-bf87-dfa8afd4bfa1", "comment": "Malware payload", "value": "a1e4c53639423ca787c63f2ca15173d6615d82a559239b2156256a3a418ef39528a09d27b43463813a67f4e11cb4afc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778111235, "uuid": "adc3ab48-937b-4461-ab20-abb57ab28cc7", "value": "T131364A1BECF91CDBC0B9F134C477A216FD62780047215BC716E0A7691E677E06AB6B28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778111235, "uuid": "2eb5f4e9-f786-48c2-9c0b-b88d8cd865e2", "value": "af0428100cb22e649c1c0b586e9c7b8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778111235, "uuid": "87695c7b-0f0b-493f-b854-af274b596622", "value": "49152:r0ZDPoKIr+yn9o9rotmFHP+CyFkQJ6W5HjXQcTPayXY:r0l5f9rymsFjER", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778111235, "uuid": "4c6b6082-a8df-4e2d-9764-37857e2deff8", "value": 4925440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778111235, "uuid": "472827f7-d0f4-4b0e-a385-7136b0ad3b02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778111235, "uuid": "8589d2f8-57a4-43c1-8f22-c009d740e28d", "value": "SecuriteInfo.com.Variant.Tedy.962100.42136246", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "461e2f5a-4959-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778078320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778078320, "uuid": "05d43b6c-812d-499a-9a3f-07ea5e16d71a", "comment": "Malware payload", "value": "0987e87707b89c71f2afebc2699496c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778078320, "uuid": "e459c5e0-9ed3-4f2b-b5d6-fc11d6d555b0", "comment": "Malware payload", "value": "11ea42e60b129c2eae492c5eaeb8d25eeb57b44c693cdbc670f61b8266a6ccd4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778078320, "uuid": "82d8e46c-946c-4619-8edb-dfb5d36379fc", "comment": "Malware payload", "value": "4921bc276aa19475b93e749860ffa15b3fa3b123", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778078320, "uuid": "a50ea6f1-789e-40f2-8c64-84ee9bb7d869", "comment": "Malware payload", "value": "6ee74adcca91463aad6797504e0847b574d10ae900b30aba613f629775497099a486acc1c440b8b28ee6f12ffbb128a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778078320, "uuid": "6ff933d7-8e1b-458d-8432-fc4d91408af7", "value": "T181D3026E37F45B10D4AF06FC8CB6066452F4D2066E91F30F15D4889B4E273A52FAA9B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778078320, "uuid": "e056f95e-24b0-4d6f-aa58-72d54d835101", "value": "3072:YuQCCb5UsL9x40BOUDfEJ8iraZF5+wZYqXh9vcXCDvd3EJJIoWBezM3b:XShioziraZFZYuh9EXMd3EDWgO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778078320, "uuid": "e2977e8d-63c8-482a-82b3-1140575afeaf", "value": 140800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778078320, "uuid": "09075fdd-3d01-4a9d-bce1-7f3803b4ce97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778078320, "uuid": "195e2b05-4f57-47d8-b6d9-c0a695369ad3", "value": "11ea42e60b129c2eae492c5eaeb8d25eeb57b44c693cdbc670f61b8266a6ccd4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0a75e34-4938-11f1-a769-42010a9c0008", "comment": "Malware payload (CobaltStrike)", "timestamp": 1778064298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778064298, "uuid": "fd89c42f-f92b-42a6-bb03-b79b85c9ba6b", "comment": "Malware payload (CobaltStrike)", "value": "94f7f2e816f9998d5930bf2244669943", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778064298, "uuid": "674947e7-53d6-4a1a-9828-813a513fb873", "comment": "Malware payload (CobaltStrike)", "value": "123b6141959b472dbbf2f0e8fd0d1316d35866efe23ce8a354e3b0dacafa8fde", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778064298, "uuid": "9dc3c5ca-66a3-45a7-af09-b5c06cfe0a46", "comment": "Malware payload (CobaltStrike)", "value": "3c42170afb56d0cb7f70391f1ed9576f9734adf4", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778064298, "uuid": "211070d1-d82d-4736-96f1-fdb98ae372a7", "comment": "Malware payload (CobaltStrike)", "value": "80f7de69e4c7cf500c10ed95c881790dfa54ecc8f515af5f649b935ff7a44e00844301497ee01b9fc01879910f8812f6", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778064298, "uuid": "bcd3a8b2-59a2-4da0-9615-e3f68259fce0", "value": "T1FB856C51FCEB34BADA96617109B356AF2331A20D0335AECBC9441A7BF80B6E51D33395", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778064298, "uuid": "04ad6988-c484-4d1b-88f0-6dc79482f805", "value": "f0070935b15a909b9dc00be7997e6112", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778064298, "uuid": "617aeac2-f049-4b1c-898f-15416088c7d3", "value": "24576:vgsiaLHT43BHq9DM4NzNyaQ4oPz1+d4MZ2YAbCtGepVN+brqati+sH:vgsiaek5l649Zb44VN+brqatn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778064298, "uuid": "ddef4502-91c4-4471-9555-e365d4f85825", "value": 1756672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778064298, "uuid": "0667386d-56ae-466e-a833-aade94ed020b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778064298, "uuid": "e6565a6e-bfee-4ea4-a7e6-fc2816608116", "value": "\u7528\u6237\u7c7b\u578b\u9700\u6c42\u8c03\u7814\u6807.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3689213e-4933-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1778061973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061973, "uuid": "e9a2434d-7c73-44eb-907e-36c40df064d2", "comment": "Malware payload (DCRat)", "value": "216cbcfc190ca10bd85a807888fa3dcc", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061973, "uuid": "29ee5eca-188e-4f9f-ba41-4c66c583d91c", "comment": "Malware payload (DCRat)", "value": "128f0268f56929b273a39926e65462b7dd980d39e1a613465a765c191d9a9099", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061973, "uuid": "06f3a410-2b7a-4475-897b-0a330c89c866", "comment": "Malware payload (DCRat)", "value": "5f9f8635588f04dd013ca5341659aeda645321e5", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061973, "uuid": "602e7b4b-0b87-4a47-a343-65b40cd248a8", "comment": "Malware payload (DCRat)", "value": "2669d7d588bb5551071206a52491d19b5c8e3753bc219a1b18ecc469cdb9574102bd95dad3f4569a57f178f1ded1112d", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061973, "uuid": "f843fc18-4557-4d73-91bf-ea16f73a6a4f", "value": "T125455A057E48CF12F0191637C2EF450847B4AC512AA6E72B7EBA376E55123A37C1DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061973, "uuid": "be17ee24-d834-4247-b450-1212751cd57c", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061973, "uuid": "4e4e75b8-5e28-4a95-bd16-b2d2f8094b1b", "value": "24576:U2G/nvxW3Ww0t2m2xAS8GrxUSJ55YC2RySYD:UbA302m2rOPAP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778061973, "uuid": "819626e5-fd42-4eb8-a022-4d2d5f675e87", "value": 1164968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778061973, "uuid": "d02872cc-9e4f-4911-b1df-067b020385c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061973, "uuid": "6e6c497b-139e-40f1-98df-130339c6e547", "value": "216cbcfc190ca10bd85a807888fa3dcc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3a5685f-4910-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778047258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778047258, "uuid": "ff12a811-5521-4f8e-b746-4e63c1f55555", "comment": "Malware payload", "value": "1ae6720289371f19dd4353651c6c1843", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778047258, "uuid": "e8d2e19e-73ac-4b8f-be33-2b811d6a5a92", "comment": "Malware payload", "value": "12adc1327255d53468eb8697921a3730dbfe731a0e0f12915d17d50b5a1b3df3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778047258, "uuid": "42ee658d-4730-4005-b6eb-353fdaa567d4", "comment": "Malware payload", "value": "4c4765555f05f7c66d890a3d0664123c01de86ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778047258, "uuid": "e2d289f6-f685-4a78-9abb-49ab06cd89ce", "comment": "Malware payload", "value": "d51c35bfcf3210391b7f0c88d1917ae2920c7d66fb985afc3e663b99b14958d893a0c11524b501b6d393cb6e0ac61993", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778047258, "uuid": "1d0c25f9-766b-4241-a746-3b7c292af283", "value": "T1A0158D4AF2F374FDC067C030835BDBA26932F46551226D7B21C4DA342E96E741B2AF66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778047258, "uuid": "a166a0dc-3c86-4680-894a-cd33a8c48da3", "value": "12288:t0vwtACRQMYViKoW80T41aA26oldEmyTPYP7b5kB0Uj/RK4hT:t04yCRQEKo10T4sA2RL4uC0UTRK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778047258, "uuid": "3241a6ab-bcbd-4615-97c2-fcff3212a42b", "value": 909888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778047258, "uuid": "fe8b2638-82c4-47ef-85cf-e4c99f35375d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778047258, "uuid": "9d056dc0-08f0-4866-a294-1e2bc8f272e3", "value": "bot.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6147f68-4957-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778077729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778077729, "uuid": "5524e2c0-48a9-4125-b1f4-387a70e54602", "comment": "Malware payload", "value": "721757b1ef799f24388a54b425073944", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778077729, "uuid": "877398c9-0c61-451a-aeba-30cad8a3e031", "comment": "Malware payload", "value": "154d95b678a7dcc56febea7a3aa2edd112c5374e3074154f87fe89b1c669ca17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778077729, "uuid": "cf04af6a-9144-456b-98e5-414c1d1b1816", "comment": "Malware payload", "value": "15c5c146ade95aee87b758375615142f7cf11db5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778077729, "uuid": "53e2b8b4-1785-4c04-b3a5-83d5d4503065", "comment": "Malware payload", "value": "b97c6f03c5f30839221731b96e018a0f307938a98512bb5537f0c8900590aecb048b2e1cabdc39acdfc7bfc108ff7353", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778077729, "uuid": "746d53e2-ee58-4994-82df-16b9c5b47a8f", "value": "T1EEE3028F6BB88112E3BF59386C374A601AF6E7DF5A51433B49D4099F06B336482D57E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778077729, "uuid": "afdb752b-d822-4bdd-ba59-f14bb8828383", "value": "3072:J3OsbfoWfFnzeGrTQQSYpNulnQkrJdm4Hsv/B4qU1Zwizdgwa:rfdTQANkDa+UWzwiJH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778077729, "uuid": "8acd4936-aff9-45f9-afd3-38e917fae492", "value": 153088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778077729, "uuid": "e8cfdcc8-caf2-4d35-b7fa-ced1ac2ed1ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778077729, "uuid": "8c9efe2d-83df-430c-b4e0-6339d57e9f68", "value": "154d95b678a7dcc56febea7a3aa2edd112c5374e3074154f87fe89b1c669ca17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5bcee2c-4947-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778070883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778070883, "uuid": "233065f2-e457-438d-ac85-180b57e6cc0b", "comment": "Malware payload (Formbook)", "value": "f0bf4b4dcb11f4e4c29c9eacc851e20b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778070883, "uuid": "88057cf9-cc34-4dbf-91e5-4d64d9503812", "comment": "Malware payload (Formbook)", "value": "17a6642be4a37635d5b9a00d9d8b5ff14ae7f4d8e94fdc1c8a53f664513c27da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778070883, "uuid": "24732617-93c4-4205-97a7-7e035988d1ca", "comment": "Malware payload (Formbook)", "value": "e14dfc8b3cda8f44a4602a4da1844901a4296d31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778070883, "uuid": "ff42a1a9-12c5-460c-ad63-776a253bf6b5", "comment": "Malware payload (Formbook)", "value": "b21f4bc4042b9f5c80a23021310334eb9af7257d082e9b8cb800b8532a6872bdeb0ebe8dfdf34dfd1af51596d18ead03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778070883, "uuid": "fe64d7dc-7651-4aa0-b1df-c8e6c533d3e9", "value": "T113E55B17C66F974E180D3B51006A5D9AFE89CAFCEF727BC4E0CF90B614AA1110B856B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778070883, "uuid": "1badebeb-aac4-40e4-a213-0f5c29702f04", "value": "49152:LvlGK6QWKci05OsAdTIM4mj5rMJUGAAAPkTZODwZtRqG4xanMqdmyB:q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778070883, "uuid": "873b5316-3331-4356-8be6-0b1bab411274", "value": 3104566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778070883, "uuid": "e5067596-05a5-4b3f-afda-5519637bf54d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778070883, "uuid": "6b93ae26-4efa-421e-b9b9-0ee52d166c43", "value": "HANYANG MOLD CO., LTD.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7c4e0bc-492b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778058780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058780, "uuid": "6a7ad2b5-7706-44df-b89a-02161189b066", "comment": "Malware payload", "value": "c7e80c6827e42dc28d6e466079653ca0", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "HDFC", "colour": "#2C4076", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058780, "uuid": "8fd7ca3c-5bb2-4668-9c18-8453a1fdf75e", "comment": "Malware payload", "value": "188da2b8c612b99e655d0cacfa8abf8ae9c5c29b050bee869b37b9d3b9d6dbf4", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "HDFC", "colour": "#2C4076", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058780, "uuid": "15faa56a-2326-454d-94c1-c631d503468a", "comment": "Malware payload", "value": "46dbe555db46007ba041d84ccc8bca4243e87aae", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "HDFC", "colour": "#2C4076", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058780, "uuid": "f8acc82a-c875-4c50-98cc-03da9e9cdd6b", "comment": "Malware payload", "value": "23e7ea99d04060c920918cedd0058e260c129eebffa1334fc0e2d7b14a54bb86a49e2ca39f95d57e5680b70c816381b8", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "HDFC", "colour": "#2C4076", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058780, "uuid": "c387b0dc-a8aa-4ea1-9fb0-a77a2e334b1e", "value": "T198B612D6FBC4492AC4778072C96A62F1115B4D568A835F877904360C38B7BE84FDABDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058780, "uuid": "390dce68-3cec-4452-97c8-b1880352b247", "value": "196608:uavXX2LthRaFOd7Z3vK6PwnqWZUd94yD+uooP80+pwOxF8AEYXULFStGEaV:JotjaFOd7Zy6PwrqAyDia80MwOABAI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778058780, "uuid": "8c647d47-fd7e-42e0-b927-8cbefcff8925", "value": 11245684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778058780, "uuid": "8bbf8417-7fa8-4d7b-87d8-99051155836c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058780, "uuid": "ada630c7-48ab-4d06-b150-6dd1035d1503", "value": "HDFC CARD.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8881e04e-4916-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778049655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778049655, "uuid": "9d0b313e-b847-4f6c-8e1d-21da468ab323", "comment": "Malware payload (Mirai)", "value": "c36f995a646ed4accae5303057b65cbf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778049655, "uuid": "ee5a7489-b1d4-4c90-a23f-58e111daf2e3", "comment": "Malware payload (Mirai)", "value": "1911ad6bd5b6cafdf145bc57ed917df9b17b9ae79fe8f5bbedba0812ad153756", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778049655, "uuid": "7a7a1e14-1586-460b-87c3-3d4e8ea61ba4", "comment": "Malware payload (Mirai)", "value": "d28ef907a963dfb48cb90b2e34eb791ea6cec91d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778049655, "uuid": "f28a0cac-2e9c-48fb-95ae-6ba4b3743857", "comment": "Malware payload (Mirai)", "value": "193ada24cc35c1ce2a6286c67c8f956305ab3579c33acbf813a36ffb778f593b3b58015d6b5c19eeac25b271128c20bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778049655, "uuid": "ab23b466-16c4-4721-963b-e85160370f12", "value": "T1B8D32755BC829A27C6E523BBFA6E018D331923E8D2DE71178C215F2177C690F0DB7A85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778049655, "uuid": "03a97c57-3158-4d93-997d-003cb056a0e5", "value": "3072:snFif7apx6XS+kUgpjWXQQKMs0u29wzulziQSf:sn8ZS+dQWXQQK5s9TeQSf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778049655, "uuid": "7e2d5ac0-3200-4c71-9ab2-e5957ff67679", "value": 132135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778049655, "uuid": "829df0f0-6ca4-414a-a038-2eecbdc1d643", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778049655, "uuid": "0b12f345-badf-4215-846d-336befdd6c6f", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c650241-4933-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1778061929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061929, "uuid": "9eca0739-3b04-4952-947d-44e3379786b1", "comment": "Malware payload (NanoCore)", "value": "6d1687f0fd169a4d4b90fa558810ac28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061929, "uuid": "3071c1a0-160b-46f7-997a-3dd54b3af2d2", "comment": "Malware payload (NanoCore)", "value": "19a80721edc7a51e480eaf98a31fc8d000f06638ea252db4ef0f4174a70c6f4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061929, "uuid": "0d5a4ebc-fc2c-4f84-a8a4-df7ed5feb249", "comment": "Malware payload (NanoCore)", "value": "b5ff74ad7f798366500c309f528055ddf479a1c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061929, "uuid": "62753832-8617-40d4-b25e-384cf78f527b", "comment": "Malware payload (NanoCore)", "value": "36a55d099f53f2b3d702d4805220f6efd7fc2657de99ead71e24acaa005c22b3486b7b38b103dfca629d90b1c00d3f71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061929, "uuid": "0894cc38-8075-4fad-ac3b-01a510cddb24", "value": "T15B14CF163BA84A2FD2DE86B9711216178379C2E3D8C3F3DE28D451B39B667E50A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061929, "uuid": "1c5899db-6a24-4a28-ad56-c91ad4c5c00f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061929, "uuid": "4831526f-f6a6-44f2-8130-6af19532c540", "value": "3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIn2XzMrrC/Y6jmdzBb6KaGaOC0:MLV6Bta6dtJmakIM5/kC/nqzp6jGaOT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778061929, "uuid": "c3b9f4f0-b318-40e4-9bf9-83eea0427435", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778061929, "uuid": "0c39157b-cb4e-444a-b028-1fd3448622c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061929, "uuid": "3118e673-002e-44ff-bbcf-7dbb58bab1db", "value": "hotro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48a2e3c5-4966-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778083907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083907, "uuid": "59617f86-d735-4ac4-884f-eb0952a8849e", "comment": "Malware payload", "value": "7a597111f7776bfb76b4cd674a6a8062", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083907, "uuid": "cc79e345-698d-410c-bd6c-20ea29dc02e2", "comment": "Malware payload", "value": "1b6ce2fff9c6a0378682123b23fa316c2a9c48b99932d7fabe68003be37c4be7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083907, "uuid": "7c86c8fb-c2ea-4b2f-9d16-b7c4993231fc", "comment": "Malware payload", "value": "333958de719042be09169d3362819eb34ebacc6d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083907, "uuid": "e1e33888-4bbb-4ea3-9e69-2b9a9fa6b3cf", "comment": "Malware payload", "value": "6ce47f79c9939dfef32792ba4436103759041d32cc270c29ef27800574a4deb9ca816a36a6660357764f3f38ca3d274f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778083907, "uuid": "692490d4-90c0-40d1-98c2-32f5d07016e4", "value": "T181510CA8C7421532FF67182FFAA1645847C6AC03EB51154D5EFF5CCE01E0A06A67DF16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778083907, "uuid": "2813cb22-29a7-41be-8f6b-e20601a264ea", "value": "48:7+jnat9/xU1948pcm3jnFYOve4UuHCC9eEVQsMosBAd4H:7katIUi3jnF7veaeWQszsm4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778083907, "uuid": "3ebc72bf-e924-474d-9edd-11d2f33cb81c", "value": 2498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778083907, "uuid": "fb6496ca-beae-4000-a2ea-c7c4b82f2c1c", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778083907, "uuid": "e92fa9fa-4b66-46e2-9b69-5dbb2311f381", "value": "164.90.195.107_1778083897081143_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e20e5a2-4928-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778057207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057207, "uuid": "064368de-cf80-46d4-afee-caa82a0cbef8", "comment": "Malware payload", "value": "558f2c11ca3346190d3131dfb9e3ec34", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "IDFC", "colour": "#2E569D", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057207, "uuid": "add67b39-2892-4185-89e6-9096e2fbdf3a", "comment": "Malware payload", "value": "1c28b1ae8472cdf59dff4cd5547c39d770f489ec49f424a96e9cdac655ccbd1b", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "IDFC", "colour": "#2E569D", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057207, "uuid": "86d7fe0e-1b65-4685-9077-c892ebf0cb01", "comment": "Malware payload", "value": "0b7515984efe65414bb65ee925e6882280a80db8", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "IDFC", "colour": "#2E569D", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057207, "uuid": "dafe9a29-750b-4c51-aace-18946ba86ef0", "comment": "Malware payload", "value": "e528c5a337ab10b9ad7cd02d8dedb5d431316abd5551ecb5464c3db91bca5f4304bbfd8c875187ba6c6bff3f5dec11f9", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "IDFC", "colour": "#2E569D", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057207, "uuid": "cfda158e-ce43-4d77-ac3e-49cedf569217", "value": "T1D6C63356FAC8AB57D0F383768A734665967EDC146F138B0339047B3E28BB1E0539A2C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057207, "uuid": "6e67ad8d-8cb8-42cd-9e13-2ef59a731fcb", "value": "196608:mEcxo+FAEoM037Ceg0Pomv8711zLOJ/OBjA+/7NyQyANynwu4Q1L:vMFT03GegMooy1zib+ZyPANs/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778057207, "uuid": "72a36aeb-c51e-4b5d-9217-5e2c4f0889d4", "value": 12211838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778057207, "uuid": "1315938a-4906-45c7-9ec4-a31b85f736f1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057207, "uuid": "69b7511f-2354-449d-b196-2ce805b412b7", "value": "idfc.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3c798e3-4928-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778057512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057512, "uuid": "f3eace82-aef2-4885-935d-ced54bef534a", "comment": "Malware payload", "value": "4b4510be2376a530bd2abdfd7ad060b6", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057512, "uuid": "00d47524-b5c3-41d0-87a5-8657f5a56aac", "comment": "Malware payload", "value": "1d73ddece0d84c3e590d989f0025532857e492b58d811e1492b5c719c0dc7c1c", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057512, "uuid": "3d93b311-12d6-4f23-bd3f-ac76a0809573", "comment": "Malware payload", "value": "ced473f14ffb60aa1f2ca5a1387c34a14cd9d9a4", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057512, "uuid": "445e4377-9a76-44d1-bb0d-7aa5f5fa5fe9", "comment": "Malware payload", "value": "18b9b5bc186f620e0ccf31c87e000344dd42d3adb08bad072f62f2e979eaf145fc2052b09c2efa688297eeb63b57dd6e", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057512, "uuid": "9ac00641-0202-4936-bf2f-760f14366d5e", "value": "T1DA961295F399AB2FC43B513349FA563212974C0B8A82DB439924721C7DBB6F40F59BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057512, "uuid": "b9cfa9cb-9dd4-4ab3-b15e-86947305b890", "value": "196608:FmILwA0LM3+y/Vf5MnGdk/XRZZ88LGjDdSwfXk1eshNN6kxnNEHOa0R:FmILILG/5aGdIXRAUGf4QvshK8nNlaq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778057512, "uuid": "38876222-dfd0-414c-bd8b-29002df2281e", "value": 9308258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778057512, "uuid": "2d757e26-c045-43f7-b200-291afd0eb6a8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057512, "uuid": "2ddc2d66-ec52-4eea-88fb-f8944eec5fc2", "value": "app(8).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2af0b772-4933-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1778061953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061953, "uuid": "7f990188-f78c-4581-a051-86ef2291a9f9", "comment": "Malware payload (NanoCore)", "value": "87613ec5711b4c90d64085d8b93bc936", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061953, "uuid": "0374e104-3602-4399-8ae9-7d1fb85acdf5", "comment": "Malware payload (NanoCore)", "value": "1e1c11a3792c1831088835574f44fd4ed8ab70f7fb3d96f73cb3d6d25e479c69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061953, "uuid": "aded4380-4172-4391-91b8-9cf60fcbc783", "comment": "Malware payload (NanoCore)", "value": "27f001a7fe6a34db2296c4acfe1518805a4f3e32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061953, "uuid": "e60753a2-0075-48ed-9df7-95c09f9924f3", "comment": "Malware payload (NanoCore)", "value": "8e3f266f02123f79833d076971aac025eef014b9373a410c6da75dc86e61f9c70e46fb36f198709a480b545b8d2188dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061953, "uuid": "90f9ee9f-c610-4097-ae94-f953480619f3", "value": "T10B14CF2527B88A3FE2DE85B9612251539379C2E398C3F3DE28D454B78F267E10A071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061953, "uuid": "7646777c-d950-487f-9980-483cf3ddf72f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061953, "uuid": "b7d1c9c2-c98d-494c-bd24-8371884215d3", "value": "6144:MLV6Bta6dtJmakIM5fd4SJm9dsJz1ORHGt:MLV6BtpmkidvzORHGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778061953, "uuid": "f531f3b9-851c-4841-b42e-633b1938c273", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778061953, "uuid": "cf4d8825-3daf-41a8-b0b9-c6b6b6545b11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061953, "uuid": "a748cdfb-00b7-4c11-9f10-a61cd36fd109", "value": "fluidlink.io.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5630b9cb-4940-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1778067609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778067609, "uuid": "514f499b-78da-453b-b0f3-6819de44cd87", "comment": "Malware payload (NanoCore)", "value": "16eaa43739ba44109c044847b7f87160", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778067609, "uuid": "b051f9cd-f1dc-4088-b721-2862d2b0f1b6", "comment": "Malware payload (NanoCore)", "value": "1e2ccd2fcb43cb401a6910ab8ea605db026ddfb1612407e647fa54a5713ebf32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778067609, "uuid": "d8ebc510-cb1f-4a6e-94cf-318f16c42762", "comment": "Malware payload (NanoCore)", "value": "437970a396a8ee00effe73c578cc43cb9bcaaba8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778067609, "uuid": "6a7470b9-63ac-4438-8215-ea9c1842a422", "comment": "Malware payload (NanoCore)", "value": "c1330a00cc6f38059a5435f789a86d156f06cb4745f199956eb4afc4467eab6351c01f83d6cd2175252570373ea429ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778067609, "uuid": "b2a3d0b6-65b5-4e5f-a5af-8eacb5a285b1", "value": "T11014CF163BA84A2FD2DF86B9711216178379C2E398C3F3DE28D451B39B667E50A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778067609, "uuid": "f13e942f-a072-4546-82d7-8ad8264dac35", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778067609, "uuid": "ce28c33e-e535-4907-b023-8b23e63871c6", "value": "3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIhpXzMrrC/Y6jmdzBb6KaGaOC+:MLV6Bta6dtJmakIM5wkC/nqzp6jGaOR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778067609, "uuid": "bcb2e915-a04f-4169-9ea8-2c7bf37de45c", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778067609, "uuid": "065576f9-f1fb-42fe-ab8b-9e977dc6ba5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778067609, "uuid": "d355b6d7-82a5-4cde-9082-38bfc9f28412", "value": "criptovision.io.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b17da72-492a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778058169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058169, "uuid": "1220e1b2-2e0f-463b-ae1a-47673445f623", "comment": "Malware payload", "value": "b129f041d987b5686d2a4aab748afd20", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058169, "uuid": "8247e4c5-ec47-4f28-a56b-b08006fec449", "comment": "Malware payload", "value": "1e637ae91f7fbe2c8ae070233c816dbfee507bb7b7f2a97fd92d104ec89c5cb5", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058169, "uuid": "ed90a283-e696-477f-a1b6-8157d7647cb3", "comment": "Malware payload", "value": "e0fb870dd1c7c2e8f29b14b92ec2d29488019ba3", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058169, "uuid": "c69396b9-e017-4d5a-b7b0-fe1855822edd", "comment": "Malware payload", "value": "2fb8a5450b61412367d8813cac25f70cb3271fdc1d1fb48057e79f36f03d90076be57f94d13deb05d9d5a8bca4b5d6dd", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058169, "uuid": "074330ef-ab3c-4c28-8eda-64da2ce313c2", "value": "T19EC62255F359AB2FC877103349FA563222970D078A839B536928760C7DBBAF40F59BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058169, "uuid": "8b4fbfa8-c245-4ca2-a467-fca5a58f7418", "value": "196608:x7BFqDo5vzIpTkgH1eshNN6kxnNEHv7xu8lIpTjOvNBatJwNz/6ZsPPy7L8K:x7BFqDo57IpTZYshK8nNWJZz8SzrC3j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778058169, "uuid": "cb0846ab-04ba-4255-a913-ff3328a19902", "value": 11910399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778058169, "uuid": "856b0c8b-5f42-4363-8523-49903bb53352", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058169, "uuid": "fc30a7c7-67e8-45e1-ae28-ba1129f1804f", "value": "app(15).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "018ef2ca-4958-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778077775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778077775, "uuid": "774140dc-0302-497a-80c6-72ac73613b1c", "comment": "Malware payload", "value": "8057164657019d028bb2729ea5e587a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778077775, "uuid": "6e6b3290-0752-4c55-a0f1-39a77552c1d3", "comment": "Malware payload", "value": "1fe199275081693c9c4110377fa0d75141179e707fd7d58285bc73a059a7ba6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778077775, "uuid": "d4f22ba0-5122-4963-9588-c11919224fb6", "comment": "Malware payload", "value": "84b4f3b41c65131f17d5de3bd02d7697ff77ed61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778077775, "uuid": "ff925bc8-b330-4fd1-927e-b233f9bb8095", "comment": "Malware payload", "value": "64fe6c0d58561d33c2bcf13c3058e56f1ed2e868328c205ab9bdc7e4fa38b38013565abab0e8ff77bf666e83bc1840bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778077775, "uuid": "2f463cb0-f80b-4674-83f1-cec9d1d2eb00", "value": "T182E3120522804A32C9A65734AEF32B256DB1E66AAE0CE75F8EFF94731B3774054417F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778077775, "uuid": "e61131d4-c5f0-4b0e-8660-bc103d586585", "value": "3072:ngrJGQ6nILctySWCEoR1olHhB4rffBL27evEwTwQ9M/wxzf0cA0:grJGjnmcthfahedc1sH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778077775, "uuid": "51fb3924-9edc-4b8d-b88e-8c20dad0365d", "value": 152576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778077775, "uuid": "afcbe4a9-ac9f-4755-889d-43136fd59f39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778077775, "uuid": "cce8e2de-5344-4aaa-96d6-34e17c689e2d", "value": "1fe199275081693c9c4110377fa0d75141179e707fd7d58285bc73a059a7ba6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13b74bed-4933-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1778061914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061914, "uuid": "7e7b3a32-878b-4253-97b2-3d3c3f6c3076", "comment": "Malware payload (NanoCore)", "value": "76a1cab6083014292e957687035cef71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061914, "uuid": "b1d13bbc-7b8f-46e3-a973-07373c795fc6", "comment": "Malware payload (NanoCore)", "value": "2006020fc08ed675272013e84ce7316bf033bbb8fb9b8908411f1f310c6aa0aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061914, "uuid": "59d53111-5a1b-4202-9985-682f80db6ae5", "comment": "Malware payload (NanoCore)", "value": "2ac52f5d37cb873306c8be0e80742384c5e73565", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061914, "uuid": "182f1083-9b37-4872-8d09-298f8b6eb03a", "comment": "Malware payload (NanoCore)", "value": "2cc62b2de4c8b392d448492dda8030ec358331f151208dca9be21f29390d0e7f370b84f68c69e816ff5b2c3b420acbd3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061914, "uuid": "1634a4b2-2cff-42ce-b0b9-0c820d87b644", "value": "T1D814CF2677A88A3FE2DE8979611201128739C2E3D9C3F7DE28D455B79F263E44A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061914, "uuid": "fdf6f3a1-bd77-43a9-af96-a64df03b1aae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061914, "uuid": "3d385b85-24d6-4e79-af86-fa5a5fa9b097", "value": "6144:MLV6Bta6dtJmakIM5q8GL+1WUQ52F+/8Ej4eR:MLV6BtpmkmGLUcQsEEj4E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778061914, "uuid": "a48e40fe-0e40-4222-952b-3c48cad3b719", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778061914, "uuid": "82364863-092f-48a9-b89f-cdf3f2450ece", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061914, "uuid": "73d41a4a-0205-4b77-9019-33efaa08fb63", "value": "hotro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "290cd76d-4933-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1778061950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061950, "uuid": "0f3d3927-c5b5-4409-bd15-09dd781f099d", "comment": "Malware payload (NanoCore)", "value": "aebc5ec0adc74d82d3580a0aafbc6a3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061950, "uuid": "bed335d9-d80b-4f91-ae2e-f1424756ea48", "comment": "Malware payload (NanoCore)", "value": "224f2c7c7bbc5c090bf6736aefc1f2589675ae61b9430cd75f1946096a5062b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061950, "uuid": "cfec8cda-d620-4ccc-9d8e-10a885319c0b", "comment": "Malware payload (NanoCore)", "value": "25a9969b577c5f2f1417e40f783e1e9aa8b77df6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061950, "uuid": "123835fd-27ac-4f86-8a39-8a3b8bf07112", "comment": "Malware payload (NanoCore)", "value": "93242615f7aeecc94a75bd523a102c37657d4ee7201e78927379472ebf69194004cc9ff1680a209d260bec5afcb46f80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061950, "uuid": "5f3557a8-0a4e-4672-8fad-8cf83b8e9d06", "value": "T1B414BF2677B94A2FE2DE8679701206535378C2E398C3F3EE28D855B68F167E5060B1D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061950, "uuid": "8289bb5f-79a8-4a68-8467-9759fe5e12e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061950, "uuid": "85ac5423-c890-42ad-af89-0fcfea9d4c2e", "value": "6144:MLV6Bta6dtJmakIM5RBGmPDZ1ZgJB6QUWt:MLV6BtpmkABGmPDZ1gB65Wt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778061950, "uuid": "3e94728c-7942-4826-b4e6-a0bd128c0192", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778061950, "uuid": "b3d2db70-61c8-44d5-9633-e37e1f40bdde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061950, "uuid": "b61f6e34-0036-4040-b8ef-6dcbea53b708", "value": "hotro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23f47319-4989-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778098878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778098878, "uuid": "9f22f11b-f447-4850-b236-34caffe5c701", "comment": "Malware payload (Mirai)", "value": "20d5fcfc95c02be6c68c077689d01c0f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778098878, "uuid": "d7758b4f-11f9-4cb5-b70b-62f2d27b169c", "comment": "Malware payload (Mirai)", "value": "22720ce20c61b89771e55c67f3392c56fa3b6b4f161be56f06b6b214fc0108bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778098878, "uuid": "b3635857-2b3a-4d33-9aa8-bb094832caf1", "comment": "Malware payload (Mirai)", "value": "96123fb27f066b3fb7481be26603388070156493", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778098878, "uuid": "a0137200-aa2e-465d-ac03-3db4e7d3f435", "comment": "Malware payload (Mirai)", "value": "f50f80e82321879cd0b8b61fe4af306ae31b22f62462fb40c263d0fb1138d50be307432f78c6725fdfc61cc2869c7c0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778098878, "uuid": "bf0f5ad9-6109-4dbf-86bd-cae84cf9d957", "value": "T19AC3F909AB614FFBE86FCD3746E90B0525CC551722A83F7A3574D828F64B64B4AE3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778098878, "uuid": "5d9afe8e-0c9a-4de5-b011-32e6a658fc2d", "value": "1536:FtJ6cGVoxBFf+g6z3jLH514UXAMTuY0+YdW0OKhZ6Qpos2Z5uxrKnr1F2IFSEhAa:XJ6cGVoJ6Tnk36Qb2C5udFKFW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778098878, "uuid": "16896d90-e4be-4cbe-89ad-12c3fb20aedb", "value": 122496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778098878, "uuid": "11b2b774-f37b-4de0-84f1-37323bf45838", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778098878, "uuid": "e8c79512-32c4-48f6-b34a-eb95dce0b1f8", "value": "titanjr.mipsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc2b5ad0-4930-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778061016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061016, "uuid": "e48e79b8-663c-4a82-b3ff-71e186e6fcca", "comment": "Malware payload", "value": "b209cfd9c2ceef9019b0d3bdb23be654", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061016, "uuid": "c5443fad-ee23-45ef-954c-18b160c76e2c", "comment": "Malware payload", "value": "22b6ed065452a9992f66c323421d010e1bb9e51ef642589044b85b07d025e90c", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061016, "uuid": "210f6005-2df7-4522-9fb6-0d876c69f348", "comment": "Malware payload", "value": "0666970ccb8a2bb45f0b0a2edad100ca24abeb90", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061016, "uuid": "bee525af-92fb-4f60-91e5-9a1601bd3a98", "comment": "Malware payload", "value": "766574116bed1aa583acb7a3672f4ab42337eec8c41d443d9bd7c3a2e3ffd9405498971cc950c647ba0c858d9d305d4f", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061016, "uuid": "6886d20e-6909-4ef8-b299-83c924fab7bf", "value": "T17DE61226F7096DAFDCFBD3386C7A126254256C258B03E58F7868B33D29F39C55A4A1C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061016, "uuid": "0010316e-dfae-419a-9e4a-54ea7d2b29e6", "value": "196608:R/RzRsDnG6H9a8Sor8QvQTTOI2Y7jUAwDHfAao6RFcM0TQNe74XMFChh:lRzRsDnFZ9MTOIhwD4ao6rbsy1hh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778061016, "uuid": "ceacd163-1fb4-4cc5-9778-cc414dd55679", "value": 14087775, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778061016, "uuid": "5be1ff02-0d0f-4b1c-89d9-2272fd7562f8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061016, "uuid": "230a7149-a3ee-4e4c-95a4-9f52b46ace0f", "value": "ChatIt.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8e6008f-4928-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778057440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057440, "uuid": "5fd8876c-0306-465e-8743-fdb34aa28b78", "comment": "Malware payload", "value": "aa15cc90baed4b2ed3701b2ef4d1293c", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057440, "uuid": "07229856-f273-4937-b38c-16fee84ac651", "comment": "Malware payload", "value": "23b0c2e740a824ff6e81d27c706f229fb1017ef3d711cfad1021b08cbac14c61", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057440, "uuid": "a6b4b870-6d4b-40c6-a9df-f78e7f9a984c", "comment": "Malware payload", "value": "8a5d2203001d2ff1639a894b4e0f8f6dc0450a20", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057440, "uuid": "d1981c78-eb6f-439c-bcb6-c87b8450be8e", "comment": "Malware payload", "value": "340bef51f980e97845469b0d861e5f98579b6a5dd2a792f73a1233ec7859f371232fbc8914c2a9aad45742508ad24e53", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057440, "uuid": "a0caab8b-b052-4c6a-9381-eba7adcb5e2b", "value": "T19C56F1C9F7D8A92FC4775032C97A52F152874C168A83DF83A954320C69BB6D45F8AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057440, "uuid": "477ac063-0193-4903-bc80-dba288d5c68e", "value": "98304:ePVSCQ05WtX3lPIQZQdVFi+dHGOIb0sRiA7OUmsriZByNzG5yWoVvihWo/KrdvFN:e8CHIFPENtLIb0sRjO1GibwvtVvCoFN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778057440, "uuid": "139dae71-09b2-41db-abdb-f831a2382866", "value": 6257161, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778057440, "uuid": "bce41e61-738b-4a31-bb9b-94772c572b64", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057440, "uuid": "ec801eee-4c09-472e-8091-e8ff0afcbb23", "value": "app(6).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "362fb1a7-4923-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778055100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778055100, "uuid": "522dabaf-3a5d-4f6e-8213-4745bfc8ce33", "comment": "Malware payload", "value": "03c96dc26cd48534ec369ca314b0f03d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778055100, "uuid": "20aa2b0a-3ac8-46b8-b9a6-896e517ea239", "comment": "Malware payload", "value": "2460403ff4ac4f72c0fba60885e6e23c679a900399e35987422956e355c91dcc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778055100, "uuid": "5412a2c7-8046-46ae-89b8-97b29ce6d763", "comment": "Malware payload", "value": "4009dd6c2f656b7450b612ad540dcd19f994475e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778055100, "uuid": "61137473-b0ab-4c28-8ff1-efaf50734609", "comment": "Malware payload", "value": "b6e3f0314329d19bc871b55a2b45f2c2c90bd782489cd899c026d644ec1b14eb4a609da76d3ffda2278d128d2c44b4ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778055100, "uuid": "95694e26-5fbb-4a88-954e-6df77116382e", "value": "T1FAB4CF1AF7A414F9F4B79138C9665607E772BC1A07A0978F23A0475A3F237A19D3E321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778055100, "uuid": "385add5f-4d4f-4e19-b304-d326a46fb942", "value": "c92c4ea9c875f3573668d37f0bdb0bd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778055100, "uuid": "579bc1c3-ba3a-45f0-9b16-42b0ed10fbd8", "value": "6144:eQb3yT537mqROOKwllQ40D1NiOyB6cZqrEIjheapQ0FRbEEBP94HG8OfhbLr:eQb3EDROOrHxcGqAB0fh8QbLr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778055100, "uuid": "613139ba-0b4a-4ccc-9bfc-0e1f84ddb6d3", "value": 504832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778055100, "uuid": "8b40a35c-74c5-4c17-82cd-6bfddbb70e86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778055100, "uuid": "53cfa545-55c2-4e67-bb8d-050103f44c02", "value": "OrderContents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22be7797-4933-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1778061940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061940, "uuid": "608633d2-d3b4-466d-a70f-3b4db4fff343", "comment": "Malware payload (NanoCore)", "value": "b9f38a1e153ecf582a3e8ea97bde85b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061940, "uuid": "5fc7bd84-c0ee-445b-bd94-57ef6b3d42c0", "comment": "Malware payload (NanoCore)", "value": "255adff30d260d672169fe0eef80201a306fa55052b0b0407bd0063c3395195f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061940, "uuid": "ce7e37ce-06a4-41cd-84bb-86daef10ec40", "comment": "Malware payload (NanoCore)", "value": "e20b5dd4036e69d171c970faafbbc5d24a1ca8dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061940, "uuid": "a13a026c-d3e5-4a0f-a8cb-b3780aba990e", "comment": "Malware payload (NanoCore)", "value": "92e0579a0d6756580a5967a5099926fd76441a28db40c47893153ae88f854571d6c6cb39414036781c6c4ce6d00c0d1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061940, "uuid": "7ac30de0-0961-4bf3-b50a-f9243f20e1b2", "value": "T10D14CF2A7BA88A2FD2DE8579601252138379C2E3E9C3F3EE28D455B74F167E506071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061940, "uuid": "97878964-3a2a-4c1e-a2a1-2dbbb91552f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061940, "uuid": "18c2fd8c-842a-41e8-bd64-5541c85119c4", "value": "6144:gLV6Bta6dtJmakIM5AlE4UXkD2rovrO6mlOv:gLV6Btpmkb24ttvr5v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778061940, "uuid": "6718304b-5410-4058-b2fd-765b1ab928d3", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778061940, "uuid": "7e1e7eac-16da-4e62-97c8-b9867e47b7bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061940, "uuid": "e30467c5-22fe-4246-b98f-aba9ef70c75f", "value": "bj88-12.com.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34c91f10-4933-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1778061970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061970, "uuid": "cfab104b-c5be-4e40-a4b3-1d266636a607", "comment": "Malware payload (RemcosRAT)", "value": "1d5c12df483a0e55fcce281b716c4967", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061970, "uuid": "2afacea3-c9af-4d9e-8aaf-fe25ea365650", "comment": "Malware payload (RemcosRAT)", "value": "271e22dff1055c1b697b7faf27c4977059761c4312536a390ea2d8c65c128e32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061970, "uuid": "b3c9c85f-e5fc-452d-a9b4-189fde8d2c89", "comment": "Malware payload (RemcosRAT)", "value": "08912d60832b1fb40cd4cc5651c440b68c7dd0e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061970, "uuid": "22f75296-7ecc-47a2-afe5-c9ef3a27a398", "comment": "Malware payload (RemcosRAT)", "value": "1fb7bced485fc4fe59e3e1bdc17fef6de122d8be139adb3949cc647ccd853b1ec6c4bae0b72313b17cba0e79564b51fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061970, "uuid": "efbe95c6-bb61-4047-bb42-45798feab4d5", "value": "T1F0B4B001B6F2C172D97664300935E774DEBCBD201836997BA3D61D9BFD30190AB39AB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061970, "uuid": "84c26664-19e0-42c0-93c3-a8ad202faf8c", "value": "737fc4be4f9f7d7c06c790667c9f7669", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061970, "uuid": "4c4eb910-5648-491b-9bc3-2103e098c64d", "value": "6144:LXEE+QEZJvHVdFjl0WGYB+cvbWvpB+qADnN8XIniCrVSMXcvOsAORZ0AXiBces:7ENlHV9FGeDWv3jADnyYiCNrsPZ0i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778061970, "uuid": "924c5d03-e732-42d8-b718-020c9c1628e4", "value": 527872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778061970, "uuid": "d4ccef9f-adf6-4083-9891-4ced5bd5aa74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061970, "uuid": "8740c3cf-8311-400f-8c18-e0bfd7f33fca", "value": "271e22dff1055c1b697b7faf27c4977059761c4312536.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caec4e63-497d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778094004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778094004, "uuid": "a50137bf-c0b4-40c4-b25b-f101e89474ba", "comment": "Malware payload", "value": "693d5860e86b6e1bbb8413b3af31cbf6", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778094004, "uuid": "03988c3f-73a1-4a6d-a4ff-72477d503a0a", "comment": "Malware payload", "value": "2777cfb4d5b747346dabf8df575475511e0a4dc85ec2e14321b340544f44cd19", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778094004, "uuid": "f691f5a9-e4a6-4c06-9429-8d01468353c2", "comment": "Malware payload", "value": "8d3b70c69249f65c9ef54c708d52c3e2b5b50ff6", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778094004, "uuid": "4958c3fc-d556-47f1-bd41-ff612c8ec0ae", "comment": "Malware payload", "value": "4041570d7fbef79292e00e43e6436ae43ce5f76ee28feff18ae752fce0252dd7c9b1d996c69bf0b10a506b80d2719643", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778094004, "uuid": "5809c234-13db-4948-b3ba-6e5d78f8791b", "value": "T1B903499F83480AADF7EC0BC890DA294B06F5D1173C2C164EABB365C3F47B64970756A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778094004, "uuid": "0fdec547-f5a7-4181-a6d7-96352e087d14", "value": "768:o/qkwH4IDdghPYwSsVAuucivePrlswUCWkou8izo508IWhCeJ7P:f4Iq0srLUxkou8ic5/IWhF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778094004, "uuid": "ff28a258-c9db-480d-8891-2840895a9ac0", "value": 38940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778094004, "uuid": "d0dfe47b-6ed1-49fb-888d-bc8f03cc5817", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778094004, "uuid": "188b24f9-3097-4790-91bb-296cbddf4b4c", "value": "r0W0I_tqtgtbfg.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6dc185f-492f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778060524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060524, "uuid": "dc1957c2-e5bc-49ad-9744-45f265e0aadc", "comment": "Malware payload", "value": "d2d37dae312f062d49a448198dec706e", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "DMart", "colour": "#13BB90", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060524, "uuid": "0cf3530c-1896-4dc6-888b-20e739bea610", "comment": "Malware payload", "value": "280df905ee0f6fb2539cd85c5b31b8bf403d91363fa6a108e48e58e85c721894", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "DMart", "colour": "#13BB90", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060524, "uuid": "d33bab86-7e89-43d7-afe2-cf3a19ee00b5", "comment": "Malware payload", "value": "fd4834ce7d90de1c7b478e3fd8a49314af2fa71f", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "DMart", "colour": "#13BB90", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060524, "uuid": "46a0d5ed-b4fa-409f-9ad6-c7819bf6f1a2", "comment": "Malware payload", "value": "edb4bc75b4c804e9f5d223d8a1e5863c6503601cd7c3eb0048ea21b6990a771703ca3f6423f3019e8cd3d264c3f8c1ef", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "DMart", "colour": "#13BB90", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778060524, "uuid": "ea62beb7-0401-47a5-802c-38b3ddc18559", "value": "T1F7A512226285D453C4FBF9F0CAD68B7791A663DF9952A217EE240BA03E33BD0D723550", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778060524, "uuid": "96f5d094-ba62-49a8-bd34-ea0e344a7b0e", "value": "49152:Wj3IBw0iJh6y88/xs5c1rq/qoz0ViBxrfP6llC9IH0iafP:WjIlM6y88/+Ur6JrrfP6rHrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778060524, "uuid": "b13199fc-9a3a-4b1e-a4f5-1f118d0eb443", "value": 2110520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778060524, "uuid": "a6e686f5-e48b-4563-8177-5a895c187f33", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778060524, "uuid": "dd9ea155-fd5d-496d-9490-d651e6bcd038", "value": "dmart (7).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "123f6286-4965-11f1-a769-42010a9c0008", "comment": "Malware payload (KongTuke)", "timestamp": 1778083387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083387, "uuid": "dd6dd1f9-1c5a-422c-bbe0-8911f0ddff1c", "comment": "Malware payload (KongTuke)", "value": "96a849dd9ab8c79f352feffb66d3a60b", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083387, "uuid": "a2ebe4c6-a94d-483f-8006-5d9577b08edc", "comment": "Malware payload (KongTuke)", "value": "28f0f4c19d290c74a2e2d20004e1eaccb062fb99f53254ba3810eeec29c191cc", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083387, "uuid": "15e5df26-e509-4b76-b31e-13504492f357", "comment": "Malware payload (KongTuke)", "value": "665d3dba03292da9262fa330fe6fac731aaffabe", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083387, "uuid": "41378d5b-b2e2-4d93-bad3-6efa20220939", "comment": "Malware payload (KongTuke)", "value": "07d01333104910003f7ec22429bee64eea93e8114c69da32ec53cddef3a6f30a56ada128fd03d8ea205ddb8aaeeb2493", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778083387, "uuid": "e6d578cf-bf8d-4934-9acf-1ef44e144f59", "value": "T12E253303B2517B85F2338F2FE414457BC80B9252F7E2E91585A2A957CBB3B26FA491C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778083387, "uuid": "a766ffb7-22a5-44a3-8ad6-666ef5abd7c3", "value": "24576:bqNHWhgZguL7Xlh2PqoADFroTH+Jkqk5ANUY:bAWhQLLlhMY0qJkqk5Yd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778083387, "uuid": "cdd462e0-d430-4f71-ac5c-527caf09062c", "value": 977525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778083387, "uuid": "a609c50f-162f-4ba5-9a70-82116406a968", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778083387, "uuid": "9c8a7579-45a3-4a71-841c-fe119f6d2c2a", "value": "d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd5d76c8-492b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778058817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058817, "uuid": "3ffe4c5f-d23d-40a1-a653-c1c0972ac827", "comment": "Malware payload", "value": "c8ef12c60bf651622fb04ad7d3f00dc6", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "IDFC", "colour": "#2E569D", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058817, "uuid": "42486cbd-5a64-46c9-bcb3-1cfe1cac0d40", "comment": "Malware payload", "value": "28f4dd61677c87df05687f9bf0e7323700b4a264ea56af06a74a475bd0c6239f", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "IDFC", "colour": "#2E569D", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058817, "uuid": "6653a2a5-896f-4fa0-94e8-180bacbd2128", "comment": "Malware payload", "value": "8b6505b47050cc9ba108859cc80cb72e63596b15", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "IDFC", "colour": "#2E569D", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058817, "uuid": "bc342297-533b-4460-91f5-f5d56db30a98", "comment": "Malware payload", "value": "3b9fdb1d33c53cf30b7c79b79b404b89771c6e277f19759f291803520bda2425bba0c586f7f9d3c724ffee81d6ef56a7", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "IDFC", "colour": "#2E569D", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058817, "uuid": "93a4b626-a558-408a-8ff1-ce8034bbef98", "value": "T1E0F6121AE61D996FECF7A3387C3A035264356C658B03D58BB838B63C2DB39C94E561D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058817, "uuid": "71ccaabb-e8e0-4c53-af2d-1ea4982bf0f9", "value": "393216:Fgnb6lopfquGl7m3zw4Bfzbu2+4Q93pahClNT:anWwfQIRt+frOCv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778058817, "uuid": "75256cce-7f7b-4cb9-8438-9bc118678b1c", "value": 16127738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778058817, "uuid": "ff06569c-e082-4eed-8676-cda87dfe72d0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058817, "uuid": "85921bf0-9ba7-4236-9681-032d0f32e5f4", "value": "IDFC BANK.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e877a07d-49a5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778111234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778111234, "uuid": "9889ab12-7fde-4924-bdbe-d8235c73e692", "comment": "Malware payload", "value": "172b3863ef8c0fc12ab64d4cabe6e99d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778111234, "uuid": "07c793c4-111d-416a-826c-3f675975be40", "comment": "Malware payload", "value": "2abbb3f0b3b681365323f0cb088b06258d52d621779aac0bd505abdfed99b201", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778111234, "uuid": "41abfcf6-ad00-4a81-a7c6-48b841d5d8b8", "comment": "Malware payload", "value": "35424b37696fe8004e993ddb167ed4faeec47701", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778111234, "uuid": "ed420ad6-c6b9-43c4-bb7d-768969f4083f", "comment": "Malware payload", "value": "d02362d39f26079f1c16c8340b7143049adea1740d85407f7b9d7fa013fee604af6ab1ece867cd38b245ed5659213517", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778111234, "uuid": "6102f2e7-42e0-4b38-a99b-729a932f0e97", "value": "T10126391AECF94CEBC0A9F134C4B36206FD61780047216BC716E1A7691E777E15ABAF18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778111234, "uuid": "b96ee50c-65c5-490b-9e94-104423b0fea6", "value": "5405b9a0d50d513e49770ce757878c9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778111234, "uuid": "de3f4757-fbdf-4cc9-9a37-9d158221cab3", "value": "49152:DYbi9lT6aacxQlYkSaY6Nali5GDboCMBiGaaLpVknj9QcThOPT4nnq:DYwrkSajJRTqaq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778111234, "uuid": "826f0603-8e02-4d1e-ab09-3e93325f41e6", "value": 4848128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778111234, "uuid": "1a28d7d0-f0c9-40ea-8d6f-ec329b5ed838", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778111234, "uuid": "3261d898-3ed0-4ed7-83b6-5e77d449fef0", "value": "SecuriteInfo.com.Variant.Tedy.953997.78859787", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a12e2b15-4961-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778081909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778081909, "uuid": "8f815027-7544-435d-a72c-9116b40825cd", "comment": "Malware payload (Mirai)", "value": "bceb6ae068cc53de54c722f2da929e03", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778081909, "uuid": "987d0553-1aad-474d-8749-9b1deb86a79a", "comment": "Malware payload (Mirai)", "value": "2bb19e5ae9592bd335aeec8eb5e52cd0587bd7546ae4dd14651ceb1563493d10", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778081909, "uuid": "ad418dd9-d802-4040-859c-59cdde181a28", "comment": "Malware payload (Mirai)", "value": "958c19726f6d7979c1a459f233ae91208d13c003", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778081909, "uuid": "6b38de7e-aed8-4ba4-aaa0-a939b26027a8", "comment": "Malware payload (Mirai)", "value": "41444d303a483e68014be9d08d1e07c7e9b13f09d1cde6f43b48fd055ff5ea28f80a0ac6ee30b3ae7525ae0540eb727c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778081909, "uuid": "6580d01b-4720-4a5d-8af8-30a3367e979e", "value": "T115A32A41BC82965AC2D4237BB56E564C33A613F8C2DF3257DC118B653B8A92F0E67F90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778081909, "uuid": "1c7742f5-ade9-4751-9440-50d249da7d2f", "value": "3072:UO0rKRPyNl9Mw0A+wC3zRAZRTsG05DHL6AaB0:z0rKIpM/7wGG057LU2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778081909, "uuid": "c2b2b34d-b53b-4144-a20e-d0d6bd6a4a56", "value": 100248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778081909, "uuid": "f5fe4645-873e-427f-b7ef-e1bf5e6d209d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778081909, "uuid": "17cd128c-d9da-4ba8-9631-6cf1c38c323f", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f335f208-4927-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778057135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057135, "uuid": "d16ea235-fd74-4d48-81fd-9ab116984b1a", "comment": "Malware payload", "value": "2e202b47faaf0bbbbdb49a7c62d30c15", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "SBI", "colour": "#FCA5CB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057135, "uuid": "0202ee09-80c7-4b33-b802-58105ffeabbe", "comment": "Malware payload", "value": "2bd3c84e99c8d96bc328f7f8a6bb5f7395951c5b75720e15a593e66455a7335d", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "SBI", "colour": "#FCA5CB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057135, "uuid": "6311d03b-1f85-4f79-8510-3a5e31de5929", "comment": "Malware payload", "value": "5982bec34f52c80028d4c3b998e30892e1b2a5f3", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "SBI", "colour": "#FCA5CB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057135, "uuid": "b2b510f0-8852-4ad0-9fad-9315e9f8e29b", "comment": "Malware payload", "value": "d7a78066e0f033e077150a3f2a5cfdaf6fe5b7875b193fadf282f3df9ebf17d20deca02d2d9ae2b327c48b0fdfb850d1", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "SBI", "colour": "#FCA5CB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057135, "uuid": "45d118dc-a8db-41cd-a26a-ee5036f0305b", "value": "T149E6124BEE58CD5AECF65239FD32032334225DA84743C5BFA1A9BA393E731C24A915D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057135, "uuid": "498d8343-6eda-48ae-ac0c-841bed8bc47b", "value": "393216:bHZWtmm12bxbpwWS9C96zwMvwH5STzfU/Wj5f:NAStwWbHgTbFj5f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778057135, "uuid": "e635d927-9b79-40cd-ad10-c7d843965baf", "value": 14517056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778057135, "uuid": "4f6b5357-1999-4f33-8706-54fa21f5e420", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057135, "uuid": "878408dd-93cc-4f68-b246-af17518ce2be", "value": "SBI Credit Card (2).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fddb34c2-494c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778073045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778073045, "uuid": "37ff22de-3921-46b8-becc-3ef03fb8833b", "comment": "Malware payload (Mirai)", "value": "96d8928976efa78bdb368908a644e647", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778073045, "uuid": "f6abb313-4f7c-4469-94dd-243e7561f27b", "comment": "Malware payload (Mirai)", "value": "2c29a3ee853466034d00fd651c3ba1d6a28ae1653418ed004288e2414eef6745", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778073045, "uuid": "3c93265a-daed-4916-9e7d-b057588411d1", "comment": "Malware payload (Mirai)", "value": "f3205b9493b91b03c66e7f79cd7551297b433834", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778073045, "uuid": "290b3106-e709-4de3-8f34-df108922d70c", "comment": "Malware payload (Mirai)", "value": "bc1adde1adf6042403f14bbe9e67370e25c944188cb423a8219919624a540fd5ae04f94ceabde5a9465f48c5f3ee7a81", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778073045, "uuid": "8822170b-a063-4bfb-a0cd-f306d15d409a", "value": "T10E715FD5C84250751C695762ADBB51AAF181B3D374EB3A0F7EC838F8A1DCF01A485ED1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778073045, "uuid": "dc529110-b920-48ee-bcb2-2dc1f733cd5d", "value": "96:i73930x3i3A3EB3cE3l3+3T3k3w3o393Uwz:4tExywUBlVuDUAYtkW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778073045, "uuid": "d8a3b152-9d00-423f-9ddf-a49103ea6314", "value": 3784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778073045, "uuid": "4b8fb5ed-ca7d-4289-b480-12f17dc1f848", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778073045, "uuid": "a2add345-7331-4233-afef-5bb6351cffb3", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a89789c-48e1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778026707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778026707, "uuid": "eb6e0a71-6d8e-42d0-9839-49e7682bf926", "comment": "Malware payload", "value": "f4396b2e8aad957f84c1f29b10c36337", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778026707, "uuid": "0c3e9c40-d607-4535-bab4-822f2e98dddb", "comment": "Malware payload", "value": "2c5bd5604c7c3bc28307a6b2672af574fcb4040f65a95a178477272f55aee59b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778026707, "uuid": "a99bc868-717a-4671-89ec-3c6a8fc17074", "comment": "Malware payload", "value": "9dd6b79d9475fca9f4ffe3e1830665fc1ee95542", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778026707, "uuid": "39052864-02e5-4a32-b363-252fa94115dd", "comment": "Malware payload", "value": "cbc39a59f27b944d19f028560561a38fcee8acdf97314c0042c304e42d359da061936dfcd21b89c3059b808b657f1446", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778026707, "uuid": "1f7c56f9-fc70-483c-9a9e-55cf3f78e9e9", "value": "T125D56B11FDC704F6E4070A3209AB66AF23319C060F74EB97E944BB7DF97B6991836219", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778026707, "uuid": "e66555f7-870d-4ce8-b986-ec13edaf9810", "value": "49152:Ifpq/e5KbklGKg3t80LcVBAEHx7YPf7K0Xhz:V/e5q9yScVBAuYT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778026707, "uuid": "d25d0567-fc2b-41b8-bd42-eb3cb926c635", "value": 2981134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778026707, "uuid": "9e49b66e-408a-4171-93a6-272e8a17c4d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778026707, "uuid": "3871680b-4b92-47c9-b93c-bb300275ff33", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "235a67f5-497c-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1778093294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778093294, "uuid": "106e8370-fcd7-4f27-98c7-bf42152d9273", "comment": "Malware payload (Prometei)", "value": "6bbd094141fcfffa6127952d03e4a6c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778093294, "uuid": "c42a5288-7ebe-4ee2-8259-8003ef28a20e", "comment": "Malware payload (Prometei)", "value": "2c5c3f940568053cf3a1712377d9b9aaaec8bff4e3373425662e8b62323a8cc0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778093294, "uuid": "0744bee7-d99b-4ca3-82d8-90356751a4d0", "comment": "Malware payload (Prometei)", "value": "d9ccb70b78cc6f6d7c366c9c54113b89656d1d55", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778093294, "uuid": "11742d9f-be36-4c4d-8c10-9aaaed8668d9", "comment": "Malware payload (Prometei)", "value": "d3069b5290600652844917e516beb37435e0ad59b8a713c2ded04643f2c8715d0474bdca693cb9b2e2e146637acf4628", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778093294, "uuid": "3aa6dd96-ff72-4ec2-8aa6-ed04570b6517", "value": "T1D8A423B4F9219E8F6DD769B91B24C31DE182C172589D4C2313AE95A34F3D632AF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778093294, "uuid": "847b07a3-12b8-48c7-9469-53a51e4e21b5", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdK:Fs6pyCC/Ya2hpi6T6N4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778093294, "uuid": "49bececd-0ecf-4e78-8133-c5240ed40c1d", "value": 449095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778093294, "uuid": "a525203c-6260-43f6-bf2e-56662776081f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778093294, "uuid": "bb30dd6f-f3d5-4b31-8d22-bec3419f2d92", "value": "2c5c3f940568053cf3a1712377d9b9aaaec8bff4e3373425662e8b62323a8cc0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "430a8740-495d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778080033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778080033, "uuid": "e9ce5c18-6f9c-46c5-aa61-9bc92a7d318c", "comment": "Malware payload (Mirai)", "value": "11329a701ed22d64deff53938760a8fa", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778080033, "uuid": "ce871ffb-a066-4cc3-acf8-7212f0abcfa9", "comment": "Malware payload (Mirai)", "value": "2c704e1c46e79ec0763d6dd8656c588fa16871ea7ce80d9e68e6edbea958ae8e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778080033, "uuid": "6c902271-169c-4761-ad34-38e72a797146", "comment": "Malware payload (Mirai)", "value": "7f24b8dc6b1607a4adfcf78f32b98524af7aab1b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778080033, "uuid": "3fa5a6f4-ec69-4ddc-8286-1625fa8eb771", "comment": "Malware payload (Mirai)", "value": "e5bb4858ce703cb6955a4be26caeeb6cf3e8874e9dcccecfa18b23f20a7b1013821e61ad68402b44dce15816df733581", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778080033, "uuid": "998e7f18-fb27-4e43-b8df-3e6183c32661", "value": "T1FA630956F8814B22C5C6027AF92E118E332357FCE3DEB2229D206F2077C696B0E76D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778080033, "uuid": "82ec9cf4-18f2-44b8-b75d-07e3d680d0c4", "value": "1536:dpnqh/sOR5YbAP+uppI4NEoq1aHg1zGI7ic8I2+lhCS5bYonS:a/9R5MEzMaG8I2+lhCSRBnS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778080033, "uuid": "54b93c06-9e61-49f2-a2a7-8f31b27c3b2a", "value": 70964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778080033, "uuid": "6c9b7b1b-f883-471a-8a5c-762cc7b5ed7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778080033, "uuid": "b6a14c09-d06f-46ca-b1dd-44a68d9493a0", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40268dfb-4930-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778060700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060700, "uuid": "a5686016-6754-40f1-a004-06f49585c197", "comment": "Malware payload", "value": "ec4b07bebe975e10334b3fb330219810", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "DMart", "colour": "#13BB90", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060700, "uuid": "3fde7bfa-b3c3-4212-bffe-8a91c4967080", "comment": "Malware payload", "value": "2d25cb4e862cc6cac19999798f044211ed99239dd15779be6271b680c028782a", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "DMart", "colour": "#13BB90", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060700, "uuid": "c247a0d3-4644-4456-a8bd-92c3c556cf7d", "comment": "Malware payload", "value": "2edb06787250b07f40071d4186289f8f34900d10", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "DMart", "colour": "#13BB90", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060700, "uuid": "a4e9ad89-85d5-472a-a3e4-956e27ec4993", "comment": "Malware payload", "value": "1aef57ddc0108dbe92ac692b6197b9f8da8b0109f76d29a972a46e1b6c20fdcb85e10cb6a93164ac6ca00417b81876b7", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "DMart", "colour": "#13BB90", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778060700, "uuid": "7d1ef3ee-8cdb-44fb-b4ee-255b97c2011e", "value": "T189B5E0D27B86563EC83D45364CA613712B46AC25CDB6A707E814732C7CB72C84F9AED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778060700, "uuid": "2eafa506-ca6a-461e-af58-e1872a6f56a5", "value": "49152:gcY+Dd+SLheidpdkBZ7Kb8aklEfSMrefeCU4Jj:geDdRdGy8maMVCdj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778060700, "uuid": "5e05e214-aa13-4f89-9b21-f16d04b907fc", "value": 2392999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778060700, "uuid": "faad8d94-e226-476e-afea-b1fbf7be7699", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778060700, "uuid": "d4db644f-99c0-41de-bc8f-315fbc772859", "value": "Dmart (12).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee81b6d2-48e6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778029210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778029210, "uuid": "69920947-a2c1-424d-806b-c89a4f734eb6", "comment": "Malware payload", "value": "575ce0d4fd656b14d12f7130ea52b09e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778029210, "uuid": "56936329-2b4b-44d3-83d1-1faa6aee6fe4", "comment": "Malware payload", "value": "30dfdb93792681dae09e222e3367b6f7f7560d73bd22b67a92dc4d230be32584", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778029210, "uuid": "1288a16f-7b57-40cb-81eb-deeee1931d7c", "comment": "Malware payload", "value": "01600ea5243a804899bbf6457c20ab071a92451f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778029210, "uuid": "1aee267f-fcb1-41e5-875e-c109beeb2b5e", "comment": "Malware payload", "value": "5c3625aa3f22a231e1d6169556b5587f780701fb64ef2dd9c87a0e3049e8af3a5a73ff1e791cea23979a6d39b6dba56f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778029210, "uuid": "c8f98120-3ea9-420c-8e34-896fbf6b3018", "value": "T126137D6966857C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C496DCE21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778029210, "uuid": "f39135f0-e754-4a99-af45-ecc5ba17aab1", "value": "768:bI+89GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bI+xco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778029210, "uuid": "9ee897dc-fa0a-4ef4-9335-df656a095f4b", "value": 45404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778029210, "uuid": "a4bf218c-3330-492e-aab7-b4bcada81407", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778029210, "uuid": "ac082405-1f34-4a13-b680-5e3c2e2591f6", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05cbdb28-4981-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778095392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778095392, "uuid": "8a78c975-3e75-427c-a838-0938fe55f596", "comment": "Malware payload (Mirai)", "value": "624dd4427c24520c3b9ca14ca63a0dbd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778095392, "uuid": "e87c0ab0-d7e2-496a-9514-8f13b260517d", "comment": "Malware payload (Mirai)", "value": "325854b7aa7aa2b05e9a3e0ded6ed91c4b6dd16dd90742633181db2efd1e30d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778095392, "uuid": "57bf10e3-ea83-4054-b9a9-13029f506c2e", "comment": "Malware payload (Mirai)", "value": "ccccd200c8b5b33c6e1279ae29be716f5b30fdb6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778095392, "uuid": "3e532653-5c37-45c3-a9f5-9de525ab5b95", "comment": "Malware payload (Mirai)", "value": "315283a8900fb6e5a1acbf4d4cce0fc94ca9658e9f4757ee82c687ebd94f2bc95d504743fb1287f308b598dc9adda4a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778095392, "uuid": "cd9635a0-d31d-4599-a154-e623a6122347", "value": "T132730211E2451DA1EA5FEAB41DE0DFD542D417C3BAE3818281DAE7A9134EF0B30ADCD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778095392, "uuid": "97c94223-36b5-4e5b-bf53-61ff509d129f", "value": "1536:Ie5XEIl8mAdXcPod+8m/ONCJB/QlL262kEzewdSpOQDfL5g5x4u+qgw099:x5XjlmVcgNUpQL2pHJSpX7Lyx4u+qgwc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778095392, "uuid": "49a1852e-df46-4693-bec5-fe8c5677adf5", "value": 75312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778095392, "uuid": "e6ef1b1d-9bd6-4075-aca9-ea05e2eaa6f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778095392, "uuid": "3319395c-63b5-4b99-a579-1f71c283ac9f", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdae738a-497b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778093123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778093123, "uuid": "5d3b5b66-3b41-4229-b73b-19303a7d3cd7", "comment": "Malware payload (Mirai)", "value": "3339d1310db998ed169bd72336d8e9ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778093123, "uuid": "94643cc7-cb61-492c-9502-c0ed4e73185f", "comment": "Malware payload (Mirai)", "value": "355f3207574a46bb5881be61a8b9b2dbf29be5f1b7b49f75cb8575e3095af5bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778093123, "uuid": "daab044b-aff2-44c4-801a-78c4851ab328", "comment": "Malware payload (Mirai)", "value": "36a89db1cffab180a15aa866aa8a204952434830", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778093123, "uuid": "75d5bd3b-f2ff-4e91-b14b-39647a9d7ec4", "comment": "Malware payload (Mirai)", "value": "817e2447306b3c1f3669c2d5bbf5bb91bf809615031acf00ff22b185bc92480cc7166e8f2b3ffe7c032df395e5c04989", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778093123, "uuid": "3105dcd0-9ec0-4d6d-876d-35e00ea67439", "value": "T13DD33A49BC828A26CAD413BEF92D10CE331263A8D2DE7223DD115F25778795F0DB7652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778093123, "uuid": "24700abf-cf04-4d3b-92ee-76c876a179a0", "value": "3072:KFwvxKGyYvPqGFtAMmwtavtdG0QtI+l7E4hYs:vxtJPqGFtL1tavtd2IKPhX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778093123, "uuid": "5bffeadc-c4b6-4327-a4d1-26e2523e9479", "value": 139276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778093123, "uuid": "018adbae-c65c-4ab5-8978-c0475e438e55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778093123, "uuid": "76711e74-4c61-4fb4-ae84-a658a1b2e8c7", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9a212a6-492b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778058864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058864, "uuid": "111cc0a2-6324-440a-b335-e4a83df9d7ca", "comment": "Malware payload", "value": "71c6e6a237d34441316096348991dede", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "IDFC", "colour": "#2E569D", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058864, "uuid": "07074d72-733a-4f3f-b02e-459d262a9a9d", "comment": "Malware payload", "value": "35fc8d052210b699657e5e97fb0063adee49505e33eea5806cb7e142257d0784", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "IDFC", "colour": "#2E569D", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058864, "uuid": "7ec76d0a-c964-4b5b-a9e7-7277ea098bc1", "comment": "Malware payload", "value": "e88e728716166b0978219f17edd7aa568014ef42", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "IDFC", "colour": "#2E569D", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058864, "uuid": "26afeb22-2ab3-4a96-9c03-3d9b8f8f0919", "comment": "Malware payload", "value": "70b5037227539f095483f9d99885f274b39b9e6231e8465b399f7ace15b197ffd11def9e47367e0acd63f51865160ed7", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "IDFC", "colour": "#2E569D", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058864, "uuid": "77cb0c77-f34d-49bb-97f9-c431e6dd027f", "value": "T1C5B612D6FBC4492AC4778072C96A52F1165B4D528B839F877904360C38B7AE84F9EBDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058864, "uuid": "08154bb8-4022-4a5e-bd0e-2be1470f8224", "value": "196608:uavXX2LthRaFOd7ZGZF/mirbNg4dbMYZZNV53GTgb:JotjaFOd7ZGZFOsbNgejr53GQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778058864, "uuid": "281953db-dc8f-4003-aaa5-ecac1ba142b3", "value": 11417716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778058864, "uuid": "365e528d-500c-4084-bbf7-6e8470d52676", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058864, "uuid": "bb4e6b3e-0f6f-4e1d-91af-34e5ba8f011b", "value": "IDFC FIRST BANK (1).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27cb2636-498e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778101032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778101032, "uuid": "670b6399-6955-4dd2-a722-08827c4686fa", "comment": "Malware payload", "value": "87b9ea0c16a29c18302dc9f8e100f47c", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778101032, "uuid": "2a9e7fd0-ad1c-4028-b8c8-6d8af8ce9f27", "comment": "Malware payload", "value": "36bf99bd088ab729a1ea887360a665a56e941fbc891774f3a878fbfe3e5ddb50", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778101032, "uuid": "9ccc4730-6bb2-40bb-ba7a-41e76fb8b6e5", "comment": "Malware payload", "value": "a6be58dae852e9f9f760f795762b966a6c1b6f0d", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778101032, "uuid": "10112859-ee5a-4f5f-923a-c44affa145ef", "comment": "Malware payload", "value": "7ac6c0b5d5caaf143b3f320b8d55a2432901294daf440d83cc921900a6ea10d3448e21cfee3d5726ee4cbe5a46a48307", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778101032, "uuid": "67c25448-5c6f-4eaa-a606-df1da3010cec", "value": "T17FE2B31B7644A330C54707328A6FD7E54B35AC089F671523329AF39C2F72AD0A5B7AE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778101032, "uuid": "09c53216-a7d7-4a9e-98df-879cf6398d9c", "value": "384:bRchIaXmfut9d+Wey3M5BCyx5Pey3M5BC0ioXoWv:bRJi1eWMDCeeWMDC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778101032, "uuid": "1c0ca54c-d696-4e8c-af59-2745a5b59970", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778101032, "uuid": "b5a14f72-06ae-404d-9074-97f1807dbd66", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778101032, "uuid": "1f4c1700-9b03-46da-9012-8b513f703dea", "value": "VPN-Setup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ba9f246-4930-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778060854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060854, "uuid": "9205e65c-3c7f-42ab-b9f8-ee2900bc5e8e", "comment": "Malware payload", "value": "8fe13ea0772efa7f23581cb11b4677f5", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060854, "uuid": "67163af2-f71a-4da4-8062-fd90dd676eab", "comment": "Malware payload", "value": "36c984efc7db1206714814c9a6074fd1028dca5c5bf5a6e08e48e2f0413ed732", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060854, "uuid": "9a0a708b-ce58-4965-a2f4-49339a624f78", "comment": "Malware payload", "value": "c34ad8df3e3e9894106c1588f2f8a6911aab5a39", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060854, "uuid": "eef88758-6058-4c3e-9be9-e5e6f731847e", "comment": "Malware payload", "value": "85d6ff02341012b159d4bcd238d6c2a644380c5c96fe4f4e95ff038d17f6a768c5dd409671d5f52d55b3a5fd1803120e", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778060854, "uuid": "3242bf55-8094-4e3d-bf8e-c4a63920cebd", "value": "T1C9D6128BDE59CC5AECF65335FD22032338226DA84703C5BB51A9FA3D3E731D28A91591", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778060854, "uuid": "956a141f-d657-45b0-8f11-dc750cfa18f7", "value": "196608:AwJDBNhF6lbEejb2+/Aptojwm3Q7u5+5oGbCF+/1gXwUYNQr1uIbGvzLKk:9tneX+oRg7u5f+yAUGQZuIbG3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778060854, "uuid": "90c1c5af-8163-4b3a-8fe1-5134b16a1cfd", "value": 13112100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778060854, "uuid": "918fd2b4-7037-47ae-9987-a724be61d0aa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778060854, "uuid": "a156f861-21dc-42be-ab76-9c163d78a812", "value": "signed(5).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45c60ffd-4966-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778083903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083903, "uuid": "c10a16da-9bdc-4cd5-9e6a-2d9dd03c2296", "comment": "Malware payload", "value": "736f193fd8c809bae28d15d1b31188cb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083903, "uuid": "ac0c3ac8-bc3a-4f54-ac66-cb59b4efbe40", "comment": "Malware payload", "value": "3827e562d1cae70f033813d86e574b6984d74f2a3b90350bdc0372a4ff903199", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083903, "uuid": "17ccba0b-8b06-47f3-aa92-2dd863e523aa", "comment": "Malware payload", "value": "b110866bd86f16b981bb55f9c9401830f810901a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083903, "uuid": "15e71123-c779-4e65-9086-5d57787271cb", "comment": "Malware payload", "value": "b17a2ad35e7262b8bca22a4c62153ea3eeccbc0de2ad16f45a92710103691794d0f17f3a54b9b2b87ee225b73d2abef5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778083903, "uuid": "831ff55a-3842-4f94-af8c-5f960460727b", "value": "T1ED510AA8C7421632FFA7182FFAA1645847C6AC03DB61144D5EFB5CCE01E0A06A67DF16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778083903, "uuid": "ba27328e-1857-4b1f-b073-04901ecbc27f", "value": "48:P+jnat9/xU1948pcm3jnFYOve4UuHCC9eEVQsMosBAd4H:PkatIUi3jnF7veaeWQszsm4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778083903, "uuid": "45411100-2e46-466a-b720-c766eafb9401", "value": 2486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778083903, "uuid": "1500df12-4306-4347-814d-7b694c64416d", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778083903, "uuid": "c0b8858f-265c-42b9-b400-2247196a94eb", "value": "164.90.195.107_1778083894032751_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4d6647b-492a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778058292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058292, "uuid": "e9f46455-bde3-4377-8e54-6578de936167", "comment": "Malware payload", "value": "42b344587d9d2bce6a94a63ab3c7e54a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058292, "uuid": "3189cd23-37dc-463b-a81e-6ea92eeb6902", "comment": "Malware payload", "value": "385b8af8d495c364e9f42b36411e546009bf522c84dda3a0879a1f776b09ccd9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058292, "uuid": "8298a2c7-7b63-4c4b-8236-0bba9a509c5b", "comment": "Malware payload", "value": "71e9b9c66083687f9cff8d5f9aa4c0e373d16ac7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058292, "uuid": "76155258-d437-4478-8636-bdee4cf49254", "comment": "Malware payload", "value": "e017a02223d938e106dab85c701af8f34a25156ffb19446b53fda96fcf88dc4440ffb5c56fb3b713942baf7f25c214c2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058292, "uuid": "417cdca8-43a1-48ca-9d86-dcd00e553aaf", "value": "T13582B58E3EC6793943BA6163189FA861F4AA5D40760CC005FB99DCACBDA4F0CE593C75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058292, "uuid": "7d7a7e08-9528-493a-8ea5-9c98343f7ae8", "value": "384:6Ad4MMQX4D6ZT/Sz5VBxdoNPtaSRx3Q5AX8KVqTWxo3cP:6AHrXJF/S9VTdoFM63t6N32", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778058292, "uuid": "94f16a3f-5e01-42c3-9022-2e62c0456227", "value": 18539, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778058292, "uuid": "73fa363c-5d65-4dab-9cf7-ab4cec38c0a5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058292, "uuid": "903afe09-dfae-4937-9be5-384d8bc53a0e", "value": "R\u00c9VISER LE BON DE COMMANDE 05-05026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "426103c9-492f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778060275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060275, "uuid": "12015093-5021-4f4f-80c3-599c252c6bc0", "comment": "Malware payload", "value": "e18b4765dff77935bf299857f333f741", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060275, "uuid": "872e04ef-008c-4e40-ad24-3f106f9b579d", "comment": "Malware payload", "value": "3a5705acc39fb96b67cd78182ec27e774d7e4e9a27a34ccedf02c5dcd34c036c", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060275, "uuid": "79f7b760-de9b-4714-a90d-296c69dc15a1", "comment": "Malware payload", "value": "9f2a45e49a12d2a02196fc73dcc4df72c82e05f8", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060275, "uuid": "91c44ec7-af00-4d42-bbb6-51dc618a1110", "comment": "Malware payload", "value": "347ef1a6262ed00ff528e922293352cec2a58695c95dcff57d6df9eb90d713807bb38d5f3992e1b0d52fd593bfb8f1e4", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778060275, "uuid": "afa3b936-6f03-4512-8601-1bd013e9baa7", "value": "T1D1B612D6F7C4491AC8778472C96962F1215B4D568B839F87B904320C38B7AE84F9EBDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778060275, "uuid": "4ae35091-9775-4632-a54c-3d079329993b", "value": "196608:uavXX2LthRaFOd7ZfeBMxALFde2NoqF0gUOFxc:JotjaFOd7ZfeBioF0JOw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778060275, "uuid": "c52ef6b3-4a70-4aae-a61a-2508fe691b95", "value": 11434100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778060275, "uuid": "6ba7da14-c43b-483a-a57c-c9d5c44c3afa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778060275, "uuid": "a9f0ba84-f24c-48c1-afef-e8699b5975a8", "value": "imobile Lite (18).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38493898-497b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778092899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778092899, "uuid": "9ca5f82c-309f-49f8-a21b-8e2fa4792514", "comment": "Malware payload (Mirai)", "value": "d94a6e1c7ec7ba7083bee02f583efde9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778092899, "uuid": "4181b340-a315-4ae2-a99f-5427f9fc5e5b", "comment": "Malware payload (Mirai)", "value": "3bd629e52e2f801fff5e87b548f7589c5fa64ad79216755965de9f646c43bdcb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778092899, "uuid": "cca37bb0-11f2-4e0d-9a42-6b4958d94bba", "comment": "Malware payload (Mirai)", "value": "f35cb69683c118acc199d87fbf8e73baa5776ffe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778092899, "uuid": "e2ddc84e-ceb2-4456-9f01-d7e0d1f1bb34", "comment": "Malware payload (Mirai)", "value": "ab4d52f0f9feaf64617d12c855b1eaed5d56b3d437b01c28c2dafdad50bf8a0f3afe5eb0f5c85848701ee9e0571ee0eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778092899, "uuid": "3dcee03b-ea8a-4ad3-9288-5aad44f7743f", "value": "T18633E881BD82A916CAD94377FA0E42CD371173C8E2DD3227CD167F51B7DA52B0E9A062", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778092899, "uuid": "a8f2a349-7208-420f-a508-4e8cbb0e4467", "value": "1536:P2fWfezp8F0l96+9KJ0MMome8fGFCUCwbZnn:Bfmpd6oKqMMQ8fR7wbZnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778092899, "uuid": "f55b2b0e-0b10-4249-9a84-8b52b4b68733", "value": 50728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778092899, "uuid": "bff69079-4bf7-4938-9763-ab2061c89e0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778092899, "uuid": "15d876e3-9005-4a5a-a475-7b80bbc6efb4", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9d42318-4931-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778061307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061307, "uuid": "d266bcd3-cedf-425f-9bba-3596888572d4", "comment": "Malware payload", "value": "449705b78de3132e524001e8064168a3", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "axis", "colour": "#820AA0", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061307, "uuid": "8f16b33c-c981-40e7-80a0-7507b7dc03f1", "comment": "Malware payload", "value": "3cb66f8eeb3654ea2a0152be55ef5469731add50affe8a5cf587e91fd22dae64", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "axis", "colour": "#820AA0", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061307, "uuid": "7bda8095-8e97-486d-8ba1-a34470058398", "comment": "Malware payload", "value": "d1174bee572c65f55a7f0b510c629a98a4bb3c04", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "axis", "colour": "#820AA0", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061307, "uuid": "6259c837-b8ac-40bf-ad52-7c5bf46dc5b5", "comment": "Malware payload", "value": "1cf3d522793ddfe0ca249011a023ae26d1f8f875c32b76dd432678589a04cffe3cc1e3ee64d3d6bf2bede4ac59d223e4", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "axis", "colour": "#820AA0", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061307, "uuid": "57a7a69c-be50-4dd6-bf8b-a6cbd380fc25", "value": "T11C073312FB2AE759FCB295F9202A47758421EC37CB16AA871844772E207B9D84FD0FD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061307, "uuid": "1b75c2cf-4e65-4325-bd54-9f39fa1a6f03", "value": "393216:asqP7OF/d5461WKTpi3dF/vMh0Lsi65jV5P5g5qw04snZ7PikIj1CoMj4:asqDOF/dSKTpi3dF/vMri6LAsjjZOJCG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778061307, "uuid": "5dfe6051-d616-4616-a160-cc51516d31ca", "value": 17987444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778061307, "uuid": "e4f6a9e2-ff88-4b1e-9a3b-5cd87b3fb4bd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061307, "uuid": "a82e75a8-32a0-44ee-8674-16dbea11fee7", "value": "Axis Max Insurance.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf7b3327-4980-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778095301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778095301, "uuid": "8da6df2c-90da-42cd-a4e3-b2af216baa9d", "comment": "Malware payload (Mirai)", "value": "eb698332bde58c945b96e4203eb0aa09", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778095301, "uuid": "7873ad9b-2a2a-42ff-878b-be7384a2a002", "comment": "Malware payload (Mirai)", "value": "3dbebdee7dd7ad222ca0b61889ccbee7e5ad735bc1ecd748ae950ddbe93d6955", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778095301, "uuid": "820ef439-aa68-4fde-83e5-10e52690f57a", "comment": "Malware payload (Mirai)", "value": "b08d185032f5dc22f4ed34dcc2a94ad1f9864b31", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778095301, "uuid": "ee2bd9a1-3c77-458a-a7cf-093c91943554", "comment": "Malware payload (Mirai)", "value": "e7fbf365b4c4233535a5127f486c3bb356871c1601704c11019495a37fe32635cde8894836e8deb8d95729a085a3edf4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778095301, "uuid": "fc536969-f658-4564-ae58-dd60b23d8377", "value": "T1EB242946B8819F15C5C016BEFE1D118E332717BCE2DE72129D246F657B8A86F0E3BA05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778095301, "uuid": "30a85fa8-d203-4dbd-9dc2-bc5f901909bd", "value": "3072:g9/bDxagOBEgMERAs+cLoiunjURfOvPXOSp7q9aF5e1VebNv6TOouQZv08:g9jtaDxMsoLjmGPXX7+aqEv6tuQN7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778095301, "uuid": "883e4f6c-f207-4d6f-9183-8d5ba3d091a8", "value": 212572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778095301, "uuid": "1c9b2637-37fd-4d3e-886b-8f7d107896f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778095301, "uuid": "d9d12f8c-ec84-4410-bf48-d7c0aac08a19", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6abb9b29-498d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778100715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100715, "uuid": "47cb7d88-0d25-4af5-84c4-0ed49688c97b", "comment": "Malware payload (Mirai)", "value": "9cb5512b9e480678f9e26d20bc74d03a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100715, "uuid": "dba564bb-05cd-4f95-9a53-95196285ec5c", "comment": "Malware payload (Mirai)", "value": "3e333b9c2a318fbc35b7ad3cbf66791b8dd5441b1ca8fa27ef528ee47d704389", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100715, "uuid": "0ec424b9-fe0d-4b20-99b0-e851387a5c18", "comment": "Malware payload (Mirai)", "value": "18d767d093ba694db66a44499a989c7ddff21e30", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100715, "uuid": "5a60dfcb-b376-468c-a7e2-80fa776295cd", "comment": "Malware payload (Mirai)", "value": "e71d9494b4aeb751ea3b5412fff42e563b5ce68bb0585ccf0cee83e0d78f495d8cd4caffc49621abce564f9ee92629be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100715, "uuid": "045c5386-9dde-4b78-9171-6ca5b0d70376", "value": "T1C2F34B46E6818A13C0D61B79BADF424533339B64E3EB33069918AFF43F867AD0E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100715, "uuid": "3ca614e2-a22b-4936-930b-dac25d954e45", "value": "3072:Gr1LvE1RcvS5bb8pgz7EaxODSSevFuLM/9fzNGZLMm1w80WiSh:Gr1L8ncvS5bgp67Ea6SSevF6M/9fRG1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778100715, "uuid": "1f174568-bdf9-429f-b033-72446449c3e1", "value": 168052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778100715, "uuid": "e3851b4e-f166-4c1b-b363-6901320f14d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100715, "uuid": "bdecbe0f-d18f-4743-99ef-f7ea60d75a08", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "082651c3-48e3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778027535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778027535, "uuid": "65054388-cbed-42b8-ad45-b433577bbc80", "comment": "Malware payload", "value": "c551caa80e3a1fe048216305e9bad080", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778027535, "uuid": "f3e3b5c5-bf60-4b3a-9546-c0c02f369ee2", "comment": "Malware payload", "value": "4016f49e7e89e13ecf0e78a880871e67bf57ef84564bd5a73fae20c3db323201", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778027535, "uuid": "825b9ce6-24ca-468c-835a-082d9ae3f592", "comment": "Malware payload", "value": "dd22346054029231eee3dbebf2195d58245e31b0", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778027535, "uuid": "36cbed5b-7c64-4e4d-81b2-474b105024ab", "comment": "Malware payload", "value": "5b8512223fe0fb7a6e5e3431fd4baa12e7e20d2fa0335db64604a603c7da0bcc6881bd62898088dddb335edf35f483ee", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778027535, "uuid": "58b62098-b23d-4a72-9dea-f56706b307d8", "value": "T162D388585D6F71B846663C29A93B1D0EEEB4870A0947CB91F72DFA702F0077380E66E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778027535, "uuid": "a1757ae9-9404-4250-bc75-4723d829fc01", "value": "1536:R1pppYog3nDw8cUyzoic6MwAPRHDG2s0yr/i2ZofIJwvY81MILxQpN:XpppoqGo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778027535, "uuid": "0f620054-a39c-4a73-92a7-3669de2cb7f8", "value": 137352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778027535, "uuid": "256b4213-4b95-4170-8181-0540db93c8f5", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778027535, "uuid": "b98e7a25-571c-4216-85bb-1329ba940369", "value": "Edge_Data_Moscow_3096.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4346efcd-498d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778100649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100649, "uuid": "d1b5c57c-da64-4a11-9cb3-aa37973ca122", "comment": "Malware payload (Mirai)", "value": "44bd4404ed0e74bbb5762a31cd57f0d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100649, "uuid": "cb4d7633-4fab-4314-8f88-4a100cc3501d", "comment": "Malware payload (Mirai)", "value": "44ba406efad617eea38dda120eced0a992515bcbd0b86027d5404c7f8ca44479", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100649, "uuid": "ed429279-d3a9-49f3-a67a-618907aac6e1", "comment": "Malware payload (Mirai)", "value": "11c146bba17391f007011263519f248650fcaf1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100649, "uuid": "bca70597-4c22-4c78-88c8-c10cf2551f26", "comment": "Malware payload (Mirai)", "value": "1dcaea5dda777272d2819576b7125b752bc973c6e549d2c505e22d363028ccfe57119fdf59510d36324c06505cecfdde", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100649, "uuid": "c8d43255-416b-49ea-a12a-c4929fe0415d", "value": "T1DA134B1355BD6607C0F8A67D02B39717B2DA765C90949B1FBE3A0ECBBA413901F2A670", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100649, "uuid": "fcff6185-7a7c-4227-a53d-395b51b33c5f", "value": "768:ImiujdRTLGkD1Sxu1qU8eCx9xwGW+R2/kPTnbz4zTlG986jOMGj4QLA1YPZJ:ImiujdAkpSw1qReCJXrR6kPTbz4zvXAI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778100649, "uuid": "27905f7c-3a8f-4882-9008-23b36f4e79d5", "value": 42876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778100649, "uuid": "1c23a24d-99c7-4aad-a4a8-767831a88050", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100649, "uuid": "1d31312a-bc60-490a-be11-accc84113992", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ffcd995-4928-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778057291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057291, "uuid": "c85e8c76-2349-4420-94be-9f3241d5e0d0", "comment": "Malware payload", "value": "1b5b7153ab32ed2a7ff6ac72b39a35a3", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057291, "uuid": "feafc5a7-077e-4491-a254-d7e2bcecdaf3", "comment": "Malware payload", "value": "465d2c04239f22d4e22365c0772435ed2b0f959b7886310068096c4c0db4014d", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057291, "uuid": "d7c16dd2-f62e-49a6-9cd2-ce4fb67735d2", "comment": "Malware payload", "value": "70b11a060bed0104cee086d4bdf4cdcf458edc9d", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057291, "uuid": "2589bbc2-bb09-4480-9286-a8f4a8d5c261", "comment": "Malware payload", "value": "79c0cfd7812bc0df3831d950534991495972c0e6effda4d8e5eccb270652b3d6d947416112978d2d1ec0e075ddec262a", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057291, "uuid": "e2d47cc3-279f-4799-b3a1-406ed1cc2a81", "value": "T144E6332AFDDA9A06D0F7833A8633C26674B9CD210F0387476548BB3D743B5E44B9A5C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057291, "uuid": "457ab5ea-03a1-45f9-b39e-1d7db9a38a42", "value": "393216:tZ5hPCAEHFrlDp7ugUGHWbumSTDUGjdqKe83:tZ7PNs77ugXPjpjje83", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778057291, "uuid": "d0ccc51f-6c19-4df7-a985-9991968f0f6e", "value": 13940363, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778057291, "uuid": "8008f076-9fb9-40e3-b728-f6e50e07a06e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057291, "uuid": "47adfe61-56e5-42c8-bd6c-b8ea1569ca8d", "value": "iMobile lite (5).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a1eb8f8-4966-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778083910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083910, "uuid": "5a5541fa-02ab-4432-9870-f2cd395779bd", "comment": "Malware payload", "value": "d06e782fca891e38daccb0d8312d7e70", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083910, "uuid": "04cae60e-5259-4ac8-9a83-4b134116fef9", "comment": "Malware payload", "value": "476b1882f5d8371b15289c83fb2522469e096f6045da9d02ef1e89ba2793efc6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083910, "uuid": "68099c91-9c98-488e-8f82-b561c6a65339", "comment": "Malware payload", "value": "83c8b33114db007bb828a1b28fb38b6e7b2c02b9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083910, "uuid": "a08a9d99-b590-4970-b8f0-1b620560b13e", "comment": "Malware payload", "value": "b6e3980793596eadd4a3d64419d0be504f9fa87499c34defbe0b8c89e37652db68ad5bffdc0c22ea7ccac678d888c455", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778083910, "uuid": "5bbfc388-01f2-48b7-8f44-8c5d0edbce41", "value": "T17351FAA8C7422532FF67182FFAA1685847C6AC03EB51154D5EFF5CCE01E0A06A67DB16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778083910, "uuid": "99d392dc-7a47-46f0-96fb-fa130e0577d5", "value": "48:B+jnat9/xU1948pcm3jnFYOve4UuHCC9eEVQsMosBAd4H:BkatIUi3jnF7veaeWQszsm4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778083910, "uuid": "35474bdb-2e26-4f19-a1a1-f83c85992e51", "value": 2504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778083910, "uuid": "dc18a43a-bdb8-4145-a125-9912e3879d12", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778083910, "uuid": "16426d77-4b9a-43a0-899f-82bc3f2b335a", "value": "164.90.195.107_1778083898595117_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ddf5301-4966-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1778083970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083970, "uuid": "cd2ae652-b266-4ac2-9083-899467d39359", "comment": "Malware payload (PhantomStealer)", "value": "4663891d7c34754defbcae81a59d1ff7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083970, "uuid": "a7949aea-d5dd-47a6-81d2-c58ec84318b4", "comment": "Malware payload (PhantomStealer)", "value": "4a51da6e05515cf21c2a42055be24c1e21c1ebad3c19964abc769fc03faf974f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083970, "uuid": "da11c252-630f-451f-91c2-634ee226a230", "comment": "Malware payload (PhantomStealer)", "value": "559e3b16dfdd831ce7ed9db25bd2c3c0c21ebb3d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083970, "uuid": "ab6c4941-9bdf-426a-9aa0-f9b37190214f", "comment": "Malware payload (PhantomStealer)", "value": "c07e4567a2cc127ac68110efb4024e468a08456948a7a1adcb6020fa1565577d119f7379fc9213e99a6c19bd0584048d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778083970, "uuid": "861bc672-21d3-4bf0-830e-c1495a0a7b3e", "value": "T145A5BDA7A867A0E0569E33DA570234C23D97E44736E6078D4B58C39C92AF4FBB5CD138", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778083970, "uuid": "d4d443c2-463f-4035-8fd9-8dc5a52480a0", "value": "96:u4j1rAibzrEZrjepa6lDNFtMnlrTrrL9QrafrM/NEGlsJViZfD/2arN+omRZSNrm:u4jPfbon", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778083970, "uuid": "449e6b06-abf6-4e62-995d-c881c9eed57d", "value": 2154431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778083970, "uuid": "5fb54d7e-246c-4395-a3c3-d10fc2aaec7b", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778083970, "uuid": "282b70cb-bed0-4e5b-9292-d8492a16364e", "value": "next.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d5857f7-498a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778099431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778099431, "uuid": "924eba30-5a2e-450f-8701-c102ff2b145b", "comment": "Malware payload", "value": "63ef237e74763a3672adf9f6bcfffa96", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778099431, "uuid": "9f995037-f868-467f-8b71-29f68bf3ba46", "comment": "Malware payload", "value": "4ae892962693de655a638f3dac07327b88d1a4b19f6e5141fe893d3ed34920d2", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778099431, "uuid": "a1a849a8-1a21-40a9-a6c0-b0abb3a15a24", "comment": "Malware payload", "value": "376a78b84983c5cb6396fc8304ade093c312d4a5", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778099431, "uuid": "440bc816-04cc-4b6c-9404-b2af217b6798", "comment": "Malware payload", "value": "5a3569358765b6358d0d1fa90b9bca1a95ac410b26ef52d76d7d951d75e4d03b07735c8106267cac3df8d09741da64e5", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778099431, "uuid": "1c91e721-5cdb-437b-b5af-8a1bd1d78a03", "value": "T185564C037CA150B8C8D6F530C8B792A5B765B49C973837D32A02AEF11F363C46A767A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778099431, "uuid": "bfcad01a-9a23-45e4-987f-5ec4122284d5", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778099431, "uuid": "490b0fc5-c463-47fd-b582-1e1c7fc165ad", "value": "24576:ixVJAZwuo5qnAoIDcGoMHjDDydVT/cN0ha445uuHR5M9JRueJnIjzgXrTRK1gS:eVJAZwPdrHYVtGQXegXrTRK1gS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778099431, "uuid": "52d4fe21-3cb3-4560-8d04-e49f9f939e13", "value": 6299776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778099431, "uuid": "062cbf9e-b649-41a6-a93f-d48ca7e67435", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778099431, "uuid": "231f15ac-d337-4afd-a9b2-dba5c10bb8e8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78474441-4928-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778057359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057359, "uuid": "e7acc8f2-eea8-4610-aa79-c22f6aaaba88", "comment": "Malware payload", "value": "276807d2ae9846e839404f620767e54c", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057359, "uuid": "a11ccd5f-bf2c-43aa-9a3f-1b20ae91384f", "comment": "Malware payload", "value": "4baf383c052bd4450b839db26b9decc8d5bf5148d7a74f1dc558a30a6d4a67be", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057359, "uuid": "ad982669-deb6-419f-86ca-a7216ae23fe6", "comment": "Malware payload", "value": "52867e5cac3aee74dc57d94f0700bb38d2955ca6", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057359, "uuid": "53bd7c86-fe78-4570-b16a-f22910ed2098", "comment": "Malware payload", "value": "06682f663b86d52173c91a1f3e84555e5294b304cedb3601c3135ee0e3a43d1b9db94bfef69db98705287f93ac515eeb", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057359, "uuid": "a2b57305-4fc5-43de-bf10-08f64e703fb8", "value": "T1E5C63316FEC69A11C0F3C33B9632566630BEDD696F0387476804B73E647B2E0435A6DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057359, "uuid": "7585e961-3fac-424b-8040-18e1c476af35", "value": "196608:vaVA4Zu+JXTDxIzM1Db3KzFkQOvuGHIhn1USRsLoq:CdrlNb6zJcuGHgn1R8oq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778057359, "uuid": "384a48b6-48ac-4255-b2f6-e664779aa9d0", "value": 12310155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778057359, "uuid": "83fd1cdd-897f-4313-9957-f1b6cad74424", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057359, "uuid": "34c598bc-f9bf-4f1d-a755-6db0f4c4531e", "value": "i Mobile Lite.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bd4eea7-4988-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778098596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778098596, "uuid": "a70cff7a-b877-4bbd-bfbd-936e0c187398", "comment": "Malware payload (Mirai)", "value": "688e46a163f4ac09636429fbb4c92632", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778098596, "uuid": "f27fae4b-c611-498f-a681-47d782f98a8f", "comment": "Malware payload (Mirai)", "value": "4bb74bb4f68b11769db7b4e806176d54236f891e000600fcf4221bd511dc2a9a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778098596, "uuid": "d0e500b7-e1b3-4289-a9fd-88dbb2e01995", "comment": "Malware payload (Mirai)", "value": "0586da0f4fc93a8c4c141bc40d657fbe6fec5337", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778098596, "uuid": "bf34b121-2bb6-4e2f-b77b-ee1cb1ddff98", "comment": "Malware payload (Mirai)", "value": "73d206185880583fb6ed5ee7705a8bf23dc28d98e308ccf41e4359fd4a084e1e260c357285de69aad0533ba73e1ec452", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778098596, "uuid": "19225b5b-b209-43d0-b3a3-f782c349d2c7", "value": "T1D3C35B82E6A2D0F1E68701B00557F3E68935EA305416CEC6EFA93D71EC717829D9BB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778098596, "uuid": "6e9dbcf1-7975-45d1-8b20-a0cc190c0d70", "value": "3072:3atpsoRNjmj1VGCr75MoS9SrPwVrx5tiy8w:VoRNjmj1VGFVrRiy7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778098596, "uuid": "e93d5a17-ca0e-4661-b519-3aed205a83e6", "value": 123472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778098596, "uuid": "3a7556d7-2683-4c03-aad2-133bf3ac0100", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778098596, "uuid": "6f568979-f315-4e05-ba49-94632d7dca29", "value": "eead126f579323883adaee039a9c46ebc855dbd21d399c35ef746266bfecffd8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8055bf6e-498d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778100751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100751, "uuid": "2d0f0181-56c5-476a-8128-0d2ea6ed753f", "comment": "Malware payload (Mirai)", "value": "ce0d87fd4cd3d2c989e01e6846a6995f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100751, "uuid": "5a6775fa-80d0-4135-b60c-ef7e4ef16e44", "comment": "Malware payload (Mirai)", "value": "4bdec1e496572671e6d69d93c6be03e4b98c65c16ef26c015df961c3ae97c11d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100751, "uuid": "8a2cb0cd-c208-427b-8b95-9868fa989d62", "comment": "Malware payload (Mirai)", "value": "8df60a55247b099b7d9e5744b1ed0fbeb6594a24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100751, "uuid": "29abfff0-c21a-4d11-ac25-974f0b8caf34", "comment": "Malware payload (Mirai)", "value": "4b79296f1b90b633d67f702df75e3853d2b928a72fdfa524b57edce933f6f1dc5d207bea0866eb49724f328fa7097cb7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100751, "uuid": "6fcd9a27-0005-4e36-88b1-d5e82bfa524b", "value": "T17604A75E2F224F7EFAB8863447B38E20975923D627D1D684D2ACD2111F2025E651FBF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100751, "uuid": "89dffaaf-b305-4919-9f8b-e43b9cd581eb", "value": "3072:0ClNwNbGoOcJ1hWlFv1anh+mtu8H7lZPZ9c6P91lcvB:pK1hWlFv1anh+ePP4s93wB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778100751, "uuid": "e302edd0-36f3-4d4c-9638-9e1305bc2325", "value": 184148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778100751, "uuid": "ccbec7b4-a919-48dd-81a2-2f15da7fb788", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100751, "uuid": "0f2605d9-9ce0-45ee-986c-84a839c3652c", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d6b9779-4919-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1778050871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778050871, "uuid": "c1589ec2-1cf8-47a1-8509-b32da43ddd6e", "comment": "Malware payload (AgentTesla)", "value": "df30f659d28cc34ba7b41cbad430ae1f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778050871, "uuid": "d3f8a541-7b77-4c92-aee0-13b585009496", "comment": "Malware payload (AgentTesla)", "value": "4d7e7e33d21e8fce44f975e4085ad999ca2337dbb39c003160f3aaebb298cba2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778050871, "uuid": "a6a5de1f-e844-4ad5-b2d5-c45250944327", "comment": "Malware payload (AgentTesla)", "value": "181b1c0a77f7ade56e84c62561eb3c9a5dd60cfa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778050871, "uuid": "63853990-0df0-4789-8ae4-6f0452387bc9", "comment": "Malware payload (AgentTesla)", "value": "e06a3a93363cfe8a98894f47db9a578f760faf609749ee3053b53144cd14197f509e34905820dc9e5d56c5a95f7804b8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778050871, "uuid": "53417ee7-3be9-43dd-bdef-baeceeb90e05", "value": "T19CF54B8666E7A2237360EFD9473DDDB1D80E95031849CF14B18EE73C381CE4A6266B67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778050871, "uuid": "c989fff6-a701-4d09-8420-59d33c423889", "value": "98304:xUxGvQsVDB0npQINXZy7kitA+pVQX3mPYDcNt7KFFjHV5F6PokX4K2rIbnoOMUJI:IGIsVSpLNXZy7kitA+pVQX2PYDcNt7KV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778050871, "uuid": "2556edc7-c0a8-4199-89b8-15577b27f76f", "value": 3380850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778050871, "uuid": "6ab5362c-3f0b-465c-aeb8-c81f5cd782ff", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778050871, "uuid": "b2c864d6-53bb-400f-8cdf-7bfd52deb5b1", "value": "RFQ 206.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48fa2a45-4966-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778083908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083908, "uuid": "0405f6fa-ad86-41a4-98e0-2e0817baf45e", "comment": "Malware payload", "value": "b9b9bbed9a8b31588ccae1e2431db71a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083908, "uuid": "59818c3f-0c1e-40d6-acf9-44c610fc9995", "comment": "Malware payload", "value": "4e7b159b873a86940bdfb4968a7894b9e79d0a30d74109e848b8263ac8607e93", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083908, "uuid": "e9e24003-e814-47ba-a7b0-ab862e0eba09", "comment": "Malware payload", "value": "143bcd1ed17b6f6b0d0e8f47d16aa2855ec3f4d9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083908, "uuid": "1a8eb929-9285-4867-82d8-256e43e66b93", "comment": "Malware payload", "value": "ea5bd1a1c33116cbb161917ff4979ba1c51970a137a1e8282dd26ddc9ef36b254d00641344f66d7d166e547ed74d0a58", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778083908, "uuid": "d1c51eb3-a4fc-4edb-b0c7-f5b30991b3ce", "value": "T114510CA8C7421532FF67182FFAA1685847C6AC03EB51154D5EFF5CCE01E0A06A67DF16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778083908, "uuid": "87b8c14d-f1b7-4671-a105-7b534ddf5828", "value": "48:2+jnat9/xU1948pcm3jnFYOve4UuHCC9eEVQsMosBAd4H:2katIUi3jnF7veaeWQszsm4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778083908, "uuid": "618182c9-5ec1-43f2-912c-af6dce484ed3", "value": 2501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778083908, "uuid": "bd45ae31-af17-4727-8afd-f0ba40b75cb7", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778083908, "uuid": "158bddfd-905d-4788-bd5b-87812a774dd4", "value": "164.90.195.107_1778083897751850_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d08bb8b6-4925-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778056218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778056218, "uuid": "7e1844a0-88c3-4425-88ea-94a6178cff01", "comment": "Malware payload", "value": "749e49197b4ceecb682ca414fb8e4590", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "SBI", "colour": "#FCA5CB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778056218, "uuid": "4cad3e79-999b-4f08-bed5-c3497aebd694", "comment": "Malware payload", "value": "4e93396db22b92f46009e49fb802d0cf05d264a64c8810a3a486bb4bc36d4b88", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "SBI", "colour": "#FCA5CB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778056218, "uuid": "c0527868-17b8-4685-9411-fcd1d7fe373e", "comment": "Malware payload", "value": "e4015fa5c5a5b97a9a2123fb7f7d04a1a99fe383", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "SBI", "colour": "#FCA5CB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778056218, "uuid": "354b4ad6-df74-4747-a417-bbf66cef0e46", "comment": "Malware payload", "value": "57c36d22ed4f36c5bcc201b8ef7a8338bf18cdac87b97557fce7d39c0093e34607fe9a0c160102b6ad4eccd78d3ec05b", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "SBI", "colour": "#FCA5CB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778056218, "uuid": "b571c263-0b60-4e4f-8a13-b2a02912df2f", "value": "T15DC6332AFAC92A91C9F78336CA31957260BADC259F0397076604773E307B5E107E76C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778056218, "uuid": "fce0280a-0a4a-4f6b-97a0-015f03133df1", "value": "196608:1xQ/lCl1lkVitId/rv76w9NF6ykUSqJnpHxxJRn5QiGTKbO7l+vjz24XAAp9sm9X:1klCjlkV8U/6wD6yDtJppS5+v1AA9N9X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778056218, "uuid": "5f3d7e60-a9e0-4293-a4ad-f88616ac0a14", "value": 12146308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778056218, "uuid": "af6e2c14-0f0b-46b0-ac46-594b8083a5c6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778056218, "uuid": "bcb7ee6b-5132-430f-a0ad-040b9aaf295b", "value": "SBI Credit Card(1).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76902302-498d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778100735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100735, "uuid": "d13a1024-9967-4a6e-a4f3-b64e790dbeee", "comment": "Malware payload (Mirai)", "value": "6ab11d0a75fb027bc75937446c0c1236", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100735, "uuid": "ec00ee79-3ec8-4128-9682-92a591b790ab", "comment": "Malware payload (Mirai)", "value": "4e9c31f1e327fd4fe813cabe498b61aeb8d24477ce236808a73a30457c625d5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100735, "uuid": "25bd4fb8-4349-4978-8c4b-8d1889e92eb6", "comment": "Malware payload (Mirai)", "value": "3cdf95b07242edce2fc0ef5e20d1d00634792c1d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100735, "uuid": "e4f011f9-d233-4080-b773-12e0ae21fde0", "comment": "Malware payload (Mirai)", "value": "0f0d1a8a018b576dabce4fa4c9619be62a839b0acf475d750b4b23c52a9e7d522a1e2e42858eb694181acbc637ddbb27", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100735, "uuid": "78ea413a-eb0f-412d-9a4b-c5894958152a", "value": "T13CD32B86F9519E23CAC653B7FB5D428D37262768D2EE32038D256F64378B85B093B141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100735, "uuid": "f06288e0-fb32-4fa5-9a07-1c772dd4aeb0", "value": "1536:xPlSFSUEjoDUdk8wuwQtpSjCV2eIf4VwKh+T87JHo4iAls4wywien62Hrcr05YQi:xPwpDF8wuwOECV84z0av0HHrcUoS7e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778100735, "uuid": "edbdfd3f-1fad-48ee-8b46-cc97b57c5515", "value": 137920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778100735, "uuid": "a0179d9a-a5d8-4361-a902-b97dc5f83cbc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100735, "uuid": "924badf8-f5bd-494d-ad06-1e92f4b2a77f", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87f67a3d-4928-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778057385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057385, "uuid": "f8966481-2119-44d6-a8d2-73ff2e587ddb", "comment": "Malware payload", "value": "fc90aa288e33f5694bd3dc06b5e6bd25", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057385, "uuid": "f2b7e2c1-8e71-4501-b75c-d374fe694689", "comment": "Malware payload", "value": "4eb082f397589b0b3fda786028b8ec18d0171a4629e219d8bc57e195408f811d", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057385, "uuid": "88d5928a-6922-4b82-bd2f-48c46355105f", "comment": "Malware payload", "value": "826989c27b6f92919230007f5ab9e6f59a48240e", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057385, "uuid": "d68d7869-fe10-44ea-a851-894dfe55b39b", "comment": "Malware payload", "value": "de7d342bc0a440c9f923519a7ac06653b3dc68e33128fce015b4eabff3a5574fead8497c9cf479a73026df691cf495b3", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057385, "uuid": "eef5b460-24ec-436b-9151-e6fb337e6dc8", "value": "T138F6124BEE58CC6AE8F66336FD32032334225D684343C57FA5A9BA3D3E735C24A91591", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057385, "uuid": "d8dd06b5-2438-43ab-adec-a41296ba3620", "value": "393216:WwaWxiX8vUU0noy8iUtg3Sf0kJHBgmJ0PrQRQo6bux:kWxtsF0gCtdBgsSlo6b2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778057385, "uuid": "d231f05e-d998-48ca-aeea-ee1adf369f69", "value": 16405298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778057385, "uuid": "381ff8f0-29cc-4da0-95bf-bb516a6565c2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057385, "uuid": "065773b8-4fbb-49b1-899a-38c7888dfbef", "value": "mParivahan (3).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44a57e69-498d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778100651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100651, "uuid": "2d809d2d-0892-42bc-81db-e852b34f9977", "comment": "Malware payload (Mirai)", "value": "cc1f6a587d6cf26ad622970165074eb3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100651, "uuid": "cb0e7f53-2133-4d92-a8f9-347ca1e6e486", "comment": "Malware payload (Mirai)", "value": "4f89f1da5096c9bbc9b50e519586b1552c5b2614dbe4a35f29c59d968cc3a8fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100651, "uuid": "584fe652-d3d7-4ad8-b6c7-6ed1c9f9ce5b", "comment": "Malware payload (Mirai)", "value": "69dab5395bfcd09a1a85e2add56902de29f4eada", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100651, "uuid": "2dcf7a6f-7563-4bc7-aafb-0d47bbd7e0fa", "comment": "Malware payload (Mirai)", "value": "3452f2d25d43e82199aa528c514dabc80b783f6ff66a78081c1fa19c4d69fec4dae3c23d90119935398999e292c51f10", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100651, "uuid": "0f252c14-6f7a-4cf2-b813-0736916280ae", "value": "T158B3AEAFF34B1491D82187F027C39BED3E6322119E6BD9E77C0E263A19751DB490A391", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100651, "uuid": "22311829-382c-45bd-b8e7-887ae3996365", "value": "1536:4xT+VT0Q2YaWYT/wfqi93CpWLeAGBPVw3g2/LWc:KAsYaNzUqiCpNAGB23g2q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778100651, "uuid": "20f9eb0d-70fa-4d0d-8dea-82a9fa2fd5e6", "value": 116032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778100651, "uuid": "c5851339-482b-42ae-9896-2d95cd76b6f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100651, "uuid": "e2db9821-589a-4a63-86f5-1d3a08bf9da0", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47592278-498d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778100656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100656, "uuid": "ade71074-8761-499b-b1b8-522c190e2ebd", "comment": "Malware payload (Mirai)", "value": "89a6345b91ed9a218fb80369d667106c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100656, "uuid": "b785c798-6a1a-412c-a44c-6253b0b77aae", "comment": "Malware payload (Mirai)", "value": "4faf29c70c8d78179628fcc5e397991454be2eba594838984bdf90f8b15d73e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100656, "uuid": "2401bad5-2bb9-484a-9577-7893c29b0785", "comment": "Malware payload (Mirai)", "value": "ffa9977b199c7f83118638311b134ed01db48fb8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100656, "uuid": "9db4a55e-6c8c-43d9-8e72-38f52b5bda9f", "comment": "Malware payload (Mirai)", "value": "724849cdb882e0889f3a2bc6f300c93e755b5ff83adf78f57605009097b873f95884bdaa84360ec0201bd65efdf3e4bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100656, "uuid": "b41d38da-eca1-429c-8d57-d5ccc402d6f6", "value": "T16682E0751FC1AC5AC27068326AECC3C7A6634B79D6EEF1B724005BA47AD171706BD302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100656, "uuid": "a0cc816f-8731-4fd4-ba77-ecb429ae56d2", "value": "384:UXD68MljUNW3MEClkPYQNwgmL7vQv/VRx0aoLlCzJsLhymdGUop5h2RA:MzM+Wal0YQNTmL7vyVv7UeKs3UozQRA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778100656, "uuid": "8e643c9f-f294-4142-aabc-5add3b5df47f", "value": 19072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778100656, "uuid": "5a58bb5e-49cc-47b8-829d-9e8313026756", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100656, "uuid": "d7b68c09-e734-4a9a-be03-a3525560cbe6", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9f809fc-4915-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778049416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778049416, "uuid": "b960224f-5caf-48d4-b241-43f0a2ff01b3", "comment": "Malware payload", "value": "b4b1e3b528dd7a7b71dd11f6a4465223", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778049416, "uuid": "b1b07d1f-b6da-4bb8-8d55-914eee9657e0", "comment": "Malware payload", "value": "51638562e488610a1a1357a5edb7f3a510a491d9a3b885d02b8be2206455f230", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778049416, "uuid": "741c0c57-826c-4af3-83dd-a68b179892cc", "comment": "Malware payload", "value": "35691498bd12e368845d323893e6ce70ef5c527e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778049416, "uuid": "bf066e76-bcf6-43a6-b572-8a9c562a68f9", "comment": "Malware payload", "value": "cef471e956f8597a7c831eae62241295f681545c650bae8f2d21a57d6e53b6401ba7280b6190dc124108170c08025d4b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778049416, "uuid": "3f736c29-2fad-4b0b-9de8-3f563627edec", "value": "T10E136D6526953C25AE99883B5C7F2F0CB9A983E2304491DDBFCA3CF18C1569CE318B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778049416, "uuid": "3ab5f9b8-40e3-4393-a29a-8bc8d4e3c47d", "value": "768:bZs9NyXsZztCS/9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bOHusZ8co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778049416, "uuid": "6222b447-f18d-4828-97fd-98d77f4a5dd0", "value": 45444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778049416, "uuid": "ce666c7c-d974-42bc-a28d-034acfeb0a63", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778049416, "uuid": "56a5981f-9ce6-456c-b3a2-2a584c4fd4ed", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03210fc4-494d-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1778073053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778073053, "uuid": "22d9946b-5ea3-4df7-bf4c-76dcde6ae1c6", "comment": "Malware payload (XWorm)", "value": "c46e874a115cc2f21521e10cc26e90a0", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778073053, "uuid": "835fb633-4b6c-4520-88f5-1b27a0698566", "comment": "Malware payload (XWorm)", "value": "5387372b2ac54854b8e99201675221e3e477a924bc767b9cb247fb516c9ef4dc", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778073053, "uuid": "4431e810-c5ba-4527-bd3c-0f96163ebccc", "comment": "Malware payload (XWorm)", "value": "2010ccea433f4143f30dba9e0f390b0191d6fb9b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778073053, "uuid": "76bcb778-eed7-4f05-81ba-7a2d3065ea46", "comment": "Malware payload (XWorm)", "value": "c07c5aaefaa3b2a186f91d08cf2d1a170d6665afaba37b857b786f7e4d160339ef30c20984dc5a69d655b01d35755490", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778073053, "uuid": "7e94d54f-80cc-49cd-a9fc-818216f1f9cc", "value": "T1E0D37D5773B530F8E1BBC279C8911941E77678361B60AB9F03A046562F236E08D3EB32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778073053, "uuid": "db078898-60f0-4b94-855a-a1ee9fe2b8f8", "value": "5d483c8313210cd3feefe35fc27f2288", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778073053, "uuid": "5d04c3c3-7d28-4098-befb-420b3952e4a4", "value": "3072:MYqX4XRVmWbI+hz2i1rrf+eZ1Tz0AY/hfm:VW4B8W8+ki5b+0G9Fm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778073053, "uuid": "f21bc295-6c60-4b07-8bdf-69e65b644e79", "value": 138240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778073053, "uuid": "8e9a8a0f-fb35-4638-b383-e41744427439", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778073053, "uuid": "84100c9d-f2b8-4616-a05e-9f8f95aac6d0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ab6ae12-498d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778100661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100661, "uuid": "b49df2a1-af67-42c3-b96c-f01da0988304", "comment": "Malware payload (Mirai)", "value": "ee94a12b8427343767a9bdfda481b171", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100661, "uuid": "1043d24f-e985-4ba0-825a-9a4c73cf7b13", "comment": "Malware payload (Mirai)", "value": "5418a73272c58a6c0a8cc3e23085f95e3c569c65a7f05a30cb990263f81ef02f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100661, "uuid": "fcfb7794-306f-49c4-b4a6-125dac501741", "comment": "Malware payload (Mirai)", "value": "04341467e3bddfb944f9146e6a4a54a8762b0ae5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100661, "uuid": "34fe74a0-8e4f-4d59-b5f9-dc017c97f673", "comment": "Malware payload (Mirai)", "value": "bfd1ad25e44d241468ad2d4b23d7ec2cb11151d188e5e033c3a5b226dc362aeb9d8d39eb7e51bee21c7735f18554a4c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100661, "uuid": "33c3c72c-536d-488c-814f-e64bec38b729", "value": "T13B13F1C3F9F85672D276B2334EFCF606A420B368B108921967D6606F5CFAA057F2C415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100661, "uuid": "21ebdfaa-74de-41e8-ac3e-758051d13f40", "value": "768:j7wpHaIvhTHJCh+ysCSwGWMOEmLDjS2tXo6bs+c9HmZzeDJVut/wnbcuyD7UHQRw:/wHJTpEDsClJESPFtYks+cAzQKNwnoul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778100661, "uuid": "39192879-2b82-4083-8c23-f3f234c2b6c0", "value": 41780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778100661, "uuid": "04bc656a-fb4a-473f-9998-bb7098b2dcac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100661, "uuid": "7a773d9c-d8e3-4e4b-8113-51cbe8d50137", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe1e5ea5-492f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778060590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060590, "uuid": "15f59fc4-49ab-4bf3-8dfa-95ee2407c476", "comment": "Malware payload", "value": "9adeb0d560123f1ac3cb9c5b1b3187c5", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "DMart", "colour": "#13BB90", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060590, "uuid": "a816857a-49ba-448d-ab88-92a93816ffff", "comment": "Malware payload", "value": "56d29b362a976b3402afc3fa602ca0152bdf1504f1a2a1745238df1fe761898e", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "DMart", "colour": "#13BB90", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060590, "uuid": "f3c46767-fabb-4319-b00a-e19ef1224992", "comment": "Malware payload", "value": "a41d1995cedcfd62cd41e569255e595f80c2c455", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "DMart", "colour": "#13BB90", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060590, "uuid": "2118f0ea-8cba-4a6b-a0b1-dd3301443f5d", "comment": "Malware payload", "value": "edb92a08d434c3432930849266a278378dda16bc68191ba56eb3e12d796a89b647086875e1607e3112d728bde7afe6fc", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "DMart", "colour": "#13BB90", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778060590, "uuid": "bc18d6db-edf9-4ae7-9553-093a87f9bfff", "value": "T161E6122AF74A6CAFD9F7E3346D3A17A610256C258F03E18B7864B73C29F35C55A4A1C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778060590, "uuid": "a921b88a-ff7f-445d-9532-f40bc80acfa1", "value": "393216:TknkBg78yko0Ejpm//xEDdpJCBZmBAncBeGV7deF:TS78rsj0EDEZ6QGVM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778060590, "uuid": "ee64bee6-331f-4f15-98ec-df9e5fa7d684", "value": 15181411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778060590, "uuid": "3feaa426-b1bf-40c7-98e1-5b052eeedd51", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778060590, "uuid": "7df38ce1-f11e-4e11-bace-27654519b0dd", "value": "dmart (8).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25ce1916-4941-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778067958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778067958, "uuid": "39f81538-e369-4939-9985-651f8fe3c77a", "comment": "Malware payload", "value": "25191376b6f13e4a321c1dc19d7787fe", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778067958, "uuid": "4a7047ba-42d5-4da1-b26a-acc2434ba567", "comment": "Malware payload", "value": "59929c698179cf62b3060402b9e4c0b198786940836652fdc6d3f708b7d9e4b2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778067958, "uuid": "7b98a35a-3eed-4833-b716-ad42b788f998", "comment": "Malware payload", "value": "89b1a9176696c1ac8e5c06ba12224fc166ba02d5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778067958, "uuid": "f630c38b-3cbb-4c0b-a390-7d4d8a0ae19a", "comment": "Malware payload", "value": "dfe00bb79a3071dbebae089503c7e646de2c832638ed26f5c1abf23b3366112a2091f1c8a302bd2d8141d2faa56af965", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778067958, "uuid": "6de9c776-c19e-4995-b030-3274bd4b6553", "value": "T1D7137D6956857C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C49A9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778067958, "uuid": "94e7b025-27b0-4ef9-898b-80ba56441d84", "value": "768:bH+r9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bH+cco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778067958, "uuid": "f9983c51-6570-4393-bbc5-daa9887e630b", "value": 45432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778067958, "uuid": "92bc0739-ab43-4270-bf4a-3c3792320ad4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778067958, "uuid": "372818ea-a416-4500-b655-0cf3d8c432a1", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11d876f3-4944-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778069213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778069213, "uuid": "620aaeb5-0509-4949-8db6-99eb845efb9e", "comment": "Malware payload (Formbook)", "value": "ea1ce78be418d61359bd694157ec2f42", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778069213, "uuid": "e311637a-9815-4a43-a048-dd7f8bfd200c", "comment": "Malware payload (Formbook)", "value": "5beb5f9f618d511c10eb05d96c59106e5b8f7af1157bea708a9d26c838839c93", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778069213, "uuid": "b016c7e5-a9aa-4e77-8571-49c0e9ae8d64", "comment": "Malware payload (Formbook)", "value": "3c13c83d80bce7a50e1df3a6d218f0b0e9386d2b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778069213, "uuid": "be13b748-5b1e-44e1-94f1-f0c054aa8868", "comment": "Malware payload (Formbook)", "value": "f0b0a0c56e5b7065a400f2a8c7d33771ecc2fb5805035887e7bce82abdb00e3878508c997bf73b25acb7459b9d3e8155", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778069213, "uuid": "93dd1d8e-f225-454f-803c-4cf786e4803a", "value": "T105E55B17D66F974E18093B51006A5D9AFE89CAFCEF72BBC4E0CF90B610EA1110B855B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778069213, "uuid": "aa7e4dc1-e473-4c11-8504-c65c0a3384ac", "value": "49152:WeUyZwmHhBe/uzJ1aGnuHA9ohbpZUABnEBX4V/uvc2qs7:7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778069213, "uuid": "7b741a7c-c98a-49aa-9b56-63f43d7f8f1a", "value": 3087446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778069213, "uuid": "b848f773-f943-49f3-8ca0-e89d89a76c13", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778069213, "uuid": "480ca7c9-b5ba-4b9b-a35a-14a70a7aab4d", "value": "Ust_Yaz\u0131 Yakias\u0131k Maliyet Fiyat istemi_ihtiyaclistesi_1062945_Teknik sartname.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24e84942-4933-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1778061943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061943, "uuid": "de8c2ca9-a0c7-4127-91be-1f80571990f4", "comment": "Malware payload (NanoCore)", "value": "d82c0b7f740b7b38375c6eebaa211f30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061943, "uuid": "9c235de8-2a9a-41d2-bfac-881323c01ee4", "comment": "Malware payload (NanoCore)", "value": "5e0e18a994c555b9d3f3cc2dda0a8241cff72556405e70d3fcd98acc36ce0b3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061943, "uuid": "992cdf9a-5407-48cd-9385-fc8d125f5e41", "comment": "Malware payload (NanoCore)", "value": "3464d4e6b8cf788a092f3057f4f886e9cf64d316", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061943, "uuid": "d22f0004-9427-4f67-aeeb-b6e02ee1d14d", "comment": "Malware payload (NanoCore)", "value": "71b6fb78815917ebda18c1d88671af913bf1d3027606a62ed333b7188f23717c81caf3f89e38f84b134c0bd6d69b573a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061943, "uuid": "cd9ad3be-b83a-4603-adff-83bc8e551446", "value": "T13A14C0163BA84A2FD2DE86B9711216178379C2E398C3F3DE28D451B39F667E50A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061943, "uuid": "52c6f5f9-e83c-47aa-8e4a-3a0633d7bb6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061943, "uuid": "d52a263a-dd5a-4ec2-a8c2-c2fefafc8777", "value": "3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIOPXzMrrC/Y6jmdzBb6KaGaOCG:MLV6Bta6dtJmakIM5PkC/nqzp6jGaON", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778061943, "uuid": "3522d728-2149-44b1-bda9-2ae25f832efe", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778061943, "uuid": "1024a8de-d98b-4fe0-93d9-1fa67ea388b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061943, "uuid": "60fe5e32-e3c1-443d-8974-946e59b29143", "value": "hotro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e498fa5-4991-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778102332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778102332, "uuid": "66528170-e0f9-4ee9-ba00-6dba086dcdae", "comment": "Malware payload (Mirai)", "value": "c17cc88e24a892e63e758917d3518d3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778102332, "uuid": "81b5b181-57bb-4b42-8992-9ae1d8cf849c", "comment": "Malware payload (Mirai)", "value": "5e22a5f4d5f24793a92b45598967b83d3bfe8c3cf8a53bbb6203ace43ddefde7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778102332, "uuid": "24d05c92-bf46-4205-a8bb-2ddb5e4a9688", "comment": "Malware payload (Mirai)", "value": "08247cebd707c825831bb67b019db13359ba167f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778102332, "uuid": "7a02e0e5-f13c-453c-9289-a13e57644a73", "comment": "Malware payload (Mirai)", "value": "b7b3b57ae199750ce5ca26f0a3f2d95dda970a4fbc519fe5a79e5d4c30a832327806de867418c443fbf95b4cce8eac9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778102332, "uuid": "6ec882b4-ec7a-4093-aab6-38f5ce676e95", "value": "T1C2D36D8AB001DE3DFD1FDABE94234E15F931A35166430B2A528BFD937D321A95D12EC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778102332, "uuid": "d6561220-f586-47b3-9d8c-5b2ae91be920", "value": "3072:w712h/iR1UW/lgXQmpM+81Uuc8RAO4sjyoMUF4gruC:FhqR1x/GAKuctOvj3F3SC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778102332, "uuid": "1f980e88-cac3-4e6f-9352-db7cf8339e1a", "value": 130008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778102332, "uuid": "40c43ccb-794f-4748-ad76-48cb267fa7ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778102332, "uuid": "7f8d2c63-41fe-4f1b-9f9c-f1397f28d2fd", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c88fe846-4980-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778095289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778095289, "uuid": "c2ee524a-3c2b-4324-9581-eacd8d0720db", "comment": "Malware payload (Mirai)", "value": "4d5e12e0b3f8b2c360e5c2b0729c695b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778095289, "uuid": "11136597-276c-4fab-85eb-9354e12170ff", "comment": "Malware payload (Mirai)", "value": "5ec1af1f7d09d71303995275154ed6747b89375e4c7b912e548142ef80ef57a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778095289, "uuid": "3135f0ed-025f-4ab3-8327-dc8e450fb7c0", "comment": "Malware payload (Mirai)", "value": "1e64c792e374d94bafde738a2f56ec52e96b5029", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778095289, "uuid": "89ba23db-e70a-4bdb-9c95-97356e3924e8", "comment": "Malware payload (Mirai)", "value": "8167e4febd3447c5af7d44c7e8fd48a3c223d049f75bbf0ea882c885c3515501f5cc014d7ef47181ac025db10f8ebbfd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778095289, "uuid": "09a58fd5-261a-4736-8621-534c5c9ffd9e", "value": "T102731260133CE83015B53DBF8BCA649A5F84AC6CDBF16882B74941A369CB817B5C875F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778095289, "uuid": "25ec80b9-0cfd-4d5a-a9e2-4d71ad551ef0", "value": "1536:WdZ1kmd4Lj+G4RbLVlA+7bHaVLaewuEpUtTjkNPP+/98ljygmI4SLR:WdZ1Dd4L747Kwb64ewVGsZPA8ZkGLR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778095289, "uuid": "239a2b12-18eb-4165-b152-db798edf5288", "value": 80320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778095289, "uuid": "f7e2e130-34e1-4ce1-8205-4194c82d792b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778095289, "uuid": "6e243a98-b731-4db2-bd5d-f5b2e9a0c944", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6e3c3d5-492c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778059235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059235, "uuid": "0d2f0aa1-28c4-4b5f-bda7-3fdf6b81b4ea", "comment": "Malware payload", "value": "68a8bbcb7b30c25dcca741ff7a67d36b", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059235, "uuid": "013e4d39-de17-4d02-b89e-472b9712b174", "comment": "Malware payload", "value": "5fbbca2d72840feb86b6ef8a1abb4fe2f225d84228a714391673be2719c73ac7", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059235, "uuid": "07e4ed73-b42b-40fc-a0a6-ae1fe88946b0", "comment": "Malware payload", "value": "d0fc58c7aa07855d341f4b92d70ea05008574a2d", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059235, "uuid": "4183d60a-e8d6-4154-bb97-3132bcb29ea5", "comment": "Malware payload", "value": "96ad3f40acdd439ebfa9906750d72816bfbc01ae8afee43f6c3fc2e0c6880f64f8de3be3182873f03021446186095a21", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778059235, "uuid": "d390d6e5-3c88-437e-9635-83ca5b00f30e", "value": "T1EA462357C9CC93E8D096AB30B687439D70E1F54A89BE9C1836C72C026F11DAF164EA77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778059235, "uuid": "3c972680-0248-4daa-a8bb-5d7736ec2a0d", "value": "98304:t8uj/T/bQVW1T/d8QV6ZRHHLRLm3Hrld3wDiutAudt9HvzSJxOVSX98Noq66FWY9:tn/iWTF7V6ZRLRmL3wDptAudtZzAOZW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778059235, "uuid": "957000af-3291-4af1-afed-91ab6b2e95c7", "value": 5565952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778059235, "uuid": "90e17e2d-c80d-47ee-b530-669c0a9d9796", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778059235, "uuid": "2ea585c6-6125-462c-ba89-7aa0109f2632", "value": "icloudz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d238479-48e0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778026336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778026336, "uuid": "bbad1774-8c9d-4513-9214-9053c1206e1d", "comment": "Malware payload (Mirai)", "value": "9efea1004081b9f04274eafa7247b587", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778026336, "uuid": "2e0a866b-bb26-4779-8bab-752485574534", "comment": "Malware payload (Mirai)", "value": "5fc52953f79ce69bf8df96552fb4ac7e59f9f1ca1d90d1efb16d0cbad479eca7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778026336, "uuid": "bd750d76-53e9-48a1-9f76-09aabbb4470e", "comment": "Malware payload (Mirai)", "value": "28ad7741a5cbba452709daf88bb99375cb6c743d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778026336, "uuid": "f38f0b00-8d7c-4770-88aa-435109e1d8bd", "comment": "Malware payload (Mirai)", "value": "9f9f7c44747b0a00e25b0c9c4ef85481b89c4a85bbcc0dd356a6c116777682f63e0a9bc45e79fd1f69a742f7004ec707", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778026336, "uuid": "7475258c-37cf-482e-b50c-c79ca97fa3c7", "value": "T1DD51B3C822D14072ADF6D9B373BAC518B99050D778C97F599CE838F4C08CE46B2C1BA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778026336, "uuid": "aedb537e-fc9a-4cb1-b4ce-589b5d4ea837", "value": "48:ipunTpyvp3xpvhpdNp/FpFOLp+npPhpqvppRp9nplhxpYbpxk:i4TInLdfOUvkpLHaE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778026336, "uuid": "cfa8a92d-c471-46b6-baf9-4d0488568ed8", "value": 2749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778026336, "uuid": "72197aa5-8268-4367-b19f-964268db3e15", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778026336, "uuid": "1c7a2687-1b92-4ae1-bac0-ab2a1061d61b", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbc5de5f-4987-11f1-a769-42010a9c0008", "comment": "Malware payload (DiscordTokenStealer)", "timestamp": 1778098328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778098328, "uuid": "d84aa9d5-9155-46af-88af-b0ca381353e3", "comment": "Malware payload (DiscordTokenStealer)", "value": "87b5be28fd969ed4a9dd0f6695010ed6", "object_relation": "md5", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778098328, "uuid": "eff5f896-d573-4963-a42e-4501d384dc3a", "comment": "Malware payload (DiscordTokenStealer)", "value": "602fb8fcee0f027bf701813de1b9f637c78b5a25c6e2e70a7bc64f558cc712dc", "object_relation": "sha256", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778098328, "uuid": "974fd7a0-b2f4-4688-9c4f-b9270a31a2f2", "comment": "Malware payload (DiscordTokenStealer)", "value": "d95cdb0ca530a1ecadf931e22cfea8ef42e7a0a9", "object_relation": "sha1", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778098328, "uuid": "1c76cce4-3358-4cc1-909e-967b3dbe6328", "comment": "Malware payload (DiscordTokenStealer)", "value": "15d30392b0cf5178a611cb19af0bc3bce806fc8b21321999d70248e9c9ff83c84cae570b0df1c42d501b35a90275582d", "object_relation": "sha3-384", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778098328, "uuid": "3e84f91e-96cb-44ce-8333-c82e1d12e3b1", "value": "T11AE7BF12B3C88B36F5AE5276817AEB55D37DE9511339E7CB1144FA9828333C15A322E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778098328, "uuid": "42130914-9277-446c-bb4d-67e9ed2da3c6", "value": "9f61998f1fe61cdc7fe733fd48bdb74c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778098328, "uuid": "b2f7bfdf-8af2-4760-9db4-45c48a13fb88", "value": "786432:RMEymg3Bk9DIg8ptb5pkA3JR85n8v3nI2jnTj83NrTAJJr4kPOh2c5:SbzRk2ZnTHr4kWh2c5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778098328, "uuid": "b7814483-1892-4705-9551-5bf68946d54c", "value": 69261386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778098328, "uuid": "4196ff2f-3909-4c4a-82c0-84b20e824074", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778098328, "uuid": "2bf22f25-cb1c-457b-9d4b-8c0eb6e85d55", "value": "WindowsUpdate.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15f2f8f6-4981-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778095419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778095419, "uuid": "04cc4e43-d172-40a9-95b6-7e46107a70eb", "comment": "Malware payload (Mirai)", "value": "8208774d2b60eb8898894a2e4b73583a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778095419, "uuid": "a447f568-bf79-474c-b7cb-d9b51d67cc30", "comment": "Malware payload (Mirai)", "value": "6055824ce21fa02fe101a89020a5f3f55268f6ad1ab4e749849326ed9114f11c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778095419, "uuid": "57eddcaa-a2d1-402c-bf5c-b659734de151", "comment": "Malware payload (Mirai)", "value": "9631bb83aa96e27aeea6e7afe2d9c1ab2ef6950d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778095419, "uuid": "6f7c814b-1f25-4454-bea5-1f793dcfbf25", "comment": "Malware payload (Mirai)", "value": "7c570dd02f1554790f4e2b214c8bd2b894152ce517cd40dd8bec5b57b39b805b466dec4fba92a955df47272d8e67adf9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778095419, "uuid": "df0a8269-a3b9-4966-8193-b23c91417817", "value": "T136145B02B31C094BD1632DF42A3F27E1D3EF9AA124F4B645755FAB8A9172D321485ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778095419, "uuid": "e50bce3c-6735-4b0f-9ebf-738e7ce9b358", "value": "3072:LW+CZ6m7+fEc+hAu5O3cYExNG8NFpdAb3O1qva5:6ZsExNG8NFpd6+1n5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778095419, "uuid": "a011199c-9066-4351-ad92-927aa8006068", "value": 201072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778095419, "uuid": "3c1e8af3-13de-4daf-87a9-6049a3244d80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778095419, "uuid": "d7a088d7-d860-4812-a3da-dfe7524309b3", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "810a25e7-497e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778094310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778094310, "uuid": "67e9b655-dc19-4d33-a1ad-9a603d706ef4", "comment": "Malware payload (Mirai)", "value": "a3374a489202b8220b0ecff259033501", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778094310, "uuid": "e0de6cc6-1b2e-4c8f-a797-731149496375", "comment": "Malware payload (Mirai)", "value": "611e79e9f0406364b86c90dee5229ad0a51b81fe5059ca90a368556a3b7414d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778094310, "uuid": "9465c46d-0a16-4972-bf70-2ca6702acff9", "comment": "Malware payload (Mirai)", "value": "aa842eb5954547091a37c34fde4b8fbe85ff53f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778094310, "uuid": "893d4143-0b0e-45ac-9ed9-29f378ef5dc2", "comment": "Malware payload (Mirai)", "value": "1b3c4e5fa3379a1ffe318d72eb4d6dc39c4f2cd6155a13ae52cafdb3f93b572579b95bcb87daf1a393e033c7bc24d885", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778094310, "uuid": "ceda2f32-ead3-4621-baa6-6f8e2cd10a31", "value": "T19D63945E2E258FBDFB6D8B3043B74E21B64823D212E1C644E14DE9015EA434E785FBAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778094310, "uuid": "888a135d-395b-4349-9d5a-007a3eef229e", "value": "1536:LQJYuW4b/pUgMIN37c69woXz6hi9sql39CwbZnX:LQhb/mK73woXuk9vNQwbZnX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778094310, "uuid": "95dd05aa-9b75-4749-aa3e-224e3d1c95c3", "value": 67684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778094310, "uuid": "59278cf1-2963-4787-9a50-283f6f85f13e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778094310, "uuid": "0883e8bc-2242-463d-9f2f-ee8f490b1ae7", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3ee90b9-4980-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778095308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778095308, "uuid": "115e61c9-0cc0-42c8-9d21-b7195a0d1f57", "comment": "Malware payload (Mirai)", "value": "970ca94e1621bd7ee51095fd0f1366a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778095308, "uuid": "32c0c585-7cd4-419e-a94d-fa8528961981", "comment": "Malware payload (Mirai)", "value": "61615ecc6ee5609c6d7a3aa4a24a9e0f1ff0f7103e5880fe1f2ec9526d493ee8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778095308, "uuid": "5a789059-2f03-4581-a83e-4616d5cbc222", "comment": "Malware payload (Mirai)", "value": "d5f4e41ce46244f1da4734f82ab681f98aa1bac3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778095308, "uuid": "0b0e92d9-4dd1-4445-9c4b-9e6b148759bf", "comment": "Malware payload (Mirai)", "value": "e091f1084f7e87ea949ea4bd844c8422390355c020d45f41e348c1bcc06b37de1162b1a71a6bec4d5b7477aa87375c73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778095308, "uuid": "81c4fe28-377b-47c7-b713-64e6ece8431d", "value": "T16144C71F6E229F7DF3AAC73547F74E24975823D626D1D591D1ACC1002E6038E682FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778095308, "uuid": "feb3d309-9f0b-4c0d-aaf4-cfa15abe3284", "value": "3072:W1AuE5KGI1lUUyz9Gy71f5Ff7N1F8v5gbi4ZnfVYY9zCX7MWXLqMR3:W1NE5PI1lncGqLljF8hgbBd3CIWXuO3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778095308, "uuid": "c08e7e51-858a-4f25-8494-a3bbe1ba12e8", "value": 262744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778095308, "uuid": "b30a645f-fe8a-4571-adeb-d5cbdeb0dea8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778095308, "uuid": "e697f44b-4458-4da0-817f-40abdde56eec", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4954e221-48e6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778028933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778028933, "uuid": "fafc720b-7ffc-4338-b947-98ee38dbeb2a", "comment": "Malware payload", "value": "b09586117c9f6ebe5242c0e73fca55c1", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778028933, "uuid": "6fa953cd-3c25-44b1-b205-f59fcf086f72", "comment": "Malware payload", "value": "6300981b7c1d9b635dccc32609b4793a10f050cf049d325137daed869f77fa98", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778028933, "uuid": "f93bde02-b879-420c-b33c-531efcc372c2", "comment": "Malware payload", "value": "28087b89ba97c614391e8c45ad40baaa57fd9d7e", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778028933, "uuid": "461d6b14-4407-46f4-81c9-5f8fd447d624", "comment": "Malware payload", "value": "9f0872e06119d2095f6644e066d2336f2745c63ebd6e91bb5226f2d8022d24f1d72ffc20e98aeeef75851e3961deb4b2", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778028933, "uuid": "dfc33d41-2010-44ac-96cd-ecfc9cbde8b0", "value": "T168C3004F00EF444147777565862B6443CCA4C92A280BD6EEB62DBF52DF0D0B4C7EEAA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778028933, "uuid": "4a4dd17a-6821-4573-ad9f-7aef6d339de7", "value": "768:33hH9+co9nUPsIpwmCrAogNas0NZRAVSZ3BgS2V9GnFALaQlYDpe6uFw6MLw4cc4:BokBtOJUHt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778028933, "uuid": "bfb7da94-c37f-4dfb-9870-172dbab60940", "value": 128795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778028933, "uuid": "5ea1be7c-4530-4cc0-ab10-29dfea58ec23", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778028933, "uuid": "d751a54b-d724-4dd7-a720-900544d61fe0", "value": "Delta_Backup_Holiday_6545.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ee2640e-4933-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1778061906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061906, "uuid": "ff26ed65-81e3-419d-a8ef-468c4245d6b3", "comment": "Malware payload (NanoCore)", "value": "36ec4f6a007dc3480e518af74cf020df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061906, "uuid": "03a24cf1-2797-4370-9a8d-85518140c742", "comment": "Malware payload (NanoCore)", "value": "65659d0e34ea78b4474f6038139cc1cffed661c61a8c5928286023be9c2b25a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061906, "uuid": "14828932-29ab-4215-bded-a48ba4a8e18a", "comment": "Malware payload (NanoCore)", "value": "7193e60529f2f72cbaf39303d98216b945161c50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061906, "uuid": "3101cef4-8591-4159-bb97-8e17ba78a35d", "comment": "Malware payload (NanoCore)", "value": "dbcb047ce530bec9dc94af0eb73c23e9bcde566e58671e6e3cd058b3527830567e18cf94ffd2072dd653559610e931e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061906, "uuid": "a980a132-cd89-4d8c-bb91-100e3e9bdff1", "value": "T13714CF2677A84A3FE2DE8679601246039379C2E398C3F7DE2CE455B68F267E406071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061906, "uuid": "37d38417-4098-4033-93d2-33763cf87ac4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061906, "uuid": "926cc280-e849-4fb5-901f-6d5a8b7120ea", "value": "3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HICfLZFSGH+2AgQ7S8xaP4W9rsX:MLV6Bta6dtJmakIM5rLZFFYSEY4ers3n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778061906, "uuid": "911904e2-bced-48a8-88a2-10a221313679", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778061906, "uuid": "77a68343-0ad4-427f-92d7-e205d84d0093", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061906, "uuid": "6c983864-7b98-4ae0-a57f-a5979a2f2a2b", "value": "hotro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "141b0a23-492a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778058049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058049, "uuid": "b169791b-215c-49f3-93f9-6832fcce1b8d", "comment": "Malware payload", "value": "a66554565fb72b4df8a1b13bd57ae03c", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058049, "uuid": "cc33b180-772d-4100-97b5-1b524ce598f5", "comment": "Malware payload", "value": "65e074a68a1a1732d8930ee2b4d3d5a2651f526d0111d4929042618a9cbbb7bf", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058049, "uuid": "157c1a80-29ec-46be-a8db-6c195577df5f", "comment": "Malware payload", "value": "140259f34b6490da7d56496f02420d6b8b82c4b9", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058049, "uuid": "d673eaae-c5fa-4d56-a771-9b362b5eee99", "comment": "Malware payload", "value": "c6b9dcd2852c9beadb4f5089f75be4d3203e9748491258332996189f586a1127d7f702977ecf8699d0985957880d4124", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058049, "uuid": "eb93d58f-aa73-4683-a6f8-269404e09d5f", "value": "T16E76029AF798B72BC83B513346FA563112874C078A8387576918721C7AB79F40F5EBC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058049, "uuid": "74d9f2db-baa8-4da6-8265-85d6aae0f140", "value": "196608:BPOIzDUArXo63y5Ck/skpTBxLGjDdSjS7pIh/X39:BjDq63y5CIsWzGf4W7pIh/H9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778058049, "uuid": "c42f4a04-cea5-4cb9-8b69-2b0073a16d3e", "value": 7806184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778058049, "uuid": "b2b3c22c-57bb-4aa3-8b73-e709003e9eff", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058049, "uuid": "181a1e21-5135-4024-84e3-32b921e1fe5c", "value": "app(12).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68b2eea9-498d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778100712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100712, "uuid": "ba006a24-e44d-4a39-90e2-ac86ec71921a", "comment": "Malware payload (Mirai)", "value": "239f30ba02617f792c17bf045aeecb6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100712, "uuid": "c28f57b5-967e-4437-85b8-7a5a00fb155b", "comment": "Malware payload (Mirai)", "value": "6667c36ee5f92ecc7b44b94d96994215a6e6251b6c8bf1f48cce4f2f2954ac0e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100712, "uuid": "5de09aea-776f-4109-a304-9b8748524829", "comment": "Malware payload (Mirai)", "value": "acb6f7e93c018a74567c4bafa810f3a131fcbabb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100712, "uuid": "fd39261d-3a21-49e9-bc15-73dd456bdaa1", "comment": "Malware payload (Mirai)", "value": "e590c428659ca63bfaf998f308427bbbe77f95d9a6e69c5c0c17583e671ddff60be6c4a35f4720eff4c41dd44ed9918b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100712, "uuid": "4dc51e44-a879-4a6b-8e50-ef5670406469", "value": "T1E104C70AAFA10EBBD8AFDD3706E90A0229CCA41725A43B757574D528F64E60F1AD3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100712, "uuid": "9e1ba86a-658c-43b1-94f1-fe0f19efe5b9", "value": "1536:1QgQYNJvs88Jc5Enn7wDNiOr8DS1cz9vHuH9eUNelZ96IuOg3q0ReiD4ubw53RNK:1IYNJvs8A8En7+RgCNelBg/R5DLcVr+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778100712, "uuid": "00fc35f2-b2e8-4eda-8377-6d2d80ff1e77", "value": 186292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778100712, "uuid": "ae77ac30-6d40-4c40-ac83-080266100094", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100712, "uuid": "05ab242e-b709-4c79-aed1-69d6b9cf4798", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c948b0f0-4980-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778095290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778095290, "uuid": "26073d21-1060-47a5-b8a8-c8940278659e", "comment": "Malware payload (Mirai)", "value": "b30f2053083d1b946d4a475e06cc6de5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778095290, "uuid": "f5c5fcce-8507-4b32-8bed-a709228714f8", "comment": "Malware payload (Mirai)", "value": "66fa56021b909359c796bedc33b01acd4e31e01c602eb1355f4ec3513a6155ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778095290, "uuid": "79575422-1813-43de-bc4c-edf4d4d8e9c3", "comment": "Malware payload (Mirai)", "value": "3bf327e9db616eb0587a8976176667bc2db03a49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778095290, "uuid": "ed01f35d-afdb-430f-815b-a19b78d1c086", "comment": "Malware payload (Mirai)", "value": "425fa8450702d487541f4daab6d25bbfffd845e77bf0c9486aef74e02daa262e52f3127f150b4e686cac89a9e010fb0a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778095290, "uuid": "69bed502-e655-4034-8a6c-380077c8283e", "value": "T1CA048D23D4796ED8C674D9B0F0F09EB91B63A52182471FBE26A6C6744087E8CF50D7B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778095290, "uuid": "71473e7c-e692-4cda-bea5-8fdb0da43f0e", "value": "3072:CSTNGXZGLuJ/mQ3DOe0cthIvQDc2ASWzvbktwdQ:CSp3K/m290cthIokfzotCQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778095290, "uuid": "69733823-ff7a-4811-8ce0-79c55f2541ef", "value": 182404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778095290, "uuid": "43001b03-d077-48a7-b97e-2e827ae76235", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778095290, "uuid": "349d768e-1aba-4fb5-a119-ec83b81265a9", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e1c39c6-4993-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778103324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778103324, "uuid": "6fce12a2-6ccd-4888-b5bc-4ad3293563c2", "comment": "Malware payload (Mirai)", "value": "43c96623a4f7a8d26c93c16104371444", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778103324, "uuid": "dceaa07c-21e1-4df0-a3b1-972139def326", "comment": "Malware payload (Mirai)", "value": "68e2eaaf831a3f3ae2009b349226218be68c7eb16c0cbb051c3dacb15f51a665", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778103324, "uuid": "e35140e8-0eb9-4065-9f57-e0d06ae6a85c", "comment": "Malware payload (Mirai)", "value": "32f6930ff22b19697a6b7fd76bc8fdf8903ee4d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778103324, "uuid": "49f38901-de7c-436e-97a7-315d8f74ec98", "comment": "Malware payload (Mirai)", "value": "5e54013b563a9eb1cf502cc858b03f91bb06859548898a498e0d37fba3132c33a421163e8db8af5f83c3ad09fe1a4782", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778103324, "uuid": "cbefbf42-89e5-4f52-b2e2-4fac6ddc8970", "value": "T1B6F3C70E6E24CF7CF39A873447B78E26969937873AE1C546E19CE6005E6034E641FF68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778103324, "uuid": "2e17814c-c9ff-497f-a416-7359919896aa", "value": "3072:ofTBcARhM7H21uMyXIKkfe0KEp12jDBAiMdqQ21MdWZrewzKE4hnLj6KjpOaiN3S:ofTBcARhM7H2wMyXIKkfe0KEp12jDBAP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778103324, "uuid": "939de83a-d329-4a63-a87b-a411231df9b1", "value": 163456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778103324, "uuid": "4db58ca6-eade-4668-baeb-d97248ff8886", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778103324, "uuid": "60c37393-fa8d-4626-98ed-c8177e6842ad", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46afcc6b-498d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778100655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100655, "uuid": "56c06fcf-32c2-4c74-9d83-571e71d604ee", "comment": "Malware payload (Mirai)", "value": "62688628d2a2497d53030f1ff3cac248", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100655, "uuid": "4cd7a366-467f-452d-b8b4-715a3e2dbdf7", "comment": "Malware payload (Mirai)", "value": "68fb47cddf4d101559e8642ace44c5e2be7dd1ee5c83e4040af020b8033eea4c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100655, "uuid": "253f8d06-f083-4107-a854-2820ebcc16ab", "comment": "Malware payload (Mirai)", "value": "42eba31013a1faf4e72aeec00dadf4ac607909be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100655, "uuid": "4454c18e-c0fe-4f17-9668-112ea80b93ad", "comment": "Malware payload (Mirai)", "value": "f70bb27a247681475162f04fed1bfce488e8f570ceef0c949528d28558e598ea21a4b239f271064d42b3f008fa26e8fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100655, "uuid": "e81d4cc2-3492-4e50-83cf-a4b2b68d2eb7", "value": "T1D153023045A9B13ADF384E711EF8784EF8018BF584D528970A9D16A4BCC187EF9ED6C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100655, "uuid": "abd3655c-f773-486c-8319-d2124a1ee621", "value": "1536:Mengef9jBTOZ3I3OPWMiGHE1/XUy5LVEI/mraOeazdG:J7f7OZY+Pnu/Xd5L2I/mrTeaU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778100655, "uuid": "a9b6c8f9-3a04-4a37-966a-5a14cfd68ee8", "value": 63132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778100655, "uuid": "8ff9730e-323d-43fa-98a4-44b14cd4966b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100655, "uuid": "6960a4ef-f60c-4398-9ab8-06b64fc8c544", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5ee3aa4-4928-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778057489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057489, "uuid": "a97e799a-aa7c-4911-9dc1-5f37ff0871e0", "comment": "Malware payload", "value": "051127c39464c615c3f3e074a236ee78", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057489, "uuid": "c9dddf7d-7432-4652-b1b4-eddcd560d1da", "comment": "Malware payload", "value": "6a1e4678ca325b354571cf4893fb3c429cc52068f979737974f49c2030710cdd", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057489, "uuid": "14aa36f7-7077-41b7-8d94-9c5214c91ecc", "comment": "Malware payload", "value": "4a4d8c54e2a9b0a6f7fb51b7e2c5ecb77a04bc97", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057489, "uuid": "05e59f5f-a749-4655-91ac-69add6fc8bd9", "comment": "Malware payload", "value": "9e5d89ecfa77834582ee44a26098469c772787e2acd0a67bc565e9d35dc97a6ac2ffd50768c0bb690f5807b272f29bbe", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057489, "uuid": "b60e09c6-b28a-42b3-a1a5-7c0cdd752c66", "value": "T175B61295F358AB2FC43B513349FA163152974D078A939B43A928720C7EBB6F40F59BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057489, "uuid": "35d5fae6-2a40-4f1e-988f-9b9adacfb30c", "value": "196608:qgzaQtF1VTE8fXO5kNzE1ZZC4DnLGjDdSiRffXk1eshNN6kxnNEHO0+lT:qgxVTE8W5SzE1jnGf40XvshK8nNl0+l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778057489, "uuid": "ce64ee92-c03b-41dd-ae9d-1dd25c620f95", "value": 11076491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778057489, "uuid": "b4ec89e5-8eb5-40cf-b32a-0ae7feab9773", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057489, "uuid": "1b07420b-3451-481a-ab8d-9efac80ed4ac", "value": "app(7).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "202bb4e0-4933-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1778061935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061935, "uuid": "852e2a76-aae7-4b19-acf1-e10ed49784b2", "comment": "Malware payload (NanoCore)", "value": "05c558a1c48275e1b25b19be7c631355", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061935, "uuid": "83bb3a56-d80d-4c91-8c41-62b3894d8162", "comment": "Malware payload (NanoCore)", "value": "6a429a3d7d7ce7b3d6bd22cd02bb4dd7afaaba5a13210c2971573f7a5d4d1623", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061935, "uuid": "73e264f0-c2d4-4be7-b3a5-a0777f0fd495", "comment": "Malware payload (NanoCore)", "value": "4e56eaaa805d7bdaa5e995a765603fe0f6a77e3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061935, "uuid": "9cf95be8-2936-46e3-bfc7-381e25366850", "comment": "Malware payload (NanoCore)", "value": "20ade4dd347890f329d9afb59681f52037907857c58cdc6a2a4e32e8d93923085b066b07a51ac90f142bbd5cfa8ddab4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061935, "uuid": "3e8fe4e4-5047-4126-8aaa-e21e7e60b238", "value": "T13E14CF5677A88A2FE2DE86B9711251128379C2E399C3F3DE58D464F78F227E106071E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061935, "uuid": "e79e367e-4c5a-44cf-a081-d3e2e8df85d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061935, "uuid": "4dae3b91-4c10-470b-8dcd-a03f54b25000", "value": "6144:MLV6Bta6dtJmakIM5p0cFHkf8wa3PNMGdR:MLV6Btpmk6rH3wKlMG7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778061935, "uuid": "7076b0fa-ad1a-4847-ae8c-0423abb4c63b", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778061935, "uuid": "9cb67132-8163-4ab0-865e-2a82e0f0510e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061935, "uuid": "0db2fed9-9a85-47f2-83c2-e0aec87e8bea", "value": "ntoki.co.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9f929ba-4980-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778095291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778095291, "uuid": "f5583704-ddb1-4aa1-9124-7f5c2090b6a7", "comment": "Malware payload (Mirai)", "value": "dd3e983d94071396cd00901ec9a50368", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778095291, "uuid": "742f3d1c-6bb0-4a1a-98d0-dc6d67a8abf2", "comment": "Malware payload (Mirai)", "value": "6a83aea69a8cf4130615df3ba6175384f1756c1257eb2094ea5724a4b1b8ffd9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778095291, "uuid": "4b1ba241-1a17-48f4-926f-891e09696dcb", "comment": "Malware payload (Mirai)", "value": "1055a8152206305adbd5f7eeb0c593c925937dfd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778095291, "uuid": "eaea241a-ed1c-47b0-af03-6a0bcd08655f", "comment": "Malware payload (Mirai)", "value": "6f98ecd077609f97406c2cda3ea2845645aa76bb7a2a446e4a3b4a325b80feb13e521951e29d87f990ebce87c721038b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778095291, "uuid": "fce635d3-d388-498b-896f-215c8f5b4cf5", "value": "T1758302FBD64578E7F8FE3D78903E6B949891E442BEAD93D403629F3C0B0444E75894A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778095291, "uuid": "77b86b5d-36f4-4b29-a320-eeae68aeac65", "value": "1536:v7sHHZycsXj17v3rfI7m9G5rYLaUSZsrF8evHYZBB/tMk:vANsXj1DbfIaE7ZUv2Bwk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778095291, "uuid": "d55e2f94-e448-4161-8b13-a8f80c4d345c", "value": 85080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778095291, "uuid": "bc24fda1-10a2-41b7-844a-f4b1aa35e11f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778095291, "uuid": "1b0056f4-bd1b-4511-9d5d-ff379620fa2d", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10de6b80-4931-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1778061051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061051, "uuid": "0b1dfd76-177a-46eb-b844-17a2180705d3", "comment": "Malware payload (PureHVNC)", "value": "626a572280adefc19037539a7533896e", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061051, "uuid": "acdb48bf-921c-4fca-8bb8-84648616987b", "comment": "Malware payload (PureHVNC)", "value": "6c9cfb355cd7acb21155c738f84ffc34ea35d3254d042ba7c99ed51132bd8145", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061051, "uuid": "bc1bb2b5-5ddd-4de2-be09-8e3216bd6e38", "comment": "Malware payload (PureHVNC)", "value": "df7d272976b02320391021b78fc7048111141fb0", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061051, "uuid": "f6c9a6fa-4440-471f-bf6a-763910789232", "comment": "Malware payload (PureHVNC)", "value": "4e30e7ec1c7c91c9261d5216701162014f8ec7905df5c182fcd6ea540957e1c7feb1c0c196ed9c374c79404c9aab285b", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061051, "uuid": "b2a8ab77-b19d-4cd9-9c45-fd90a5bb1d41", "value": "T198B4238AE24389F0E98F38F694576FBF8925A852DC7DD814FF94A092D6B0E71102F11D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061051, "uuid": "e02159c1-e967-4cab-9db1-ee85e172bbf3", "value": "2d586c7e63e6a7d9ee915912ebdbb756", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061051, "uuid": "42a025ea-a5cf-489d-9eb1-568a200d18bb", "value": "6144:JDIL+vfqshT4ohl26RZ0ZrgeSRvSPoejPKKj61wURZmDU/TqaZasO3sJ3IGrTwrs:Zfqs6ohLOreejyDv1ZO8P/wlrOx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778061051, "uuid": "c4a66ac8-51eb-4ef2-a6b6-55b7cbe4cdf1", "value": 504832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778061051, "uuid": "38b6ef8b-7f93-48dd-abe7-12d9fd6c8833", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061051, "uuid": "437f4633-8d18-4270-80d9-14f4ff978814", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18249926-4933-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1778061922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061922, "uuid": "a7034a33-8429-4796-84d2-300bdef4e978", "comment": "Malware payload (NanoCore)", "value": "ccf92da466e3fa159d454930373cf974", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061922, "uuid": "2e4be1f9-d41b-4dca-b4d9-9f6fd39e2a6b", "comment": "Malware payload (NanoCore)", "value": "6de73f4929551300411b2513d453b2737aabfbed5e19ef1e457c3a5742755200", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061922, "uuid": "c0438496-3873-4855-ae92-fe7c84fc029f", "comment": "Malware payload (NanoCore)", "value": "42b32f6beb1ee81c46bc676aedc47b1b46313b51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061922, "uuid": "af44dc57-c470-4291-b3c7-bca3e775f525", "comment": "Malware payload (NanoCore)", "value": "50cf9e9e3c384416501c08a92b3a0a66ccc06ca8f1e1061e3595ff7bb5865ac23a991f58cfbe195806da35cf50eabfb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061922, "uuid": "cd2190aa-14c0-4b16-9fb6-a5685745f342", "value": "T1CF14CF6677A8492FE2DE867D601212529379C2E39CC3F3EE58D854B38F627E44A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061922, "uuid": "b63294b7-f5aa-40bd-b4fc-30b68c06903d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061922, "uuid": "f367a943-c43f-47e9-96ef-3bf6506403c2", "value": "3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HI2jwKNdlIhtRSE8KaDtyvLGVQC:MLV6Bta6dtJmakIM59Tw37ax4L23", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778061922, "uuid": "85ee572b-bd0c-4175-ac28-17b983c37907", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778061922, "uuid": "4e32246e-5a2b-4775-a58d-b1ce5c81830e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061922, "uuid": "fb978870-cc1b-435e-82d4-39d87eae4ec8", "value": "hotro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4304dd71-495d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778080033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778080033, "uuid": "ca993ab5-0357-4779-8d3d-bd54c8a5cda0", "comment": "Malware payload (Mirai)", "value": "0c4e79edddf91f9aec0c309b1d1e3586", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778080033, "uuid": "815fcfe3-1c36-416e-bef2-86c2634590bd", "comment": "Malware payload (Mirai)", "value": "70ba83dd167e2349cd7c79e1b06799e8dcd43f3b2903ac148dd82d9c159dc7c8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778080033, "uuid": "e7587da5-1f50-46c0-bee6-ce7f39e2e14a", "comment": "Malware payload (Mirai)", "value": "ca72f9d6d21a6b6f2ee621d6c82da3caea00999f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778080033, "uuid": "b43df8c1-3bcb-44cb-8b48-16eb474df9c0", "comment": "Malware payload (Mirai)", "value": "44c1623a912a7706e93521e028e473e1efdf372294e131123038d07d8c275478d964c75df148046a9f6e5287b81d3d35", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778080033, "uuid": "147576bf-794d-43c2-854d-024542a325d1", "value": "T1FAF2E891B8854727C1E41379B6AE5A8E377073EC92CBB62BD8224B207BC591F1D63F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778080033, "uuid": "376d49d6-1896-4be5-89d7-ae188a47d789", "value": "768:VxwgXqSoG5M1ImBHGaBwO3iRtWV5za9ZSFH13RCTXpoc3tSwn:VRqZG5MRxGaeVKSUVB+Xjn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778080033, "uuid": "340b5c0b-7bc0-4aed-9093-f906f4fcd899", "value": 34864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778080033, "uuid": "82ebd5c5-eb9e-4c44-a51d-c4678c53cfed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778080033, "uuid": "e2015615-a409-4375-8582-9d66e0e89484", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39cf407b-4933-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1778061978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061978, "uuid": "71ad28dd-b3f3-4e00-a073-dbfed2a2a34d", "comment": "Malware payload (ValleyRAT)", "value": "4f075ec4698a9fa58ad20a0aba41f416", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061978, "uuid": "f9f3db9c-1a5c-46aa-a29f-9781c4ff625f", "comment": "Malware payload (ValleyRAT)", "value": "71b37b2955f8bdf93a4f72c20faf6ef9a690214e00e5a1892d5d345865f17892", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061978, "uuid": "54f638db-e715-4a55-b7d2-4293082115f4", "comment": "Malware payload (ValleyRAT)", "value": "51a812820cd1021b81daca2344e7a31dd8db803b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061978, "uuid": "0cae9ee5-a5ff-4441-a0fa-bd375b260f82", "comment": "Malware payload (ValleyRAT)", "value": "435aa0523a89d09d516c1386ce408d552e756b8739230781b5e22fdb1b33522c5ca8b781461ff8e8a0990b9f67592934", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061978, "uuid": "0b47b30a-6723-41ee-b28d-9bad14b6bd76", "value": "T193B48D21B942C231D1A901706AFDABB795BDA9344B3009CBB7D40E7A5E706D37B34E1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061978, "uuid": "af8e599d-2ae8-4556-b449-777136deea30", "value": "cce331b83b6ebe6b74eead579f4dbf31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061978, "uuid": "69f4a535-2022-4d60-b35c-b44b3376cea7", "value": "12288:Dq0uXDnHoHp3OopAZWov3cG3HIguoF/c8P7Da+0Q9zi0e:Dq0HeWyH4poF/LjO+79zH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778061978, "uuid": "53deffaf-df41-4dcb-8e94-124d78fc3b60", "value": 530944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778061978, "uuid": "8e6abc75-ab40-4bf4-bba6-c10dcac958cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061978, "uuid": "e4b7323a-6807-40d2-ae71-2b00932e2ac8", "value": "4F075EC4698A9FA58AD20A0ABA41F416.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4acad0e2-492a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778058141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058141, "uuid": "b963cb69-6321-4fd8-964c-dfa3a181444a", "comment": "Malware payload", "value": "1e7323dabf8053d278959de52d26ba37", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058141, "uuid": "c488a1dd-cde4-468b-ae33-02fcab6ecb58", "comment": "Malware payload", "value": "724f82afbb4d457dc34ac115e2c628e68a9b1231f36ad1cd7addc338021abfae", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058141, "uuid": "c3bdd460-f7c5-493e-b208-92fe83d1adf1", "comment": "Malware payload", "value": "44a1190ee714a17677c5fda51da01c7dd14493e2", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058141, "uuid": "356781bf-97a1-4bff-97cb-a8fdc26f86ee", "comment": "Malware payload", "value": "4eff1d4ffa3e567d08ed89af5ab39461c17e03b11028ddd16beb41242c4f6fd42e147aeef95fbb6bc5ec033579e5a9c8", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058141, "uuid": "186e598f-c997-4884-8027-e341aadfdeb1", "value": "T1EAB61295F399AB2FC43B513348FB163252974C078A829B436968720C7DBB6F41F59BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058141, "uuid": "5896d658-d141-4ed3-9a37-133514b9d985", "value": "196608:jqNKLIQLMbYWdb27dm1vqFkVKiw1RkuEE1ZZ8jnLGjDdSiRffXk1eshNN6kxnNEn:MK0QQcW9S0v5Q1RDEE1AHGf40XvshK8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778058141, "uuid": "1c8ca0df-6803-4c82-bf7c-7aea77cc96d6", "value": 10759458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778058141, "uuid": "2a7770f7-b396-4d02-8edd-87be9974d79a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058141, "uuid": "eae5c6f0-c27d-42d1-993f-e4070cd83b52", "value": "app(14).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9a0032f-4928-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778057468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057468, "uuid": "869628d8-f5a0-41a5-afc3-5291fe7c7787", "comment": "Malware payload", "value": "503c52f59aa70305a25c3f05a2865bd3", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057468, "uuid": "86183d8e-7681-48dd-a7f0-9b4bf1428778", "comment": "Malware payload", "value": "72fa32a3063786ec9a479e455e99d311ef2961a51e07c54b55e5f74540b392d4", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057468, "uuid": "046a1d12-371f-44e4-b7ea-827027e7894c", "comment": "Malware payload", "value": "300dd26baa8a0cce56bdb5566dc7932fabf7e8b3", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057468, "uuid": "c75d6ac8-0402-437c-bb77-96c5855dcdbc", "comment": "Malware payload", "value": "db4bea4f4f06ecb9870392cb066329dcf078887d439ce5a379d83b86f5ef95e5dc4d017f6c4c428637862b803f0f9f78", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057468, "uuid": "0f88f4bf-20ea-4dda-818e-41cb5cfc3da6", "value": "T15DE69D1BE7060D32D5AE5338ACFA130677322E9B77434B871544B968BCF32C1DB99299", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057468, "uuid": "e40d5873-8fcc-4a10-b91f-a739d12c0b74", "value": "196608:VIrGkrL7jEo+aEBj0Nr00I7qJjpVX7LupupzfNniVR+SXZmMGHlQt:VIrVLkR+SoMGHlQt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778057468, "uuid": "52606d9b-c7c8-4854-8dfa-d5e445d98063", "value": 13917704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778057468, "uuid": "54c28864-dce9-4e31-be5f-d7bd2053c7f3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057468, "uuid": "c43dad79-226f-4230-b1a0-d1a72ad8885f", "value": "app1.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf9a5289-497c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778093556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778093556, "uuid": "0c8b1160-a9bb-4479-8bf1-4fac5c17b1e6", "comment": "Malware payload (Mirai)", "value": "17de2b208bc164195156dffbe1308c6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778093556, "uuid": "10b32a1c-06e0-460e-bc08-638d71209009", "comment": "Malware payload (Mirai)", "value": "74c2018b565d8f4870a188285906e531c381615e441bb60fb7ccfa5eb04620e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778093556, "uuid": "69e704d7-513a-4f79-ad61-bda2516a12e0", "comment": "Malware payload (Mirai)", "value": "d135637adcdef9f9d7f1743d3ceedb0f14a1f344", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778093556, "uuid": "004717e4-465c-482a-8f66-f5ae625f0d97", "comment": "Malware payload (Mirai)", "value": "8f7531bc4c71770b09a10fdc625221d9c069d122444c85d7b23565d5a4939786c9c6b55f96b3927870ea0a3ef1058fc5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778093556, "uuid": "060564e2-3fd9-457c-859e-6ceaff7d4f43", "value": "T17BD33845BD829A27C6E523BAFA6E018D332563A4D2DF721BCC215F117BC681F0DB7681", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778093556, "uuid": "e41b5893-02a2-4cfb-a792-10ebfb690480", "value": "1536:AkUc0nbsJYbvQ94AYRrwj3DC/EidW9lb69IWU6wKUXHbtqoTBoFi1/4CH9RDOQLX:AkU4YwH3OTleb/oFi17gi+B4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778093556, "uuid": "11601bd0-f37b-41ad-8008-21d747e6f03c", "value": 136652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778093556, "uuid": "11c9a1f4-8ce2-445b-911b-44404676e6f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778093556, "uuid": "95e8a61e-383a-4333-98eb-56f19a64dd93", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cee058ac-4934-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1778062658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778062658, "uuid": "ea280dfc-7524-475b-bbf5-9e1c8623208e", "comment": "Malware payload (RemusStealer)", "value": "15f40d10cf4fbf656c609f0681b4c071", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778062658, "uuid": "357a9ebb-9d3f-47ce-86fa-241199d73e67", "comment": "Malware payload (RemusStealer)", "value": "75fce6ec4b0815d7ccc9d87c2687c3c379c8e446739b3302b72688dd632c9f9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778062658, "uuid": "e5c2cc70-dfe2-4e70-8743-59bf1ad2ce2e", "comment": "Malware payload (RemusStealer)", "value": "eb438fb507ed17a32b9d94068184eaf5bc904fdd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778062658, "uuid": "d705e76a-6ee6-4f1c-a423-2b170d381d0f", "comment": "Malware payload (RemusStealer)", "value": "7dfd1d447b3d4acb9a77df9da80506854af55a933b226692707fe00f4246e57b85224111048446785f925b92e2d05430", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778062658, "uuid": "67ab7ce3-b917-4950-ad1c-af6b52848e06", "value": "T145562986998108E8C1B64130857E7B253B717C6943F8A3C776E061313E37BE15EBBB66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778062658, "uuid": "3b648371-42b8-4578-8c45-3a6a0838a2b3", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778062658, "uuid": "7ff05465-9a02-4497-bb58-5b714be399a7", "value": "49152:6AuVR2Hbd4EK9CZx0f0OLEPct5le6S8al45Bl36BD:rurwJft6JalIB8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778062658, "uuid": "02c9dd73-322c-4e9e-8542-1fa73f848045", "value": 6108872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778062658, "uuid": "064ba1f6-e3f5-4f6c-ac64-bf8ac3cfccd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778062658, "uuid": "3131e190-f505-4bd3-bc6d-144cbab2aab3", "value": "15f40d10cf4fbf656c609f0681b4c071.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83a272ce-4943-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1778068974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778068974, "uuid": "90c8a737-4b1e-4758-9710-e57414d0dfd2", "comment": "Malware payload (njrat)", "value": "69f1a1bca5e6054270a7382712e40ac3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778068974, "uuid": "b5fb8584-97bb-455f-931f-be763ff92c5b", "comment": "Malware payload (njrat)", "value": "797a4574316768c9e35bca960303066617e47069c78ea1f1d949cfa3535eb2de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778068974, "uuid": "38b90ce4-c15c-4c83-9e7b-3d8db36d1827", "comment": "Malware payload (njrat)", "value": "97066231416ffb4f33a85855e7ca02c1db9fd04e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778068974, "uuid": "c7ff3d1f-cf94-40de-b9ec-c52f47b405ee", "comment": "Malware payload (njrat)", "value": "443ddfca4e12a92b06fa4abaf41e6c296c304e872f5d50d01402b7045c512ad63eb171c354775f01ce423954c7db2dce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778068974, "uuid": "21eb0f32-ad0d-4c0f-862a-1ae5f2c35e15", "value": "T1AB0512F6A64ECB01CCA2A7F49A71E3B203E04E9DE150C329DEDDEDEF75263265514182", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778068974, "uuid": "a84bec3f-0f9d-4f3f-ad46-280c3cb8bcbd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778068974, "uuid": "6a52fd86-c3ad-4af1-85b6-0b75d1c9afec", "value": "24576:YRYkBZ5hvnBA+i4uZ5zjYj9azYgcatWwKne:Y/zLopj4az3q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778068974, "uuid": "d8267f3b-f4dd-4522-bab4-2fbbd2f70836", "value": 795136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778068974, "uuid": "045d879e-a613-4d28-a43c-5bb4e9965826", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778068974, "uuid": "20d0aeb9-3954-4f73-baec-3979a93dca15", "value": "OC_265108..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1162c37e-4933-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1778061910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061910, "uuid": "87a60544-565c-4690-974d-dd6c4acd437a", "comment": "Malware payload (NanoCore)", "value": "ee041e7f582247537fb836e51a1442fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061910, "uuid": "a8e1d891-0686-401a-b346-df8c9147e82b", "comment": "Malware payload (NanoCore)", "value": "7b8eb0b76afa80393b9190753061c05a392f7ea5b05640e33f2f0705693d1460", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061910, "uuid": "8f5c7402-0467-4f83-9d39-e7075753c552", "comment": "Malware payload (NanoCore)", "value": "38196a46536c32c4f5717bff5ef6bc0258d1298e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061910, "uuid": "c1cd2f88-994b-4569-ab9d-cbd9e78deb9b", "comment": "Malware payload (NanoCore)", "value": "95f9753da913d78033562c9544329cedd9f00b6b81aebdb8b5c23427ef069b1f841ec2a965c3c2462850da5611c6e727", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061910, "uuid": "0b11822f-5a0b-4551-be78-34f48c5eed18", "value": "T16F14CF1637A88A3FE2CE8679601212139379C2E398D3F3EE18D455B79F267E50A071C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061910, "uuid": "3ecb7661-6ab6-40f8-9ef0-3674583fbd9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061910, "uuid": "89398de1-a6b6-49d6-a51b-abd1ccc052f3", "value": "6144:sLV6Bta6dtJmakIM5NR/4/hpQBhhVLy7W:sLV6BtpmkCR/4/UBh2y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778061910, "uuid": "b3ff4a8b-8967-4415-a8be-484a3603ce99", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778061910, "uuid": "c525ec34-f688-4c97-99c7-d647361a7cfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061910, "uuid": "1e64fbf1-4aca-41c6-b797-0b4d618c434c", "value": "hotro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2afb97da-496f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778087723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778087723, "uuid": "88873d6f-1a55-45f7-b2c3-b5956553f3b1", "comment": "Malware payload", "value": "874df94ec43df2cb302b5052ae5b57f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778087723, "uuid": "0888d9cc-7961-4235-bdc5-1fbe977f7049", "comment": "Malware payload", "value": "7bbc230e75fcb55ef651877b5b290d0f5d13a174d4b658cca0f5fccf21cf595e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778087723, "uuid": "2fc539c3-be09-4746-9a76-b526444b0e66", "comment": "Malware payload", "value": "11d49c34f0df44a25ef7f96452ec92b04c96d0e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778087723, "uuid": "639698bd-9fdc-4473-ac1f-7e21e357083c", "comment": "Malware payload", "value": "b657c7907921756b48924dbb1603841235d3081fc025f88a39303466b724869992e61ad6702804569e0fec35ea258802", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778087723, "uuid": "c21728a7-032b-4758-a101-ed4f73fefd48", "value": "T1A0E63B5622EC02C8E0B7C17CD966DA06D6F27E154F21C7CF02546B6A1E37AE54E3AB31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778087723, "uuid": "a7bbcd2f-adca-46ad-b3c8-46a03e44719c", "value": "0d83ba4dbd92e6355da88357a33c5f1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778087723, "uuid": "3fdd408a-c451-44a7-9bd8-925de755f022", "value": "196608:AV1eagKQy2ypaze9B0NicKgV15jXyVVdD0s:AVrgKQy2DzebOKgVXXa1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778087723, "uuid": "ba5540e3-d7a8-48f8-a6e0-97ff4d30a576", "value": 14538392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778087723, "uuid": "be878ef6-5ae6-4e4a-9bde-2643fccd7247", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778087723, "uuid": "30223355-422d-4f14-8802-b7c434228c24", "value": "ABRIR_DOCUMENTO_ENVIADO_EQUIVALENTE_FACTURA_FEV45801__UNIDAD DE INVESTIGACION CRIMINAL DE LA DEFENSA SAS 991032901_ .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7dd24b5-492e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778060015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060015, "uuid": "95424500-5607-47df-aa83-10660ba8d240", "comment": "Malware payload", "value": "e950f00a8f5e4788a2d484a20c9151d4", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060015, "uuid": "19a98399-0c02-4f2a-807f-761198cfaf02", "comment": "Malware payload", "value": "7c35a60136762d28c659950584a63295db3a524ffedb99fc0d5646d0a374cbba", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060015, "uuid": "7c3f8a9d-5f5f-4b2f-90f7-56abcd57e0b4", "comment": "Malware payload", "value": "72920fd37da47bbc4a53ea5a3fcbf427af640422", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060015, "uuid": "964dbb59-bad2-4174-89de-ba81bfd5b467", "comment": "Malware payload", "value": "132c2f9d565f45c2da19b5f9e4a3f351c0a38d773c048a80cc9a05a5a1592aeb33ab63c83415fa0437b25d2c681a8a9a", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778060015, "uuid": "f8db3483-7c51-4322-a4a2-dd8221bf9b91", "value": "T1A8B612D6FBD4492AC4778072C86A52F1255B4D568B839F877904320C38B7AE84F9EBDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778060015, "uuid": "cc5e1e34-12d5-475a-b929-6a65142724c0", "value": "196608:uavXX2LthRaFOd7ZluYROhQAT2V/SbuthzLS+KFZ8H3WAwF8wiPvZ:JotjaFOd7ZDEpT2VLJLkF6H3+iZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778060015, "uuid": "441c8626-d43d-4c8c-a544-9ad5db551df9", "value": 11434100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778060015, "uuid": "43b4f49d-1faa-44db-a163-be5e00201da9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778060015, "uuid": "bac74238-5f33-467a-8dad-fbcd3958633c", "value": "iMobile Lite (16).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97aa3de3-4920-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778053975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778053975, "uuid": "7c04ea91-86cc-49fa-b9d5-cf2e1445f328", "comment": "Malware payload", "value": "f694401d8e80bb0f672b1b30fd7b153a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stowaway", "colour": "#5D23CE", "exportable": true, "hide_tag": false }, { "name": "UAT-8302", "colour": "#F096F6", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778053975, "uuid": "252050fe-11f5-44a4-87eb-fb3d1932b0fe", "comment": "Malware payload", "value": "7c593ca40725765a0747cc3100b43a29b88ad1708ef77e915ab02686c0153001", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stowaway", "colour": "#5D23CE", "exportable": true, "hide_tag": false }, { "name": "UAT-8302", "colour": "#F096F6", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778053975, "uuid": "0e42b3eb-6006-4a26-be6d-4a9d5c79073e", "comment": "Malware payload", "value": "3ddd90b99ee7ac3ec39e1d22b67c257d273a0970", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stowaway", "colour": "#5D23CE", "exportable": true, "hide_tag": false }, { "name": "UAT-8302", "colour": "#F096F6", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778053975, "uuid": "48446b03-1486-4f1d-b773-fcd1f376604a", "comment": "Malware payload", "value": "b86466493c6e1ee3f75669e93cf2f18b0d4633e4620f93e67bbd1d5e30af17b58f1edb5936990258fdda5ad64da5df91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stowaway", "colour": "#5D23CE", "exportable": true, "hide_tag": false }, { "name": "UAT-8302", "colour": "#F096F6", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778053975, "uuid": "8a619715-25fd-4a2b-aea0-cfb9c48ec06b", "value": "T18CB533A1C8519F01F07DD4B6E2369D49E3103409A653B8F5AD8F6B83F8BB9F18DA6107", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778053975, "uuid": "5ee1292d-7d05-4f9d-b29f-8263ecbd057f", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778053975, "uuid": "7e10e2c1-f405-48bc-a76e-c51a10433016", "value": "49152:nMIBv8Te0kufBjwujayPT0e7uGHxACEGeEV+6kEpiqIfWJycBNErhg2lThypWV/7:MIJ860nBjwujayQeX9yEofB+96rhgpWR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778053975, "uuid": "7ce4ecd1-82e5-4e49-a12f-516c72b57ed4", "value": 2278912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778053975, "uuid": "1c40dd0d-334f-4834-8c87-cffeb510e479", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778053975, "uuid": "d059e5b9-8278-4155-ad95-f2e9af6c9279", "value": "windows_x64_agent.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4304b24a-495d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778080033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778080033, "uuid": "e4d1bd5b-09a4-4697-a1e9-1c094411f380", "comment": "Malware payload (Mirai)", "value": "757eb4e3bdc7940461b2a2dd32f08b89", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778080033, "uuid": "a2d17f29-9eb3-4b89-ac8f-73d0bd36637c", "comment": "Malware payload (Mirai)", "value": "7c809d5aff37ea98b5cf2aa7c6b2148075f6a09b7d14dcbc10b3ee6313744249", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778080033, "uuid": "8ce2dab2-abf6-445e-ba8b-3157564f7fd4", "comment": "Malware payload (Mirai)", "value": "c46e46d637dc8b463ffec916d68f428e809dc117", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778080033, "uuid": "85aafd12-6c39-46cb-97d0-8fd2de3810d2", "comment": "Malware payload (Mirai)", "value": "589d5b07327cc7e1219cdd424d8d26a38d870bc1c316c637e5c08d2657768d3638f9220a37c8a4460db8077f5fe3b390", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778080033, "uuid": "dacd95ff-2901-4ea4-a434-916ece5b4d6d", "value": "T193434A50F8819623C6D1127BF66E468D3B2613E8E2DBB3079E225F2037C686B0D77E55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778080033, "uuid": "3f40fa19-750c-4746-873f-44d02c7227c8", "value": "1536:pjzQgyzv4qsU9KHU+0FQL2g4TtiCsyXvqnX:pjoQ/0qLh4p9ZqnX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778080033, "uuid": "1dcb1a48-f4da-4194-a7b1-8df4489d80a4", "value": 59640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778080033, "uuid": "88999c94-fb27-4e22-96f6-fe6326c829be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778080033, "uuid": "dca78886-feb4-4eed-a39d-f2e810c4cc59", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "882d7158-4961-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778081867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778081867, "uuid": "1cc82686-d3a1-47a7-8586-8fb3dd098e3a", "comment": "Malware payload (Mirai)", "value": "ec89c8cb9dbdf4bb969619a731370116", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778081867, "uuid": "fb061b48-6729-4685-99a6-35c3f614e198", "comment": "Malware payload (Mirai)", "value": "7ce8763895b52c9345961d321a95c1b2dfec59c24dd30873c9ebe191af1fd15a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778081867, "uuid": "ba49cff7-9888-46b5-b7d5-267bf4c539a1", "comment": "Malware payload (Mirai)", "value": "391fc44ff6b505400a663200655868549e5fb51e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778081867, "uuid": "54dc271c-d334-458d-9533-12a9cb7217c9", "comment": "Malware payload (Mirai)", "value": "208a6c403674572e74fdf1d5cc8f1768a6ee10fb676f921d1d65f4d88ddf1a7f566b8436a7073b9cec83b84a43fc2fb1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778081867, "uuid": "ca18ec38-ebda-49d4-a28e-8b3f2bb1641a", "value": "T1A57302BC38E67675C2B4EE34E0A16F67D30219F5C9F42AB8065E81BDA1C3685093D6C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778081867, "uuid": "58637133-d173-48ea-a731-5ef2e457491e", "value": "1536:uQIxauY2ZZwbT2lFpXYVGXIK3DColyLDV6AJixzA:uHauvZZwCFpsGZADVNO0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778081867, "uuid": "e1a9a6d0-dbdc-497d-94a0-cbdd5864b32f", "value": 75020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778081867, "uuid": "b7f07c01-56dc-48d9-ad63-71c720b07862", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778081867, "uuid": "de943b2c-e4e5-41ce-af5b-c468fc0def07", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a37d70e2-4987-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1778098233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778098233, "uuid": "5288d486-87c0-412f-a270-b3c38f51f7df", "comment": "Malware payload (Phorpiex)", "value": "bbcd4e9e8cfd4d808d5bc94494fe7cb3", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778098233, "uuid": "1629444c-8867-4e45-a8ad-bc12840a6e6f", "comment": "Malware payload (Phorpiex)", "value": "7d1aaf2bcfcf46cca7a584c92bc50c56cdd44ca67ee136c1939837ab26369a80", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778098233, "uuid": "65188bfe-a825-40f8-9cb7-d3637f0987fb", "comment": "Malware payload (Phorpiex)", "value": "0488dc2be47bda078a89bc79ad0eebd083bc0649", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778098233, "uuid": "29b7e757-fd6a-4b3e-ad00-a582e3487a89", "comment": "Malware payload (Phorpiex)", "value": "b7403a5baab7eeea0b26c74dd166590e83b269dce494796e9e23ab59141d88e83e24556d70c78b7351b1b5b981f35309", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778098233, "uuid": "d1da4f63-0e3c-4ec7-841e-28b73411a579", "value": "T1A5824B0FB9424216D0D200B49A76867BD97998B637C814EBF7D08AEE1B686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778098233, "uuid": "20de141a-e453-4ae0-b2f3-c37f3b1b527a", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778098233, "uuid": "95fa16e7-4083-4b19-ad37-885850700502", "value": "384:/I78VGQic1/wzw077u9NHu/gBhav8U9cO:cA/0769Zha0U1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778098233, "uuid": "fa2f5e5f-4e05-4f7c-93c7-a8d59c24dab6", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778098233, "uuid": "170647ac-9d03-4313-9721-d8ca76a72b2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778098233, "uuid": "bad548df-13bb-48ff-bc6d-2b9f466a3394", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "746e5f87-4931-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778061218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061218, "uuid": "9a76c746-b147-4ddc-9aac-a64d1b599ec1", "comment": "Malware payload", "value": "b0406736e725dc250d308a0f751adf11", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "jio", "colour": "#F8B52F", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061218, "uuid": "5ae15660-a737-478a-8eca-c90f03083938", "comment": "Malware payload", "value": "7d6ac48ed7d8a221b41c6496c6fb859513eb2438bb9b7a02cf6a93e1ee84b3b4", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "jio", "colour": "#F8B52F", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061218, "uuid": "b1543ecb-c7f0-4299-a518-52166126dbad", "comment": "Malware payload", "value": "c934bffb5004e9c09884ceda258d3c520c99aed5", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "jio", "colour": "#F8B52F", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061218, "uuid": "72a14239-61dc-493a-a151-8e2339c9aa1f", "comment": "Malware payload", "value": "763ff394756235a5fa731b15a39ca706741f278f68543d31f8af3e7ae1ab537eb38639e8cc5baa03e52053c1f44614a9", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "jio", "colour": "#F8B52F", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061218, "uuid": "199052d5-e54d-4e81-b73c-e4f5a0c7f1ed", "value": "T15AC6124AEE58C86AF8F69239FE23432734235D680713C07B956DF6393E732C28A915D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061218, "uuid": "aa7f3965-10b7-4fa1-b6f1-127622867083", "value": "196608:VumowEg8RikEGqXsdPmP7/H+gToredrY1l0E80BV4a3f:CY4lWX57XTIel8XIaP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778061218, "uuid": "4901a497-8884-47d3-ab1f-a321c22b4e4f", "value": 11924282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778061218, "uuid": "e00ae753-dbc5-4490-80c1-fad86f3de041", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061218, "uuid": "15763399-73c2-486e-8f1d-f9eef1e89eec", "value": "JIO COIN.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "377da463-4924-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778055532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778055532, "uuid": "98361d0b-04e4-445d-90b3-62c1c9a8728b", "comment": "Malware payload", "value": "b1135bce21005a199cea4fcc8121da86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778055532, "uuid": "21f93e27-29c2-4706-adeb-97f2d4b50578", "comment": "Malware payload", "value": "7e48e43f3231d8e9f8017c41df32ae966493c9f69ab6ab7703190bba384ed8eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778055532, "uuid": "079df9f3-7d58-4214-96cc-f2e29cd994d4", "comment": "Malware payload", "value": "5ccd14eae1d110d39beb6fca39f3db75cbdbbb93", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778055532, "uuid": "e63d0ce4-5741-4e82-94b0-fd6400ae3e7d", "comment": "Malware payload", "value": "c10fe4710eaf7ae9e29086a4d9f766ef5694f55f4ff527b4e9afcaac54fff17248ec8897c460236cd5263d8f0ad34f1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778055532, "uuid": "715e7d87-9591-4325-acaf-c41a4f48e7ff", "value": "T137159E5AF2F334FDC067C030835BDB626932F46551226D7B21C4DA382E96E741B2AF66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778055532, "uuid": "c3c71229-1761-4997-b76d-b80ec9ce2049", "value": "12288:IGkCFA5H8YqVJMa4v7tH7KMukmyxiTZ05kyIjkRKviT:IvCi5HiVJMa4zd7iTtAIwRK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778055532, "uuid": "7b8e43c1-e1da-4094-b86e-be5f37ba06e7", "value": 910008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778055532, "uuid": "012f52c8-2c21-4979-8b9c-4e6ce22b78b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778055532, "uuid": "f8065c58-e8d6-4645-8769-dca325340c04", "value": "bot.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cec5463e-492a-11f1-a769-42010a9c0008", "comment": "Malware payload (Koadic)", "timestamp": 1778058363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058363, "uuid": "df181225-f9f7-4233-985b-5c55e86e99ef", "comment": "Malware payload (Koadic)", "value": "a706aaa828941f57bc212e1b546b3648", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058363, "uuid": "626e954d-e08f-4a6f-9967-5d465768351e", "comment": "Malware payload (Koadic)", "value": "7e932acbc4767d4874eb7b0f74531963d61067c2bcbb031bbeaf96cd5679d816", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058363, "uuid": "209aaac5-2d89-4905-8ddf-b881c3f0e29d", "comment": "Malware payload (Koadic)", "value": "cc4be1a5698f1d3b98174fcc2e8df79a67e969bc", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058363, "uuid": "6fdc4203-12ae-4383-b180-08e7dcef5351", "comment": "Malware payload (Koadic)", "value": "9b14b514b0bb0b005abf6f8d21086446cba8dc797a59559bb6da2203adc8f88a0ff05225b15c02b0df5d87a9b4f9b1bd", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058363, "uuid": "6eba8da3-f9a9-43cc-85de-7ceccf311f42", "value": "T1FD9281308EA3E54F62C12F415452646CB59B5ABF1CA78991E0002A1C6EDD3DF5DF3F46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058363, "uuid": "57992381-8282-4b0e-88bb-1615d78099e9", "value": "384:sKSkjd0/dbxJ3LJe7l/AGm5kXHKCV641sL3mr8byYCwKb8H9GMz43egqo0B7fzpX:cksrLv7py4dQ1wEOwyqP/A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778058363, "uuid": "6141e3dd-5bb9-4dda-929a-33f616cbf778", "value": 20999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778058363, "uuid": "7301ce29-b300-41c4-b82b-29d7ac683855", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058363, "uuid": "49fb2698-da4d-472c-aeda-89cbefbd116c", "value": "Unicredit Banca_Bonifico Bancario.pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68e34b18-4920-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778053897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778053897, "uuid": "24ab49bc-dd95-4f56-bfa7-fbfb23f6f783", "comment": "Malware payload", "value": "c9f19c180a9751ed98f9292c47031b89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778053897, "uuid": "85349c2b-ecef-4fcb-98db-c102998d5167", "comment": "Malware payload", "value": "7eb9120919d5aa9e1a6afb4e2595ceaa91dabcf0a1af4acb06e53fff137e741c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778053897, "uuid": "eed429a4-960f-4491-8c90-1d2813f130c7", "comment": "Malware payload", "value": "4544643679ce71ec6e08260f541cf46422e28f63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778053897, "uuid": "1ec7f2a8-68eb-45ec-8c55-bb4965d0565b", "comment": "Malware payload", "value": "42d3f044d392aab08da3a64f52373dbfdb5532ff4c921e9da927548f549722ada534810501729329b7dd21740c701d0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778053897, "uuid": "6030a04a-4f23-4af1-88be-5f619107cb0d", "value": "T1A5964A43ED9254E9C5E9C134C9768366B7317CD80B21A7D72B64A6763E337C06EB8328", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778053897, "uuid": "adc73be3-0df7-45e7-9b81-d8f4cba7b07f", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778053897, "uuid": "58a7672b-fa4c-4f89-b908-fb9e98a26617", "value": "49152:e+G1Ubsx8rb/TSvO90dL3BmAFd4A64nsfJ0UOU+kFTQkSm6a7RLXL/A2MK5ljoOT:e+GtoNnIeL0GjoO7yAcDzVPE/75hyE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778053897, "uuid": "7f451270-df39-4939-9561-6304b5018e35", "value": 8887296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778053897, "uuid": "eb307041-6dda-443d-9f5c-95b791c5d3ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778053897, "uuid": "caa5f19f-ba93-4d21-a125-ebffaf8618ad", "value": "7cfaee97-b7bc-4aac-a09e-55f259805ae4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f45df40-499a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778106145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778106145, "uuid": "8feee9e5-9acb-4875-b136-f5ad4b31909e", "comment": "Malware payload", "value": "6c4d8d0ac82ae03aa136acfd02ea1002", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778106145, "uuid": "96818dff-9b4c-4f53-8710-6ec101a409e4", "comment": "Malware payload", "value": "8051cad205995f09812a65abe67d8759dd0f9d4eb821e22be9cd4dbe51ba5f7f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778106145, "uuid": "73f30951-4ce1-4280-93c8-d57ff7ee61d5", "comment": "Malware payload", "value": "96f1210af502e15dadfcf8364bd2dbc6b6df25d1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778106145, "uuid": "6cdf5e16-0983-47f8-a00f-ba23163366d8", "comment": "Malware payload", "value": "ef3ba44647dbdb490615300633b8f183ac00e60b40145e404048eacdd922c91863bdbf3b69642fb8fb29caf8969c5e44", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778106145, "uuid": "585c141c-d72a-4f19-9c72-bac4954b294f", "value": "T149137D6956857C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C49B9CE21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778106145, "uuid": "db9f036c-83d4-4c95-9d26-39833a4e158c", "value": "768:br+I9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:br+Vco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778106145, "uuid": "6c3d654b-1125-4d36-a3d5-f1feb77de6e8", "value": 45444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778106145, "uuid": "94c026b4-520c-4c3c-9327-cf08bf22e218", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778106145, "uuid": "5cfa1281-37b3-4100-9235-4040c700b1cc", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee8218ed-4928-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778057557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057557, "uuid": "a7402837-92a5-4cec-abb1-71019421a336", "comment": "Malware payload", "value": "f0a6e940b6f22c168d2bbf1d1a67a113", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "M-Pajak", "colour": "#566AC3", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057557, "uuid": "c9f05693-2977-414c-90ae-6b926bfd0d74", "comment": "Malware payload", "value": "80c2a67d893f560488cfac7ccf29956d122377ade9edf627a73f505821bc12f1", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "M-Pajak", "colour": "#566AC3", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057557, "uuid": "d0331a3b-bac2-42c5-b21f-678237fb2dda", "comment": "Malware payload", "value": "ee14de538cdcf25b0540b03b853324efa3319694", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "M-Pajak", "colour": "#566AC3", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057557, "uuid": "c1afce70-4309-420c-9663-cb31d34b89d4", "comment": "Malware payload", "value": "ee9d422ba0bfd147eb430524b21d60ededcc8013338a799c26803c24c253791b62aec0c87e73ad4a11267dd1aaa80fea", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "M-Pajak", "colour": "#566AC3", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057557, "uuid": "282d754f-c1d1-4ef8-868f-3b3349545e33", "value": "T1C247E105F20C662AD9C6F07DAD8605E1B536BC8A6350C5463537B32DFAB3BD48B267E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057557, "uuid": "9643e6a7-30d1-4c11-92b5-7452afe42cf4", "value": "196608:6SQvOUZgB6v0PaZKs1sgAXFNgI7a7/Y3Zu9yzhLrZy6epA0D6yHnFphvQwo2b8+7:6SuOM9Myds3FNgIuM9zhL9RNw5Y0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778057557, "uuid": "f4adf4d9-b4d8-4780-bb7f-ed26d5c9ffeb", "value": 24613433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778057557, "uuid": "f8d99993-d179-4f51-b488-586804e937a2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057557, "uuid": "31b4aa3d-33db-4303-9cf9-2c67ff7e0ee3", "value": "M-Pajak.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "502f7c38-4930-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778060727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060727, "uuid": "d981a694-9536-489f-9131-7ef188599efd", "comment": "Malware payload", "value": "5746b141ef80a8cbd1b55799032edefb", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060727, "uuid": "ba468577-d670-43a5-a090-1b88987d6fff", "comment": "Malware payload", "value": "8360ffa40cf66d481b18c65b5172af4aec2cd4e7cd97d3b93a00241417761e8f", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060727, "uuid": "4bf88b46-9c03-423a-8e6c-951064cf8254", "comment": "Malware payload", "value": "ae54a02d3f0137ee11f6d72deebc9a6d105dd3cf", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060727, "uuid": "64431124-4713-4cdf-8827-64fe850f5c68", "comment": "Malware payload", "value": "a5a038c8f5d6c23f257d124c3424432fe9bca99dbcc292bb1f26894e9fef3c176aee6cde4de5fe3e16aa5ede11d8b805", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778060727, "uuid": "767c348b-2e66-47c7-be24-5c2dc615275c", "value": "T1F7E61217F719AC6FD8F7A335BD7A42A210156C258F03E18B7828B33D28B35C56A9E5D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778060727, "uuid": "35508302-68fa-481e-b179-56ddf73c9a98", "value": "196608:KmbdYXxDeIgMUnIJAoH50BLda7EM7GvVFwo8agHHcFl5SoXDNSCajr:5dCDeIkpoH5mxMC9FwaGcFlAoXYCaX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778060727, "uuid": "84fa6189-079e-4bfd-8738-044a63cc6d9e", "value": 14157424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778060727, "uuid": "44434a66-3185-4122-b47d-7e84db8d0d7c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778060727, "uuid": "64821ff0-9d8c-4ce3-a8aa-b1422a3e95e2", "value": "mParivahan(23).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2efaac6b-492f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778060242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060242, "uuid": "45d36aee-44a2-4369-ba9d-a3bf8792a48c", "comment": "Malware payload", "value": "15ced8d9c74d0214f188067cfa2f839e", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060242, "uuid": "80451575-f4a2-4eb8-88a2-7bbe58b739b0", "comment": "Malware payload", "value": "836618a826dd7bdc7549d3a98db95f8a1eb770547b2fb486df33e1d4d55e3745", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060242, "uuid": "19a44d89-edcc-4584-ad72-f051c6f551bf", "comment": "Malware payload", "value": "df93a764f4a3bd9e95c20fd70d4c0278799b1e45", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060242, "uuid": "f042cd97-1141-43d4-857b-7dd311545aac", "comment": "Malware payload", "value": "c4f8ff224b15151c333cc7689808b05d3af4b757281e9e0e2f48f561f4a444f5beb262bbfc51b20437f27d2b108cfcb9", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778060242, "uuid": "24303661-9c60-456e-b244-c274a56a4db7", "value": "T197E6122AF6496DAFD8FBE334BC7A026250155D258B03D5877938B33D28F39C59A9E1C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778060242, "uuid": "fe5c9768-c2d0-4806-bb4b-76ce5ff8b6f4", "value": "196608:DUnoP4geVCcQBvwwa4J5nLqCFjlLCtNrY4vonggsrXDBv73uhtY03l3B5EKMM:AoP9oQBgyFLqCFtC3YZQBruhtt1R5EKH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778060242, "uuid": "92384306-dcd9-4182-b698-71ca57fb4aed", "value": 13952600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778060242, "uuid": "f69a1c60-3aea-4b62-bd9e-cff68479728c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778060242, "uuid": "d9bafd9f-294a-41d5-874b-05aff63c85b4", "value": "iMobile Lite (17).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14df281b-496f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778087686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778087686, "uuid": "8f02ea5d-9389-40b9-9d86-63889922394a", "comment": "Malware payload", "value": "2e6963019a7c80d92ab9e5a43a9ea9d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778087686, "uuid": "91e05943-77cb-4e4f-99e1-b777313091cb", "comment": "Malware payload", "value": "85d6ca930f061c2bb8fa140d11604b1327ed766ac5599c3ebaf86715913381e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778087686, "uuid": "eb0bfd96-4832-4a89-b404-88badb7abdd6", "comment": "Malware payload", "value": "48b06ec1e8a6b0ae388696f4577b193cc90c6f25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778087686, "uuid": "6dabb6b1-4e0b-46c3-8bd3-8b4094b0f692", "comment": "Malware payload", "value": "f6779ec98fceace6006746b0d6ea41eabfd3d503dc91c5449e08c3c9cd1e980f85d53a4b84c2aa7fa1374fa86a6d82c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778087686, "uuid": "42e5aa5e-276f-4fd6-8541-eeeed0da9044", "value": "T1AE069E16E3CC4B95D45ECB34CB1BD723C2B1B8274736B18F1596274A2EB7B921B3A601", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778087686, "uuid": "0fda80c7-5cb5-4336-bbd8-2332a02ba3be", "value": "1fcdac1089b095e7d22e41c005f74d9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778087686, "uuid": "fe667e13-ae85-4cd1-94e8-30595e65e604", "value": "98304:tg9rN9TZc3wJfwxRKHTEIeg+ATRb7ksAd33fhuK199kVsOW:orN9TSAJfwSzKg+ATRbFAp3km", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778087686, "uuid": "ba384151-5d0a-41eb-b595-942220426d0f", "value": 3878400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778087686, "uuid": "63624b02-3e7a-45bf-bbcd-2d06d02f0c62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778087686, "uuid": "47c19ece-4036-424c-bf75-fd3b3fab7363", "value": "WTSAPI32.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc5f168e-4927-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778057043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057043, "uuid": "feb0bc89-0c94-4a93-989d-a1059394ae7f", "comment": "Malware payload", "value": "47710694c1df1710d2ad8dd9567db64d", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057043, "uuid": "135bf0f4-6ead-4c9c-b4f2-98201dd9746d", "comment": "Malware payload", "value": "877bda655f641698c3a49a8b8a37e173710c328ab52b0fb731142f3570bc5e5c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057043, "uuid": "20a49a71-4608-4de3-bf6f-e8d6484b3309", "comment": "Malware payload", "value": "d7468989fd712d2c1a0a9aa9a870c55494e36935", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057043, "uuid": "d0a69f6b-0c47-44f6-839c-536e5f65b522", "comment": "Malware payload", "value": "46d4a7d84cd008fdb9b2356a7f1c9a850f67c04f4560eefb1c5ce7379542804cc1e3b16202e62c9b8a7a770b81249b23", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057043, "uuid": "87d7659b-c8a5-45fa-9c9b-acee057d0fcd", "value": "T1ABE6124ADE48C86AECF6533AFD32432734236DA84703C07BA5A9F63C3E775C64A91591", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057043, "uuid": "5d6c2e77-f730-43dd-8949-24b4bb8f6ca0", "value": "393216:P2alsHaTiEYQHwTKZ15M7OoWfOlA6CbrUIbxv+G55:tpTiEYQP1M4fOlA64XxvhH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778057043, "uuid": "df6d1ae9-df1e-4fa0-9816-df503ce1c67d", "value": 15188782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778057043, "uuid": "397ff5b3-9cb6-4668-a922-2481620f4cc6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057043, "uuid": "f35601ea-5007-415f-b965-18a167085189", "value": "Indiemobile APP (4).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "860e95ca-4934-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1778062536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778062536, "uuid": "9641179b-c88b-45f1-85da-d5ce6734e17d", "comment": "Malware payload (Vidar)", "value": "2985dfae86eabff3744168adde9eafd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778062536, "uuid": "ef71133e-27ee-4ef9-af8d-77d9cae247e0", "comment": "Malware payload (Vidar)", "value": "881acc10744a5ca668d9af86c2b605415585f70ae4ec50a7ccd16680339bbc99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778062536, "uuid": "b6b2834b-bead-4de8-8b88-9b8f65f54dda", "comment": "Malware payload (Vidar)", "value": "5c93332596bc2ea0f45474eaa0df39295edf2e8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778062536, "uuid": "7a2e0a03-f638-4d4a-b62a-3cea28a9919a", "comment": "Malware payload (Vidar)", "value": "818b21bc4a38d2b97269aae2a22a304bb6d72299787875e06785cfbd1289a5b52c7f987948f73f40589a0d282ddfaa2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778062536, "uuid": "5f97d036-b147-4dbd-8644-c0c101798890", "value": "T1F4A55B02389105BDC0A9B73249F27682BB35B8190B3677D32F95AA783F37BD00976756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778062536, "uuid": "7f3211d2-9adb-4a62-b5bd-8efc2c39443f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778062536, "uuid": "d2cd7bcd-7d9f-4cbb-a551-20d3f98765ca", "value": "49152:uOlevIwI9JXrWe2syHaj7bZDitGsIROyrT:uADQG1pn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778062536, "uuid": "75fb9433-54f4-4098-b4d6-2bcf634637d4", "value": 2080376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778062536, "uuid": "1925d29d-99e7-446f-8c0c-bc7dfe654d4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778062536, "uuid": "be19323b-5d6c-49cd-a888-2314a2922ba8", "value": "2985dfae86eabff3744168adde9eafd2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43f59951-498d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778100650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100650, "uuid": "287aca05-ebef-4f36-9690-e674ca8df8da", "comment": "Malware payload (Mirai)", "value": "ecd47b73063a29f2d4e69e20e8291e91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100650, "uuid": "c9400725-b74a-400e-bbb1-aa425dbcbd1e", "comment": "Malware payload (Mirai)", "value": "882e601e3576e3abb4de5bb35447ca23c93a220e0e2b95a8f8d03b50bb919f5d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100650, "uuid": "8491c82f-5c61-4eb3-82a4-336ce669fab6", "comment": "Malware payload (Mirai)", "value": "6e5b89a0297dd9a8c279f61d76b8e2f7eca82891", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100650, "uuid": "52a89ddd-f7ba-4b75-9312-dbe2ac7a7f21", "comment": "Malware payload (Mirai)", "value": "41d6b2a485dbe4114139f35332d56343e242ecc6acc9913c94b20816b3f619cd590c253aaec3c26d71e82b739be5005b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100650, "uuid": "eb2cd271-1973-4935-8367-437295901a10", "value": "T13D43F161D34B85BECABC187F585FCA4C38C932F5F3A7A703926011283DE5759895E1CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100650, "uuid": "ce0723f4-fc29-413d-9d3c-5c21f4d2f961", "value": "1536:JvE70FbMxrLfBhCcwt2QU0ojDiUwMzOmqlaUK30tBL1:Cggx/phZwaqU9KnaU+0DL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778100650, "uuid": "6579a406-d63e-47d9-b0a9-bf2669965ac1", "value": 55944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778100650, "uuid": "77db8e97-78c2-4bd8-8d5f-97ccb500e2d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100650, "uuid": "d303db4e-a0eb-48ea-b2c5-949218153a9e", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf4c7e97-497d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778094012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778094012, "uuid": "b98b919f-2fb8-48d6-a698-647ee003dedf", "comment": "Malware payload", "value": "59a5b185092d4b710dd25265cd387b05", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778094012, "uuid": "f949471b-9f2f-4da2-8769-0e792253e2fa", "comment": "Malware payload", "value": "89d3177d424b3a3d042c6f015962ff07a0d8772dc13ee09114d2923c6d88bb2d", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778094012, "uuid": "40325c89-892a-4493-b4f8-1074d44157cc", "comment": "Malware payload", "value": "12c2c313e8a67a9dfa2cfbbe5b76f76252d8b426", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778094012, "uuid": "df161594-ab45-4a30-ad06-0e90f65d517f", "comment": "Malware payload", "value": "11c8f3611479a4d23ff18e29a2e10d26e92f6a453d39f621391fa069355b867e0a635f43619919110be349a22fb32aee", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778094012, "uuid": "0e4531ed-0d5c-4861-b5cd-4d062bbe4c8b", "value": "T111037B9E87540B6DF7EC0BC890CE299A42F1C1173C2C255EABB355C3F83BA197475AA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778094012, "uuid": "546fb752-f729-4abf-94a3-77de1bbc00e7", "value": "768:R9Gm2ZQL2ynnYYRQ3ewJK0fuftq0AEomgFweA0GAD94McX:KSL2ynYYWkBAEjLltFX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778094012, "uuid": "2cdb5523-8b31-4ed4-9729-7d151b5753ce", "value": 39033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778094012, "uuid": "41c948b2-cd72-4e60-8b20-43cdafbae863", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778094012, "uuid": "0a10a53f-5a26-4758-a6d1-acb00c06126f", "value": "rleia-me_iuvmwpnneg.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08b87a4f-492c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778058889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058889, "uuid": "3adea6f3-31ba-47b0-8e05-f76f6c990012", "comment": "Malware payload", "value": "a2a97ab875a4a6ccea0ad3f024b42781", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "indusind", "colour": "#495C30", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058889, "uuid": "1c1bd8b6-7e1d-4ead-8bca-033302bbed19", "comment": "Malware payload", "value": "89f9f4fac3854cfd0cdec46a5a6b7f605df4a65d7c4745fb7f3dde79cc5c2d35", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "indusind", "colour": "#495C30", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058889, "uuid": "c862eb07-2480-4d1e-89ee-3de4fbd7f454", "comment": "Malware payload", "value": "aec9a8b44fdff04d3bf24974593cd94e5eea22e6", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "indusind", "colour": "#495C30", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058889, "uuid": "be1245a1-a409-4425-8e6c-512c9829bfc0", "comment": "Malware payload", "value": "be0bb5a83b338222e9a138be7696964ce0f8e506b304fe285f76345eb1908b1c6831c32da4be49141b95c25b5f232cca", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "indusind", "colour": "#495C30", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058889, "uuid": "cd4be4b7-9eff-47d1-864f-5eecf8639560", "value": "T1E5E6124BDE48C96AECF69335FE32036738225DA84703C07B6599FA3D3EB35C24A91591", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058889, "uuid": "7087e161-4ae0-4494-ae83-a636b6f42cea", "value": "393216:XGbVXMerxOwI3x0lCc9eizvTZotYfRcB5Tkz:2h8nwIKR9eiDTStImTkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778058889, "uuid": "145aa4db-ab84-4caf-b0be-c2319cfb8e61", "value": 15196966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778058889, "uuid": "edb44fcb-165b-4e77-abbc-6e5873b304ac", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058889, "uuid": "7f2331c8-3bd3-4b8a-a63f-311a8a04085f", "value": "IndieMobile App (5).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65e34a76-498d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778100707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100707, "uuid": "ddfefe3d-c2f3-4820-a58f-16dd6607ef53", "comment": "Malware payload (Mirai)", "value": "0f47fa2b4bba8cc6f6bbda4de0eb1533", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100707, "uuid": "6c64ae71-688e-43d6-81a9-86b7a9c4e75c", "comment": "Malware payload (Mirai)", "value": "8a3c2d71cfb9d5b1aa51365b7433223b90c0704368c784e7e85a22e2d7ef5d69", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100707, "uuid": "0c772db2-cc5b-4511-949b-33ce8421894d", "comment": "Malware payload (Mirai)", "value": "fce43247237f26dacf34e7ab0306e7337aadf2d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100707, "uuid": "27e90269-9208-4241-8deb-cbe031c10169", "comment": "Malware payload (Mirai)", "value": "12d45b816bf13af064410adfdeac0952febc69156cfc4ef97209befa87c43b4a24f7928adad729b65fd7913d0e9212b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100707, "uuid": "d937486e-d5ca-4663-877c-f5ecdb569d5e", "value": "T101E30846F8819F12D5D552BAFE0D124E37231B78E2DE73029D24AF21778A9BB0E7B405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100707, "uuid": "7f3bf47e-7090-4281-9c4b-f15e9cee7f65", "value": "3072:gS7oTuzHgH+i/Xvt4KZh3W3GWeM8agrR8k+:lUTuzHgHVXlZh8GWeM8a45+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778100707, "uuid": "0811a85b-0e00-4efd-b914-7f65223e6711", "value": 150620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778100707, "uuid": "a789c406-bcca-4717-8f96-2eeeabe80509", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100707, "uuid": "628cef93-f679-4255-8dcc-b5e9a6aaf801", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "327d1280-4948-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778070985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778070985, "uuid": "379503fa-e726-4fbf-acf3-4e31068c482f", "comment": "Malware payload", "value": "77023b3704f00c992398dbe874767e30", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778070985, "uuid": "b6480e1c-912e-44cf-897f-18a26b6d7688", "comment": "Malware payload", "value": "8abd96dba6d696aa01d9e1b23e25998e79a9c15f2bfa8f4e4d33d822074a702c", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778070985, "uuid": "a54a9edd-64c3-4447-98f2-e7ab4a115a86", "comment": "Malware payload", "value": "b567826f81ecb13fd4121620b33fcd20f8536396", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778070985, "uuid": "a01c8da4-ad66-41d1-824d-b7ee28820c9e", "comment": "Malware payload", "value": "2c1840c6df9319496bd5d1764f6cdf601828fa80db790ace7abc75ef8d2492a9e61d9c7d0c8c8f19d5d0fe73bd75a3e1", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778070985, "uuid": "29f2af56-2d92-41dd-b2aa-795462706ffc", "value": "T10EA55C077DC119EDD46AAA3289B662917731B84D4B3623E31E507A387EB3FD05DBA700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778070985, "uuid": "2d4e3f0c-86a1-4005-ac34-167c83a29979", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778070985, "uuid": "c87e38a6-5438-4c0e-a7a6-02f68661a2ec", "value": "24576:PGSE02C0FuJhMr5LpH+ik/DIhpVPmPmqusPNGVTvDuYTOtPQBN:PGSE0gFuJhMrmikiPekVfTf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778070985, "uuid": "5c2ea084-acf3-4f71-8598-e271412722e3", "value": 2135168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778070985, "uuid": "0a0aa05d-ec97-4589-a377-63543139c269", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778070985, "uuid": "6dbff63f-9326-418a-bbbb-d52fa637636f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e57f2ebd-48ee-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1778032631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778032631, "uuid": "c79cee81-699b-495e-a2ce-5d2de19cba55", "comment": "Malware payload (Joker)", "value": "f99760f25ad4618534321a80a401d82d", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778032631, "uuid": "e479d454-3f4b-4c7d-ba8f-bd9378f5c755", "comment": "Malware payload (Joker)", "value": "8bd5750aeb4aab29f7eaf2c0ad1e1b0f68baa74266f0681773230a95bd5a99ec", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778032631, "uuid": "0b3295d0-8df0-44b6-ae22-5d19155d50ef", "comment": "Malware payload (Joker)", "value": "70a0dd48b7c75159c64896e1d4d7fff37321a572", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778032631, "uuid": "18786e99-c12c-479f-8ac7-231968e65d29", "comment": "Malware payload (Joker)", "value": "1c6b19deb955713b8032813e14bc3a5a459a40e78176d5634df10e49e2a4cb798d4ba3ce1d0925ba01cbc82e8a7e4964", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778032631, "uuid": "f2b6b5cc-66be-4e9a-8551-c0f1d16469e2", "value": "T148E6CF49F91CD42BEEC9B0BC8D8F07D3B56678151614C18B2822860DFE937D4AB66BF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778032631, "uuid": "f638b17b-3965-401d-bca5-574a9a80c121", "value": "196608:dhArIMNp8s44NGfHpwbXelVZUIPgorQxCunKGjKwMuqBW701QCOAlE:dhdMNoHHpwbOKorQxCuKrW701QCFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778032631, "uuid": "1bb3276c-7d22-4d1d-83dd-7c09b749523a", "value": 14892359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778032631, "uuid": "07e6c3f8-cbc7-4e52-9181-9a5c760fb4fe", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778032631, "uuid": "055d4ac3-c2ff-406b-8072-4d5f9c574640", "value": "Fast+Text+Messages_2.1.6.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdb30301-4994-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778103861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778103861, "uuid": "e3277c1e-42ea-41bf-9581-2cd2c1c41713", "comment": "Malware payload (Mirai)", "value": "adb11670e18adeb03505aa61e726dbe5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778103861, "uuid": "c458927d-8b8f-45a5-a73e-2347f2cdb725", "comment": "Malware payload (Mirai)", "value": "8d622315e90b9422c28c7bbc722eecd14f6ef9a61f90245919abb72cf5b914a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778103861, "uuid": "ee3558c9-8006-4ee2-a60c-90126eebeb71", "comment": "Malware payload (Mirai)", "value": "dcadac896a9203fb6e1d938fb69f9c4ea1cf5346", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778103861, "uuid": "3877a4e1-d41a-45bd-8546-f0413ef09c54", "comment": "Malware payload (Mirai)", "value": "b6d7b45b66984031190ad673b038e54ffe9fd03283905cff4eca83e866f4503290dcd2711312d2abfd9fa43ddc18c5a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778103861, "uuid": "714e6f49-b1b5-49b6-8b97-ca9fffb3e8aa", "value": "T1C153F856F9829A11C5C403BBFE1E118D331377A8D3DEB2139E116F21BBCA5670A7B462", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778103861, "uuid": "dc7b476a-eea8-4a3c-aaf5-a795912d01d8", "value": "1536:2Enl0J1z0IE9gdkK3Jgxoy+UQJrPjP3IUiMTyPF0QCwbZn:70J90IEck1xoRUETyPF0XwbZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778103861, "uuid": "96d23b85-eabd-4e8c-872a-95efa7df0226", "value": 62796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778103861, "uuid": "60ac4d26-9955-4377-8f10-3be862c21910", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778103861, "uuid": "9093305b-56e6-4299-96fe-048b0064ba59", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "031340a6-492d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778059309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059309, "uuid": "44883787-1116-4396-9748-49d2910d4373", "comment": "Malware payload", "value": "d6511c84da303ed2a93dab5c91538b7d", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059309, "uuid": "65995930-995c-48c0-a4d4-b06ff0b05ddc", "comment": "Malware payload", "value": "8fd5b8db10458ace7e4ed335eb0c66527e1928ad87a3c688595804f72b205e8c", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059309, "uuid": "4b0b97f4-610c-4b93-80fc-9a0bb3320dd7", "comment": "Malware payload", "value": "e47a68b3c0d40178e41c817b309da9c4462b4793", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059309, "uuid": "700621ac-ae2b-4cd0-bde3-b5377a99dda5", "comment": "Malware payload", "value": "4b41f2b5e25183b2d0059b32d935418894b5c1ddb11ceeca005dff197b78f7bc3351c424d0fbb4c4cc0d3ba21d3f2fc2", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778059309, "uuid": "e74d88bd-5e61-437e-a151-841231b4e563", "value": "T139C4296322D51C22C1BAF6BE454B4F1CF971FC02C74617A16BB8420DAFBAB2245759CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778059309, "uuid": "1377edb7-69b4-4b28-915a-c94f1fe6b790", "value": "6144:NzC/A/9Ncae6O+swtWVu0AGv2I2xklMMYjq5:Nzj/6wWVu0AXIBlM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778059309, "uuid": "23eda9c5-9e2a-4afa-8e00-cd3f953554d4", "value": 556208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778059309, "uuid": "987df2d3-24ef-406e-887d-9263edaf73c6", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778059309, "uuid": "0ea6f643-04e6-4180-a100-63616b92310c", "value": "Mac Password Popup", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9d835b2-48ff-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778039886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778039886, "uuid": "66294e63-debe-4c8c-a3d0-db91591a5bf6", "comment": "Malware payload (Formbook)", "value": "9b7872e358b60398194cae8590725a37", "object_relation": "md5", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778039886, "uuid": "947452ea-2cff-410e-a29e-e2ce2ff9fd41", "comment": "Malware payload (Formbook)", "value": "900fde10fd6e49ce75befb962f37f741476b20ade4ff64d6605d06624b071cc5", "object_relation": "sha256", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778039886, "uuid": "6831f311-91de-4f46-81e2-9787c340b660", "comment": "Malware payload (Formbook)", "value": "824a72d7d4e044aa7f55e0c74f7b777f141366c2", "object_relation": "sha1", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778039886, "uuid": "e900fa77-42e3-4f4a-b8c5-b048e5bc7187", "comment": "Malware payload (Formbook)", "value": "80c6f9a88967c02132864f17822246cb4f6dc891e388ee4b4d903d1d6da654d64c0c6695482fa171e9ae91f8e9e02e3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778039886, "uuid": "f362c37c-f1db-4df9-99b4-58ff4c229b23", "value": "T1E6E55B17C66F574E18097B61106A5D9AFE89CAFCEF726BC4E0CF90B214EE1110B852B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778039886, "uuid": "53fe998d-e792-4b99-97f0-649c247196fa", "value": "49152:mm24A7q2xOcnmlYpUcewufscEbiHh/UMErnN3U9GqiuFosCxgp:x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778039886, "uuid": "34e8389c-df14-4e8b-83e6-8844b137a322", "value": 3096487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778039886, "uuid": "b5e0789a-9d3d-479d-b17b-c754dc7b1faa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778039886, "uuid": "e148b898-ea92-4038-b40a-cf0cbed51a82", "value": "PO260506 Inquiry Taiwan-USA..js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1163885b-4948-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778070930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778070930, "uuid": "03ba92b6-74dd-4475-ac76-4bc80b231d3b", "comment": "Malware payload", "value": "3df589b10b118cc1cb2ac63045fc603e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778070930, "uuid": "772657a9-eb8f-4d20-bfac-c7859072cbc2", "comment": "Malware payload", "value": "929377892a5f6ecf77f07cb7af98debcdb03d1f325530ecf0e26e85b0313c7b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778070930, "uuid": "f7349d16-cf51-459b-9553-3daa797a0e67", "comment": "Malware payload", "value": "6d36e8fe85a172e56d4e9de7f9c1c41dfb646367", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778070930, "uuid": "de50fe9c-fb88-4fe4-9496-7cef8b17cb2d", "comment": "Malware payload", "value": "b06f5075b1de0caec56c8241f70081e04e777ce0883f7b64fd173c95a67b2dc8fd5fd9583e31806c28dce9dd2f07dd58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778070930, "uuid": "156c31e2-20be-4630-8310-bf1f9e79d343", "value": "T147A5F18EFBBA66DDEB291ED1249FEF6A41071414BB931498641364C7E923C13072B3F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778070930, "uuid": "927385eb-2e09-4f10-85a5-9182c3b1153f", "value": "384:tSOGQPRNp0hUcFvoC6FdpKtMNboiMCt+TQ3ZEvPXlqFwEEzQBCa8X/ecYjv+M31e:tIdZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778070930, "uuid": "ef709ea6-e056-4923-912b-27401711d64b", "value": 2067527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778070930, "uuid": "efbb48de-aff7-4ae6-a8af-14bbb2087f67", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778070930, "uuid": "510e928a-f966-4bcf-a224-6b2abcda04d4", "value": "LYY.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edc39bf1-4994-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778103941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778103941, "uuid": "91786de3-fe0c-4d0d-ac86-b87b4502f996", "comment": "Malware payload (Mirai)", "value": "2bb71a0ead8bbe88db014efc534ea746", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778103941, "uuid": "f8471490-25d1-4a56-93cf-dcc4b291f528", "comment": "Malware payload (Mirai)", "value": "92df4b788d162f11e35788fad386183fe67c334ff7931f39c2a068318ec81382", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778103941, "uuid": "efc1b527-7003-4d38-aab1-ef9297f31f00", "comment": "Malware payload (Mirai)", "value": "d9be7a67829fc1a7a1cac0deec9ace65804ce08a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778103941, "uuid": "c4eb7d36-fe33-4d33-b3b4-2a325d412893", "comment": "Malware payload (Mirai)", "value": "a2f9431b53c90504c00b15e6144b45593a614365769d871ddaffc2632b68963182f2fc23289c3736a76eaeee8380c492", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778103941, "uuid": "81d33478-0ef2-44ba-9be1-26f811caa80b", "value": "T11AC36C4273280F07C5A25AB42A3E17F083FEE59120F4BB48690F9B5A4676E7B1585FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778103941, "uuid": "120b7dee-4412-4a01-a80d-6da77778855a", "value": "1536:QzvRCrguO1ue/QoIi3vGr43vIMeJ2lj63ruMgMMZF2s2riuKgIcvdt9RXd3FhSdJ:QzVHvInJ2ltZFpsSgIWdpRSikp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778103941, "uuid": "7a000f53-d296-48f2-b140-d7b76c7165aa", "value": 128560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778103941, "uuid": "cc0f28df-a766-42f1-82a9-194003269847", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778103941, "uuid": "b2c71ce1-a4e2-4aeb-9b6d-c30ec55bb5ac", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abb425b8-497b-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1778093093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778093093, "uuid": "1546e93d-d3ee-4ae7-8a3f-51cbb8538200", "comment": "Malware payload (CoinMiner)", "value": "468c92b4cbd1380001ddc3df11173073", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778093093, "uuid": "03727218-4706-4fc1-b162-012f82db7cbe", "comment": "Malware payload (CoinMiner)", "value": "93dcf47bfec581c7d0a1395ea09df32e199fbc9ee879211c75a9b8f52879ea41", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778093093, "uuid": "b40fdc17-4161-44cb-89b7-8eaa4fef565b", "comment": "Malware payload (CoinMiner)", "value": "180e79b801b1559668e53b9c7f2aa96fb4a72234", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778093093, "uuid": "ad15eb4a-6102-472c-b90f-9bb7d81f5445", "comment": "Malware payload (CoinMiner)", "value": "836a63fc4968017b354768fb5d97f30a3260d4fd5e4f75a1b02fd354ca7fcd462bd45357fda9b22571cc1c313e1598bf", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778093093, "uuid": "1f59330d-0111-4f64-bbca-e0d3a13934a3", "value": "T1E932801C6E4A4332DE5049B8E4754246517C2EE3B397EBDBE633D2CB49D6E4488C1A2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778093093, "uuid": "d7f3c506-2d5f-4ddd-9603-5abaec2eae5a", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778093093, "uuid": "e5665674-b42c-4f65-a540-7b06a102c86c", "value": "192:fIovWQrkS5BQqixSHO87usPFJxTEZmFhq2c:fIo1gqisuzsPFwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778093093, "uuid": "3a31706e-392e-4218-9a49-5441d2aa6c64", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778093093, "uuid": "63ee21dc-4d85-4702-8ba8-5ff4d95c83f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778093093, "uuid": "2ea74544-759c-4a0e-8f71-6dbbfed9b177", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad9313db-4930-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778060884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060884, "uuid": "e8d43518-e3ac-492c-bef6-4f49f2e13e75", "comment": "Malware payload", "value": "fab672e9a1993c3cccca8e334de05c4a", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Challan", "colour": "#96C9E5", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RTO", "colour": "#D5C724", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060884, "uuid": "29f1bd99-e62b-4985-9cb4-0c7b2cb3c109", "comment": "Malware payload", "value": "947ac2541ec78de940471886c66ba697f23668fdc27d49f5ab9403da8c4cc7f8", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Challan", "colour": "#96C9E5", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RTO", "colour": "#D5C724", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060884, "uuid": "6faa002d-8c84-45e9-83c8-176ee889f327", "comment": "Malware payload", "value": "26effd30b3d22cff209bbcce4fd35668e86e2069", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Challan", "colour": "#96C9E5", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RTO", "colour": "#D5C724", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060884, "uuid": "aa44f693-24c2-4515-bfdd-1846fbb8bb41", "comment": "Malware payload", "value": "0e8bedb9559cd26c0f43c290e5f12df62e40278c059448d2e26ae9b4b928361e60d6c04a28184c83a65caea8fc234f3a", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Challan", "colour": "#96C9E5", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RTO", "colour": "#D5C724", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778060884, "uuid": "fc6ce050-e691-40c9-bfe8-45978e0f88bd", "value": "T161E6124BEE5CC86AECF6527AFD32036338225D984703C17B6569FA3D3E731C28A91591", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778060884, "uuid": "f7c44404-63f2-41f6-8243-bb262a5a750e", "value": "393216:uMRoih3lycxDYL332RwOJ7GqE5aJpSi0mk:XekDcGwO9jyvmk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778060884, "uuid": "b9520785-11a8-422b-afa9-9165d30c67c1", "value": 14086970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778060884, "uuid": "68a1fab3-17dd-45a2-81d1-0617e33cb259", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778060884, "uuid": "4a8bb5d4-eca7-4ff7-8020-81147ca5c6d2", "value": "RTO Challan(1).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d1ca6be-48f9-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1778037207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778037207, "uuid": "4ec1e59b-f3db-4f85-ac90-689cfc4fe509", "comment": "Malware payload (NanoCore)", "value": "709ab30ffd7a5baaa09e656ac967345c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778037207, "uuid": "0751ab53-6e03-4fbd-9169-ee2e51b4d7df", "comment": "Malware payload (NanoCore)", "value": "94e9869b0c46d3f43e7fe3fc8733d82ce27d0a5e6142daa6ceee0a8d865ebc66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778037207, "uuid": "a57022a4-2f0b-48e2-9632-e5bf6630039a", "comment": "Malware payload (NanoCore)", "value": "0b94bbf308d00392ee57ca1e873619c5585952e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778037207, "uuid": "b628f9d5-d588-4ea7-bd81-045fb4d5d191", "comment": "Malware payload (NanoCore)", "value": "ff26f396e94a55b84aff8e8ee9b27ae453db7ac814a69bbae0361ce171f28b138cb793d865ad92c0dee97b17185d555a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778037207, "uuid": "57d1671e-051c-46a5-adb5-a0051f07410b", "value": "T133C402167BD88A2FE2DF86396152415297B8C0E7E8D3F3EE6CD885B28B657E401071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778037207, "uuid": "056602d9-4b71-4a49-aeca-538247933ba8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778037207, "uuid": "d8c31f46-6299-4fce-9836-cdac8a914807", "value": "12288:JLV6BtpmkrKpO2Wu3mX264iLBU/C77ygEMaC0oEEL7hjESCnZUWt1NQ7S:xApfrKpLWu3O8gACXbEMa2l7SS4UWt/D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778037207, "uuid": "2012e3fa-4b67-4684-bde2-7611c8d85988", "value": 556032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778037207, "uuid": "35e5f488-0129-4ffa-a26a-e8118364e127", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778037207, "uuid": "bf5e5804-26f1-420a-bce8-9e204e8256e6", "value": "Document_Final.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "496924be-498d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778100659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100659, "uuid": "d82c517a-87cd-4950-9992-5de1aa6b7067", "comment": "Malware payload (Mirai)", "value": "d55658a3d0d5886735d5d192d10794dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100659, "uuid": "229f156f-1fe2-4697-98b0-d737edf6a960", "comment": "Malware payload (Mirai)", "value": "95355a30fbde193c919b3680ffd5c8635adceaedbec09133a834d828e793130e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100659, "uuid": "40539db8-3828-4f65-a23f-6ec394f2b10f", "comment": "Malware payload (Mirai)", "value": "21c3eea678403156d1c518fdae9a3861ba16cfe1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100659, "uuid": "11738824-3647-4295-94b1-35d25fcebf75", "comment": "Malware payload (Mirai)", "value": "a0dd45c05887ca0415581f30fffcf3075f51f0393cd8230495c9ba62edb3830b1213a3e8863ee6149a9ed8d840e7a941", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100659, "uuid": "ca6e438e-337f-451d-881b-0781c26682c8", "value": "T192F329C7F900EEBDF80AE77648530809B130B79254925A377357797BEC3A0E8456BE86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100659, "uuid": "db094f7b-ff2d-4b9a-ad8c-05a021fd256e", "value": "3072:OFsZxGJvj7dzJAr0AKdQEVgjbioLnMF71HtyTsvkTOMe:fx+JAr8dQdLMjNyTnTxe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778100659, "uuid": "0ced7c0c-5931-4640-9dc3-d0ec81c8af09", "value": 157792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778100659, "uuid": "9f2050fa-98cd-4770-bc0b-b9a62697221d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100659, "uuid": "71170e37-b85b-47b6-b749-34cd28f254c1", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da9869db-4958-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1778078139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778078139, "uuid": "39ba194d-12f4-445b-9a45-9c8cfd7abf22", "comment": "Malware payload (PureHVNC)", "value": "6fac8fc1e76ad504bab62f8d4ee33067", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778078139, "uuid": "0039e603-c7c7-4d9b-9026-6e743a0c1f01", "comment": "Malware payload (PureHVNC)", "value": "95cc556d124b8f9a877e5ba5adb7a55e1a73d8de95a82c19d786ff94e45c5dc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778078139, "uuid": "80dc8166-34a7-4499-b832-22c6f1cfc519", "comment": "Malware payload (PureHVNC)", "value": "5eccfd5ad4bb5ed03588d91e0d0c59131bc05d75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778078139, "uuid": "d8217fe9-5a01-4453-bc99-4af07e869ea6", "comment": "Malware payload (PureHVNC)", "value": "8da96041387755de836c8354d5d2b731685cb11148ef88bc6a62dbaf9419ead5089d7d504a5f04c811ed1c69d31a63c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778078139, "uuid": "5ac13d01-fb4a-4fe3-8486-ff2420d8cb0d", "value": "T189E3020F33E0921BDDAD573694720F211AB19B5C9965EB0F09DAB6F64D3372022547E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778078139, "uuid": "107f3fa3-0a0f-4475-9434-044779fd71be", "value": "3072:bm5CKF7Y9CVy0qjOlfPGUj9k8gUyPngwK5PEY+/Fb2fVnO60apmj:bm5bVhAO5PGp8g5cPN+/FatnO6Hm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778078139, "uuid": "76119f40-36c2-4457-92c7-c65eb3d3d057", "value": 146432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778078139, "uuid": "01f59c72-ac69-496d-a3b9-fa24f457d0e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778078139, "uuid": "ffd3eb3e-ab9e-4a09-9a98-221f7df04f41", "value": "95cc556d124b8f9a877e5ba5adb7a55e1a73d8de95a82c19d786ff94e45c5dc4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64b15266-4938-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1778064198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778064198, "uuid": "5bb42329-c5bd-4adf-b992-1266d90b5bd2", "comment": "Malware payload (Gh0stRAT)", "value": "d9f762878e8f265cb776057ecc0f2497", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778064198, "uuid": "f2e8c6ca-ee8e-4b89-ab11-be042768f9d9", "comment": "Malware payload (Gh0stRAT)", "value": "95f3db5aa7d2d2251c22708368ab6bd55457c7cc51fae2a817bf88dc0e1648b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778064198, "uuid": "ae9786f7-30ae-4362-9944-53a9e9b1e7c1", "comment": "Malware payload (Gh0stRAT)", "value": "5bb97a858af093a716a1af1838f806c9490e31a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778064198, "uuid": "ee0eaaef-8149-403c-8239-0b66abee7d60", "comment": "Malware payload (Gh0stRAT)", "value": "8919ec6edca009362140c8f6104052c9ae0920458016e417a9b87ee3580de8fa9155fa4a8f06776f1c6a08194ab11f09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778064198, "uuid": "4d4aef2b-c2cd-4aa4-82ed-d4af1d781649", "value": "T13CF63323F3CBA43EE49E0B3346B3A19454F776126622BD5796F484ACCF291500D3EB96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778064198, "uuid": "f7cf3a5b-e875-4b46-a5c5-2d68ea136253", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778064198, "uuid": "f7067df4-e537-4c59-87e4-47a80158a3e7", "value": "393216:8rQdJprzcnvdI1DT78AlQRVMbJHGHyUoFOmeztXKnOA:wMz6IRgxRqbNW0Omc0OA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778064198, "uuid": "489cad17-1998-4e0b-ab50-efba957027f5", "value": 15876788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778064198, "uuid": "7030391a-710d-409c-a592-6219e4b43fb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778064198, "uuid": "c06bb4c6-8661-44a6-8238-c69ed0acf337", "value": "Feishu_v2.0_x64_win.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1904816a-492f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778060205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060205, "uuid": "8854abdb-695b-4be4-a8c5-651b7967ac48", "comment": "Malware payload", "value": "c1cb0afe2c087bb815a7dc507df40def", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060205, "uuid": "f9b36329-555b-465c-999d-9bf50663a42c", "comment": "Malware payload", "value": "9673428dc1c1a98432fdf3de38389f04436cdb49b51073098b8fb9ef1ac6fce7", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060205, "uuid": "67f91f68-da30-4b44-96a8-32e7451cf4e4", "comment": "Malware payload", "value": "66e8f5862c8556ddc1c6ec41a433b536c1955618", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060205, "uuid": "900fd78a-9d73-4535-99b6-9366b0906df0", "comment": "Malware payload", "value": "516578018a4b0aa3b9f9c331fcf098637bf0c2d4240a32a34dab2a678ba14b217cc96421c4692d348cb8793c5bb1f1dd", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778060205, "uuid": "0065bb24-9c4e-421a-b405-71a11b44fe6d", "value": "T12C272393D7448C4EC0B3C23146AA077F563E8C27552BA3A7268A7528EF7A1F50F6578C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778060205, "uuid": "50338f8b-1a39-46ef-a7a6-2a1cd87a3fd2", "value": "393216:vescWN0pK5VR+I+dg+lieCaEnT0LP1XIBYlFPTyVn16RX:mNP0ZA2WJMY7Ph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778060205, "uuid": "a2022ff0-39ad-495c-9cb2-bc8c779568a8", "value": 21296972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778060205, "uuid": "ee4e947a-2eef-43aa-828c-1e711a2d031f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778060205, "uuid": "ef778da2-67a0-4ec8-a47e-82af48caed9d", "value": "app (10).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15485ab6-4974-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778089834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778089834, "uuid": "cd00dc9f-4daa-4b20-adef-de4aa4c828d4", "comment": "Malware payload", "value": "864a618f6fed203deeea2f770edeef86", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778089834, "uuid": "3f47d339-0e8c-4492-b54c-80cf903608e3", "comment": "Malware payload", "value": "986680561ccd7b3ad1794149428bcac3d8c3811f5f029776de9c5349307fe1fc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778089834, "uuid": "e31c33c9-cff8-45df-ab4c-32ad75d69c1e", "comment": "Malware payload", "value": "8f2f2357348ee1a52b8ae284d04bea1fefbfee92", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778089834, "uuid": "bd1709ee-8cdf-4701-b322-d95e9c992b0a", "comment": "Malware payload", "value": "27a6f4b0e6570c7f3469945737eca8186357052c557c41ff3c7eec1b34f1349009dc36fab80233d75c643f54f92269ce", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778089834, "uuid": "44a5f0a2-b6d8-44b4-a241-7b9950715328", "value": "T158138D6966857C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C196DCE21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778089834, "uuid": "565d9b48-c9ff-4e39-a97b-2a94fddd5bbf", "value": "768:bF+69GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bF+vco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778089834, "uuid": "faf24e86-526f-47db-a663-b7ea9635d995", "value": 45448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778089834, "uuid": "04d69c84-9200-4dc5-9570-6301cb78ff0e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778089834, "uuid": "085ab3fd-c977-4d20-980f-284223ec63a8", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "480320ab-498d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778100657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100657, "uuid": "e082e7e9-3340-46ff-8b66-8f45309820ac", "comment": "Malware payload (Mirai)", "value": "f389850339cf9e784b56d5d1a8b4d512", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100657, "uuid": "baa81e05-00ea-4158-a49c-0504408722d3", "comment": "Malware payload (Mirai)", "value": "99950a809bf804021feaf7f86a52c9c68657a5b6c118f0c4eb174124949ad11b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100657, "uuid": "baded094-b1ef-4c99-b362-a91d7f6635e7", "comment": "Malware payload (Mirai)", "value": "c54563099ae27104fa94492539a381654f0b3657", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100657, "uuid": "1a378359-37ab-4083-b3b1-8c88030cb27c", "comment": "Malware payload (Mirai)", "value": "ab450b24894466d7f1648ba6a66a902758c496be8a62e58b3deecae6b90fadd5f6c96f816e4297916011770e643af9c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100657, "uuid": "9c404c36-f35f-43f8-bcda-74793d03f665", "value": "T12A3302F4E81F6F77C7FF6230E921C16437A7A68913D6898D62817713061B8A1CE02DE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100657, "uuid": "0f29f878-9ea2-472e-878d-f5e54ea09924", "value": "1536:sFShXFbrasd3uzx53b6+29+J9+DqmXP9dp4u+qgw09r:Ewrasd+uH8+DqmXlz4u+qgwa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778100657, "uuid": "df3011c4-e78f-4207-a3db-2463d86f1488", "value": 50804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778100657, "uuid": "3b703fa9-a582-4745-8a40-3b9699ad069a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100657, "uuid": "65c4623b-6e92-4548-a073-35d73193f796", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "465405c8-4966-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778083904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083904, "uuid": "67565993-34d4-49b4-bcd1-43763a7ed4f9", "comment": "Malware payload", "value": "30a6aa62bd7d17cc475c1b3b87fbf7d2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083904, "uuid": "d220bc4b-cd3e-4040-bc1c-caa01f4f1b1e", "comment": "Malware payload", "value": "9c0a54a27ef8da576df8bbbec40a622a7a2c6a30e4df773e8badbaac81c712f7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083904, "uuid": "c0b92c4e-8f0f-4b73-af00-ed0ae29f1428", "comment": "Malware payload", "value": "9c66a65acb3c8076d8359feeb0d254b17a5d6084", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083904, "uuid": "56dec861-955a-4e1f-ab4c-b5370109903f", "comment": "Malware payload", "value": "163b318f5666475e437d2b0bb5c92303e4caf51d79bcba634e3c396585436d19d8f73df344d43137dbeee5cf4fa65ce8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778083904, "uuid": "be097016-90d8-478f-bc4f-830b8b636ce9", "value": "T12E510AA8C7421632FFA7182FFAA1645847C6AC03DB61144D5EFB5CCE01E0A06A67DF16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778083904, "uuid": "18e52cdb-4b72-412e-989e-9ccee2d33e92", "value": "48:q+jnat9/xU1948pcm3jnFYOve4UuHCC9eEVQsMosBAd4H:qkatIUi3jnF7veaeWQszsm4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778083904, "uuid": "c417acd3-6c0c-4898-9423-82997dcce720", "value": 2489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778083904, "uuid": "35401cd8-dc69-42ef-bb9f-5788a1df1bb0", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778083904, "uuid": "d54edee6-a3cc-422b-a345-c21f5a647d89", "value": "164.90.195.107_1778083895133243_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24dc7565-492a-11f1-a769-42010a9c0008", "comment": "Malware payload (SpyNote)", "timestamp": 1778058078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058078, "uuid": "ee11b7de-3426-4483-ab22-93a992c285d9", "comment": "Malware payload (SpyNote)", "value": "02744324b35b02ae81dcbc7aa847c836", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058078, "uuid": "fa920fc3-5456-4031-92a8-1d037c1c0a36", "comment": "Malware payload (SpyNote)", "value": "9c1cc79b801e8d632bdb73517588e9e7626cf22643263f038c20cc42dfd0f922", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058078, "uuid": "7dd4c1a4-9946-4207-a18c-126520574c19", "comment": "Malware payload (SpyNote)", "value": "8ab383d16670c39fb492f507ea1a753e55f784dc", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058078, "uuid": "1b961755-40f5-4276-b6b9-f4028439ca93", "comment": "Malware payload (SpyNote)", "value": "6d6c5729906051a2a16e2de9bffc361c77535fe6ce7f66e15d26bf2700686b4fcb8365363cd60b1fe455df27f45024d1", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058078, "uuid": "2924cdec-f1c8-46ea-9a1c-0f2a30b18eaa", "value": "T15906DF03EB58D6DBD9BA83F56B370CA55A030F68C643AAE71415366E2EB71C10DC5ACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058078, "uuid": "0ff0ac1f-8e8e-42c3-b03f-9c369870c8e5", "value": "49152:eK1RpVJfjkuONhLbyW+uAUruGYDT3I2mzFzdGGjQTOeEUPYqt0cgopdsI+gmSW:eKTp3vvEAsYD7mzFzBkT90tofsaW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778058078, "uuid": "23379c4a-a2f5-4b17-b197-010b538e2c16", "value": 3898830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778058078, "uuid": "14687162-8f38-48ad-8691-a2ca34e5fdbf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058078, "uuid": "d466b139-1ea0-448a-b9c1-5c1a23098a71", "value": "Customer Support(1).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24e401b8-4989-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778098880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778098880, "uuid": "fb1feb58-76fd-4a76-b173-14baa646b380", "comment": "Malware payload (Mirai)", "value": "bbcd8948ce3d2abbe0c55a95ac7970dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778098880, "uuid": "5117a581-c77d-4646-8e47-50e0b5cc6920", "comment": "Malware payload (Mirai)", "value": "9d2dba097fe987e6c379c8b170102cd22db1ecf612390d9b5e26a16c925d4369", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778098880, "uuid": "b784688c-f4a8-4bb6-b8ac-596ddab609f8", "comment": "Malware payload (Mirai)", "value": "d506a7f5983c0a4281732e1310469f1cafd5db67", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778098880, "uuid": "6626a491-fdda-4a28-936c-7cf9db370f1d", "comment": "Malware payload (Mirai)", "value": "ff97f15bf4c15822c66955a1645b63f0827570c668a6e9d49d4e6012961c0d23091577fd32ac0c1bdcbb0ffc85dae20d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778098880, "uuid": "7afd778e-30f2-4355-8384-53ae42b46444", "value": "T15CC3AEC3FA4B14A1C86206F007C71BAD6F93A121CE5FD4E7AC0DB63B5A7A4DB1916781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778098880, "uuid": "88557f2c-752d-4ea8-86af-3f8355ba3f7e", "value": "1536:VcjBfdqDk6J9Peg2bA/5WOoP/9UbCdjkHlI/at1czxs5BZg9iEa/LW+:V6fwDrobARn+/9U+djkHeat1cWg4q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778098880, "uuid": "926967d7-526f-4654-93fe-6a8caccac1f4", "value": 124676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778098880, "uuid": "e6d97e7b-0573-4f45-a8ef-29d05befbcd1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778098880, "uuid": "a636a394-7dbc-422a-a63a-601f874120fe", "value": "titanjr.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "877db94d-4961-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778081865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778081865, "uuid": "2ce4e592-0354-41d3-907e-7b515db26b1d", "comment": "Malware payload (Mirai)", "value": "7d37bdf669bec5303c3987976d3aaed8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778081865, "uuid": "5b94d199-77e6-44c7-8984-130b3f5e75b2", "comment": "Malware payload (Mirai)", "value": "9ff4635a1cd9e401cfce19eeed54b6cde408bcccb70be490186c4808a3ec3b13", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778081865, "uuid": "00898ef9-82b9-41bb-9ffd-cb70d793f09a", "comment": "Malware payload (Mirai)", "value": "cfd43de5b72ac8c8919c04f760fdefff20a18ae7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778081865, "uuid": "31c6d2ac-dce7-4006-af65-b8c04955c6f1", "comment": "Malware payload (Mirai)", "value": "2b604474cc5cf070d01a4d30ae47f199b185202a7d0eec2219d3f6769a5dee2bf3f3f24f6de11eeadb9b505cb90b6f7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778081865, "uuid": "87d4460e-0a1f-4dbf-a15d-531fea3de457", "value": "T10713F2486109ED3494B1B533DD689A421AD74BB8C7BABBE70C7241793FCD2CB60E42D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778081865, "uuid": "ff7f31f5-87c8-4cb6-b5cb-511315114a0c", "value": "768:slbrB/X1hsGbWvq1cIMXK0K4ZmPefb428rTs3UozX:4B3pM6p4Z8efb42vzX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778081865, "uuid": "5532c419-1e84-481c-b976-7c5c45cdb76c", "value": 41564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778081865, "uuid": "2a0adfde-7dfa-4b49-8beb-7bcc10c60864", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778081865, "uuid": "cf7ac4cb-7fb8-48da-b8d2-802cbede79ba", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bca6c64-492d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778059405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059405, "uuid": "e6f3fa3b-0a90-466a-a1be-ec3dc6673a4c", "comment": "Malware payload", "value": "e5f0d28260a60c041ede761c31f324da", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059405, "uuid": "d27f992d-0b07-4139-a9ed-0b1faf9a9c32", "comment": "Malware payload", "value": "a05400000843fbad6b28d2b76fc201c3d415a72d88d8dc548fafd8bae073c640", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059405, "uuid": "22eaa7fa-3579-4be8-aa45-c73a8d09cad9", "comment": "Malware payload", "value": "f8dacf0d163c63561a14593d19f356a2054b08b6", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059405, "uuid": "68dd14b9-3786-4d2d-986e-857a299f629f", "comment": "Malware payload", "value": "1c574818f7a04227787e50e7ad3cac694435d926fb75f7115d4f193d8af7b8d3c42c8926938b3d18a77d42e2cb61e433", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778059405, "uuid": "0ee282b2-1567-4507-9961-76f4c30f730f", "value": "T140A4076227C10C27C07AF5B689174F0CBC72FD42C79666A567B8420DAF7AB120279DDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778059405, "uuid": "f6b85200-0f23-4853-85e5-2cb6cbf9cbc9", "value": "3072:+j5ayec6tXan63CMM2uOo3oKcGl4XX4WnsAsua6PopKYXNz0z14WR8fz+gicP4Wy:+z6Ba6SMypcm4XoesQo4qAza88Ir9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778059405, "uuid": "ad3e14fb-73af-484c-88a2-96e9d2e46cc3", "value": 452480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778059405, "uuid": "431ed596-6fb3-44ce-bef8-917dc5a0691e", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778059405, "uuid": "180162e7-3735-4228-ae73-dca33c19929d", "value": "Mac Password Popup", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25e5e73c-4944-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1778069246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778069246, "uuid": "2bfe3c01-a534-4d89-9b40-cb900092fd8f", "comment": "Malware payload (PhantomStealer)", "value": "90a17ef7e5af2463230cf1310e07679e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778069246, "uuid": "46de5657-1d29-4c98-915e-5bd1232dfb44", "comment": "Malware payload (PhantomStealer)", "value": "a09ab10dd99d1a9825a60b40cbce0eefacdb94176ff5ba83d47af3e24849a8b7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778069246, "uuid": "fca849c7-9e17-44f4-9854-ff52aa44ce03", "comment": "Malware payload (PhantomStealer)", "value": "d45ba40ada91c8ac9595461548e336757c877cd1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778069246, "uuid": "4d0f61f3-490c-4948-90c9-0cae13101ede", "comment": "Malware payload (PhantomStealer)", "value": "e4f3475d1f89fe3ee115c580d9e53b07f58afba9be6be24ec562e2e7f2f83a0f0e222efad9bed79b22aaeb98cd9fff5c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778069246, "uuid": "c03fa960-17dd-4171-9e28-a8c9092b66a1", "value": "T119364A85272A9072B32DDB5DD17AD9B1C94E200354C9DF1D30ADE3387609D0BA39EAE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778069246, "uuid": "b11a193c-b289-4102-90e5-a440dc201972", "value": "98304:rVcG+tWkN8CFKYEUpXncuq3d+UJmyjPOY5fMFQzAVVYSBSJZZJ8H96kMz2iAOb4D:zwxKsqUpncnNLmiP3fKQzO96kMi5O4X7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778069246, "uuid": "7ca45045-9239-4dbd-9e3e-87ea13694397", "value": 5172162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778069246, "uuid": "5f9615ed-177c-4612-b8b8-4441a26b82d7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778069246, "uuid": "68a76c49-4edd-4a32-994c-8c19b98aa1ed", "value": "Payment Remittance \u2013 USD 31,000.00_pdf.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecf3a431-48f3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778034791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778034791, "uuid": "e9a52faa-bea3-417d-9e5f-d37bca0d5ee1", "comment": "Malware payload", "value": "40774fca2bad1825d5a748b332226b71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778034791, "uuid": "53509f2c-abfc-49d1-b9ca-ce5e0b506ab7", "comment": "Malware payload", "value": "a1c18d5121b7cf9be0c84f6c75d4d82cdcf9166043c71cc710e8653a51cf3a45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778034791, "uuid": "c3c7cad4-59c1-4461-80e8-df565a57255a", "comment": "Malware payload", "value": "40ccc70993be864dfd10c019b59d25f4fdaf405a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778034791, "uuid": "42cf9838-f3e0-47fd-8b39-23217f731f9d", "comment": "Malware payload", "value": "f97c84c96c4b1de18fa72476bb323770f947f56d6e71849b87d6a4766c9862f7fba4f660e3e62a392e551f1164b6692d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778034791, "uuid": "cef8df39-e626-4d3e-a1d9-1203708fbc4c", "value": "T180264B17ADFD5C9AC0AAF134C4337216FD62780057326BC716E0A6691E377F09AB6B18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778034791, "uuid": "66856353-8786-409d-aa6d-548e15c28d89", "value": "c449d984077458679948447e337e4cdb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778034791, "uuid": "090bb8d1-827e-4ca0-8570-67b450b5cbc7", "value": "49152:J82r9ldAlZKzmC2+0hqdSfdvaM4O9FlV71GjVQcTyh/kqn:J8I4KqFvhjX7bvn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778034791, "uuid": "3d8e14df-9a63-484e-8b4f-e01b12ebba54", "value": 4641792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778034791, "uuid": "6e531683-9f6e-431c-9171-d6c7636e689a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778034791, "uuid": "0b44e6cf-6b30-4a41-b016-29971db11a71", "value": "SecuriteInfo.com.Variant.Tedy.961995.64174387", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ed4859e-4943-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1778068993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778068993, "uuid": "b9db73e4-c83b-4e66-b7b6-fc5d130bea27", "comment": "Malware payload (XWorm)", "value": "1a72669671039c29f5139ea1c51efcdb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778068993, "uuid": "464c460e-efa8-45c9-81c1-c537d6c1dd8a", "comment": "Malware payload (XWorm)", "value": "a1fb2c28972c3deebd64a0cd156c42216104ede73a1270aa384650c245677417", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778068993, "uuid": "3f26433e-9882-4023-8b26-c34990dd0ed1", "comment": "Malware payload (XWorm)", "value": "85995b8e67bc9f9d077ea364c4111f86c9eb6bc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778068993, "uuid": "463a46a3-721b-4719-bc9f-c4b118eb43aa", "comment": "Malware payload (XWorm)", "value": "a743ee8e73eb359156a48ed95605faf7f9e049a16ceaf6e1fb0e6b9dbcdc74e390ade0b8344fc922880b17d435665a1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778068993, "uuid": "583300e5-9a65-4613-889f-7f9583c5f816", "value": "T131F4AED51F872F91C639ABBCC1134984E3F1C853D366D6DB6FE850E66A92BE9CA03401", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778068993, "uuid": "8d8c2b7e-f2e3-4697-88d4-e6fd5bd27c4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778068993, "uuid": "cd185556-f6e7-4bd8-b366-2d3a817db035", "value": "12288:Xvk0xNzPOk3OcRRrIjKqRO79WQOsHUbfuxdtlhvsQH1zuBcR7NuOsr:syNqHcRRsOqROw5yU74dtlhD1CcR7g7r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778068993, "uuid": "8e2a3758-f4c5-4f6a-8887-6a4aec61271e", "value": 749056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778068993, "uuid": "22fa0ef0-8d4a-4925-a553-57b5c6312a63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778068993, "uuid": "1e213d83-b32b-48b0-a8ae-6302f8d50d11", "value": "SOLICITUD YGUAZU.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3febfd7a-4916-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778049533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778049533, "uuid": "c4843188-7ab0-4f0d-a032-024d34de3584", "comment": "Malware payload", "value": "e700aea4954f877f1182e73a257b6621", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778049533, "uuid": "58392e7f-5a14-4f57-977f-f3fcd1e5cb4e", "comment": "Malware payload", "value": "a263687b0ab309bbf1488ad68db10750ebbe7a12aeae4379c7eca67b7a6a3653", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778049533, "uuid": "7d60ce6c-9d19-4938-8fe4-801ae4d981bc", "comment": "Malware payload", "value": "3968416adfa19ae0e38b0ca27f74e8aa72f7f5dd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778049533, "uuid": "2f6b3da4-c960-452d-8cdc-5d01296ee3e2", "comment": "Malware payload", "value": "54cadb9922edf942bd87dea33ef182521173d38b23f2a01ff6312f346eceee31e350e0844d267f46a9c0e3b56e5c25b8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778049533, "uuid": "1f9a49d3-e1c8-4dbc-b886-57ecee4097c2", "value": "T165137D6956857C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C19ADCD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778049533, "uuid": "255dd6ba-3d0f-4b73-a5c3-f626c136a937", "value": "768:bUZ1+D9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bUZ1+Eco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778049533, "uuid": "53430c03-2372-4843-bd63-e7837e2ab747", "value": 45436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778049533, "uuid": "b3edeeb3-19a0-477b-a013-934087ba14c8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778049533, "uuid": "3fe55d98-e806-4f03-bfad-fef10598a29e", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15fe445c-4933-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1778061918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061918, "uuid": "0e7bbd63-fa68-4cb2-9f76-4971ee56dff2", "comment": "Malware payload (NanoCore)", "value": "dbaf8b87a03e2881cdd8d68719951735", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061918, "uuid": "2ce40ba1-a002-42db-ba7b-8a4f9914be11", "comment": "Malware payload (NanoCore)", "value": "a28e41776cda48065bdf40f52dc0ce858a4dd8ec8c7f6480c960507adf96e2d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061918, "uuid": "b6ed2ade-92ba-4d08-8087-d90c528aa120", "comment": "Malware payload (NanoCore)", "value": "9700e999660bb7b399adb15598115443db5b4f5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061918, "uuid": "ad9a0197-dd6b-45e6-b697-454ff4787697", "comment": "Malware payload (NanoCore)", "value": "1ca8d83bc975dabfbfce929ea896be437df1117e3303e42260d8177a8588d4c30363a2eaca9ab3758af4e7ab8bc6ed2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061918, "uuid": "9335a151-2632-48d9-9999-4da298801777", "value": "T1AD14BF2677B94A2FD2DE8679701206539378C2E398C3F3EE28D855B68F167E5060B1D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061918, "uuid": "b0985b14-7df5-49ed-82d5-87fc9ef3df3b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061918, "uuid": "b82270a4-1bc4-434e-bf37-c6d7cab4868a", "value": "6144:MLV6Bta6dtJmakIM5YBGmPDZ1ZgJB6QUWQ:MLV6Btpmk5BGmPDZ1gB65WQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778061918, "uuid": "8b9447e3-1a74-427e-9e30-7eff74936237", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778061918, "uuid": "90d5c57b-3bc1-453e-8985-06904f2fd3d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061918, "uuid": "502cbbd3-66c5-46f9-94d6-30b8bf088c34", "value": "hotro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4330cb6d-495d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778080033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778080033, "uuid": "f3bd186d-dc8f-460f-8946-333d8dc132f0", "comment": "Malware payload (Mirai)", "value": "87cd612095d04c2edb0a38a70cb67c64", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778080033, "uuid": "39c60a51-a751-4e34-bcba-2d4c4bb7fa85", "comment": "Malware payload (Mirai)", "value": "a3c0ce04eb238eecdfe7a0819b7255f9e853e5d0f373318c3a81ba7efb1e761c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778080033, "uuid": "65e355f8-def4-44ba-85cc-5d09afa9451d", "comment": "Malware payload (Mirai)", "value": "1d0a1e24c51269c6c09c842b33752f6c71e186c4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778080033, "uuid": "50f8bdb9-8db5-439e-9e2a-998ddd708837", "comment": "Malware payload (Mirai)", "value": "d70eff9defefd9a3fcfc1cea4a04cb23cee54fee32b49c9c9c2f708cc0220044a41f852488fc07fd5df908325bbf7ed2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778080033, "uuid": "77c97358-ab8e-4701-a647-c94c4fefeecd", "value": "T1D1D32A56E7408B13C4D61775B6EF42453323ABA4A3DB73069528AFF43F8279B0E63905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778080033, "uuid": "b886a8e5-20dd-41f9-ae3d-66dcb14e76c6", "value": "3072:lS6VGvX5uazAFEsHYw3NK8YwxGnLp+SQkM/9CH:lS6V8uazAFEs4iNNgnLp+SDM/9CH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778080033, "uuid": "4a51087d-f5fa-489f-ab95-6bd8a7a59c21", "value": 140758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778080033, "uuid": "dbb4f512-1514-4650-9cec-78bd90531db2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778080033, "uuid": "b9887606-d7ce-4cdb-9af9-86b10fa1ce15", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e2386ac-4922-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778054845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778054845, "uuid": "1387ce56-c3ba-42ac-b594-d7756fd04f08", "comment": "Malware payload", "value": "68c3d03da4eba61cbf291d24e6185252", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778054845, "uuid": "ed68456a-4746-4dc3-9c76-2c8dc9352547", "comment": "Malware payload", "value": "a4b24e2bb410c144cc1112bcc2fe274febac3df129283f067c9c45b1c51c6c8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778054845, "uuid": "b22bb529-23ae-4003-8c78-85c820cfeead", "comment": "Malware payload", "value": "9becccf3dc6fe76ffe8a3b479450cd43f948391c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778054845, "uuid": "da9a8bda-23e0-4d44-b14e-29c975adb912", "comment": "Malware payload", "value": "82349fd7a8923a9f01eb3516c38fefaa4ad0e80f6245fca92995e7991e06216c74fe514e4c6d3bb2753b567a38959818", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778054845, "uuid": "27a6335f-aff8-4314-9796-e46201646df3", "value": "T167B32801F742EBB8E68308F5087ADB64FF354D1B023088EBF7D166B4B8A1A9154E755E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778054845, "uuid": "fb03eeae-710a-44bb-80ed-0ddcf4d27f5a", "value": "1536:aVrNxG8giUnvzkgJaWdOFkRCfni290e7vmrAcWA+WdObWrzxe/T7vqfFzLRrl+3p:ap68giUws+knSlGldL8/T7vqfvAzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778054845, "uuid": "c29bdb98-4511-45d5-b594-c8f2a89d2a1f", "value": 114768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778054845, "uuid": "06543587-2d6f-4f55-99fa-d69fc75bfa5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778054845, "uuid": "a6b8680e-c254-437f-a74b-daac1cfb7ff3", "value": "a4b24e2bb410c144cc1112bcc2fe274febac3df129283f067c9c45b1c51c6c8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dd49823-4999-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778105874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778105874, "uuid": "a3cb27ab-d35b-49f9-826b-2f1dd249d0b9", "comment": "Malware payload (Mirai)", "value": "e10ad0608590b6198a38d51474c01abc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778105874, "uuid": "47f49f2e-aa82-4a9b-9d26-2910e622f3ee", "comment": "Malware payload (Mirai)", "value": "a503ee75ccb05a9a16c98bd20b609855a6f7a36ba33eac2939faecc28a5f7835", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778105874, "uuid": "40dbb8a0-b583-4cc4-8060-e63391a2a5e9", "comment": "Malware payload (Mirai)", "value": "286be3d1ac7b98917848a5d711a474e4a41a32d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778105874, "uuid": "3bc0641e-76b5-4ede-86fc-ef2a20091cf7", "comment": "Malware payload (Mirai)", "value": "af9178767abf88c5839947db652bd89d689d0892d90904eac39713a4805d044eb7ef25e56dd09511b758bf83911d8293", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778105874, "uuid": "d581fc9a-1766-49ee-942e-5ba04aad6802", "value": "T141B32803B8C184FCC09AC130576FB53A9926F19E523CB6EB6BD4EF127D4EE604A1D964", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778105874, "uuid": "e19d45ec-d7da-4942-ba47-cc5a1b320b51", "value": "3072:5QPDtU+WIEQCWfLe6ZcAfDLzt5bJ6cZrBEGisGbF8eug30NhqZ:5YDtU+WIEQCWfLe+cAbLzt5bJ6cRBEG2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778105874, "uuid": "25cbbd6b-7a65-448c-9103-5f125e4b26b5", "value": 117808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778105874, "uuid": "18ea8d06-f83e-4875-8c9a-e0428ff6fb5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778105874, "uuid": "f1444e46-dc48-4363-b981-5a017969b329", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af9e8816-4920-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778054015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778054015, "uuid": "fa4a1483-5ff4-47f0-88b4-082cfd061441", "comment": "Malware payload", "value": "3e32fdee6f8ca782352641eac4d72056", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778054015, "uuid": "159bed4f-b27a-4e82-af73-a68cdf7a0a29", "comment": "Malware payload", "value": "a5a9ec0ca4ca5c7e331bc1d27bc995985fdebcc46b53740a0944b1e99ccfe922", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778054015, "uuid": "ecd53c38-6f75-4a55-a205-b6ada644b654", "comment": "Malware payload", "value": "f25da1b4d9ab5cbe0a684a670837e1545190edbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778054015, "uuid": "f7872e24-bf1c-48f7-aa59-3f0408388acc", "comment": "Malware payload", "value": "2d98722da7cab12b00e550e940dee14ee23dcb7950ded0460f251d1ac7b1a0d733e2a2ff0cd9a7d4fa522988caf4f8e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778054015, "uuid": "e95b3be5-7f1d-4a14-bf16-fa99e2c4ccc8", "value": "T18D463907F85155E8C1EED2308A269262BA717C881B3133D76B60F7B82F73BD46A79354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778054015, "uuid": "70ce72b9-1efb-4f5c-b4bc-c511622f92a1", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778054015, "uuid": "2061f93b-7d3f-46b4-a650-a485ce8423c4", "value": "49152:Q9LfGi0Mhmrb/TfvO90d7HjmAFd4A64nsfJ6AERArkLwnknmy7cbjXefqkweeB4M:q8MUXsnkVLj89EEES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778054015, "uuid": "3a8cbe92-3aa8-4a59-a7e2-3f517a0f0398", "value": 5507072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778054015, "uuid": "898c02f8-6948-40e6-98e5-ef31159d0a53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778054015, "uuid": "2882c77e-52d8-41c7-ba0c-64bbb3662936", "value": "windows_x64_agent.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9859a351-4931-11f1-a769-42010a9c0008", "comment": "Malware payload (GhostGrab)", "timestamp": 1778061278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061278, "uuid": "6e7d5e0f-fdc6-4ba8-a6fa-ae89017c0b5a", "comment": "Malware payload (GhostGrab)", "value": "2383d03af42cb24389c42f8f8c649bd9", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "GhostGrab", "colour": "#CDAEFE", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061278, "uuid": "1dae1dd2-a662-4025-ba64-82e9b5ed6c81", "comment": "Malware payload (GhostGrab)", "value": "a6ea793e52823218041ededc61900c6ea273b50ec64d32c4d2a3ce722450705b", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "GhostGrab", "colour": "#CDAEFE", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061278, "uuid": "30228ad7-8b0a-444f-a57a-b2e919a55d7c", "comment": "Malware payload (GhostGrab)", "value": "4633a579726e424b7788bd46eb5ef9594ad2cc07", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "GhostGrab", "colour": "#CDAEFE", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061278, "uuid": "2277296d-0a89-41ce-9771-4faeecee3d73", "comment": "Malware payload (GhostGrab)", "value": "4fb3832979953e087ac7e3ab1a86783f45b9de0be6c758219c9359d2ffde849e1b43c5438828c4539986aba906b72cfb", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "GhostGrab", "colour": "#CDAEFE", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061278, "uuid": "33c3e1c2-511a-4814-8e3a-78e35448320b", "value": "T1907601EBB3E95E59D83261B1846D17B6651F8D288F4B9A076D00331C79B71E42F88FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061278, "uuid": "e44f1213-d4d4-4828-8677-28348297f89b", "value": "196608:k4k+XmepvM/i9qj7junS7VthplJP8QYw+5rwIplN4I:vtcX/ngwIrw0lyI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778061278, "uuid": "144da607-5223-452b-b4d8-17a4c389edfe", "value": 7152767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778061278, "uuid": "b854c12f-38f2-4294-b0bd-82f2ea972faa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061278, "uuid": "8a373085-6dd2-4660-a3c3-c306ab74c351", "value": "myapp(3).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7e260df-4980-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778095288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778095288, "uuid": "8d4533f8-571c-4108-b2d4-a56d64871c1f", "comment": "Malware payload (Mirai)", "value": "df3162b9c6aaeb315ad75e27baa4b4df", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778095288, "uuid": "d9a4fdb7-787b-4826-abda-33c9cf19a914", "comment": "Malware payload (Mirai)", "value": "a87149f1eb2e9481b34b25bab3165e23e01dbf96eddb8571b5d30d20860bd6b1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778095288, "uuid": "6d970d1f-bb5f-4f55-8426-08566e891175", "comment": "Malware payload (Mirai)", "value": "4a1f2aa86ad7baf26992359fe143b484d25922a5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778095288, "uuid": "657ba1ca-1001-43f1-a495-f5d232b7078b", "comment": "Malware payload (Mirai)", "value": "0cc107ba179dae75d9b205f5a8dc56f7347c684fc4d984ab1fcc43b2a865efe3f6302c3a2850c9bd076a465526a80d18", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778095288, "uuid": "7656ab65-9033-405b-8767-8af1de6cc7eb", "value": "T14AA15CC9139358707CE29C276169C814F6D9B68AADC54F4190DCF4F9A4CCF09BE42AB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778095288, "uuid": "613f2636-8037-41bb-9436-5900072e6072", "value": "96:2RKhEcfEnsTE111mC1mkPnJtbTrDVpfXRlP9:2M+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778095288, "uuid": "d94ae8aa-50ba-4b5e-a643-e0b8e002f482", "value": 5029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778095288, "uuid": "1bad8f92-bcd5-4f76-96f5-80de4c2353a5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778095288, "uuid": "81d26d03-d9b2-4a11-9118-0431f2466785", "value": "kla.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22c06ba1-4997-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778104889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778104889, "uuid": "ca6dbcbd-d0fe-4859-bef8-57776b85b393", "comment": "Malware payload", "value": "365d59fbffb88ca9d64fd8cd505c997f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778104889, "uuid": "2acb3b0d-0c7e-46fd-9925-50bfcce08e30", "comment": "Malware payload", "value": "aa280fd17abd645b9a68fd038380dca971c484644bfbc3174871b877ea2a3b99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778104889, "uuid": "39357dff-5125-4ea1-a68b-3c9bc7ac1c1f", "comment": "Malware payload", "value": "fb3664401db36fab89d3e5f53cc6f6c2d5342843", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778104889, "uuid": "c7ec4ccc-6dfd-434c-bc56-aa758f3b3f1e", "comment": "Malware payload", "value": "a1b12e376f6bfa8d59e8edba83b76a53b133a63530c6004b8060ced316444659b512f523402d71d6218297d54e96be14", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778104889, "uuid": "4dd66a5b-fa34-4ff1-b073-1ab7238b06fc", "value": "T1B0967C73945224D8E1A9C9B4D51416527DB83C8B573873CBBAC472F61BBABE48E78330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778104889, "uuid": "40f2580d-d686-4259-a0ee-51d61c9240b5", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQT:cqYUQuVDt0TZEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778104889, "uuid": "4db4251c-e62a-4e79-94be-68119695569c", "value": 9043968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778104889, "uuid": "41f71533-418c-4167-999b-8abab30307c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778104889, "uuid": "db43d324-283c-427d-9eff-1e13409520ad", "value": "aa280fd17abd645b9a68fd038380dca971c484644bfbc3174871b877ea2a3b99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a59ccbc2-4961-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778081916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778081916, "uuid": "059fe1eb-848c-4e63-ba94-267b15467847", "comment": "Malware payload (Mirai)", "value": "39286d120df75aaad7b9a1408883e65b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778081916, "uuid": "a97945f1-89b0-4cbe-9d44-70769a198610", "comment": "Malware payload (Mirai)", "value": "aa7317b4f4852abb4d1661444ff305d83e6cc383ef8feb3c02fde501ab33e2c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778081916, "uuid": "796f29c4-8210-4d9f-ab83-9a13b4487b95", "comment": "Malware payload (Mirai)", "value": "7c04b01cf7bd7873f62552a203ab1274fb3c9907", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778081916, "uuid": "e8761846-8cfd-49fe-9b7e-ff99fd5ed854", "comment": "Malware payload (Mirai)", "value": "e552c876640fbf612f79cb043a7b7218f050964fbf9ff2ed459349349416ad7bc16115c81f9192b108fcb8bb27191cbe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778081916, "uuid": "d8f1da44-0042-40ae-a18d-10e74281dc12", "value": "T12F443A45EB414E13C4D6277ABA9F02453333A7A8D3EB7306DA246FB43B8775E4E62601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778081916, "uuid": "a5ccbcae-a64c-4f69-a631-a596f04d62dd", "value": "6144:J0ilu1OyjajvkbDkaiRJaxx2No4FR+Jr9CwXH+cKLV/GPmK24Vsd:ao2YkbDkaiRJaxx2Nou8wb/smKFVsd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778081916, "uuid": "6412815a-c8cf-4e67-9de0-4c52ce128ade", "value": 277157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778081916, "uuid": "509477cd-441e-4e68-9dd8-fd6a133f9644", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778081916, "uuid": "5e0d3a97-8538-4710-93ac-7ba7e7745233", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17730bce-4926-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778056337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778056337, "uuid": "33379b45-16c5-4ea0-9ca4-f2af4ba094fa", "comment": "Malware payload", "value": "314eb9a35a1f257e233f340fb459b1df", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778056337, "uuid": "947e4889-5989-42e0-804f-18522ee03b19", "comment": "Malware payload", "value": "aa7f74176ad36d1c0dee000c1d9b860155eef1219d92b93d3d21268e8bbe17cf", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778056337, "uuid": "153306ec-28bc-4c5e-930d-40fc0644fbc3", "comment": "Malware payload", "value": "063784b0f1a7bab7b1738e71f8a0d8aa9dc3ea6f", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778056337, "uuid": "460b927c-2444-4dcc-b3d0-e4072fc242ee", "comment": "Malware payload", "value": "c4edc6d7491adc5107dd7fab5d7b5690fc7c5dbba4828db770ac4b03714f08448eed7f2ac29630dbf3bf8a0ceea5415a", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778056337, "uuid": "8b45f1d6-99b9-4818-9e0c-3c71d631b61b", "value": "T12BC63352F794A54DC4F2C3322DB59AB2541AED12DF43939BE825333D2A3F5C08E866D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778056337, "uuid": "c5bdfa6b-9529-4b17-b110-789230f22e55", "value": "196608:0jq6NPWv1a918ShKr1Z6XVyTwc7F0YKUEjLBFvcHj3BrpHtbGaUFeXARQUzj5mb:fO+vRy+YVyTpRkUmcHzoj8ejj5mb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778056337, "uuid": "80985389-8dd4-48a1-b9a4-a2378e381740", "value": 12476688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778056337, "uuid": "68dc6e3a-23c8-4f3d-abfc-4046cc8f66d4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778056337, "uuid": "bb07b736-c3e2-4e40-a431-e3462796cea0", "value": "mparivahan(15).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9641817e-4927-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778056979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778056979, "uuid": "ac22adfe-b3e2-4656-a40a-92ffd55e9509", "comment": "Malware payload", "value": "6024ea179793ab421d28ce79c6d12200", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "IDFC", "colour": "#2E569D", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778056979, "uuid": "e92bbd7f-982d-4fa2-9da6-a59e92aa21c0", "comment": "Malware payload", "value": "aae6837ffec783e20b0527407ab0e0fc78810cd6d78cf2f3bf5a611c1afbc083", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "IDFC", "colour": "#2E569D", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778056979, "uuid": "8c9be0f9-9d22-48d7-8432-cf5a7bf36123", "comment": "Malware payload", "value": "dc3ef3aec9a3165478c70ce68dcd106ecd2598c7", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "IDFC", "colour": "#2E569D", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778056979, "uuid": "b641b5fa-0a0b-4220-b114-3341b43d6794", "comment": "Malware payload", "value": "e536285f23a50410f8ddfb1cc5ab95f81ba1261a7791dfd504832781dc789732bce8fee74e180084b3bda5e93a73bde9", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "IDFC", "colour": "#2E569D", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778056979, "uuid": "feb7e42c-0fac-4258-abc4-a2630ec37f59", "value": "T177E6124BEE58C95AECF6523AFE32032334225DA84303C5BBA5A5F63C7E731D64A915D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778056979, "uuid": "99b4ce89-534d-4ce4-9d84-9c36bffccb5e", "value": "393216:YJodI10Jo7hYigz6b6BSwUMZ7iQMuWVLJX:YJoa7ipWu8wUMFnIR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778056979, "uuid": "5ae125a4-551c-42c8-b168-d30e99d85a4e", "value": 14586662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778056979, "uuid": "c3e5ae3e-d8c9-451c-8db9-3a4bde24974a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778056979, "uuid": "e1e3a944-efb0-4d07-8142-e6295a2de8dc", "value": "IDFC First Bank.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67804b9b-492b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778058619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058619, "uuid": "c61fdbf5-ad38-492a-8b83-88d4a77b715c", "comment": "Malware payload", "value": "1d0c2e0694c76451ff7d79282dd60083", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058619, "uuid": "bfdab187-7bf7-4048-ae33-3a7949ccd5a9", "comment": "Malware payload", "value": "ad588cb1dcff0b4d0acbdb31627b2e04ba0ef82aead492784d4a651f6fb11865", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058619, "uuid": "18453e1d-6741-4d69-b784-ef7855eb1ab0", "comment": "Malware payload", "value": "5d08d2597c87b689b2dc24077afef1ec733389e6", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058619, "uuid": "80e3e1ca-04b9-40e8-a13f-680ad804abc5", "comment": "Malware payload", "value": "1fc2284323a273633a406a991a26cf39bfccd16af22df96b7386c13ac05f2eb328cbc54b840345bb4c67e890e0b5138f", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058619, "uuid": "45305929-6651-4edb-a2eb-d83e54614145", "value": "T178B612D6FBD8492BC4775032C96952F1215B4D528B839F87B904360C78B7AE80F9ABDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058619, "uuid": "e5199803-2719-4152-9fb9-42c89ca7e2c4", "value": "196608:uavXX2LthRaFOd7ZMebVmXRmwcHTucWQBz+eF3ij+9GYFcZm2z2di1S:JotjaFOd7ZMkso4RAzh3i+FyZzz2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778058619, "uuid": "f5a30cb8-0e98-42b3-8832-46d21625644d", "value": 11434100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778058619, "uuid": "9f78b607-6a54-4451-94d2-6828cc0ea564", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058619, "uuid": "16e39c77-f984-41dd-baac-67088a01e971", "value": "iMobile Lite (7).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3833e117-4933-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1778061976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061976, "uuid": "2ab5f69d-a8d8-47e2-b16d-f93d49d43ea7", "comment": "Malware payload (ValleyRAT)", "value": "18ceead3ab3983c7a5c63ace122f46ae", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061976, "uuid": "17b4c885-a85a-4f35-9c73-ca7a4fc97916", "comment": "Malware payload (ValleyRAT)", "value": "ae2a7bdba09654b243c42676904df970cba606bdf609b701c084e2ec475e48d7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061976, "uuid": "24bafa0c-22b9-4bf6-93ad-b86f6f6e58b8", "comment": "Malware payload (ValleyRAT)", "value": "282666eddd7c247a231c3ae8467f431d7dfc16a7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061976, "uuid": "f28a4c8c-940b-457e-accf-b11c09dfbf32", "comment": "Malware payload (ValleyRAT)", "value": "31a40d505c845e5405c71506e6f09286652a44a487639fc862ffbd95f1b63a3790af58b0db97029bfbc161127c1e8079", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061976, "uuid": "175d9d84-323a-4fc3-8cfa-4635403f85f9", "value": "T1FEB48D21B942C231D1A901705AFDABBB95BDA9344B3009CBB7D40E7A5E706D37B34E1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061976, "uuid": "78bbced5-b572-4a87-9f28-6e2c4172154a", "value": "cce331b83b6ebe6b74eead579f4dbf31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061976, "uuid": "20b3d664-c505-4381-b329-60ed89b91460", "value": "12288:Dq0uXDnHoHp3OopAZWov3cG3HIguoF/c8P7Da+qQ9zi0e:Dq0HeWyH4poF/LjO+h9zH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778061976, "uuid": "91f79514-a0c9-4675-bca3-51cf0360d2e5", "value": 530944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778061976, "uuid": "35e8eddd-6448-4f2a-9a42-30129e482a05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061976, "uuid": "9e3515e8-3a2e-4c11-bb21-d3f6d0611a51", "value": "18CEEAD3AB3983C7A5C63ACE122F46AE.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bb12f1d-4938-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1778064236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778064236, "uuid": "191ae76a-b2aa-483c-90ab-4cc0857f1177", "comment": "Malware payload (ValleyRAT)", "value": "76f34b7da87fae2d0e1b24c3e9cb9960", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.ct", "colour": "#043A7B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778064236, "uuid": "d923d86e-2a70-4372-83d0-6cc1ffa99726", "comment": "Malware payload (ValleyRAT)", "value": "ae3ff26fadd67b2c3659c8f0d591edc60bef7cea7d0c915219d567e73c1a745b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.ct", "colour": "#043A7B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778064236, "uuid": "87e591cf-c015-41be-81f1-c0c1538e0c37", "comment": "Malware payload (ValleyRAT)", "value": "6dd3c6144d645661665a0289d9f98a093a63fd4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.ct", "colour": "#043A7B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778064236, "uuid": "0d0fbed9-1187-455c-9373-8b2a2f6345f8", "comment": "Malware payload (ValleyRAT)", "value": "f4998c741e1df51e0e1251aefaeb5d1e55d7fd4b56a35925019eb66408a1ff094a8c127cab05af2b553e7e71701821b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.ct", "colour": "#043A7B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778064236, "uuid": "3bc926d2-0396-44c8-b9c9-333ce78d8e3e", "value": "T125648D10B9C19032C6B33C304779E6B14D6EA8312D609E9F93DC29755F34A91EA39B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778064236, "uuid": "75421621-621f-4f8d-a858-48df592f7847", "value": "a46f3548f49cbdf7a93bec1f7d9db0a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778064236, "uuid": "511acbd6-75c7-4dcb-9d20-c63f6038e689", "value": "6144:/kj/QHs1H593AQvCgqq31cWeEVI53b0qqn5/55RFxwQzJqTv:/5Hs1z3AQvCgqq31hxVIxb0PZZzc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778064236, "uuid": "432bb07b-5fc9-41c0-ab9c-786a3749abcf", "value": 317440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778064236, "uuid": "2c458927-20a5-4c58-bce6-b49fa5fb742c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778064236, "uuid": "863435cd-2c8a-4981-8f36-4abfaaadad39", "value": "\u624b\u673a\u53f7\u53cd\u67e5\u4e2a\u4eba\u4fe1\u606f-1r.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa99c429-4986-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778097816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778097816, "uuid": "92e18b34-52fc-4ad2-bf6e-6245964af749", "comment": "Malware payload", "value": "e6b6ee67265f671d2fa3259f973e6382", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778097816, "uuid": "8c19f911-7eac-4c7a-8b22-4efd13362bfd", "comment": "Malware payload", "value": "afa005ad2707e4b6e1e565091c57ec5abdf45cd738bd1f1edfc04fcca1ad9c64", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778097816, "uuid": "cc251769-c178-41a7-8820-147f471a00da", "comment": "Malware payload", "value": "d24d9854f8e81de9dc381881efb18b235772cb2a", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778097816, "uuid": "87ed3ec3-fe9d-42c1-b28f-99ba435e1433", "comment": "Malware payload", "value": "151f2fb1c24c9f147fcc476013ca0b89f365a16d5af743800718fc48a6a14bd2b687f1c43905d3dd5c56bfbd2c29bac4", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778097816, "uuid": "e62c21c5-e4c1-4015-a624-1e39b0048e06", "value": "T1B522BF00CE05F8287910B3C1FDA4DAA98FED712EF9FED60A7155ED30E2F85666990E11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778097816, "uuid": "8a4d7b67-eb5f-414c-af23-e143b01b95fc", "value": "192:3gncIWRfUpVWeKXTpti3B4Yn8mD/SsiAhwZJ+wujOxaLoLKUwAubTr:NfUGtlWHqb3dudoLHwAuHr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778097816, "uuid": "e5d700d9-0fdf-4f32-81fa-17c35e59d165", "value": 10067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778097816, "uuid": "e1be6937-f634-4dec-8d99-c968f0b1d52d", "value": "application/x-arj", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778097816, "uuid": "3641004d-cf35-4f46-9224-14d867c7c89d", "value": "1_14_9_1524_05.05.2026.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74daf910-492c-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1778059071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059071, "uuid": "b3cc6518-31e8-4331-b5e4-7c1147d7a36b", "comment": "Malware payload (XWorm)", "value": "880b6cc18121cc7e416e09100509161e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059071, "uuid": "814a60f5-4f02-4c91-a716-4cc3582015d3", "comment": "Malware payload (XWorm)", "value": "b0479587dda76317e2e2261984b0522ce0f4e08d2b9093414618c6cbdf7ace6c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059071, "uuid": "209870b7-306b-47e7-bc7a-231b0a6fc7aa", "comment": "Malware payload (XWorm)", "value": "d429a21df011a20e643182730921258eae17920c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059071, "uuid": "494ed5a5-2aba-4951-b593-432ecee6b701", "comment": "Malware payload (XWorm)", "value": "4ee00be0f95327c4db13f25f8149069015039301c845a469149010066ccf606ec7428a1ef1601bbddc2f02c7786f4e8a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778059071, "uuid": "b0a7cdd3-dc33-452f-a62c-bb4ec5b7a1f9", "value": "T1E9B5FDD98180C68307328CFFAE84299625F3CB1F82194B5DB991D0D54E726AD86DDBFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778059071, "uuid": "f987def0-08dd-40d3-aaec-603a23e0523b", "value": "768:ziiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiU:S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778059071, "uuid": "4a4d8c86-b00e-43e4-adc6-817109598f0f", "value": 2387880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778059071, "uuid": "28029829-ad0f-4fe0-a7bd-fd8564b1577c", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778059071, "uuid": "4d74adbb-c847-4b10-9a1e-6f1c8cc0d301", "value": "awb_fedex_original_shipping_documents_bl_tax_clearance_custom_duty_2026_06_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31aa2917-4933-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1778061965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061965, "uuid": "5e22ae90-a1fc-4103-a17f-d1df90a55e50", "comment": "Malware payload (njrat)", "value": "093c4791414e66b5f0b937c3a1997055", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061965, "uuid": "f13917c9-0c10-4e23-aa81-5cc3793099c4", "comment": "Malware payload (njrat)", "value": "b17351a1733beec30ecd6177feeba19e3d659580a93f75a0daea39e6317b4a27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061965, "uuid": "f5f50c29-f608-4434-9db9-76e17f55c400", "comment": "Malware payload (njrat)", "value": "fd30739d40420eb54576595f48121fb87de7357b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061965, "uuid": "3b0fabf3-bbfa-4f1a-871a-0f79f82c0223", "comment": "Malware payload (njrat)", "value": "cfd30f73b872e0cb8b26e16814d37e22877054724bddeced460c61900cc4139b7bac5edba63572b5b426e2fc717764c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061965, "uuid": "59fd356a-9314-4b02-b1eb-a650ba58b957", "value": "T16F93D74977E56524E1BF56F79871F2004F74B48B1612E39D48F218AA0A33AC44F89FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061965, "uuid": "1623c9cf-8e50-426d-9980-e982a78ac54c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061965, "uuid": "72761ef1-108c-43cf-bbff-6bf9c2380d43", "value": "768:IY3HOJhWXxyFcxovUKUJuROprXtgN8eYhYbmXxrjEtCdnl2pi1Rz4Rk3ysGdpCgM:3O3WhIUKcuOJXPhBjEwzGi1dDODCgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778061965, "uuid": "aee9aa0c-b29f-4b4a-8b4e-a0c298d83a74", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778061965, "uuid": "b70fa14e-74b6-4439-894b-0b7b0c6d1fc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061965, "uuid": "5a0d30ff-5aaf-4a1b-a4c0-da0d7f6b8b37", "value": "093c4791414e66b5f0b937c3a1997055.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c384a549-498e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778101293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778101293, "uuid": "1bb1b220-dce9-4e3d-b109-63ca706f7871", "comment": "Malware payload (Mirai)", "value": "60c81ca6a013e7d2409ee28566b84673", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778101293, "uuid": "7f6ef701-6cee-429c-b326-22c8c11cf2a7", "comment": "Malware payload (Mirai)", "value": "b23a619dcfd75de7022745a4654aac3b41b6c1e91d38db30a2972a1dd0bc47a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778101293, "uuid": "b972f861-306c-4e5e-8b41-d04bef6b3e63", "comment": "Malware payload (Mirai)", "value": "9fd7e3f480a7eaceafbcd2bb854b419591b1e48d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778101293, "uuid": "f07becf1-01e1-463a-ac48-4f879a8e52fa", "comment": "Malware payload (Mirai)", "value": "9b53596be16c1e495747fbc9026cc454fd8feef958abd821eafceaafda92167b20717ffbfcdab06cb31ba287ad2402a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778101293, "uuid": "803a6b8a-5a4b-409d-99c1-afd5736d4b7e", "value": "T1FFC33A2239392F27C4D1A9BF12B34365F2F15B9E15A8C90EBE720D4FEF2426065076B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778101293, "uuid": "ce65aae3-030d-42b2-8024-c561cca29617", "value": "3072:HsSz20z1tUePeC6UTxsIXKTYlmY8rylBb4:MSz20zcePv6UpXKvHryld4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778101293, "uuid": "b4331c5e-aaff-4217-b91a-fa8cba09b299", "value": 128280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778101293, "uuid": "6aaf1881-51f6-4642-9eb6-847791626ea1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778101293, "uuid": "f9534178-3185-44b4-a924-0307c02fb73e", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e23c9e3a-491f-11f1-a769-42010a9c0008", "comment": "Malware payload (VShell)", "timestamp": 1778053671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778053671, "uuid": "ac72af31-a998-46a9-9874-38ec454714ff", "comment": "Malware payload (VShell)", "value": "e1d172a8046d208be76ca5454c718be9", "object_relation": "md5", "Tag": [ { "name": "UAT-8302", "colour": "#F096F6", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778053671, "uuid": "bf8d7275-3c62-4c28-91a8-acf235694cc1", "comment": "Malware payload (VShell)", "value": "b39cb5e2b18aa78de8d7ff6f586bfe904db4f6ad42b6224ae81009b398e7c851", "object_relation": "sha256", "Tag": [ { "name": "UAT-8302", "colour": "#F096F6", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778053671, "uuid": "67b95d9c-8689-4d4b-93c1-ba19c1e768ad", "comment": "Malware payload (VShell)", "value": "627a7ed6f0c0beef4b6f75e45aee7c3eba65781d", "object_relation": "sha1", "Tag": [ { "name": "UAT-8302", "colour": "#F096F6", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778053671, "uuid": "308c1c95-0b93-4c3d-9bfc-4e3552223ea3", "comment": "Malware payload (VShell)", "value": "17ff5c6936a0052268186b3d4f284c4ad1eca11ec5a21d3ac50fbb580c62a17f09c77b87c027d5ba5af54d7b1e448ef0", "object_relation": "sha3-384", "Tag": [ { "name": "UAT-8302", "colour": "#F096F6", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778053671, "uuid": "a6327fdb-0916-4b41-bdb2-b7ccf01e966a", "value": "T1770633D274F2B5E3BC75FFA672591BBA94BC907131104E21F8404D922BEB77086968CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778053671, "uuid": "3329a0df-5706-43b2-8594-c2c1ef7f8a79", "value": "98304:vENFBu5RAORdFEIlTJEoQOZRTzf16JcE6UKZbNNKq5q:vEN65RAOHFr97ZRTzf1ucE6hbN1w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778053671, "uuid": "b2b0ea39-4f2c-4db3-b687-51bea2224791", "value": 3950322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778053671, "uuid": "ed036596-4013-489e-99bd-ac3f4c7eae78", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778053671, "uuid": "cc7bdce8-e4ed-4005-ad83-c509377d704f", "value": "vshell.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e54e7775-492a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778058400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058400, "uuid": "bb94c9e7-9c87-4389-a7c3-514499239d72", "comment": "Malware payload", "value": "81753337d682c3f3e126535f8270b1e9", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058400, "uuid": "9c0999e1-2ee5-4c9b-9bb6-89b28d1c01b2", "comment": "Malware payload", "value": "b3ba45e944557bfa2c67c73eab49f423367c5cfdb394ce162cb1612ad94ca4eb", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058400, "uuid": "0a17fba5-4807-4d1d-b516-a40ee70a1d10", "comment": "Malware payload", "value": "6b9d0a12d5ce2cc3292732abf4e880274a39a20e", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058400, "uuid": "75537d37-6b13-4059-b155-07c4aebabd52", "comment": "Malware payload", "value": "22f12f392db982847360e09dd2fa542abe6214859e0df91f06c36a0a1b821310b63afe7772ba130c9d3e3decdc7679cb", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058400, "uuid": "a0444d9b-b6b8-4915-86a1-039c7a17e1dd", "value": "T10FC5F7B4FC49EC586FC5D48E03762B3F99B821D86D6F8FF0D1D299B16254CA7988B180", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058400, "uuid": "b532f993-8f61-440e-ad8a-f97bcb4aa938", "value": "1536:J55555555555555555555555555555555555555555555555555555555555555x:b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778058400, "uuid": "57f7f07b-3b4a-42c5-8c70-6a31f05f870d", "value": 2640219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778058400, "uuid": "9c6df42d-c136-47ae-8e50-1a018dd9c3e6", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058400, "uuid": "b5d89c4f-5df1-44f1-87bf-6bdd34b281f0", "value": "Order List-May 2026.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c6a7ce6-4959-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778078250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778078250, "uuid": "1fd6275c-21ae-4c88-af83-2d5d211a7cd5", "comment": "Malware payload", "value": "b6e522f2e769a7d9412212d8cbb9f1ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778078250, "uuid": "a9c4df71-60f7-4f15-a730-4d5b7797985a", "comment": "Malware payload", "value": "b46b8d0d32825eb9ab6bcc58c5123c2f2221c7ddd7fc9a3d35bf6ee9eb4e943e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778078250, "uuid": "71f95700-51f9-41d3-882f-b757e40b3897", "comment": "Malware payload", "value": "8023f83723cfa6701a35ebb87008a83bcbb1d2e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778078250, "uuid": "25429abc-086f-41e6-b42f-b24cc6087cb1", "comment": "Malware payload", "value": "e90ff9721ffb20af9c05c31f35594e9a86549cffbb8becb63aa489fd40ccae9f4a43d7a0502104b595c6aeb914e30d88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778078250, "uuid": "47e5be94-4743-47f8-9e8d-32ef40292391", "value": "T165D30287EBD89692ECFA477495FF281848B9F7145D03A74F4BD2C2CA4A753448A703A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778078250, "uuid": "31ad9790-ac14-471a-a720-2e5ae3538bd0", "value": "3072:LPy9CpzlR/t57/jkxkWE2ASOmXe560XYYeH:LlDVp/jYZFe560X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778078250, "uuid": "a34210b0-e77f-42c6-8abe-08abbbc8f497", "value": 142336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778078250, "uuid": "b1f32b49-6849-469b-b65a-5a84a92ba3ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778078250, "uuid": "99a0be99-2a53-4929-82c2-b8c886644761", "value": "b46b8d0d32825eb9ab6bcc58c5123c2f2221c7ddd7fc9a3d35bf6ee9eb4e943e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97d81f17-4921-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778054405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778054405, "uuid": "d141cff7-577d-4ccf-8069-06252f15fe5d", "comment": "Malware payload (AsyncRAT)", "value": "c906947dbcd305867dea5232856233a3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778054405, "uuid": "d01f69b4-13f7-4bea-b739-240ac76c05f7", "comment": "Malware payload (AsyncRAT)", "value": "b5713aa135a4e4b4b194d057a49a253a98f4767903c72099ceb16d2b12e5cbec", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778054405, "uuid": "b9260ba9-ecf8-4f1a-8936-e16b3f3bb90d", "comment": "Malware payload (AsyncRAT)", "value": "a98141129d573e3323b5a442341a5ff1d34a5c9f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778054405, "uuid": "836e577e-67a8-4bcd-bc75-d0c62f06750d", "comment": "Malware payload (AsyncRAT)", "value": "bce31aa8086a326ab9f15f53c6154e3245a5bbb40413f47a2663e519a00ea7cea51c76394c757e4ac57ed9208cd962e9", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778054405, "uuid": "7189fff0-0809-481e-b5af-c37dcefec1d2", "value": "T1C915D0D43A26EB0ACD920A309A34DEB116F51EACB501BAA39FDD7F5BB4AD1105D0CF41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778054405, "uuid": "b0140732-a545-4c7d-a420-3d18d46fb801", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778054405, "uuid": "6b16ed78-d4a8-4ddb-bb3a-e0028709cde9", "value": "24576:eKaCzZ53/LqraBOzVcSi4yRwOGbQ4nN9F+U+zq:HaCV5vLqraBOzx2wPkqYU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778054405, "uuid": "e3adf1e6-57a4-426f-a057-f3fb46dfc134", "value": 932352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778054405, "uuid": "bf13048f-7c52-4006-8e6b-3fb715400d8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778054405, "uuid": "6ecaa39e-5309-49c4-9180-c3001b7774fe", "value": "z1payment_00111436.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d33be448-498b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778100031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100031, "uuid": "2eba402f-94a2-4f1c-ac0a-b5039eed6882", "comment": "Malware payload", "value": "05f90ba84fbc550e1708ec05c3204e6e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100031, "uuid": "65e76373-44e2-4490-a543-e91ab1ac5914", "comment": "Malware payload", "value": "b571de82f3cd8efbd9f577fc56774fcea6d32b1e1a62e24ba9304742665e87f3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100031, "uuid": "6c2bc753-3e17-465c-83a5-594c0e5aa888", "comment": "Malware payload", "value": "9af9bcc5fe4b2aa87832af70e81b62c9bce98d63", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100031, "uuid": "f3da13c3-c3c9-4db3-b571-14b79a388f8f", "comment": "Malware payload", "value": "b04e4f2a8d20ab09e40104e46825aa3f220908c6fc973a8b32c67649baf732c8a37dbd92c1f1f7272752cf332bb4f2df", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100031, "uuid": "fc6424a2-1aaf-47f6-9768-36edf0c91b2a", "value": "T186F08B8CA1BCCE9118ADC486B1F0800554A19447A0F86BD5F28E0430AF14E4D392330D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100031, "uuid": "54ea5c4d-0acc-4a2d-8ecf-e107786fbb9d", "value": "12:FzY8id/7JAC7akxGWi2jX0KTkLKcj5dqcrTsnn:FzY8k1/sWi2jkzprrTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778100031, "uuid": "d2d51c4d-ea4a-42e9-a2f7-c95b82b372a5", "value": 641, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778100031, "uuid": "5d7183d0-a596-445e-bbc3-1d2c1e60866e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100031, "uuid": "00c271b0-11b8-4a83-8f84-0d6b12a091fc", "value": "o.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26f3c8e1-4933-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1778061947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061947, "uuid": "1505f066-cc22-46b8-b530-12ce91e36744", "comment": "Malware payload (NanoCore)", "value": "b17356345e651acce60ce440d725ed77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061947, "uuid": "d4d56441-764d-4843-a348-179eae3a8150", "comment": "Malware payload (NanoCore)", "value": "b572ae9f63567fb74c6e0bdb80e762b4d4bd65d17d4d83376ac3f552bc8d2a73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061947, "uuid": "dc3425bd-23c3-47da-9abe-26a72b10da07", "comment": "Malware payload (NanoCore)", "value": "f090f381f9b96f5765e07779d8b45d8816de085a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061947, "uuid": "9dea9f62-a116-47ce-a09e-e0f5e9bd37fb", "comment": "Malware payload (NanoCore)", "value": "3432c9d1ef48c5133911d621fca0a040ed8ddc8a0b72c298f748558bc40f9dacd9c6c47f1e20b221fbf8eba8f04c8611", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061947, "uuid": "c5507c3e-cdc1-4e7f-af74-a2a9c7241e6e", "value": "T1CD14CF6677A88A3FE2DE8679701246039379C2D398C3F7DE2CE455B29B267E406071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061947, "uuid": "95f4da88-d4cc-4a90-8f6f-752c67585e0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061947, "uuid": "97235248-916b-41b4-96c7-0553dab57d19", "value": "3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIBKLZFSGH+2AgQ7S8xaP4W9rss:MLV6Bta6dtJmakIM5HLZFFYSEY4ers38", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778061947, "uuid": "664d5ec5-52c3-4ab7-adfc-a300e0733d7c", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778061947, "uuid": "0618c50d-312b-4082-9d3a-5771b91e0e2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061947, "uuid": "f1821ba1-391a-46cd-882a-3ed145a227f4", "value": "hotro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b59c839-498d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778100662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100662, "uuid": "32d35977-5bd5-41bc-bbd1-6a5c4f985229", "comment": "Malware payload (Mirai)", "value": "0ce925c10c005407bc3d415696fe2d7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100662, "uuid": "8a5d5993-7968-4f6e-800b-b620a912ccc1", "comment": "Malware payload (Mirai)", "value": "b6104a5f646f80e1e4022543ad689a444d5bab506a721652cab2581cc8746823", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100662, "uuid": "edd2264c-0e97-4293-8ab7-71fb99d235f8", "comment": "Malware payload (Mirai)", "value": "1a9faf213072b474b753ad6314d97b5fcb9d2aad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100662, "uuid": "ac8b1d83-2370-4102-b18a-457cc17b7658", "comment": "Malware payload (Mirai)", "value": "cd9fb0e5f504269db708bde37c0860c82f149dfd18f58d9288131cc6584dad8b41a583f340c2cea3d122d88f49052a58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100662, "uuid": "c532a447-8130-4fe8-92d9-6a5eeaafe4aa", "value": "T17313F155A7F90110D066247E60EB716918B0D286496F43D8BBAC3092EC6DF35B33D7D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100662, "uuid": "cbf24310-de62-46f8-9a93-ef9d26cf0f21", "value": "768:YHsX72oAEg62Hr64TyTawDyXu8nCzRskzz7KYNOkHGfIOnbcuyD7UHQRjG:Yi7QEg6oTWaXnCNJ5rHGhnouy8Hyi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778100662, "uuid": "c0c348b4-9be1-4423-b464-4268d004c44a", "value": 43028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778100662, "uuid": "4fb9b115-e930-47ce-9381-0df1aa258ebe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100662, "uuid": "0fc382bd-2174-44c5-843d-d22c988364ac", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "645bd026-4943-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778068922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778068922, "uuid": "87a28ba8-487f-4600-8ac7-7d0d4f5c1e08", "comment": "Malware payload", "value": "c7fda3c57b409b9560785ed90bc925ed", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778068922, "uuid": "5f690a2b-44ef-4095-9772-42733f0b72ae", "comment": "Malware payload", "value": "b7d8e380a8468e509d8dea2ae27647e4e20f68d04bae2d577338e9d0c86208d5", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778068922, "uuid": "8f72d170-bfb6-4bed-8cca-14facbc6488a", "comment": "Malware payload", "value": "c73bcaeeabec7bab4e212ee0e9c81a3340a687cf", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778068922, "uuid": "2c39fb2b-7d01-4204-885a-b472ba413286", "comment": "Malware payload", "value": "308e568175cae8ec7be5a1e358f008df79ff8f9d0f80888878407c860c3e62610ceda40e54a6c4c200d42fbde4c10196", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778068922, "uuid": "7eb9fc27-a877-4568-8ab4-2620597302c7", "value": "T130E61233B28AA53DE06E4A369973E161193B7E116D134D0BD7E43C9DDF291A03E3B642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778068922, "uuid": "c6fe887f-7a6a-4912-a861-cdb2a1590432", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778068922, "uuid": "f45e5637-514c-49be-bedf-25fbda08e0fc", "value": "98304:YL8NcfYnM2gYZBiLYItof2gJHj57sBIK6knYdttpr9ywP6xrrZ5mZJz:bbM+CDtKj57WIKHnY7r9ywPerl5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778068922, "uuid": "1ae0fe21-0e1f-4c5b-8eb8-cb2771fb9c5f", "value": 14158801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778068922, "uuid": "aee17915-9d59-4e4f-8144-1e6ae5ba4d54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778068922, "uuid": "a4c4d7cb-c29c-4597-a256-e62c18f74f5c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20bedf67-492c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778058930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058930, "uuid": "73849602-cff5-4fc1-b581-b4cd9b4ff974", "comment": "Malware payload", "value": "0c37d2a22018a800d26191326825d881", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "indusind", "colour": "#495C30", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058930, "uuid": "e0938f3f-1d4c-4ddf-b856-8ccb30525c07", "comment": "Malware payload", "value": "b7dfef717c500fe8539630c092ccf0449538547d11cd227b79384bfca9949d8f", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "indusind", "colour": "#495C30", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058930, "uuid": "067eeab4-c7f0-4ea6-8c0d-91dfd29b51e7", "comment": "Malware payload", "value": "2fdb4d4dc81644f9f436711fb5c5b32b6e4083d4", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "indusind", "colour": "#495C30", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058930, "uuid": "f6f4a8c3-7d56-4694-8afc-25fa9e31040f", "comment": "Malware payload", "value": "0f1587d741cb670384ca005ffcece6c15420215d5a1c0f6d08e82f0a609774ab7f9c8290c7ad5262308b8164391ee3c8", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "indusind", "colour": "#495C30", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058930, "uuid": "d9eea3f6-ea89-4b27-b7f9-ccaea5b993c2", "value": "T1ECC612D6FBD4492AD4778072C96E22F1265B4D528B839F877504360C38B76E80F9ABDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058930, "uuid": "0ee4cb78-0fef-4de1-a8c7-8b4c7f0af58d", "value": "196608:uavXX2LthRaFOd7Zf2GD4GDB5Z1PzIgP75nZZbCptfOLdxFaZp:JotjaFOd7ZuBGDD575nZVafIxFG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778058930, "uuid": "19b96c25-da56-463e-8ded-134b1d84093b", "value": 11937908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778058930, "uuid": "2acc8e9d-0e98-4b06-8cef-9c522425688c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058930, "uuid": "250dc254-d186-424b-8d94-ff7981ebb494", "value": "Indiemobile (2).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df8f01ee-4964-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778083302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083302, "uuid": "fa720cd8-8c17-494f-b617-4aba85b2288d", "comment": "Malware payload", "value": "0eb4d69461ef6d96cb29a19e729435eb", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083302, "uuid": "72df4a41-1d3e-417d-b9d8-f8931880b872", "comment": "Malware payload", "value": "b853fbacafd465e1d80acc0c5c43c2b3ab8fef3ec5e3c34ef7802a3616aec23f", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083302, "uuid": "0a7a694c-3880-4f36-99fe-e09533810d70", "comment": "Malware payload", "value": "d8134fff014f8086096078268e7e0837376e49b8", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083302, "uuid": "a85e5fa5-58c2-42ab-9de3-088de021339b", "comment": "Malware payload", "value": "4c4aaea5f215b578ac10185e2b2269aadf0bca4b5fd29ef893ca95d07c70e3c0fd54d06db31bb5e0d969940d9c41bbce", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778083302, "uuid": "91d287d6-941a-4e4e-89a2-2d029224a5a9", "value": "T1AD363A077C6151B8C8D6F630C8B792A1F725B89C873837932A41AEF11F363C46A767A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778083302, "uuid": "936bc9c9-7c38-4cde-8334-608e57114974", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778083302, "uuid": "f08e7400-b478-4ccb-aaca-2c1787981b79", "value": "24576:uoWwveu+pW9c7ldTXxjisqyjYJBaPKM1S760Q2J1PwGIjzgXrA/K184:1veu+pWsvT2yjYJBC/gXrA/K1N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778083302, "uuid": "8afe47d7-0f27-41b2-ba98-856b2c310cdd", "value": 5067392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778083302, "uuid": "4e551ad1-2d5b-4ca9-9586-596ad8569b2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778083302, "uuid": "7ef4d8fb-9a99-4502-99a4-fa379ebdc60e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3edb950-4979-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778092328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778092328, "uuid": "d3bb88ad-aac9-4272-b994-1122ea4756de", "comment": "Malware payload (Mirai)", "value": "434a915a6f8642e7bc964e2401fd82c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778092328, "uuid": "7544d603-b5dd-4338-a6c2-a7d494929776", "comment": "Malware payload (Mirai)", "value": "b9a0a33790e89c263d5c27e3943d1f4656ce56b49b049ea3f69c9d1edc7bbb38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778092328, "uuid": "32c8a356-aa0b-4842-b064-73d9c7aba8ed", "comment": "Malware payload (Mirai)", "value": "e81043c3e46cf2e9a24dfa914c8a3fa1b2b83e54", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778092328, "uuid": "94cac1c8-a623-4c3e-93e6-58de958b3cbc", "comment": "Malware payload (Mirai)", "value": "70dbf49cfbe05f6477c9a9558ae20a8a16dce67402fbd3d349ab21818f8c12f879573ffee13ef3f69e6505b6482a0cd4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778092328, "uuid": "c9871919-63dd-46ca-a87e-cc4807fee666", "value": "T1C873E74AFD82AF11D4D813BBFA1E018D33536798E3EE71129D116F21A7CEA1B0B67452", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778092328, "uuid": "eab5e6f7-0d32-49d4-a5ae-301a12defcf7", "value": "1536:W1n2PEDjzOD2Vlt2J9j/XexEvNbF4nYs2kTCJ8Cll9UiLaS+5QiCwbZn:P8DPOD2ftgjvdvX4nYs2kTC70S+Cpwb1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778092328, "uuid": "d15cf760-1181-40b8-9359-e6bb74c3db5c", "value": 75200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778092328, "uuid": "6f2cf018-a967-40ad-a95d-ead376777682", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778092328, "uuid": "027d9fe7-f203-434a-afd9-4aa4e1329e22", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcc62b0b-4931-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1778061446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061446, "uuid": "c6bf9c66-8dd4-4693-bee4-9291f87db1bc", "comment": "Malware payload (AgentTesla)", "value": "6f00f9369e2ac604368a8742ebfb52a7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061446, "uuid": "4948c21c-2fac-4fa8-82c6-59e7f1e79455", "comment": "Malware payload (AgentTesla)", "value": "ba5667043566050e766cc0559f1a8be0890dea5ee2fb9dc54646cb1e3362148e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061446, "uuid": "6a1a6963-1b6d-4195-9e32-91836d6e49fd", "comment": "Malware payload (AgentTesla)", "value": "2cd210b4cf850f36c2d8a3f70511b40b3e118508", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061446, "uuid": "e68c816a-c840-43f6-9f77-c80c3cf24527", "comment": "Malware payload (AgentTesla)", "value": "22f5a2d6530953e4510ced09912ac1ab1edf17ab6e38cc4d6a1b0582f716d9f99a520b3a1ff5e64e91a9cd2b224d9bea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061446, "uuid": "05be56de-6801-4c65-80d2-2f876130ae34", "value": "T1EE1523B6E72DCF02E8A107F80A74E33703A96D9DD251C31B8EF95DDFB5226510685683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061446, "uuid": "5f1f9635-0898-419b-ba65-2eafa049ca43", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061446, "uuid": "cc876c1b-20d2-4192-babd-86e072ebe851", "value": "24576:6RYkBxhnAhaB8YtpmhmGj/dtDM0By6Ei2iZpCYU8u+0T:6hhkaSQ40AdtDPeiZpCYU8P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778061446, "uuid": "2b4051e8-569a-4cad-a5b7-3311c51f6ad6", "value": 940032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778061446, "uuid": "bb880756-c715-44e4-872d-96c4caf506d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061446, "uuid": "f218a66b-c7de-4b76-80cc-591acd4b6086", "value": "quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47399045-4966-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778083905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083905, "uuid": "6b0027e6-b84b-4fb2-bd82-aee6c818660b", "comment": "Malware payload", "value": "94416eda32104aaf97cb101fa47b4ea2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083905, "uuid": "4d16a09c-ca54-4493-85ef-8e1ee6303eca", "comment": "Malware payload", "value": "bb5e655b938d830ca02a21753a4ead8057f72b83a3f26b3b257bd934b18d3461", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083905, "uuid": "68bc89f8-24a6-4fea-8ca4-0554fdab9c62", "comment": "Malware payload", "value": "8677459ab7d962e1540b4bc6d21e7fa172f8d8dc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083905, "uuid": "871b6e79-1fbe-431b-a7b7-ffaa39384eb3", "comment": "Malware payload", "value": "c39051f08fbc21d6125dbdfe9db4e67fa147d86827595280d665d4bfd05c226e17e12e300a954c9f8cbcba27c17fb73c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778083905, "uuid": "a6fb22fd-c07b-451d-aafc-e1324b0f7882", "value": "T193510AA8C7421632FFA7182FFAA1645847C6AC03EB61154D5EFB5CCE01E0A06A67DF16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778083905, "uuid": "d2c6de7a-a373-46bd-9799-7f8160c844ca", "value": "48:l+jnat9/xU1948pcm3jnFYOve4UuHCC9eEVQsMosBAd4H:lkatIUi3jnF7veaeWQszsm4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778083905, "uuid": "e366548d-ead2-4fff-a582-9236350f5d41", "value": 2492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778083905, "uuid": "45a9b13b-834f-4d8a-916b-ceb7fff0bf2f", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778083905, "uuid": "4c2b9622-391c-4718-aa29-2163771e53e1", "value": "164.90.195.107_1778083895874104_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c0d661f-498d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778100717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100717, "uuid": "62bbba14-40b8-480e-82c8-16e1aef5982f", "comment": "Malware payload (Mirai)", "value": "6af675ac92f5c1582e81aea653b9cff0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100717, "uuid": "8fa58f0a-a87c-4bdc-97f0-cc2f0a6e4a89", "comment": "Malware payload (Mirai)", "value": "bd8f58b1ed18caa6907d4d69ad618f059fce809984d4008aee90bed199d116cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100717, "uuid": "ecc79dc1-1dfd-430f-b4d2-e928c4a6cc2e", "comment": "Malware payload (Mirai)", "value": "aed4c5c9546c840e2b22e211e60b0ccb2be31a26", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100717, "uuid": "9a31d561-3e8e-4938-8bfa-d012d9be275f", "comment": "Malware payload (Mirai)", "value": "7f04e9f8a31a8b9919337575026a1227a0186f293927ea92e05e9189b5d3433838f1327e2b714c3ba3a36eec78dfd994", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100717, "uuid": "cfe93fa9-443a-4011-a330-96d46527ba36", "value": "T1AB13188BF482993FC9D4837AFA6E614E7312F3E4D1DB371BCD098B55328710A999B940", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100717, "uuid": "84077973-7377-4beb-8ca5-0a3706eeb6ff", "value": "768:oh+qS98PO52eJR1ZxFi7npI8hagcE9axgQNjzkOMDAS//vzRJoS:ohwvLFInpIDIaxgMHkOMR/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778100717, "uuid": "8a3d1b5a-faf8-4fc9-9cd6-29103e273668", "value": 42300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778100717, "uuid": "0881cf8d-9a03-49ec-82ea-f864c9d7521a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100717, "uuid": "e10b51a4-9516-41bb-91a6-9a81a87fafb3", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d22f069-4929-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778057823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057823, "uuid": "d4e2eb90-b993-4222-a606-b9e36a698ac2", "comment": "Malware payload", "value": "59764c6fcde9aef8b8b4de3fdb77d523", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "M-Pajak", "colour": "#566AC3", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057823, "uuid": "35529070-1ed7-4c19-ad63-8347986e07ca", "comment": "Malware payload", "value": "be355d5f787ace801c4ef99fbbc19a55edd21920830c06ccde3e80ebc168ec90", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "M-Pajak", "colour": "#566AC3", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057823, "uuid": "da837de2-24b5-4e17-b9ba-d962f251d58b", "comment": "Malware payload", "value": "8aca44d83033efd78c232dd9e765ccd7e05f2f80", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "M-Pajak", "colour": "#566AC3", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057823, "uuid": "655aa90a-cbaa-4b23-9b50-ec1d2b78809d", "comment": "Malware payload", "value": "98ba57a0f5cf097c184789114eb354064812ff07701c1df414c8b94539611c1885b300d76996294735e28cf357138193", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "M-Pajak", "colour": "#566AC3", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057823, "uuid": "41334d5f-5f96-49c0-915d-401ce24adc63", "value": "T12D47E105F20C662AD9C6F07DAD8605E1B536BC8A6350C5463537B32DFAB3BD48B267E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057823, "uuid": "34478c9e-70ae-40f6-a668-49869a3debf4", "value": "196608:f9ReS4viKanjxds1sgAXFNgI7a7/Y3Zu9yzhLrZy6epA0h6yHnFphvQwo2b8+2fl:f9SLa14s3FNgIuM9zhL9nNw5DI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778057823, "uuid": "7254ef76-520d-4cc4-be8c-6c731a3ff02a", "value": 24613433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778057823, "uuid": "79912cfd-55a5-4599-bb46-06ba51720c2b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057823, "uuid": "493ab79f-46c1-4b53-a9c1-49cdc83cbc8d", "value": "M-Pajak(1).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22c4b47a-4989-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778098876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778098876, "uuid": "078f88f3-5ca0-4bb8-aa02-755196c19c61", "comment": "Malware payload (Mirai)", "value": "861335ef72cf51209c29b2fdf240f77c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778098876, "uuid": "bc384943-7cd0-4e7f-a1d0-5a0afede821d", "comment": "Malware payload (Mirai)", "value": "be8e3ae9ca1b991c02e9b8e6253f56c7ba5fbfbfb182341387d7e06681272a1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778098876, "uuid": "7086aa6a-eda6-45fe-a4a3-156de3541795", "comment": "Malware payload (Mirai)", "value": "0ed7c456cae058937acf78a070fad5b9d48a1bce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778098876, "uuid": "670cd8e7-94d3-48b7-b968-106a305b37c8", "comment": "Malware payload (Mirai)", "value": "008c13b753f7002f918ee992b7c0d6205d6ddd08fdd6d07bea5f39e902e20c447b43c0b1c3d0058aa730c6217f25b241", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778098876, "uuid": "4f082709-a7a4-4980-8906-03f39fff9a43", "value": "T188938D85FB83E0F0DD0609B011ABF7798A31DD362024DD6BEB98FD76AD326129116B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778098876, "uuid": "d927af98-c3fe-4977-abb8-d6b72c8103fb", "value": "1536:JUj89KwKFRAXmD9DDCczZ7JY4z8GG0Yqo5c0aU331QUHLaEiKKr:w4KFRA2RDDCczZ7JY4ITluiGD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778098876, "uuid": "57cae6cc-cf53-4b91-8271-ee11ad906315", "value": 95444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778098876, "uuid": "1e11416a-a439-4751-bedc-16baedd561c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778098876, "uuid": "4d67e6ed-f134-4b73-b4b0-47496a4fd5e8", "value": "titanjr.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bce64e60-48e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778027409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778027409, "uuid": "21da477f-241d-4672-b22f-dbcf43304ed8", "comment": "Malware payload (Mirai)", "value": "b37d8bdcb1222953bf6f89346bc493f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778027409, "uuid": "415e8576-d798-4f26-b7c1-7d06c3ed1593", "comment": "Malware payload (Mirai)", "value": "bef1502fc32fd7b6a71547dcc4ceeb7cb5a6f87188fcab2332ed9b8203672df0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778027409, "uuid": "b45dc7e5-21fb-4d50-a089-c8be7ddc8a9b", "comment": "Malware payload (Mirai)", "value": "74f54157aa6e6e5e1603eba5fb2789fab459bef4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778027409, "uuid": "c623fb6e-dc9c-4495-bc5a-425024bd80f8", "comment": "Malware payload (Mirai)", "value": "cb8b2b3951d799e107ec64e67cc0dbb3cda1b62e628d7404c3ec395d4aed61c5d3dd13837b7bd0c4dfa75a067930ec74", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778027409, "uuid": "b201c53d-bec7-4624-8fb4-cc32b0d1a0e5", "value": "T122E25A93A401C9B2FA66A1F0962BDB607B73F0777056D62BE3120938E861D8CD74335D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778027409, "uuid": "b5462176-a456-4372-8765-a16fe98b15f8", "value": "768:quST4+X0nG+gMJJx5GwyC/hEUqRzGF9hKKtPdyNk2MFgG/zyj3YriM:quArj495iqTEIdyNO/zyjori", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778027409, "uuid": "e7c98733-0b2c-4925-8dce-37e1800a4955", "value": 33748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778027409, "uuid": "b18807f2-c2b4-40d6-8e16-9a8902f5ac32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778027409, "uuid": "bf166a18-967b-4023-9a54-54e4996d9153", "value": "bot.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acdb2593-4958-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778078063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778078063, "uuid": "b4c751f1-02ef-49ba-b95d-021250e62638", "comment": "Malware payload", "value": "65024c7206c78fbc32b00ae78611d0af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778078063, "uuid": "b48cf532-8ff8-4deb-b1a6-9e000860cc61", "comment": "Malware payload", "value": "bf686fbf8ecf1fd876f52b52fa5f08d3b317f02ac8d94dfd7ec98e97cece7834", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778078063, "uuid": "1d49f2f9-e5ab-4f77-9035-e706b398e68c", "comment": "Malware payload", "value": "e5d585b1503d397fb886018e8c7690ef51cbe6f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778078063, "uuid": "6babd542-95b3-486a-9422-e43d6022afec", "comment": "Malware payload", "value": "8916ded12a6eeb55cc817f331cf314a87d3cad3bd4d9db862b8c0a9287fbbdb630e57cbbefe0d55ddc41c46bc8cd08b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778078063, "uuid": "8164355b-1a52-4e26-ad2e-ae79ee92b3c3", "value": "T1B4E302E637554B1BE2EF9972A1B34F00A871DBE1BC63371297D9C09A0E73E41D8E0A40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778078063, "uuid": "d579706f-68a4-4973-a0e1-3bc744f6af8b", "value": "3072:/AEdHYCkPCmbPINnYLbNtCxD/EMZ0ExWnP+NzKvjMHAVlE:/AQHbQCa9b/CxrEMKExMWFYM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778078063, "uuid": "f8166d97-1e63-4af8-a114-e8b2cdc4c823", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778078063, "uuid": "855afb09-8279-4939-818a-747efe62b881", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778078063, "uuid": "bfc9daf6-a2e6-4e6d-803c-b92437c12f1f", "value": "bf686fbf8ecf1fd876f52b52fa5f08d3b317f02ac8d94dfd7ec98e97cece7834", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1b42fb9-4927-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778057106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057106, "uuid": "e79b9bce-b353-48a7-989a-5764f82b7870", "comment": "Malware payload", "value": "96a4242dbf98f9490067767f1fdd4a4b", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meesho", "colour": "#735329", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057106, "uuid": "eb04137e-328e-4a45-96d6-a79c2991c2bc", "comment": "Malware payload", "value": "c0fc14b50590fd85b36343a597a4aa9d7017bf0044fb452c1e9f39312f4fefda", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meesho", "colour": "#735329", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057106, "uuid": "0f5b95cb-c0c8-4488-8e3d-f077a15c445e", "comment": "Malware payload", "value": "58988f6583f5a387bba281531adf45d5ad4198ce", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meesho", "colour": "#735329", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057106, "uuid": "263f5c3f-df30-45a2-b15e-42da18fd729d", "comment": "Malware payload", "value": "4d7e4acbaea9a90e5f97af45b2b3da13310f2fef14ccac0d6d91e2dac467c8ecd6991595d5a0a4f064cfc6b6ce128215", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meesho", "colour": "#735329", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057106, "uuid": "4d44a833-4d16-4f9e-acb6-04aa89e9c4a0", "value": "T195F61245E758DE3DC8F753356A3616363436DC668B03C287A92D333C68B75E80B49AE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057106, "uuid": "6316b091-1771-48eb-a018-1e8afc7699bd", "value": "393216:1Z2ZpqBK0r/MEmqbFixDDtLKX0IGzrWsA+FvNzl:14ZpW/MmbFQYkIArWs/F1zl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778057106, "uuid": "bd41b7f0-4b2c-4b3e-9612-5a866654e5b7", "value": 16263890, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778057106, "uuid": "f003ae9e-cdea-445b-b747-d2be2f7e285e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057106, "uuid": "03084a43-5c01-4c44-98a5-ec19b8641443", "value": "Meesho (1).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05c66c46-4991-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778102264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778102264, "uuid": "8773d341-1ac1-4754-a655-c6c9b894e286", "comment": "Malware payload", "value": "efe8f013f8733000785f0df9932984af", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778102264, "uuid": "3c673870-7e0b-476f-abd2-e843e7dd85ae", "comment": "Malware payload", "value": "c39ce6becf3908bcacd5bbe22a6339a1a9c9082c8e7af82b11daec1fc9344a1c", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778102264, "uuid": "2d275eca-284a-48b4-adcc-87a8185958e9", "comment": "Malware payload", "value": "b73719d773a8c0783a30866b99c26f93ccb6144f", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778102264, "uuid": "c830574f-1642-4687-ab83-8686c1f1694e", "comment": "Malware payload", "value": "c849c3e88ab9d1954698f81481d5e475adb2751f0e1c8e2856a00127a5ff5a22f3d2bab8bda7b841bc4b295a17a02229", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778102264, "uuid": "04350641-9de5-42c4-ab10-71fd63684811", "value": "T1D151DE6263F00B59B4600A96546D660B84F1D1763A2254E0D6E3C7DAF63EB8B7C3C738", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778102264, "uuid": "06061754-7cc0-469f-a9e0-f563dad9888a", "value": "48:Kteg8xPeCNdpAWp1pQ3H85HW2t2SlVsRJ3Q13RC5:Oe8AIWPusAuLV0JQ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778102264, "uuid": "6e1e84df-6999-45cc-80c8-48a40de7c45d", "value": 2731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778102264, "uuid": "b06c1197-52f5-4491-9056-5aee6b9c6bd4", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778102264, "uuid": "9ce6cec0-6682-4809-acb6-200cb15e8ad3", "value": "FACTURA_L2XYRJ.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd5c9350-4929-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778057904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057904, "uuid": "061046e0-5f44-4e54-bd81-726710e04444", "comment": "Malware payload", "value": "33cc6050898323d4beee8d824bc99d57", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "VSSID", "colour": "#838DCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057904, "uuid": "f5cf31ec-79e8-4b8c-b7ce-1f119b9978d9", "comment": "Malware payload", "value": "c3e3734c19b1cc81ebd94aa2330f965ffcd1695cca1169a5d7100543cecd82e4", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "VSSID", "colour": "#838DCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057904, "uuid": "0463dd17-f4f2-4727-8b69-2c31716bdac9", "comment": "Malware payload", "value": "0cd3d2cbe54b87c1247f72c5e52d84834e7640d3", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "VSSID", "colour": "#838DCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057904, "uuid": "cdfc2652-5166-4fbd-86e6-c18f4df1c440", "comment": "Malware payload", "value": "b471f319f7d73e4c2be622c6ecdb7c77b755f6784fb86ae657f699bd36ead6a2288740eb62095455ce0b6baf5b0f5338", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "VSSID", "colour": "#838DCE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057904, "uuid": "50366e5b-ad2f-47ae-afeb-7a3b0f31a2a5", "value": "T10237D005F20C652AD9C6F07DAD8605E2B636BC8A6350C5463537B32DFAB3BD48B257E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057904, "uuid": "b4fdc8f7-3b01-4ba7-9bca-3f9e5dee3002", "value": "393216:MQj/moO9XBW4Cs3FNgIuZ9zhL9TclrxyMd:XO9RhCsFitZhHTclrxVd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778057904, "uuid": "19a0c342-2cc4-4718-9828-abf609a8f8f6", "value": 23108934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778057904, "uuid": "8bf29d06-3316-45c3-8dc4-7388d73f3dd0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057904, "uuid": "10ef5250-8a3f-43f2-9385-cdd59e1785c5", "value": "VSSID.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c28266fc-4937-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1778063926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778063926, "uuid": "12b2a646-0185-4c53-aa0d-dc7d5446f24a", "comment": "Malware payload (ValleyRAT)", "value": "cb9e0290c31a6cbc2c04eaa010c49c62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778063926, "uuid": "7a9d9724-da0c-48e8-a6d7-8f2816bed06d", "comment": "Malware payload (ValleyRAT)", "value": "c537ef13a8db150c25e246dda1807e3b36396d4f41a54e3b12d87b57610ff10d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778063926, "uuid": "28ef28f6-fd36-4095-b8c7-e2c54763ae33", "comment": "Malware payload (ValleyRAT)", "value": "8343e801163c984a697d44a0cd5f2a966911750c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778063926, "uuid": "59e44565-2d6b-42bc-8a8f-3dd5aa1688d4", "comment": "Malware payload (ValleyRAT)", "value": "2d87ce46d6ea6baed61ab9a42844ec663368f89f4020273eb43be3c5683f4e410d3fa0727daa125d0f49618672166629", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778063926, "uuid": "5da0b6ac-c8f9-482a-9a24-67d16689e8a0", "value": "T111744AFBE318A1C9D158F478A4864BAD6F22F07D966167C6C13A0752FF11E806E6C1BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778063926, "uuid": "f7bcb1f2-f384-4c98-8387-bfa5dd47c715", "value": "f0633cfa210a9a58b6a79488e8fa621d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778063926, "uuid": "29dbbff7-7945-4f77-92ff-79a746c1f93b", "value": "6144:lk4ZR2fNjdMNqeNk1OW8KAmAANB2rUTb47/YSQiLNvAKn7WqH:lk4ZmNxyqey1OW8KieBJKAgLNvjn7WqH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778063926, "uuid": "67762b6d-2e9c-4529-858f-b11bb0ee860d", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778063926, "uuid": "1cc0292b-8912-48ba-84e4-dd758c4fb6c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778063926, "uuid": "d1a0b871-a195-4ff4-b455-8d14a778721d", "value": "2026\u5e74\u7b2c\u4e00\u5b63\u5ea6\u5185\u90e8\u8fdd\u89c4\u8fdd\u7eaa\u4eba\u5458\u540d\u5355pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f40e97f5-491c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778052412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778052412, "uuid": "2cfff2e6-530e-40ba-9f83-f99e68696b53", "comment": "Malware payload", "value": "c0db7720d2303fcf9818fefebf08ded0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778052412, "uuid": "f4325395-74aa-41ac-a43a-46c63a93ea64", "comment": "Malware payload", "value": "c59b742d4304e9c6a64d995b428beb90276f45ebb7667f3db7ce7b9b7620e3e9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778052412, "uuid": "b4451b9c-eeb3-4a62-90f0-09854cd0243e", "comment": "Malware payload", "value": "ed3137f5012eee1753a59d65e8d9a21913c4a118", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778052412, "uuid": "8724d1cf-3cf3-4108-a0c9-68a10e74a642", "comment": "Malware payload", "value": "8c9462eafa0f9a64f8c182eadcf8308e4bd4c40f0c06edf8a4a321a0922dc06c833a27189443e186e3988b50ac407226", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778052412, "uuid": "bc42b76a-347c-497e-b33e-2f109d657b70", "value": "T172136C6566913C28AE9988371D7E1F0CBDAA83E2310491DDBFCB3CF18C19A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778052412, "uuid": "db936000-8746-4950-9166-9d4256fccfa2", "value": "768:bDXRWNGxVk9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:b9lx/co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778052412, "uuid": "2e62b490-6107-40d5-9cbd-d77f99c0c7ed", "value": 45428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778052412, "uuid": "9c191bcd-0a53-48c9-8d36-e04eb4fc1e7d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778052412, "uuid": "cddf663e-e263-4157-b0b9-a88e7fb5b733", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f11bf87-4933-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1778061960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061960, "uuid": "86376f65-5765-495c-b8a2-5a08d9c0286a", "comment": "Malware payload (NanoCore)", "value": "6571830c0cc41bf6f4e8ef0d7b0594f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061960, "uuid": "c3d7d28b-9a00-49a3-9a55-67a79054ca11", "comment": "Malware payload (NanoCore)", "value": "c660782dd2c14081ee00ae5725022328bc79875ad299ec6fb12cbaee572f46a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061960, "uuid": "79f5d3d3-d524-484c-8a11-50d9f07a6cee", "comment": "Malware payload (NanoCore)", "value": "e12fc1b0a4743b61dd91cf9bfd2675dbc06abe22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061960, "uuid": "7c41348e-ba42-44ae-9548-afcb1f1647f2", "comment": "Malware payload (NanoCore)", "value": "eb45df7b61c43256f8257468f989ee21371a2c0c6460b7de07266d856aeb973c8aa436fb5bfb028444df51588f475616", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061960, "uuid": "635d83e9-d1a2-40da-8408-18b4af8ced3a", "value": "T12D14BF2677B94A2FE2DE8679701206539378C2E398C3F3DE28D855B68F167E5060B1D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061960, "uuid": "038576b4-375f-4e54-8a14-508898b2bf22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061960, "uuid": "0e4aa4a1-703a-4fc3-a1b9-0379d4483931", "value": "6144:MLV6Bta6dtJmakIM5TBGmPDZ1ZgJB6QUWF:MLV6Btpmk+BGmPDZ1gB65WF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778061960, "uuid": "1cc692c0-fc5d-4f97-9cc2-55d87463c885", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778061960, "uuid": "670c6ec0-275f-4b2a-abcb-db005bdd2b4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061960, "uuid": "98b408f5-d685-4d4d-bcff-954a17b702e3", "value": "wdroyo.us.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e4e37cf-492d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778059409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059409, "uuid": "7867f1dd-47bb-44c2-97cc-d35df98319de", "comment": "Malware payload", "value": "cc6ba7f2944061537eedb8b6b9510780", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059409, "uuid": "226fccd4-277f-4368-955e-a89f1006a9ee", "comment": "Malware payload", "value": "c6aa6db2256152000c341a4a16007f27665a01571e241e7f306428bb36cd35b6", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059409, "uuid": "7f110758-b671-45f7-9650-9926d63bcd78", "comment": "Malware payload", "value": "0d8ee3579c31daf0a372effa77bebe5f32778b60", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059409, "uuid": "0ebd6176-acf0-474b-a320-eb3531987674", "comment": "Malware payload", "value": "7146ed3afe674efa34bf6dd390619ffb24316c3971ae4a198973054795f8cd0d5d6d3fe43a3d5494cb530fd5c9b04c23", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778059409, "uuid": "89225dea-64f4-4cfd-98bc-f52cd031f631", "value": "T179E6124BEE58CD5AECF69379FD32022338225D684703C57FA5A4BA3C3E735C28A91591", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778059409, "uuid": "1ae28c56-c862-4ade-a0ab-01fdc30e9809", "value": "393216:LByPVY9ZPC4EIyYl37EO5+gfS+gGxmdjTli:869ZqwwKW+gIknli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778059409, "uuid": "72aafa43-f3e0-494e-9b03-f5abc7ae4dd3", "value": 14701370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778059409, "uuid": "2143c284-8806-4b8d-9033-3f6a39db8ab2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778059409, "uuid": "490266ec-e327-4dd0-89f0-d30512a7ba96", "value": "iMobile Lite (14).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "333b1c6f-4933-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1778061967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061967, "uuid": "841f8c2a-bbc8-4b6d-90dd-f8076371e438", "comment": "Malware payload (njrat)", "value": "d85fe6a1100f4433e31e02c7829ba3ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061967, "uuid": "22c93fbc-eb26-4ea7-b103-27831ba931a0", "comment": "Malware payload (njrat)", "value": "c714b0fcf0496ec2deea5a0dfc1669f79de13e40de0d8c18a8974330bea65d2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061967, "uuid": "cb01ffc9-5c98-4863-9e8c-9901e11b0b86", "comment": "Malware payload (njrat)", "value": "9ad7a5cca1b992895f12cfd76d511a5dab2947d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061967, "uuid": "26474d6c-05c2-450e-8e68-ea7b52810f24", "comment": "Malware payload (njrat)", "value": "37632be153af2e725488fddf3a9a6a5b78cf42231c2ed3c549a8ab213484eab4421ac429726d07b2758a2d6289ec5731", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061967, "uuid": "fca792e1-da0b-4ba9-baf8-156d2ad807c2", "value": "T180F3299A774A4B10E57C1C71D0EF6A3003F09ED32632E3893F85759D8A522D36E4EAD6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061967, "uuid": "0899a840-ad43-4402-b420-7181e2ccd22b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061967, "uuid": "0d88051c-cba9-4a1a-b575-86a133d6ec60", "value": "3072:Kach/QFvQsIzPuylQtUK33aj7AEMTR/9bUGrJ8t:Ka0xQtn33aj7zKRVb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778061967, "uuid": "8df30754-96bb-48f5-8753-98531c18b215", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778061967, "uuid": "8bab8636-24f1-4a7f-890a-5b21fe76c263", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061967, "uuid": "f8c83e91-9a8f-48b8-ae27-eef564cc2567", "value": "NewClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "367ac17a-4906-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1778042645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778042645, "uuid": "91fc6672-8fb9-4cb5-ab17-95d364d9ed97", "comment": "Malware payload (VIPKeylogger)", "value": "fad6013a160dcc4eadd21584c69c7a42", "object_relation": "md5", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778042645, "uuid": "ec23663e-a752-4491-9bd5-c714e03cddd7", "comment": "Malware payload (VIPKeylogger)", "value": "c869961a929906fab60f2f57bce977823ca211929a20134c478407ab216cdf92", "object_relation": "sha256", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778042645, "uuid": "85239521-d3f6-4972-858c-f7cd62458911", "comment": "Malware payload (VIPKeylogger)", "value": "1d96a752631e158dada39c28af1f02de4a133b18", "object_relation": "sha1", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778042645, "uuid": "063f7f45-0c15-48c4-aef1-11666622970f", "comment": "Malware payload (VIPKeylogger)", "value": "81d8af97788e4b3b1ea735990f000b3399453655faaffad40623848ed1af068904080c75ed6fe98b7df3e99d99657d77", "object_relation": "sha3-384", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778042645, "uuid": "f149dec7-25f1-46d8-933a-4739cef6a4f6", "value": "T19803A3D975E67260431234F32A2BA067E72D5C82B70C8124FDF4E8AEFC68768D575878", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778042645, "uuid": "c3537439-b569-4a7d-951e-4219c8300ea7", "value": "768:QCKPD616YhPcqY8FWzBg3tPU+s+RSkP+J5a:QFYZFjFWzBg3tYI9P+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778042645, "uuid": "2b13126b-3695-4987-a00c-16eeb6078dea", "value": 38576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778042645, "uuid": "433811d8-755c-443a-98f7-bacb37e0aac9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778042645, "uuid": "7dc32041-13a9-4720-9d0e-e551bbc5ee64", "value": "HSBC MT103-374627463.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b1cbde0-4928-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778057256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057256, "uuid": "336e447a-d642-443d-87b4-b8df7ed0c395", "comment": "Malware payload", "value": "deebdffced0bc1fca7ce3c03738cac86", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meesho", "colour": "#735329", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057256, "uuid": "e043f00f-d454-4b9f-933f-7dc5710162a2", "comment": "Malware payload", "value": "ca0cbfafd134ec07611c07f563c07cc9d9b5b74f0f54ad71243f64e8074da1bf", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meesho", "colour": "#735329", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057256, "uuid": "82e2439b-66c3-46a4-a991-1afed71ac514", "comment": "Malware payload", "value": "8d75415476c5c3f9a5f97e4a3e421c914239670e", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meesho", "colour": "#735329", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057256, "uuid": "7404ca7d-70fb-4622-a31f-d9d4ecd45f8b", "comment": "Malware payload", "value": "ac659195219009710cc91dd07e62e40be0c783e40b9832efbf9d7a09b32fb4cfd6ff05b1087355b73e81da73bcfb1a8d", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meesho", "colour": "#735329", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057256, "uuid": "0b8a0cd9-7895-4247-b34f-b84b91a18037", "value": "T120C63325FBC94591C4F3877389B282A6717ACC299B038257A958373F303F6E4574A3E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057256, "uuid": "b243aab2-2ac7-4e52-8884-fa053d6c5af0", "value": "196608:4FL2RkPo3s7p07FU/Bac1kP2MzHBn5S/c206lDPxWlJeQHzaU/SdFrh7Anv:4lLPooYkBacu5FEE206lDPclJeQHzVy2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778057256, "uuid": "d01c1f9b-d455-4213-997a-e0b9efce5f36", "value": 12179058, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778057256, "uuid": "730c47d4-c624-4f93-9361-0623c84fe8c5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057256, "uuid": "4e2c0fbd-c8f0-4890-bd35-eae6e94638a7", "value": "meesho (2).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5defa16-4925-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778056173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778056173, "uuid": "4131a93f-c5e0-4a4f-be6a-c6bb7c536d9e", "comment": "Malware payload", "value": "7d45ad47b37ae726def46854636f31be", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "indusland", "colour": "#D4E8F2", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778056173, "uuid": "cc4facc6-bde2-4f3c-873f-0f252dcadd4f", "comment": "Malware payload", "value": "ca52e6accd7ba754dec8f355a84083252dedb0945cc4335e96af46596432480d", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "indusland", "colour": "#D4E8F2", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778056173, "uuid": "5168f617-0cb0-49ff-8a21-f81e85b27025", "comment": "Malware payload", "value": "879074a6bad2a2fc602b550b12fecf686d766ad1", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "indusland", "colour": "#D4E8F2", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778056173, "uuid": "f5908661-eb9f-4aea-9bf3-e361354488e8", "comment": "Malware payload", "value": "85fd4f39ba067ef6d50766cfe2e88161e72ec9f419b7b0f7bb57d247827ecf02de690e1e1afa685a8747790a1b09674f", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "indusland", "colour": "#D4E8F2", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778056173, "uuid": "a97f5f71-de7e-4246-b06e-797714b51fce", "value": "T14DD63361F6C54F41D8F38373C5724262347ADE61AF03C6176808773E243BAE4A76AAD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778056173, "uuid": "340c8ea3-12ac-4500-a615-914370d1c003", "value": "196608:++yabTuRsISqmVaRadB9rFpZktabjDnAogWMHxjBO5Eix/pU1ocf+u:+BaosISqYNFw8TnAkMHxjdKU6cf+u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778056173, "uuid": "fd5eff04-a00f-45b3-9fcd-905e3cb8bf1f", "value": 12813950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778056173, "uuid": "a72b4aa8-1c0d-4fec-8668-d1b1f0a791ff", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778056173, "uuid": "42b2d3cd-a5c7-48af-b5c7-064c0e060026", "value": "Indiemobile APP(3).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a782410a-48ef-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778032956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778032956, "uuid": "d3e97469-3942-43e5-ab79-5ba66c024808", "comment": "Malware payload", "value": "c5d6a8a08926ee691de9099ea9f1bee7", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "PowerShell/Malgent!MSR", "colour": "#F1F99D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778032956, "uuid": "99e239c9-5d88-4563-b0c9-f16e5eb8f2b1", "comment": "Malware payload", "value": "cab7f141fd6f2c58055b3731ef6a64b8a2d4d88a974770b047da19c0904322f0", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "PowerShell/Malgent!MSR", "colour": "#F1F99D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778032956, "uuid": "217061fb-00fa-4219-b89d-38a578131f46", "comment": "Malware payload", "value": "511c169fb4280d15a17a684d34c0e0cb9735f384", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "PowerShell/Malgent!MSR", "colour": "#F1F99D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778032956, "uuid": "228f0b15-614f-4bcd-b655-3c3e49fd3b28", "comment": "Malware payload", "value": "4ef51f7dfe9e0b9f2ba76aedac8574fc4b153b96a3596e5d1bd56575a1a2b6195d3170c2a11da6b19eed4a830e11018f", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "PowerShell/Malgent!MSR", "colour": "#F1F99D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778032956, "uuid": "77d0e68f-55e0-47cd-95f2-0ec34dec021b", "value": "T16FB131116D0085D5C3E34A2BD8D3E346BBA5217F52886E84B45CC6C1BFE372DCB1A69A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778032956, "uuid": "9e532cd0-1553-4a37-81fd-fb4ecdbc7996", "value": "96:MszjtwZxHpMmQ38hFfPv1Cc6NEjivm8hEVzCTrvw2OXpDCfS:/yZZpMmQsh1wc6PF8zCX0XpWS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778032956, "uuid": "56be4278-f449-4a89-8c4f-884805cbebc1", "value": 5552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778032956, "uuid": "4e9caa42-da44-4e56-bfac-e9c0abb67a54", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778032956, "uuid": "af9323c5-f874-4264-8eab-78456bd43bc8", "value": "vcapcha.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ec59c4e-492e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778059973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059973, "uuid": "eafd5380-26f4-498e-9275-88df90400891", "comment": "Malware payload", "value": "ee7d2d840c781b322b369a38744da905", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059973, "uuid": "2854d49f-74ed-49b3-b2a7-8f46eb5d7d07", "comment": "Malware payload", "value": "cb69fd543e67fcbe0f824a1ab8d05c1fc0a5b78c621698c9cf185f6e5c8c6f8e", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059973, "uuid": "1e346b7f-5b4d-4a05-bffc-32be1227750e", "comment": "Malware payload", "value": "8c1d9717d2e3ed1e52a20f847b70acd7d1eea2fe", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059973, "uuid": "b1ae18f2-2fd8-4ede-bdf2-17ecefc12bfb", "comment": "Malware payload", "value": "3046bf716536a2265dc73895013bd29c2dfe075dfed930cefa3556100c5f36ddad0daf7513efb7d987e4f5127b845d78", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778059973, "uuid": "839421d3-8ca9-40be-95af-432f50843887", "value": "T147F6121AE60C9D6FE8FBA3387D36035224269CA48B03D5CB7874B63D6EB35C94E561D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778059973, "uuid": "3f7528f0-748f-45b9-b570-5fee2a02f9ad", "value": "196608:+BSdlp/OfbYKzT1d1aDOngw+uN124dqg42+N6sjtTrYcttCrP0zgRB8qxVhJUth:6MhxKVng+0lr2+AoTrYct2P0Glgh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778059973, "uuid": "6f9af7ac-f1f0-4214-8a14-6f62afc45955", "value": 16234215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778059973, "uuid": "572833de-834e-4d7a-8c4a-14e2e54102f6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778059973, "uuid": "1d14349a-4e99-476a-b5fd-cc03b47214ce", "value": "iMobile Lite (15).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc229e04-4990-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778102247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778102247, "uuid": "0fb7feb6-70f8-4855-84d6-41fa56f2b44b", "comment": "Malware payload (Mirai)", "value": "9a264aa7caf469d63b86453bc4b8c2db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778102247, "uuid": "583dda21-055d-4571-b19b-ae500538a267", "comment": "Malware payload (Mirai)", "value": "cb86d3554ceae0f786dca15a129b1cfe8a59d0b7b094cdee5f78cb50c47b0319", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778102247, "uuid": "c1bb0896-b9e6-4140-982a-b2310b5aa221", "comment": "Malware payload (Mirai)", "value": "b63c9412816d51cdda6cd032d15a2810344c881a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778102247, "uuid": "504b037d-eae1-4ed1-9ec6-d0dd2cc4ab76", "comment": "Malware payload (Mirai)", "value": "7fc2cd20c4cdb4a52311bc66ec91e391bc4ae7f44b293a66387109558544136922065c07d93e60d1642d4206facd5eb4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778102247, "uuid": "9c3320df-d4d8-4173-9a1f-3db69e1aaf09", "value": "T1ACB38D76C47DB9D8C0904278F9B2997507A2B110416B1EBB2AC9C46A00D7EF8FA1D7F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778102247, "uuid": "5a568879-0fe7-4d19-8499-9e2ea68494b5", "value": "3072:AGIZ7AGjQuzZySF0yFrWg3s0MTjKgMbSU:A3ZsNS3lxKWbh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778102247, "uuid": "bb72e4b7-69e0-40bd-aab1-eeeea36cc7c4", "value": 116168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778102247, "uuid": "1adc152d-d10b-4d5f-9212-cb0656f49172", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778102247, "uuid": "fe68a4ce-78c3-4069-9b39-ef0f62a86739", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a82db22a-4937-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1778063881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778063881, "uuid": "0ba132c3-d436-4df9-9334-0ab6865065f3", "comment": "Malware payload (ValleyRAT)", "value": "3ce1c9c00465c61d0f3ab20fae51e9d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778063881, "uuid": "2a58011e-7858-4ceb-8083-e226d10f585c", "comment": "Malware payload (ValleyRAT)", "value": "cb9b0c1a89b969394804a3fa26db283a75f0e6db4c171544b6056f076ddbf886", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778063881, "uuid": "34199e7f-7d13-47f9-8f46-7abdf4570a33", "comment": "Malware payload (ValleyRAT)", "value": "32c7c4a16fe5b1547415018da51abe42d6da5a08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778063881, "uuid": "3f28b2b3-b091-4457-861b-c0e538919dbd", "comment": "Malware payload (ValleyRAT)", "value": "bbd234be5c26f4dcc929b15e50a9114fd18994f948a1c6cf9ba4f31e37094942eb9014a7e31cbbae7a279ac73868f47d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778063881, "uuid": "4f1ad394-16ea-478f-a5b9-2bb179366899", "value": "T10705183BF70E26BCDADB44BCC44B360949617A0D2F35B0C3929743A32955A6C4BB47B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778063881, "uuid": "f0b95b77-c428-47e5-8c19-80b2e1160bfc", "value": "edb37c1fdc5a0148db6058a80b6167b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778063881, "uuid": "c8b4ee6e-3fb9-425a-ad43-d1beadb7c0d7", "value": "24576:5zdnKneqiA6q5t3JZqtlFzQnbwsY6YUWn0uNFsPn+4DLe/fx4e7wkd6ZFvX7qPwZ:5JH/d63", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778063881, "uuid": "5e067a6a-60b3-42e9-8f7b-8e4f86f18119", "value": 853504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778063881, "uuid": "12ed2079-4c99-4cd4-86ed-bd8b5ebb3169", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778063881, "uuid": "e6a0dd21-e4ad-40c6-9fe8-55347f909165", "value": "0506.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ebcdf65-4933-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1778061933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061933, "uuid": "59607ce1-7eea-45fa-9ed0-73d184b059eb", "comment": "Malware payload (NanoCore)", "value": "9613b54489ab63c76ea8232b483c964a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061933, "uuid": "05f2a343-0c75-4f0d-a6f4-6d0ab57cba0a", "comment": "Malware payload (NanoCore)", "value": "ccab67b15d93d3850d81c22d6e6b92fa45489c4d39e8c482eb8de76d637a8221", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061933, "uuid": "5d85ae10-9374-4790-9d26-616d6b951a87", "comment": "Malware payload (NanoCore)", "value": "f582c55c36d9e88878db6ab311c11dca84910852", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061933, "uuid": "02e53836-82c9-4af6-b905-52a588f7cc5c", "comment": "Malware payload (NanoCore)", "value": "6b081892ee0775f97e5f46bc945c1e64b7e0be0af62ada46f46517fa179a46ed0c1c2179b3faa6cffd251b4f2f712bc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061933, "uuid": "d98213f8-ca76-414e-988f-ed45ca99fa81", "value": "T13914CF6677A8492FE2DE8679601212529379C2E3DCC3F3EE68D854B78F127E44A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061933, "uuid": "b3a90972-cfc8-477f-9f33-d2e466e5a7ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061933, "uuid": "0abfee2c-33aa-449a-a69e-64bfb72ed80d", "value": "3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIMUwKNdlIhtRSE8KaDtyvLGVQH:MLV6Bta6dtJmakIM5mTw37ax4L2e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778061933, "uuid": "25a3e364-75e0-4caf-ac45-bc0b4f701102", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778061933, "uuid": "a6d9ddbc-67c7-43e5-a72e-ff0ae3424fda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061933, "uuid": "96736d0b-f3b7-4113-8df4-db14e550cc3b", "value": "ntoki.co.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bfdfa37-498d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778100663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100663, "uuid": "e72a753c-3337-431e-85da-7738dd166243", "comment": "Malware payload (Mirai)", "value": "d43301b5771f80a48a0b8a58bf3862c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100663, "uuid": "51756a2a-e5f6-4817-9dd7-b9901554441b", "comment": "Malware payload (Mirai)", "value": "cce27c42b2191083e282453c97252b630bc2c0a333814d1e0ec2b2d002c20515", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100663, "uuid": "8133ece2-a8ee-49d3-bd0b-964f991f7e7f", "comment": "Malware payload (Mirai)", "value": "99e22e51ed6bc3811dac6c2845c7d5b3c8f36a5b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100663, "uuid": "f1723be5-0038-4e1c-b741-baf16267d68f", "comment": "Malware payload (Mirai)", "value": "9dd167ad23e357852550233adecda5e36e41584667789b9307f21093f2e89587de8a960cf25d24471848d785b07a3e90", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100663, "uuid": "c18b32ee-f9e2-4d82-a6fc-025b03556d5f", "value": "T1AA43F12D7322E5DAC7D898F55FD443A03C3016E79082616B790EFBDA86C1D903967E8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100663, "uuid": "8ad82a87-11dd-4c5a-aa0d-b0c618242dbb", "value": "1536:JOSDVYaBmIK72zyPV2UqDGdqxNC+CpIFNNZ1VJuP:nDOUmIKtPFq2qxNZhVQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778100663, "uuid": "6b5f8ac9-e3e8-4954-a2e8-360bf9a89973", "value": 55312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778100663, "uuid": "841c5e00-47e6-4449-beb7-25fae60edf51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100663, "uuid": "e910ee2e-0eea-4c4d-807f-1225f485c6c4", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a4e06f3-498f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778101412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778101412, "uuid": "77105ce5-15ee-4027-90db-a60fde8de229", "comment": "Malware payload (Mirai)", "value": "9751b10b23f39283e04724dd1dc466af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778101412, "uuid": "ad8896d8-95a1-4150-9c0b-f3b3e554ee42", "comment": "Malware payload (Mirai)", "value": "cd6f0fcee3d9e0b01161cc2aac305568c04685d212c48171980ac336724ec207", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778101412, "uuid": "ac1594eb-21f2-417c-b4a7-fec90b8c5c00", "comment": "Malware payload (Mirai)", "value": "2adfff54f3c3a2762a74d4801c527149cd850fe3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778101412, "uuid": "1a7be71f-b0ce-41d7-89b6-35c3f400d5f9", "comment": "Malware payload (Mirai)", "value": "5044f71c51eab66a674a463afab3ee64f8dfbcb9c1eb194ca426e8e7fcffb19547cc3cc81fa2fc2413444ec570de14fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778101412, "uuid": "1d685bfa-e7ca-4716-b6e9-ff2275a90676", "value": "T178F3E7057B250FFBEC1BCC3B05E92705288CB91621FABB36B934D508B54B65F1AE3964", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778101412, "uuid": "c74ad2ba-9d7c-47bf-98d2-7fe7a263e088", "value": "3072:iC+bdQdzh3XKY+LyAFZHIwr5LsqsuFa6mDLc:iLbdQdzkYgHb5LhsuoI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778101412, "uuid": "a41744ee-3aa4-425a-abac-8aa967bf559c", "value": 168304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778101412, "uuid": "1f5a46d0-7788-4b16-bc6d-94543168c9a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778101412, "uuid": "6af4544e-5e1b-4230-bdfb-3e2a9fa0cd8a", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c79864c-4929-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778057849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057849, "uuid": "96509742-3079-45b0-af25-a6e9e3e56869", "comment": "Malware payload", "value": "20a21b099d17b36f1f79661fcf95476c", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057849, "uuid": "211240d9-bfeb-415f-9390-9277f7d34031", "comment": "Malware payload", "value": "ce48290f4b048b14b03d317daee0d7f252425a83829ba937b3b9575f2b04e919", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057849, "uuid": "154fb1c6-d000-4e37-8d9a-ecb6c352e3c3", "comment": "Malware payload", "value": "7febd327a211ec44bd8b3615e3172218084000d8", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057849, "uuid": "f585755b-be22-4c8f-9ecf-58ec54d32c0a", "comment": "Malware payload", "value": "398621bcd861c7eb265806edae59ecb857fc98f0bdcbc2c8254512b9e6612c879e8ae8f7731f7dc4542f5f9320f2f087", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057849, "uuid": "1304b0cf-2aef-401b-865a-9b1d37d7ed4f", "value": "T11CC62255F399A72FC837103389FA1632529B4D478A839B536924720C7DBBAF40F59BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057849, "uuid": "9fbf70a3-2702-46e4-a067-1075199cce35", "value": "196608:vVu+5qqx2jKHuj0VtwL8sMbkuH1eshNN6kxnNEHv7xu8lIpTjOvNBatJwNz/6ZsL:g+gqxYOombDYshK8nNWJZz8SzrC3G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778057849, "uuid": "5a27cbb2-5c0f-4e69-8ef2-b3f0d0567b9c", "value": 11910537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778057849, "uuid": "3632417b-608e-4d1c-b274-830bc00b042c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057849, "uuid": "a3488267-e981-4595-aa10-d3bf63e6f37d", "value": "app(10).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04307312-4965-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1778083363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083363, "uuid": "04595f2f-bd30-4106-ab22-15793ffcb793", "comment": "Malware payload (AgentTesla)", "value": "8d7d68479b212c692b9879e5446d2373", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083363, "uuid": "d2ecd0e8-ebe1-4753-90c5-dab3a2c9651f", "comment": "Malware payload (AgentTesla)", "value": "ce88a6ba648105baafcbfad502ec8d1054e06a2c79d26b8e31fb978817aa17c1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083363, "uuid": "96fee279-98ec-4cd7-850e-4d991bec3d29", "comment": "Malware payload (AgentTesla)", "value": "22fda111d1ab541080bc22f0de9acf5a49943b1a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083363, "uuid": "43431d4f-8715-480e-972b-7ef14c391825", "comment": "Malware payload (AgentTesla)", "value": "76cd9d13e44a38e15e780dc82feecddcfb1491fd689ab2076cb75e7964c13b7803c0e83ef14f2957172fc7c44b7f0155", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778083363, "uuid": "dddfa97a-25ed-48ca-972e-1c696dd4a8d6", "value": "T121158B1523E41A04F2BF5BB5AD7905204BF2FA66AA3ACA1D7D6400DD0D22FC0DB96773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778083363, "uuid": "bc2dc2fd-7c46-4d43-8a85-3f78127e7143", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778083363, "uuid": "786475bf-ffff-4577-a22a-40a4fe0899c1", "value": "12288:Dl/J4mH5ugthDBiwE1gbkNEQCvoGFvKGtYpdOQtjOyf:E6hDBiLHEQCvoGFbYpdOajOyf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778083363, "uuid": "271087d0-a284-4a6f-a6b8-c168b0de9378", "value": 918016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778083363, "uuid": "3fe12291-a647-47b3-ac4b-21738390a96e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778083363, "uuid": "947321b1-10af-4b87-822c-816034b208fc", "value": "Ogooo crypted.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e9564d6-4987-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778098037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778098037, "uuid": "71ebe86d-faa6-411b-a665-9a81c3ebd12a", "comment": "Malware payload", "value": "85904ae5ac4954c0e64fbba5ddf8c03b", "object_relation": "md5", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778098037, "uuid": "8eafa8c4-8b63-4990-9ebe-f6137af26b57", "comment": "Malware payload", "value": "ceaf050a4da26a8198198b570407ed8fef46e528f740115faeac45f28e821032", "object_relation": "sha256", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778098037, "uuid": "52a93259-407b-49ed-9558-78c0e3edffe8", "comment": "Malware payload", "value": "54613fc6067c763387431eee2e58f0d43b5fdfac", "object_relation": "sha1", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778098037, "uuid": "5930ce92-00d3-4964-863d-adcc189366b1", "comment": "Malware payload", "value": "181d46df63b817b284d27bb5f5063db0510bf0a56aa69795d8bab0354caa81da114c8a6120154b4641bbb52ea771e94d", "object_relation": "sha3-384", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778098037, "uuid": "c8bd0b8a-ea2d-4505-84da-60202c0b39ff", "value": "T1583633CBFD1FD12AD47D45756BBC4B3469820E38B4F0A8E142F678E83E1F586A0D9512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778098037, "uuid": "48dbba4d-a7ad-4a03-affd-0fc21027b824", "value": "98304:Mdq8NEgnPRFp2kZLq3cBQDPVR+2Qln0wkuGOcoKi5+UxXZ20U6RAcu:MU8ignPHoq4w2QlHsi3Xnvecu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778098037, "uuid": "36e32fb7-3131-4113-b0b7-09e383450565", "value": 5332640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778098037, "uuid": "0f2bc898-2306-4305-a82b-73c59b3d72ae", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778098037, "uuid": "8f1f6555-3c0d-4111-8b25-d532f8a95858", "value": "nssm-2.24.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac38672a-492c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778059164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059164, "uuid": "56a9fb4b-25e9-4b87-8991-e675c19cf0ba", "comment": "Malware payload", "value": "e2c9c8adccf32255cbe0587a4b425bcd", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059164, "uuid": "3c1aafc8-67b4-49cc-a529-e3fb0701da7d", "comment": "Malware payload", "value": "cf32addd82960501859f205b0fca8c0b51a40857f71e4a2aee8d70b2433319b7", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059164, "uuid": "8a5fbcf3-0f05-4ff4-afff-29bd6586aed6", "comment": "Malware payload", "value": "68c7def1be89cd9f4a7fbff5e0188cd099c6b8e0", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059164, "uuid": "b9b12344-69d3-4227-afe7-5371ea6b0161", "comment": "Malware payload", "value": "0a46fe38545ca04bd3a5df3e8ef6d6f6911807264929cfe7f0ac3c3cc5c3548fa06362ff511931f6a7c8c3315df65e43", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778059164, "uuid": "5d9b39fb-7c93-4391-8147-5968005ed818", "value": "T170E6124BEE59C96AECF7533AFD32032738225D680703C0BBA1A9B63D7E735C24691591", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778059164, "uuid": "dab3d076-d95f-4da2-8cc4-dd4e8d1e3166", "value": "196608:wEKQ0+z6dqPpg0s7ilNV+cZou3+MYqPoAAqesCvZlTzcVriu1e9CXAmcW4fx7Al5:50+xm0N1jZfFYqAA7e/czVrcVfx7Af", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778059164, "uuid": "16dfcbce-6ced-4b55-85f0-507889f1502d", "value": 14693181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778059164, "uuid": "acc6ebe7-bcec-4198-8031-c8c99c26a15c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778059164, "uuid": "503f494e-da5f-4857-be18-2c445b4b0d3f", "value": "iMobile Lite (11).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acad6fd2-4929-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778057876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057876, "uuid": "4ae1d8c4-6bb5-4762-925a-b9dbe7277bf1", "comment": "Malware payload", "value": "2d3aa7b5a4f8bac4aa3e87fb9ee92cef", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057876, "uuid": "ff38b180-44dc-43a1-9aeb-96efbe820d0b", "comment": "Malware payload", "value": "cf56b1a784f0c6aaf9bf0fe0afaffbc6b47c35e01b799a34a59dd6fc50496ac6", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057876, "uuid": "ff60f4b6-deba-47ad-9f6c-f557d614dd0d", "comment": "Malware payload", "value": "cd6f095f4142765c108deb96623a6d415cc93faf", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057876, "uuid": "5dce7366-f050-4962-b5f2-d9f0fd20cbe1", "comment": "Malware payload", "value": "3b6fc289a654cda89a53319bb583a934645effae809ea1ebd1cc79d16850996503c0a05e6fd41d63f85c1a7c9e3a603f", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057876, "uuid": "1c756e3b-0090-49e5-ab5d-72c318814171", "value": "T12FB61255F359AB2FC83B10334AFA563252970D078A839B436914721C7D7BAF44F6ABC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057876, "uuid": "bf17d83f-d38f-4962-b95c-ff7b180cc55f", "value": "196608:N9neRTNfLZaj2kgH1eshNN6kxnNEHv7xu8lIpTjOvNBatJwNz/6ZsPPy1m:N9nYNfLg2ZYshK8nNWJZz8SzrCc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778057876, "uuid": "dc0afc25-cf7c-4d5d-b217-b683375246e8", "value": 10685085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778057876, "uuid": "34224ca8-7b40-49e8-928a-88abb46c4ffb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057876, "uuid": "9680abe5-0337-4d2e-9e21-18b80cbe975e", "value": "app(11).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b1896a4-498e-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1778101145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778101145, "uuid": "f5592c40-faaa-4fe4-9f35-4cb3e6d4d7b9", "comment": "Malware payload (ConnectWise)", "value": "31c0ffa1cfe497c87ad667cf8a10dcc6", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778101145, "uuid": "92be4fcd-f49f-458a-9216-b4035d3db526", "comment": "Malware payload (ConnectWise)", "value": "d13a708ba2bcdac8f9ce4d79dac309176dff8c20a9614602a32a4a18f5008ce1", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778101145, "uuid": "c4d4776b-677a-437c-bc03-f00f8b4a8686", "comment": "Malware payload (ConnectWise)", "value": "257270c7422c869855e8d8f66f09ec962ac11b12", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778101145, "uuid": "e9e93053-6eae-4985-a0bb-6371f165932e", "comment": "Malware payload (ConnectWise)", "value": "067ed6f82eca779b4812e934e24460bb1ba7655351a59207df2e45975230f732978c512c09aab1cc5eb0ea107b20b1a5", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778101145, "uuid": "4c449333-28e3-4768-a8f2-cc5be2ae8cac", "value": "T11421AD06E506AEBFF79C424BE3E30CA4EFD197020A10A0D4DE514AF6185F264F678586", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778101145, "uuid": "e225bae7-f9ca-4033-a0ab-839974935410", "value": "24:HAhzUOPayJBmyW0acY/gd2DHEnKGmeIm39OMLWWAZ:HAKgJB7W0a5kk2bWWAZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778101145, "uuid": "dcffd33f-0638-4590-9bf4-3486d65c37fa", "value": 1329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778101145, "uuid": "9ccc5aed-0ead-4ca5-8226-c9d1778d6ca2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778101145, "uuid": "94fedba7-5ba6-4b16-a274-d2c21f589899", "value": "install.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cfedca6-4933-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1778061957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061957, "uuid": "b7b64cd4-e272-4e4b-8e6b-9e7ee25b80a8", "comment": "Malware payload (NanoCore)", "value": "9df3bd0497073e8dced2ebd83d9093ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061957, "uuid": "11681232-e1e6-4eb4-80ac-bd011e744c57", "comment": "Malware payload (NanoCore)", "value": "d20f0f21c068499f764c1cc92aae89883ad95dbe4c6a372af4b1556bf85a9964", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061957, "uuid": "635d0ab0-42a8-438c-869c-02333f63ffaa", "comment": "Malware payload (NanoCore)", "value": "6799a891f15371eefd1a50686446b57ed9036b90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778061957, "uuid": "5ecdafdf-c849-479d-82e4-7cd19ecab017", "comment": "Malware payload (NanoCore)", "value": "911497c719029bf94048b5be0b44a6ea07236c72594ef7895d2ea7a00f2d565fbdf00e62dda41a5782c6e01ad2d72907", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061957, "uuid": "224971e4-7b59-4978-9fe5-6893f679dcad", "value": "T12014CF2527B88A3FE2DE85B9612251539379C2E398C3F3DE28D454B78F267E10A071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061957, "uuid": "6afe64ef-1525-4f91-8d4b-8d07c27b84d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061957, "uuid": "cf1b54a7-8cbd-4ea0-aa24-04c16f6a6c94", "value": "6144:MLV6Bta6dtJmakIM5od4SJm9dsJz1ORH3:MLV6BtpmkJdvzORH3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778061957, "uuid": "e1d0e595-5a60-441a-a4a3-be48d6fc6ce9", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778061957, "uuid": "bb3e2fb1-c1d1-4445-9e97-63d4d5c69f39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778061957, "uuid": "d9cfa9ec-458f-4280-827d-f157159bf5a4", "value": "firstlead.io.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "258746fe-4917-11f1-a769-42010a9c0008", "comment": "Malware payload (Havoc)", "timestamp": 1778049918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778049918, "uuid": "97f359ab-b1be-4cac-b585-0486dba9ead5", "comment": "Malware payload (Havoc)", "value": "63e45ffa6d0c22cb04646ef549d61065", "object_relation": "md5", "Tag": [ { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778049918, "uuid": "2a4724f2-18bc-492b-ac0a-608511836a0e", "comment": "Malware payload (Havoc)", "value": "d24216d0b82747e9406a696da76960183926145f9621947e34a772137f5e22a6", "object_relation": "sha256", "Tag": [ { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778049918, "uuid": "4f1c6dd0-4d85-4251-bab0-ef33816c1639", "comment": "Malware payload (Havoc)", "value": "34e20e58b54e241596dfb2b87451b42f6bbaea95", "object_relation": "sha1", "Tag": [ { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778049918, "uuid": "dd637ad4-e066-4fc9-97d3-171358094285", "comment": "Malware payload (Havoc)", "value": "d332fc1f2308fa6b70ca56e13a66d97f48819ff3a5a0091d65bf585cc2b05ec16fdd42b219d1d4f40a669ff888723516", "object_relation": "sha3-384", "Tag": [ { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778049918, "uuid": "fbdcdb75-5beb-4595-a6a4-b1ab177492dd", "value": "T10635339D25C05127D961C572DD6606F2C42F7D80A23C2A0E302B776A7F732B1BBBA395", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778049918, "uuid": "83b213af-f090-41c9-8e13-847c53ace5d0", "value": "24576:JZozSag/f5OBxUNt0/imuoIYTxsiA8MFMn/9LTfKSGgqW6:Jxag/Ixa0/i8BTxsiA8F/9vKHgy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778049918, "uuid": "78200d26-7466-4bba-98c0-95d88331cf52", "value": 1122304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778049918, "uuid": "784fe481-9d88-477f-a250-7a9cf37a6e55", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778049918, "uuid": "19ca7d67-c2d1-46b5-a25b-788626d2b13e", "value": "update.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17904259-4981-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778095422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778095422, "uuid": "2e7dea50-1341-4849-aa70-beb6538fad1e", "comment": "Malware payload (Mirai)", "value": "e3677b34258071bc0da759eb4ca49627", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778095422, "uuid": "f83519cb-c6fe-4268-ad54-d2dc6ead5da6", "comment": "Malware payload (Mirai)", "value": "d2cba50dbcffdec97f90cc7c9906cfb3792ea06f55bbdb238e573ab71f198cad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778095422, "uuid": "ad6ad57c-35e1-4d8c-860d-e45d3dc5d55c", "comment": "Malware payload (Mirai)", "value": "cdc627cbbe5d80508f8ae3d06d8acb577db80292", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778095422, "uuid": "15f83153-8dd8-4d12-98f8-ffa0627559c2", "comment": "Malware payload (Mirai)", "value": "7026c0c44ac031928b9bc4b594189ec4d3f099f1e977a20381219e432f47158f9f1c7d2a281119ede33de6dadfa39702", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778095422, "uuid": "e6a71197-68e1-438e-9717-d2fd752627ee", "value": "T161E36CC1E743D1F5D85A01B0306BF737DB72E53A102AEE92D768AE32AC62541D61B36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778095422, "uuid": "1ef9ac6f-003a-4fc9-88f9-6e6370088cf2", "value": "3072:ogtBryEnI/qo2edn7Yz8fyJp7kkt3ffkGzqybx0o4hmRigsCVyyb9GIw:oeryEnIyo2eBEz8fyJp7km3nkGzqybMN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778095422, "uuid": "5dbc0a4a-a604-4dda-be86-f258e0986b1c", "value": 151400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778095422, "uuid": "c827dcab-bf3b-4fe9-bbe9-4b9fc761dfda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778095422, "uuid": "40439f66-6c26-438f-a8d9-43813819c3f0", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "161c9b8e-4930-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778060630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060630, "uuid": "c8ef8d76-0047-416c-85f8-2932e09ff35b", "comment": "Malware payload", "value": "6a42689643c109b7ff9cede45d4cf6ec", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "DMart", "colour": "#13BB90", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060630, "uuid": "6a4b65f1-8c29-47dc-b82e-04c512e0c634", "comment": "Malware payload", "value": "d381074c4202ebc33e2b42fe61611de2b114d7e1daa8b91a62fd2ad623027686", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "DMart", "colour": "#13BB90", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060630, "uuid": "5455f053-bac0-4ff3-b993-36798c273ae9", "comment": "Malware payload", "value": "b3d6fab5f624cf0cc21554087c8e36860bb5b3c9", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "DMart", "colour": "#13BB90", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060630, "uuid": "d06fbda1-301e-4a1c-9e11-b236daf40b46", "comment": "Malware payload", "value": "ce307789c42b18f9802ea4fcc107f4432830ddee8598e4000be486d7f36ea43c514df847f14dd383cae44f313ed2b3d2", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "DMart", "colour": "#13BB90", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778060630, "uuid": "c975f030-bb62-4e26-b317-262abf35a22f", "value": "T10CB6124AFB489A1BC0F7533389BA5A31544B4CA54F83D6837954B33C68B75E04E9ABCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778060630, "uuid": "c2d0d110-54da-44ba-ba78-fd9f2a865a0e", "value": "196608:crswCWd6KQqd/ijb4vAXTftfHKChBsqbGvA+EL/QNR+h0ZQiISE5gYorNTF8rW:mCeQqkBjtfnBsUoA/OC+/rdYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778060630, "uuid": "b3b48693-fa99-4169-ace9-05139501df71", "value": 11401657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778060630, "uuid": "904d1116-1977-4404-a377-a7eb8dd7624a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778060630, "uuid": "4da6daf2-6920-430d-b97e-fe85e66208b4", "value": "dmart (9).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f103ee-4991-11f1-a769-42010a9c0008", "comment": "Malware payload (PlugX)", "timestamp": 1778102499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778102499, "uuid": "2a729880-11c1-4f60-ac8b-093b8d5b7fb9", "comment": "Malware payload (PlugX)", "value": "c1b37b269f99f3cacd1f4af4c76a0d70", "object_relation": "md5", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778102499, "uuid": "b12de4cd-1173-4b36-8498-b913e04bf621", "comment": "Malware payload (PlugX)", "value": "d4322938cb7d0956c2d70a3c977919eb2a30b48ccd9dd25a827ec959cc58499f", "object_relation": "sha256", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778102499, "uuid": "3d938a03-03c6-4b29-9a97-345d5a61cc29", "comment": "Malware payload (PlugX)", "value": "a210b9acc62ab49f30e7bb032459f99b5839e999", "object_relation": "sha1", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778102499, "uuid": "d97d74e0-dcec-453d-ba13-5edb8f3286e2", "comment": "Malware payload (PlugX)", "value": "4032ef425178f6bd4191f9e7e7dd4c4961de5486199fa0edc5b449be03d749bf4a6ca469da1b5051cb5911f03e3b0889", "object_relation": "sha3-384", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778102499, "uuid": "a6a50842-53e6-4673-a176-c0a167eb9659", "value": "T186430291378B9F029195D2A8DC3A6A50CFD7E6E68B119FFE041F744366C78909C5FE10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778102499, "uuid": "730255e9-a78a-44aa-a538-db658bed1376", "value": "1536:4y6rsNYh+th4r9DiOALx5eyumhTW5MyK44GhlN:4frTwQpTYxDhMMIf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778102499, "uuid": "cf61046f-9524-4955-9069-01a7e8d8ff45", "value": 55380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778102499, "uuid": "16543940-1e9a-43b1-8ff0-74908a077ef2", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778102499, "uuid": "0acb2760-53be-4fb6-8a6c-64cf90326718", "value": "ABC.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "478d853f-4966-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778083906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083906, "uuid": "0bd24cb0-8434-4445-9982-ccfe18fcf969", "comment": "Malware payload", "value": "d355af036f9898503ab9dd03fb437fc9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083906, "uuid": "ab298a92-64f8-4d99-b6ea-4f8b2393f17f", "comment": "Malware payload", "value": "d50b9442d397be84a0787968c36d9f7a0c39a6a725eac84eac6e71f9bd932eb1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083906, "uuid": "f3320f97-c5de-4903-8806-6f0abf8cff3c", "comment": "Malware payload", "value": "8882153c16e22f82bd57b0578a29b16fb2cea933", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083906, "uuid": "b9e6e606-61d4-4d3f-80d5-c88a6579cc02", "comment": "Malware payload", "value": "deb23005b00f4b092e57121a7b8553de97eec66718c39aa95c8ce217772d4510495cf4fcdf84f55537c038c355a9031a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778083906, "uuid": "71a5c7a3-7f77-4fa1-96fd-0a9a5fc5bf84", "value": "T167510AA8C7421632FFA7182FFAA1645847C6AC03EB61154D5EFF5CCE01E0A06A67DF16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778083906, "uuid": "ef80989b-46f9-441e-84e2-bc6120a4c16f", "value": "48:w+jnat9/xU1948pcm3jnFYOve4UuHCC9eEVQsMosBAd4H:wkatIUi3jnF7veaeWQszsm4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778083906, "uuid": "80d270d1-878e-4619-a5da-ef9f428fa774", "value": 2495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778083906, "uuid": "41de232c-a459-49d5-9340-0e38aeeac60d", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778083906, "uuid": "e6d1787b-df4d-4a81-87c3-d0d40575df72", "value": "164.90.195.107_1778083896505627_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78dc1193-4988-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778098591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778098591, "uuid": "9d6ad549-9c1b-46d6-bd67-baebc46a2270", "comment": "Malware payload (Mirai)", "value": "1c1dac5fe7611f7f2a1fdb3335f16ad0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778098591, "uuid": "157a8253-8b10-4042-a37b-e846abfd7ab4", "comment": "Malware payload (Mirai)", "value": "d77215b5136ca0aae51a8d4e8d29fa9123e2e2f08364a3e08880ad7e814c0ae4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778098591, "uuid": "8eea5dfe-d420-4c9a-b665-27dbc095d194", "comment": "Malware payload (Mirai)", "value": "89aa4bed4cfd3a157fffc5bac8965651d25fe976", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778098591, "uuid": "6455462a-a648-4054-9ca2-87ae8ca68988", "comment": "Malware payload (Mirai)", "value": "26b07424af7639889c9e0e9519abf65b80b957d715af2645c07f0437fae588807d0c08a883a8c33d51b4a43513ad4f2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778098591, "uuid": "052b717d-c443-4cdd-99f5-3980c57e535c", "value": "T10B148D68FE4F68D2D2C7E37DAE4A0FA231277D749565C0B51A00A29FD5EAFD488C0613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778098591, "uuid": "103d90ee-bbf0-4ddb-9d5a-5c7b9fac0399", "value": "3072:badBpAIWIfbEdOcdY3rZiigZ2eNRzPxz:bOVfbEdxm4iub5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778098591, "uuid": "f8e36c31-66ea-401d-96dd-b025296540de", "value": 197488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778098591, "uuid": "bd2fabed-be55-4a19-80bd-e767ebefe8f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778098591, "uuid": "b7f924f5-4066-46ae-be3f-61d09317b245", "value": "e64d909993647ed17312cea32f60ec65d71dd440ac126d2360aaeeaaf72f7cc1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f34ed096-493d-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1778066584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778066584, "uuid": "2dce1d84-fd27-45be-8bf9-4ce0e7dbe361", "comment": "Malware payload (DarkTortilla)", "value": "ca475bd787d9c431195b9704ea49caae", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778066584, "uuid": "34bd517a-6bc0-491a-aaff-cece61052e4b", "comment": "Malware payload (DarkTortilla)", "value": "d85a4e90276f9c3610ece625c7ed8fc560c7ecf860852a9e416b0c42970333f6", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778066584, "uuid": "72ecdf0e-1af3-4aac-9046-d2f519ff70c5", "comment": "Malware payload (DarkTortilla)", "value": "08ccbf9c54cd11e8d84ab62044e9b7415b35937b", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778066584, "uuid": "d1fb782e-f37a-4447-88c2-01214dd998e4", "comment": "Malware payload (DarkTortilla)", "value": "d16fb8e1f687c427e714e38172a41bc43fa3beb14a4eeb858594c54c5f892d52dcb93c9e28c9893e32d8c175a419be79", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778066584, "uuid": "25784a05-c3e4-451d-84a6-6d639f458fe1", "value": "T18A35C0C55F472FA1C23A6BB8C2131C88E3F1C5639792D69F6FD890E66B52BD9C903121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778066584, "uuid": "6cf6a397-0ccb-461f-8acf-84a76f800d69", "value": "24576:DXRsOqROw5yU74dtlhDdpjzXClDu0aIgf:jRz6OwYqKhpjSD7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778066584, "uuid": "6f01d7d9-ad66-4079-957f-17e13a896eb6", "value": 1124864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778066584, "uuid": "a758d6d3-5af8-4c7c-a6d4-c287676aacfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778066584, "uuid": "d513335d-53e8-4fe6-b744-2ffcc96899f7", "value": "Quotation.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e28588f-497b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778092829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778092829, "uuid": "8ef3a549-7d57-42da-8373-46e56da9bfb8", "comment": "Malware payload (Mirai)", "value": "969df305450a2f1d3efc2d69412ccf0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778092829, "uuid": "c0a2a081-10c1-40da-9482-bf55d9f22457", "comment": "Malware payload (Mirai)", "value": "d85c9e6a105157b84ec0b0f5707dd5e7c25df2838a772dd95affab6f7c68db9c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778092829, "uuid": "1bded914-3568-43ae-98de-068a7adb8236", "comment": "Malware payload (Mirai)", "value": "9798660d99ac2ec931695fa93a6878ea3ae2f8dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778092829, "uuid": "d9658c94-5aa6-42b7-9a9d-668b4994fa6d", "comment": "Malware payload (Mirai)", "value": "015c0ce9a0f564120f28b27b6e73d2dbc287d6519733e7b93ce59463c8ba9ca515baed476150561bd25a3eb327365740", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778092829, "uuid": "aee7b6b7-1243-4d21-a3a9-464e2e8b9e76", "value": "T1DBA3F751BC92962BC6E023BAF6BE128D336177E4C2CF711BC8255B167B8551F0D67B80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778092829, "uuid": "0f6c9a6b-13b0-4e4f-8c53-a33c9fb66b02", "value": "1536:isgijW22TvRmM3h2T7ejI5fwwqff6ZzgsLZ0OVCiIRqiT0Qvx6EqdlRbPghcHrw:isgijWHQMRKCULQqibyucHr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778092829, "uuid": "6a5a7abf-5789-47af-a326-c8702fe13724", "value": 99732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778092829, "uuid": "3eb6b39f-4bd7-4aab-bc82-c9374e8a2fac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778092829, "uuid": "4f3df02e-46ea-4c60-96f2-8632c54dc083", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d72581ea-4930-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778060954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060954, "uuid": "0dcb9588-757c-4af2-9d5e-1c0d1e5d8c48", "comment": "Malware payload", "value": "416d5daea6d12e36282b717f0aaa76f6", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060954, "uuid": "25573752-e8f0-4985-9008-50f954bf3809", "comment": "Malware payload", "value": "dbd4e7f10579f00acfd714453ccecef4458769103633be4c88d4eb615c0741a7", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060954, "uuid": "0baefade-aa02-4d52-99d5-242c067ba8b8", "comment": "Malware payload", "value": "bce629d1db3485df44d49aec0dc04dd58130abd8", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060954, "uuid": "5e829f89-4784-4cd3-bfd8-8347a78379f4", "comment": "Malware payload", "value": "4f90ac1a2583d349bdac6dcba6539646ea45e3c864c1937146ed7fdbb63651247e3d20bcf4fcf45f0187a9d7786e9b08", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778060954, "uuid": "6bb5dba5-b8c9-480f-a50f-b2cc762055ae", "value": "T199D6128BDE58C86AECF6523AFE32032334235D684703C47BA559FA3C3E735D64A91991", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778060954, "uuid": "856c77dd-0aff-4b30-a4a9-8dcb91a70cc3", "value": "196608:n/NIGg8MH5a6Nu7KrmwiwEzab/2CqbRb0m7CKfxMEXynLTlc94oxAgzwRT9QCdDO:mdrEzaYbJDHffCMxAgUR+Cg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778060954, "uuid": "9c6581c8-5999-412c-8cc8-948ef787b3ea", "value": 13124396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778060954, "uuid": "51fbdf1a-1456-44b5-80e2-0bd1bb7cc1af", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778060954, "uuid": "5e263814-aa98-404a-8ced-2174f6c4a2ad", "value": "mParivahan(25).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23795e51-492d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778059364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059364, "uuid": "be0c36f6-9133-4c24-a4eb-1c605000d00a", "comment": "Malware payload", "value": "c938cd78d3ab64813144f6967020ebd6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059364, "uuid": "bff1f6aa-b99d-4a56-a9f8-416e10291d7f", "comment": "Malware payload", "value": "e31b9786b9c8ef640a0a0588fda42df4850cfc4a479c1df6eba1c319a4254eaf", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059364, "uuid": "d24144d6-5064-4693-97c9-7aad8941d594", "comment": "Malware payload", "value": "e9e7c4a1bad1be0a2fc977f596d63c7dcef55122", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059364, "uuid": "ed9d8114-05b8-482b-a9ad-34e204fbd512", "comment": "Malware payload", "value": "42a75d191d29fd6e5672ca57a409dc1beb399668c61ea9e88e799bbe8edee456e3d76e51d6e48571fba7246bf33ad268", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778059364, "uuid": "def2f7b7-f901-4b5f-8753-0927904c63ae", "value": "T195C5D46AF92019A3B24C762BFBB51A1469510773B3A6F04E7817EFAEC0710F80565773", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778059364, "uuid": "f327a702-a7c6-4716-8271-d85954c46a73", "value": "384:dVM0Hw94HH/AldQuddMCAnB4Hm55MXcHp5b0JrJ54P66HSTQHsS8gx7IXV5SXQiF:L2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778059364, "uuid": "b3680dc0-2d92-4c34-8847-371f35188b9c", "value": 2555210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778059364, "uuid": "92ea4060-9ee6-4e66-8f5a-57ddcc3747d1", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778059364, "uuid": "8d3dca2e-4447-435d-8b5a-9d17ca7e39f7", "value": "Request for quote.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bedc7f8c-4983-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1778096561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778096561, "uuid": "64bd61a2-ae34-435a-85f9-82ff0ebe96d9", "comment": "Malware payload (DarkTortilla)", "value": "c7a67bd5da5cf4f9604fa07bf4d37762", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778096561, "uuid": "77fae0e1-feef-42f0-bd47-5cdef9841afa", "comment": "Malware payload (DarkTortilla)", "value": "e325d90135d2397a10bf930ad8ed536fcd3ffbd189cd0e7b2cbb376c5b851af9", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778096561, "uuid": "7ea5d87e-bba5-4f38-b71c-7d42f778b0da", "comment": "Malware payload (DarkTortilla)", "value": "1db8e69eb1e53790431a1fc9da6615222e0f0eed", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778096561, "uuid": "f71cc51e-6e01-4bf3-861e-d59f8f85b455", "comment": "Malware payload (DarkTortilla)", "value": "20fdfecc3d72d9e32ddf78a4a4d6c6a4dfbfdebe36a401c5acb14e468a17de8cbcf25b9c4381c3e98ae9c32dc779c9c3", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778096561, "uuid": "d914643b-8afb-4060-b38e-757552806768", "value": "T11B258C1523E81A04F2BF5FB4AD7901204BF2FA6AAA35C65D7D5800DD0D22F81DB96B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778096561, "uuid": "7bb17704-706f-4261-8b46-61bfecd953ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778096561, "uuid": "179f068f-2cd9-489c-8720-7c30837c6dda", "value": "12288:yl/J4mH5ugthDBiwEK36oKhmqfQzgETH9+GUGLUy04ikyRb83HAfQjO/f:N6hDBiZoyfJuz0+y+3gYjO/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778096561, "uuid": "506bc734-ff01-4bdb-abf9-82a8e8fea338", "value": 988160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778096561, "uuid": "531bc037-18fa-4e0d-ade6-0b5b312408c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778096561, "uuid": "ea7100d6-a44d-445c-909c-f535977fceba", "value": "Quotation Request.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "907990d0-492c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778059117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059117, "uuid": "354d626b-0649-44e0-ba3a-02222a438cc2", "comment": "Malware payload", "value": "fc02b864a950423a3a7736cb32ddfd9a", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Yes Bank", "colour": "#AC7ABB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059117, "uuid": "5694a013-1ee4-4b85-85eb-94cae598ae61", "comment": "Malware payload", "value": "e4d9c44d7a2577a8a0a241923d7d74cbd66ad8a8c2ce62b13ceee576d6977acd", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Yes Bank", "colour": "#AC7ABB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059117, "uuid": "0446b0de-e6e4-4f2f-a811-969bdebe7793", "comment": "Malware payload", "value": "896e2a6141e122e4bd0958b82fab659bcbacef1c", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Yes Bank", "colour": "#AC7ABB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059117, "uuid": "eef95a0c-5a29-4243-97a4-ad5dd828ebe0", "comment": "Malware payload", "value": "090af78db57f44cd14bd654fb8d73f37ee84efc297f3a023444d9d5232bcf49b0da3fd1d869482e15dd3b21cab031d1d", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Yes Bank", "colour": "#AC7ABB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778059117, "uuid": "dd288150-881a-456c-b409-917122490a49", "value": "T137B612D6FBD4492AC8779072C96D12F1215B4D528B839F877904361C38B7AE80F9ABDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778059117, "uuid": "c1061cf8-d903-456a-af9e-ce3769840862", "value": "196608:uavXX2LthRaFOd7ZyzJbFkC7YoCq9eWNdbC/oLjNtae+4ZlFsjfo:JotjaFOd7ZyFbJ7jy/wLj2etZlGE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778059117, "uuid": "7387f2d8-462a-48d7-8135-6a78f3dc1646", "value": 11348084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778059117, "uuid": "ae1c4ba8-18e2-4199-a852-27ffb8c7307d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778059117, "uuid": "9262e3e1-8c63-4509-a207-5cc4172bfa9f", "value": "YESS BANK.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "443ee162-4926-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778056412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778056412, "uuid": "3d9b3839-537b-4851-804f-873eb572f2af", "comment": "Malware payload", "value": "95ef4546902cd354ebfccf8c50d4a2ef", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778056412, "uuid": "c7793ef8-1a3d-47ad-8a1a-7e08d318e061", "comment": "Malware payload", "value": "e53e38d1e1edefc7ca3a6a96a876162e577dfc24c05d980bf18ab00efc3b81d8", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778056412, "uuid": "824dd986-ea07-4650-960b-4b94064cd7fb", "comment": "Malware payload", "value": "d2e0ba89a0b9f85ff4a2c80e69a0cb16f1536f9d", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778056412, "uuid": "5a8fff40-4bf5-40f9-84b8-a8202f2080a3", "comment": "Malware payload", "value": "79a71c556913d7a2d83f2e42b82eba204a5faf4d7cd7874cc753f80827e92b0c1ff1448b5a3451a4c9d41251e6a4f0f0", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778056412, "uuid": "9a2cae54-7f69-4746-8309-8b22f46373d6", "value": "T11006E08BBB496A2FC87751F205AE523212474C1B8E8797476D54320C2DB76D83F9EBC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778056412, "uuid": "1b190c5d-9796-4e20-b061-0328b3d87bd9", "value": "98304:O7i0r9E644Fij8rmgKQD1/EaOAgQmlbvHeJP3Hc:LyFij4xsiRmlL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778056412, "uuid": "145d6837-7e24-4a8c-9df7-e5d5ee189e49", "value": 3713665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778056412, "uuid": "9e7c925f-617c-431e-924f-37ef3e75f7a8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778056412, "uuid": "f6b08a15-ec18-4143-86bd-1e540efab946", "value": "Sexy Chat(1).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f52eb3e-492a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778058203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058203, "uuid": "765c7860-b901-44f3-82fa-70d9b2885980", "comment": "Malware payload", "value": "5039416032bdf58ed43da37713d8d14e", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058203, "uuid": "a5c1553a-2324-436c-a8ce-859332449d70", "comment": "Malware payload", "value": "e5bed6d18aa6ee4c311f6c9a0fea241f2e6d5af3cbffde1cd1d4a20891bcab6b", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058203, "uuid": "f496e5a5-19d8-4f51-bad8-0d76beda8c88", "comment": "Malware payload", "value": "0c57449c0a03acc29436303de99073f5fc693d34", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058203, "uuid": "efb6a879-64ff-4303-87cf-e977552c8faa", "comment": "Malware payload", "value": "86942a66066d27dfee803287a853224863f07d5cac09367eb151faaa8ddf474f68d01e381faaee12a60d6760578e14f5", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058203, "uuid": "0e0fe440-3d0c-4f41-b3b0-325f434e7fc1", "value": "T1C9E6124AEE48CC6AECF65339FE32436338325D684703C57BA569B63C3E735C25A91990", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058203, "uuid": "a31518fb-b48c-4c76-8f72-f0240a7e2972", "value": "393216:ny8LHJFyqmeTrH122YmWNdwmQRIx2HLInLPHlh:nyaHryqn02Ym3mQRdKbHlh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778058203, "uuid": "ab1f2260-98e6-47d9-bd78-fe284ab6e06c", "value": 14074668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778058203, "uuid": "2ce43c4e-fcd0-4bbb-a2d8-b1a52d3ca597", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058203, "uuid": "ee45fdfc-534a-429a-8caa-5850b0b86826", "value": "CR\u0395D\u0406T C\u0391RD \u0391\u0420\u0420R\u039fV\u0410L.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40b5d545-4988-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778098497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778098497, "uuid": "bdf95290-8b89-4779-a1e7-d7915783060e", "comment": "Malware payload (Mirai)", "value": "21231ff77ce56e9582e7685c0fdb257b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778098497, "uuid": "5b7642fd-aa31-48c2-ba72-65c658c228fd", "comment": "Malware payload (Mirai)", "value": "e64d909993647ed17312cea32f60ec65d71dd440ac126d2360aaeeaaf72f7cc1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778098497, "uuid": "bbe1c8ba-c8db-4924-8b61-6cf3e81cdbe0", "comment": "Malware payload (Mirai)", "value": "9127e8a0b2926a827a8119c9a6a1e6faabb61fc9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778098497, "uuid": "e0e135b7-0c7e-490a-be71-a36e0268ff9e", "comment": "Malware payload (Mirai)", "value": "14906f18fba86b7d40b2b7cbe652df45036462257d390b6e13a250f15e2165793498afbf0ef988f1a7b2155b49ef9679", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778098497, "uuid": "6a482bc2-c83a-4321-b3e5-92abac3944a2", "value": "T1FE6302CF7DB02F27D1D8A1B2703815CAC93A9D8AE243865C87E1E79647398375488B1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778098497, "uuid": "6aa344a4-5a84-4668-be9b-b6ed4b224cab", "value": "1536:SaxZLmYKVDNSl2y08yumeJyGYVmIMG6qz3Nk:SaxZLmYKX+t08jmeJhYTR7Nk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778098497, "uuid": "888e8a02-dcec-40c3-9127-977cf180341c", "value": 70468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778098497, "uuid": "9123dd73-bd5f-4dec-a1c2-bce6588f9d99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778098497, "uuid": "92799cb7-0ead-41e8-8258-bff8e7060bea", "value": "e64d909993647ed17312cea32f60ec65d71dd440ac126d2360aaeeaaf72f7cc1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d7ebc6a-498d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778100720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100720, "uuid": "f365e9c4-f66d-4224-9427-b865c8366a30", "comment": "Malware payload (Mirai)", "value": "020b9590f51a7c1717f30734275aecc8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100720, "uuid": "571ececd-af41-4e52-a45c-0e0eff1caf16", "comment": "Malware payload (Mirai)", "value": "e66c5631a68cefe174866d74c72d497c1448d58683f6f89fbc65cea9039198a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100720, "uuid": "913c4c18-2f42-4c31-bb28-f9d1d053cfca", "comment": "Malware payload (Mirai)", "value": "99a4036b441bd3090a7cd151c1748f607209cbf4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100720, "uuid": "bea42a5c-c017-4039-9069-5c2cc79f6e4f", "comment": "Malware payload (Mirai)", "value": "71a80359eb4a6ab408f31eecdae42f73b34b4221000d0aeef1d571281d6344936ee926e8f98e28b7ce1c3bb2a5611ba4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100720, "uuid": "dc1ba4d5-12bd-4474-ad1e-73628a603954", "value": "T1B5D32905730C0847D2673EB43B3F27D197EFDA8221A4EA05254FAA8E9172E731589ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100720, "uuid": "25c7e290-74bd-4cd4-9e28-a644809038cc", "value": "1536:PVh64FT1ChpxpMBbujtjo1FvAPyx+kQJSJ8qYHepq918Ls0N:PpT8hpxSSFoQPm8t0bN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778100720, "uuid": "134e43e3-3c45-43b9-8198-c02350df6a88", "value": 139668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778100720, "uuid": "390805b0-016d-4f93-a525-9a54b8151896", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100720, "uuid": "2b1f9622-f556-46ab-9a51-73df74ac928c", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46a9a697-4920-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778053839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778053839, "uuid": "798178dc-28d6-4670-ab44-86c81c54cbf2", "comment": "Malware payload", "value": "76f4a223ba57db108fd7ede89bd61301", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gogo", "colour": "#F0D91E", "exportable": true, "hide_tag": false }, { "name": "UAT-8302", "colour": "#F096F6", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778053839, "uuid": "9b73c39e-9b83-4e34-8439-09a7313bfd23", "comment": "Malware payload", "value": "e74098b17d5d95e0014cf9c7f41f2a4e4be8baefc2b0eb42d39ae05a95b08ea5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gogo", "colour": "#F0D91E", "exportable": true, "hide_tag": false }, { "name": "UAT-8302", "colour": "#F096F6", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778053839, "uuid": "8bb95a57-3912-475d-a30b-ed38d688be36", "comment": "Malware payload", "value": "495aafc32f8f3eddd3da6a48ef5694330473a79e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gogo", "colour": "#F0D91E", "exportable": true, "hide_tag": false }, { "name": "UAT-8302", "colour": "#F096F6", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778053839, "uuid": "42f4a352-4fc7-4408-9171-289ffaa5493b", "comment": "Malware payload", "value": "bfa50f2fe8aadd2f877ada6b177f93275ce75fa06f8396d6e3181a46a8e2da71d0cc4c9cc331b4fdfd438989f4e0e618", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gogo", "colour": "#F0D91E", "exportable": true, "hide_tag": false }, { "name": "UAT-8302", "colour": "#F096F6", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778053839, "uuid": "e1e6fe10-abca-4aef-9a14-e83769f4fb29", "value": "T136F533F1549103B7D938CF7EB5B67682D641A971320E664CD991CAC34B7E3D33AA088E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778053839, "uuid": "59abe2f1-5b40-4458-b174-c5454c602954", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778053839, "uuid": "8b5350e3-4a84-413f-8245-f08b324e40e5", "value": "49152:HqOgBE09zoXD3YO5gnv9jL2YazkRc41GWwtZ8+m0J2/RB8cRHlVQa1wn3ntR:H+By3L5gtGs1GWCZDmc2ZVlVJ1g9R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778053839, "uuid": "cc842876-f618-478d-9d20-468c732e46a4", "value": 3341824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778053839, "uuid": "c0aabcb3-4255-43e3-b457-43ae6dec8a40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778053839, "uuid": "264ec05b-9f4b-42b6-9724-6903b59e7700", "value": "7cfaee97-b7bc-4aac-a09e-55f259805ae4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de4904a3-492e-11f1-a769-42010a9c0008", "comment": "Malware payload (RedHook)", "timestamp": 1778060107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060107, "uuid": "0831e27f-2ee3-4bfd-91f4-0465a87a6186", "comment": "Malware payload (RedHook)", "value": "3ddd3fbe5efc0e0616df942baba2ab0f", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RedHook", "colour": "#614F60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060107, "uuid": "1bcd83d0-dc5a-4fa9-8c69-c715767ddebe", "comment": "Malware payload (RedHook)", "value": "e7ebac9ba2548db5e772f1a0d657acf0f61425e67cf326bea142a1f1c13a077d", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RedHook", "colour": "#614F60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060107, "uuid": "bc291549-3e3c-4941-b652-4cf94417651c", "comment": "Malware payload (RedHook)", "value": "10be043d07c93961b9d93723706ccab9b09347ba", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RedHook", "colour": "#614F60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060107, "uuid": "008d2293-d9d2-4e36-9cbe-cba920315684", "comment": "Malware payload (RedHook)", "value": "754322d23e44b3d4051fb117905d4ec09813e242900a9d075b2bee69333dddc6631dedda3060d2805d8c20ca5f341723", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RedHook", "colour": "#614F60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778060107, "uuid": "42a0c21b-cf43-4619-97e0-fae660feb17c", "value": "T15DE6124BF748892BDCB610745E4A02317622ADD58B92A3C77910B7397EB72D44F39BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778060107, "uuid": "2ecc87d8-bd88-4ae9-8715-b4ec858ed8c3", "value": "393216:uHevjjNLD5yEUEQrliBWkKB+psvJDKORmnia:usjpD5yEfQrlSuusBDKOcia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778060107, "uuid": "f2b06565-7361-4c50-8995-984299f275a3", "value": 15191127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778060107, "uuid": "d12b933f-e691-45cf-a43b-bc106d58dd83", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778060107, "uuid": "44d78e6b-19cb-4757-9032-88bd0441cfc0", "value": "TTDK_8.0.2.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c54dbb61-4968-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778084976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778084976, "uuid": "72865202-c814-418a-ab9b-1ae3cbde5c29", "comment": "Malware payload (Mirai)", "value": "15cd73e2fd631783ed7b07dbec32cf1c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778084976, "uuid": "5c682a0a-776c-4aeb-b60f-5fa0de80eef6", "comment": "Malware payload (Mirai)", "value": "e9eead6504fc3efd6e7e06a418b3c68e024949dbed07dcc79cee03a5e4bdd50d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778084976, "uuid": "72a3da39-c0d3-4d93-bfb9-2f76c6dcc144", "comment": "Malware payload (Mirai)", "value": "008bc8631998a28c18e431d66a069262e31cf6cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778084976, "uuid": "6671a595-bee1-4df0-a1c5-24ee4681b9cb", "comment": "Malware payload (Mirai)", "value": "6728094d764874d67e43835adf0e0427daa46b6ec4e776a51d9fc7e3a59e5c12a7a8167ab4cdb2b9151f8558efdb351f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778084976, "uuid": "3f738e1d-8993-4592-aee1-2ae2a9c97aad", "value": "T12DD34B07B4C190FDC4D9C1748BABB13BE976B1691238B25B2BD4AB272E89E305F1D644", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778084976, "uuid": "0bb20d2f-2582-4c5b-9653-57e8f45784a6", "value": "3072:m0Y7L9uN7sAk5U1jEJyr4lKqX+CgHsCuvufiZCKmBJ2:m0Y7L9uN7sAki1j3qPf+7Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778084976, "uuid": "e9e842b7-20e3-47b9-8777-e62b13b53a7a", "value": 139336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778084976, "uuid": "3d2b374c-824c-4a92-ac55-5ed6c4eff8ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778084976, "uuid": "f76a4b59-aeee-4cb8-80f4-87920fe261e1", "value": "e9eead6504fc3efd6e7e06a418b3c68e024949dbed07dcc79cee03a5e4bdd50d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d36d659-4929-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778057716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057716, "uuid": "b026eb3e-0b43-4b74-942d-a8709e9851f2", "comment": "Malware payload (Mirai)", "value": "70f70743f287a837d17c56933152a8a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057716, "uuid": "7479a8a8-e6a5-4a77-ad63-513d2ed72744", "comment": "Malware payload (Mirai)", "value": "ea1d34b21b739a6bbf89b3f7e67978005cf7f3eda612cefc7eac1c8ead7c5545", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057716, "uuid": "df610f2a-2e43-456b-b463-544db2645a95", "comment": "Malware payload (Mirai)", "value": "b0f2c668cbdd63a871c90592b6c93e931115872e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057716, "uuid": "730de5b4-7571-4845-87a6-96ebf648aad3", "comment": "Malware payload (Mirai)", "value": "310ec7f393a63005f9461f70c8fa04122218f6e3c8fa0cf5ba63b772d5c7ab75731e3b5127eeb349e75b7660ebfab591", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057716, "uuid": "d6b061c2-702d-416c-9817-7b2d13b97c71", "value": "T187E33C2375C04479C0E5C631C9DF84269572F40A53216A0EBF852F347E6AB26EF2EF96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057716, "uuid": "66a0039e-7213-4208-8728-e97f69e870da", "value": "3072:SQL8Wfof3Ji3d2t77bc+R4PJUxv6UumQgxzLwze+1Nro:BeJ82Nb/R4Cxv6UQ6aN0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778057716, "uuid": "41cafe23-3753-42b3-a950-9872437c2e13", "value": 151464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778057716, "uuid": "6335ae77-e06b-432f-b35e-5364d3177750", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057716, "uuid": "ae24a491-1c2e-4b2e-a69e-4608e2fe3942", "value": "quasar-implant", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69aeeb57-48ef-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778032853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778032853, "uuid": "b9ce0924-4bb4-4294-bf7a-c486c1c447fc", "comment": "Malware payload", "value": "28bd8fe22d9a7155d7b1cb4824b1a3ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Stealer!MSR", "colour": "#C0F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778032853, "uuid": "6a717a45-7b37-4681-a1ae-933ba711624e", "comment": "Malware payload", "value": "ea234fbcfc2a2af75bb80a34a0d624bb078c5322b160642977da79cdd9806783", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Stealer!MSR", "colour": "#C0F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778032853, "uuid": "cc21e621-0615-4326-b25c-110a5f21aa31", "comment": "Malware payload", "value": "1b360e992e963664543dee40687d5700ea60085c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Stealer!MSR", "colour": "#C0F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778032853, "uuid": "d0d1a063-0b49-4503-9108-d87321530fbd", "comment": "Malware payload", "value": "d62144f36966541193f69857aa94e3c615a0e6fedd3886d26e62a3ae04fed840b801c7603b391ae3c6bc0f0144325b1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Stealer!MSR", "colour": "#C0F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778032853, "uuid": "2967b798-83c2-44ef-ae30-9b0cb624024b", "value": "T1AD6733D63248409BDAEA22BBD85BC22144A3F8535750C6EFC3BCD7609E53BA1553BF18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778032853, "uuid": "00d3ac0e-177f-44b5-a32b-966b93f19f17", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778032853, "uuid": "969d9177-6f3a-47ba-a404-63f899146959", "value": "786432:SoSAXOhFlUR1OrCVNITK7zcY87xcuhAIax5rPvFTe1KsX+:SoyhEWENsKHE7xkI4vt3sO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778032853, "uuid": "8363d42e-0594-4833-9de8-5e78e39f2931", "value": 31537407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778032853, "uuid": "b1f31847-f16b-4d45-8106-e731c07a411e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778032853, "uuid": "9d07f221-a8b8-462d-8740-adac84d20afd", "value": "e89nv81d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04b4f0c5-492b-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778058453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058453, "uuid": "161596f5-e41b-4186-ae0b-2fce9e59af4b", "comment": "Malware payload (Formbook)", "value": "3c3d4e6dd0c27c1e623c198f7ecf2163", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058453, "uuid": "96307c7d-4f95-40dd-a677-3259bbc908ce", "comment": "Malware payload (Formbook)", "value": "ead0a612c58e858cabd1248aca1ee32fa8d5e5a290bda6771bdc53e500140b12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058453, "uuid": "4f15f926-0146-4450-881f-10b364b1f1c7", "comment": "Malware payload (Formbook)", "value": "4397efc638c80dd6ab2ea8430793a4b7a047c402", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058453, "uuid": "790604f4-e44b-468b-aae5-3edf68d3731a", "comment": "Malware payload (Formbook)", "value": "e3962da9431fbc0857df4f3939d8004ecf1a97628e5acc4a26ad2b79b1f45ad3ed34d2466fe3960a216daa8fb07ff1c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058453, "uuid": "3d8f08bc-6bfa-43b2-a227-2a5e7f4deaef", "value": "T13A45F0D43A2AE70ACD924A359A34EDB146F80DA8B401FAE39BDD7F5BB4BD1105D0CB41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058453, "uuid": "e1796c94-e557-454c-b2ff-91c28df4a4be", "value": "24576:0baCzZ5L5Ttsy42BBsOdad734SRsmDPrndaga:oaCV5LltR42/s2SiCPrcg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778058453, "uuid": "5675ebf3-a109-442c-b760-03d9f84db3a4", "value": 1179136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778058453, "uuid": "6ae2d039-a96f-448c-962e-2957d8953e0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058453, "uuid": "28ce91fa-960f-4789-b432-4f656840de62", "value": "Purchase Order 350088.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f8388d0-498d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778100723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100723, "uuid": "970a7e4c-da86-4faa-9658-0c97a41f5b79", "comment": "Malware payload (Mirai)", "value": "0263a84ad21ed2e4a15d6bb64114ea7f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100723, "uuid": "fd5db93a-9a72-42bd-9fa9-89b74407413c", "comment": "Malware payload (Mirai)", "value": "eded8b72f6da1ea5378850eaaa96532d09cf1a42847e4897bf700afc379ad17f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100723, "uuid": "7ede32d2-a0c2-4182-ae32-cbf44a4883c1", "comment": "Malware payload (Mirai)", "value": "39c978e8497c7625e5ba044e94747de5b510d8ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100723, "uuid": "1f7d7df2-e550-4d11-ad98-69cc92c8ac56", "comment": "Malware payload (Mirai)", "value": "ebd0addab128429d70fd09a31a323dbdb9e090873bc84311d5002850511f78dbaef8b19f1716986e2ef44cde3a78dc00", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100723, "uuid": "11249af4-2b1e-4318-a1ad-ded1b0f2ebe9", "value": "T157E32B07A98080FDC4E9C1784BFEB036D932B45E1238B25B27C4BE265E4EE615F6D725", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100723, "uuid": "9b0a4ede-2969-4395-9283-24fec2eda4b2", "value": "3072:BofVcC1I68YYejOg2b2U5Q9dC/Agf0TOZjfm6kG:KnBGV5LYgpmG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778100723, "uuid": "c18cf832-55cf-4a26-b4d0-9593842c75c0", "value": 147640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778100723, "uuid": "c657d1c1-8eae-4b23-acc6-b79613bc508c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100723, "uuid": "fe78a973-98a2-4f36-bec3-d9dc98761ce2", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "424c6122-4988-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778098500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778098500, "uuid": "c97cc87e-dedb-477f-95c4-13d328c07dad", "comment": "Malware payload (Mirai)", "value": "d54609633faa36a4c58ae26225d7d401", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778098500, "uuid": "54a8bc0f-9d46-4917-a542-c81676b2661c", "comment": "Malware payload (Mirai)", "value": "eead126f579323883adaee039a9c46ebc855dbd21d399c35ef746266bfecffd8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778098500, "uuid": "5768f2d3-a8a4-4ffc-89d4-779688dabf14", "comment": "Malware payload (Mirai)", "value": "80170880ba4af313bcf2dd8f62591bf3e3b2c852", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778098500, "uuid": "ba740581-1917-40d1-8b36-fc671581bbb8", "comment": "Malware payload (Mirai)", "value": "89c73dac675011b7e2ae01640ce8ffaade898733b17322a5aceeeca890d82f83a54b1736cb0b41a74ad5c9507570ab1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778098500, "uuid": "73989713-e7bf-47c9-a264-812f0478ac0c", "value": "T14B5302F760D47DCDC25A8734060B1A033EC563B8A18A663676C5F5988AF6354CFD8BE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778098500, "uuid": "7161d2d5-0617-4d75-8b6f-0e538d66a979", "value": "1536:C1/S5aOdeB51F+yuXkoPgvFbFX6hTZ0f8ASAZZBLkg4azHH:CM5az1Fy0oPgdZX6hTo8RqLGazHH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778098500, "uuid": "c8b261ad-5aa8-4cb9-a697-f463b94d2f37", "value": 60808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778098500, "uuid": "00e2f948-546b-4c77-bf4f-66387361f8af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778098500, "uuid": "e1030b8c-4cef-4b0e-9b22-aaafabc3cf87", "value": "eead126f579323883adaee039a9c46ebc855dbd21d399c35ef746266bfecffd8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88e7db4a-4961-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778081868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778081868, "uuid": "24260ee6-4460-497e-ada1-df7b3cdb3a3f", "comment": "Malware payload (Mirai)", "value": "7f91b3acf8e380a78a61422e3b79dae1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778081868, "uuid": "e6f226db-8bdb-46ad-8241-ead2a6a34590", "comment": "Malware payload (Mirai)", "value": "eefb634eb31119028eca996f87b0e4b3b00a2b2edfd6e205a2a275112341ddc4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778081868, "uuid": "fcb832e1-7bf7-4e7e-9b4f-f20579d5756b", "comment": "Malware payload (Mirai)", "value": "d2c5f5df26cb20bcf6b4f40fe47c0335b6ebc850", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778081868, "uuid": "6d0769de-57f9-4d84-b760-d0a2e649c8de", "comment": "Malware payload (Mirai)", "value": "ad99b6bfd7af8deb21283e6f514a2697415832be2b061cb15e650b283d279b51fe64a67ad53933a40ae1d40bc6ec0e5d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778081868, "uuid": "74551823-b3cc-479c-bc60-ca710e73b0be", "value": "T174A3123327286A1157D2B835FA4C18043699B751F0E19B83627F04B57CEB8A963D8FC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778081868, "uuid": "7958874d-e4a6-4b51-ae7d-297e9c063a11", "value": "1536:v5sEAgOWgOTCZpUp8HGe19j2U3E9JLw4ArgwmcakULcuyDf8CU0a/KjMGumV+5f:RIWgO2PUG19jjWBwmcKLelU0VUf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778081868, "uuid": "5be2b0b6-ef25-44ce-8204-f1f1bf80964f", "value": 99772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778081868, "uuid": "08436bb2-5361-49e3-9a1e-e016d453ea3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778081868, "uuid": "29544653-ad4e-469f-99ff-b6c46900cdcd", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86c9be47-492b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778058671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058671, "uuid": "7c51b7f1-9c15-4386-9574-0de4c4646e86", "comment": "Malware payload", "value": "f6e9e779b54ef79fdf5c3f154c51bfb7", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058671, "uuid": "9c5139af-a9e5-4eec-8575-b28a0680c7e1", "comment": "Malware payload", "value": "ef00da7a789bb7bbb1a8e63aea3476ca8a840c23715678e00ef283c1b4a4cd9a", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058671, "uuid": "7c2122d7-ad49-4fc3-9f93-08eb640aa487", "comment": "Malware payload", "value": "5ca3808ff9df208da53e101417ee753405cef1df", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058671, "uuid": "b8c6146e-f8b6-462e-90ff-5f9fcd5d2133", "comment": "Malware payload", "value": "aaff9a20748d5e2d26e430efec0a7dabb640c03a11374c3a873ffe6a7d5188a585a3b0f8d25ba278393952d82a5e9f1c", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058671, "uuid": "ff40ac89-f1ad-4708-80fe-591fb3c53a03", "value": "T11EE62227F74DADBFD8FBE334897A15A1401AAD26CF07A6876828737D14B74C45B862C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058671, "uuid": "5a41a046-ab00-40b9-9705-eb6ec7f052c7", "value": "393216:c9NWJUPxQa3eQkxl5sfz234C5Edjc+u6UxjZ:cGUeajslb+u6UxjZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778058671, "uuid": "1904a1dc-1919-4c23-bdb8-6d09e6f9a673", "value": 15066733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778058671, "uuid": "06b98d60-93c6-45d9-a948-f16c823d9b83", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058671, "uuid": "67d41fe0-adbf-4209-b915-588150088bfc", "value": "iMobile Lite (9).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cbc62ad-498d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778100745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100745, "uuid": "21af2cc0-8d9b-439d-b496-087a34592052", "comment": "Malware payload (Mirai)", "value": "f495f70ea50a38674e1db8a9e9223e4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100745, "uuid": "831e52bd-53a5-4501-b498-e486c4970a9b", "comment": "Malware payload (Mirai)", "value": "ef06c2039f195bb63ea29529ffc19f6d31e3b00d616d7a39487039c6dd12652f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100745, "uuid": "2a04268c-c823-416b-9589-d56a57205ca3", "comment": "Malware payload (Mirai)", "value": "5522e2656f8956b45cc520d77be8a73d040405e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100745, "uuid": "9b37d833-a068-44c6-8941-f325d08b40ff", "comment": "Malware payload (Mirai)", "value": "8d9c045c65cddca43368d1aeb23035ca75e7cd613e4f6bbab39e5d4756d99d5c6f1a3b96d6bcd7f3077b44ccc00b54ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100745, "uuid": "dffd8680-077c-47db-8af7-8d987e7848cd", "value": "T14EA339C5FA83D1F2D81708346162BB3FCB71C9AA4066DA4ADF9A6F31CA37541C716368", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100745, "uuid": "490c63ea-7734-4218-b6a3-18096c7d54f4", "value": "1536:jhQDIyL3EWM9Gzu4ZHr2v+1j9UxrB4lWDSmiF:jh2ToWM0zTr2v+1I4w2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778100745, "uuid": "eb5db1c4-541b-4f8a-94b2-cdf985d29cd1", "value": 105992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778100745, "uuid": "0633facd-df93-4c16-871e-615d3582aff4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100745, "uuid": "1b0a549a-2965-4062-8924-b592d857b995", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26cf1f3e-4966-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778083851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083851, "uuid": "af5693bb-3662-4196-9620-006d043fcaa9", "comment": "Malware payload", "value": "ec3ed72f87d010ede63f76139329abc6", "object_relation": "md5", "Tag": [ { "name": "DoHdoor", "colour": "#F59200", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UAT10027", "colour": "#5B556E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083851, "uuid": "f2c1fbab-1c2a-4add-b929-01d377d85409", "comment": "Malware payload", "value": "ef0b2dcc885f9424bfff49b8ca9f8d004f4ed9237185dd6a24a4a7f5685eb78d", "object_relation": "sha256", "Tag": [ { "name": "DoHdoor", "colour": "#F59200", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UAT10027", "colour": "#5B556E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083851, "uuid": "62981508-236c-462e-8caa-9b8fc1d3da5c", "comment": "Malware payload", "value": "39fdf1ea1669c50ecd86b2497f2022c5bcb7aef7", "object_relation": "sha1", "Tag": [ { "name": "DoHdoor", "colour": "#F59200", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UAT10027", "colour": "#5B556E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083851, "uuid": "5618b831-4cfb-4474-82e4-22c6e3bca6fe", "comment": "Malware payload", "value": "c8572adf6af948ede711cf8abd55330e2a96e428c65645d1905bc0fa1f7f30904fc71d0e31914baee8c0d83165c08ab1", "object_relation": "sha3-384", "Tag": [ { "name": "DoHdoor", "colour": "#F59200", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UAT10027", "colour": "#5B556E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778083851, "uuid": "2f99a079-a665-43a5-9b2d-4c4155f1822e", "value": "T1E4C58D07F29611E8C46AC238D34B5233AA71B89D17247AEF1294D7752EB2FD0673DB90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778083851, "uuid": "5c17373b-499b-4199-9115-f7007edd80a4", "value": "bdcc2924cbef07bc4f4b961fb68c2e45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778083851, "uuid": "c9eaac95-d026-453b-9c41-a27a8242a6f6", "value": "49152:J96Z/hQ8jLxhstyPURKdsjmVA773GH0/hg2skkk3E04o9k5v2iO/eIU6insh2m:iFhjdsjmVA773GHMhg2sy3E04o9+M+nk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778083851, "uuid": "863276be-2f75-4181-b571-34efa65639ba", "value": 2594592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778083851, "uuid": "6b7bc7e0-38e1-4c31-a8da-67f017050ac6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778083851, "uuid": "eb5cc40c-335d-4f65-8840-da9be34eef91", "value": "DcnTEL.dll2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e68165d-4925-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778056027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778056027, "uuid": "7b762964-1785-4f77-a320-d257061f46c0", "comment": "Malware payload", "value": "7b6926dd069a7d795f5729a2a87c57d0", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778056027, "uuid": "e22ecb67-cb5c-429a-a022-384b05a18d2a", "comment": "Malware payload", "value": "ef16cc8137d29356d0ef23b61ddb9cfd5e2784578fa818d54fe670bfa1e6ef73", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778056027, "uuid": "86c7479d-539f-464c-a82c-0f3b95fd070c", "comment": "Malware payload", "value": "b63958dd1d559b8b559c3968fb1e5116b76275a0", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778056027, "uuid": "039b1adf-b2f3-470f-a2b4-44df95553eb3", "comment": "Malware payload", "value": "ffb569d3ca88c8108a79ffd1e1533c4b0d9abb0da35501f2c4a7084921db9ffdd251f55b3864fd7f24343bff1e1e987a", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778056027, "uuid": "70e74084-9730-4261-a632-2d10de63e819", "value": "T182261282F7E95E9FCC7682361B87173226628E01DAA3D747A614736D3C7B2C84E097D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778056027, "uuid": "2eb66885-5a59-43cd-8380-70b939a44b9a", "value": "98304:aYuWEz7KT7+PsGFCpuPT34nZ0cHtx1pCRXgTcWjjFX6SFE:aYQk7Ss+24oZ0chIkcWjZQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778056027, "uuid": "56464d3a-685d-45f8-bde0-0585b6900bf9", "value": 4483479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778056027, "uuid": "4b368b8f-b8e1-4fd8-a50b-c738fa8d013e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778056027, "uuid": "87f920bb-6dcc-453a-8f80-a820676de90e", "value": "app-release(3).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4c1de88-4916-11f1-a769-42010a9c0008", "comment": "Malware payload (Havoc)", "timestamp": 1778049836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778049836, "uuid": "fd51d356-c8a6-463a-afc1-d11169d1d035", "comment": "Malware payload (Havoc)", "value": "ce9abf0dab1facd7afeb70dc34925a78", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778049836, "uuid": "d383be8a-c6eb-47e3-a791-df3acb257ee7", "comment": "Malware payload (Havoc)", "value": "f2357e70f359803d42298d016c7e1631e9fba6c7e01e5df1eb8fb9ff7eb3df4e", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778049836, "uuid": "372b4621-76d3-466a-a96b-d140bdf3923b", "comment": "Malware payload (Havoc)", "value": "149f5cfe98e06f9f7fb6d29dd271830c02250f9d", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778049836, "uuid": "fd2e22e9-cd07-4636-951b-1002fb0923c8", "comment": "Malware payload (Havoc)", "value": "91a44eba79eaeda2050cd81d57c62531d01f64043169edfbfd9445d34d6f4d6ec143006007078094723bb42ac219dcb2", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778049836, "uuid": "3ed7fd53-5563-4468-8d6d-79b8004b9a41", "value": "T1E2F02717AA2DF9118CBB266165A16AE3AD81C307661321F6364FD029BB0C09D8DC90CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778049836, "uuid": "e28df1f8-02d7-41e2-9547-73ebcb81994c", "value": "12:vYvAGThYaFR9pHySlQA5Y9FaLlZFg05tADJRA57zd/A57jHMJ4dk:v0AEpFly6EFmZFg0DA9mVxIBHzk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778049836, "uuid": "7b6716da-bdbe-4b6b-8f32-7c5bbe03e221", "value": 503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778049836, "uuid": "3aaedd05-e9ec-41f4-8adc-2ff0c3dd64e3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778049836, "uuid": "207cfbba-6f63-4260-bf3f-fc7f1d2bab77", "value": "NFE-43250902055205000108550010000269881023835318-1.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cbc4b32-4940-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1778067620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778067620, "uuid": "95576e5c-9c2d-4ed7-aef2-a041f2eef364", "comment": "Malware payload (NanoCore)", "value": "eec79887bff2080b894f692000e05e73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778067620, "uuid": "8b2aed8f-e89f-4c69-97e9-1009d335c6fe", "comment": "Malware payload (NanoCore)", "value": "f2c48d5218a46f9a5a631d8b666be2ff355ca5b6d9652de1b1bcd31ca9051b4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778067620, "uuid": "55a3ba64-628b-4f40-96b9-2f2ee8f682b1", "comment": "Malware payload (NanoCore)", "value": "85b2d4ac369a93dc6e6c8cc61e5c1377c3053c19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778067620, "uuid": "9e2b4913-79e2-4647-a69f-e25204209a43", "comment": "Malware payload (NanoCore)", "value": "c25e3cb0196808ff963b04ab8976b9a700c747ed43825bb5975a4d7cdcccee18ee81c6b7d6c293b95d1ec26a1c692655", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778067620, "uuid": "61fd6585-eb2b-42e8-82b1-0b677beec278", "value": "T1A314BF567BA88A2FE2DE8579611202128778C2E39DC3F3EE18D420B78F567E50B071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778067620, "uuid": "5f2ca562-4e66-472f-926b-f84b0a838aa8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778067620, "uuid": "7e1566ee-a503-4e1a-8cde-57874bec3536", "value": "6144:MLV6Bta6dtJmakIM5xG9lT9E6CvvHPfI2xl:MLV6BtpmkmGrBfCvPPfIWl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778067620, "uuid": "ee08a380-75b3-4503-8a86-7adb37c87dc7", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778067620, "uuid": "43631cb0-cf51-4335-b47a-dbb6a92769ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778067620, "uuid": "d7c99161-1f90-4240-ae38-7480f5cd4205", "value": "streambeans.io.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4602b44b-498d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778100653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100653, "uuid": "bc0ca419-5da7-4cef-8de3-4856e096f23a", "comment": "Malware payload (Mirai)", "value": "dad68c03ef231947c38997ed35d56ab7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100653, "uuid": "3a40f857-03a1-4b0b-a72f-33ae40c2a8bd", "comment": "Malware payload (Mirai)", "value": "f3e1aa7e4afbf32a6cf8b24b1ec6cfae63c9a4ac73ab199d124a224b177f3c68", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100653, "uuid": "f0b4a707-2991-4ade-93a8-47bd51af4c77", "comment": "Malware payload (Mirai)", "value": "2d37690867848bf7cbd1511cf7a6e76d113ea1ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100653, "uuid": "a3a79b03-242d-4d3d-81b5-764b71ec760f", "comment": "Malware payload (Mirai)", "value": "7b97425fef168ef9ca3d9719798175e4c9f2f74a7fa93eed60de67407ca8826a72a985d9cd8405dd1c5658110d3a3ea6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100653, "uuid": "41239e0a-5aa4-4f24-946e-eebd7ad657d4", "value": "T1B943017A98F4E066CE5D2C7D70DC81AD7D08A2E171C1AA1817008C26AF48DCFFF655AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100653, "uuid": "a6385c2d-a77a-4d6c-85e1-ae4db2bcb050", "value": "1536:3rVTXsf13tjYnVkVpAEeQVD9Yv0zSlU97QmU3bfr:lwj6Gjq2ev0zIUKLLT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778100653, "uuid": "f6d5361c-f531-4151-8783-9ae8be7a5ebe", "value": 56388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778100653, "uuid": "4c9966e9-1035-4e49-90ee-857a737d7eea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100653, "uuid": "a644a2cf-101a-4e7b-a5b7-6fafe653195b", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ee41cba-497b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778092830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778092830, "uuid": "c0bcbaee-d3d5-4d7e-b105-08ca73ec96aa", "comment": "Malware payload (Mirai)", "value": "c4ead8e332b7a592b217c50f1d8d4943", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778092830, "uuid": "0502a987-d902-41ff-9afa-7da928fdbdc5", "comment": "Malware payload (Mirai)", "value": "f5858c7a6daebb29b5b9ea7b559dedf0eb29f0b1dca56bf6f267db24512db4b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778092830, "uuid": "ef604ac5-4ed4-4001-a12c-1258fff2a0ce", "comment": "Malware payload (Mirai)", "value": "9cf8d0b0bf5db573adc152f6d6db4a499082aa94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778092830, "uuid": "5ef9221f-9f4a-430b-aedc-6485fd42f33e", "comment": "Malware payload (Mirai)", "value": "02eed0cdd07c7a1e9f05aeb6e4928865772a28e496463ccf29f5b1c591e9e00b4c595fde22f9e87d495197793e636e95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778092830, "uuid": "1642e02e-125e-435e-a247-c7112a76330a", "value": "T1D9B34AD0E647E4F4ED1906B82133E3379B36F436412ACA83D7A49B33BC95A4199573AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778092830, "uuid": "30cf13a6-ac16-4ebc-8c01-38b98e9b3785", "value": "3072:Z0JHTEe7CHnl3l0ZhyE5KLKTtiMRZ5AUKh1myF78A:CJzEe2Hnl3qZhyE5BTtiJ+yFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778092830, "uuid": "07ecd4ee-a2f3-466f-8242-229fe60f19f9", "value": 109812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778092830, "uuid": "8ad1d689-b344-4db3-9386-71446887fa6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778092830, "uuid": "6be2fc19-39af-456d-8937-a14894533831", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48b8a738-498d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778100658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100658, "uuid": "975d479d-ac73-476d-8cbc-de3a7dfe0dcc", "comment": "Malware payload (Mirai)", "value": "410b55841ab85084f2db1abf0fb3feff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100658, "uuid": "c0a619f0-6638-4b34-b14a-165974ffb53a", "comment": "Malware payload (Mirai)", "value": "f59c5792e6f6b6f87ff3e4bd10961804b9f9fad20dcf3b9ff24c5a6bfe7f0bc2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100658, "uuid": "2132fc4b-4e0e-490e-989a-96de504d9fb4", "comment": "Malware payload (Mirai)", "value": "e8372abdb4121e484cee6b2ff0a9897cbaff9591", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100658, "uuid": "7376daa2-d399-4a90-998b-9347dd05f967", "comment": "Malware payload (Mirai)", "value": "7a721f848627ea135f6d6719dcfcb3d5c82664c6538f9ff55583a09742079e6e778d0835911cbfacd5e4e1d8ccc8a72f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100658, "uuid": "4c8de132-b285-4132-a0e7-e50caf274d77", "value": "T1EC33F14B85FBAAD8F87750700A19EFC0B6B26D53A21343A641577DF9193CA998312FC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100658, "uuid": "4a6a1b1a-bfbb-4001-9baa-9b12ef8d1429", "value": "1536:D/Hula6MavTPmJm1gl1iRfq+49jiAdrNqc43:rOlan6TPmuq8qn9ji6y3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778100658, "uuid": "a158495a-a0d6-4fda-948a-8f96fc163f2f", "value": 54020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778100658, "uuid": "f7013f58-4ea7-489f-b459-809ae6dc0d36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100658, "uuid": "e525b15c-b58d-4768-9d70-62c52260895b", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a36a51f3-4961-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778081912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778081912, "uuid": "69f0f06d-e861-4fa5-9ba0-890ff3488946", "comment": "Malware payload (Mirai)", "value": "4b29593273a51968f5605ed85ed771b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778081912, "uuid": "82ba6344-ceaa-43cb-a5d2-e3ff1c4f42f7", "comment": "Malware payload (Mirai)", "value": "f5f4157fcf9a394fa4d435a8fd87b43413298cbbb1895d72337dba38f459d364", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778081912, "uuid": "4f385a7b-085c-4b82-a8bb-471075c24685", "comment": "Malware payload (Mirai)", "value": "d8ac366dfc28fb5cd1313f8f06572046447c2fe5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778081912, "uuid": "8ea959bb-ab3a-4254-bacf-4c08057e7b9f", "comment": "Malware payload (Mirai)", "value": "e72c0b9bdcae7e5fe9a9e1940b8613e7bf6ace645d59c9d6025927258e562acb9b7ce77ed49b450bfcc11bfad31d6055", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778081912, "uuid": "475d9665-d86a-40f8-80fe-0b456af77af7", "value": "T1FC142A45F8819E52C6D522BBFA5E428D372A13B8D2EE3103DD215F25378B96F0E3B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778081912, "uuid": "7f43e243-0279-4182-8e59-96377abe8481", "value": "3072:ywMgMUifSInJD35HRHiMHcA6haMyFiod4XiKMMPvg3TzT8fslQ9P:ywMbbSmJ/HiM8AxpIs4XQMg3T/8qQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778081912, "uuid": "f5edc2d9-6b3f-414c-b8dd-7bbb8da42f6f", "value": 199712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778081912, "uuid": "0e1d7cfb-c1a8-4ea3-8609-738175fa5bb2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778081912, "uuid": "e5c1abf0-c931-4124-8fff-483c4ca5a4b6", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d233ccb2-4980-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778095305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778095305, "uuid": "b73d4b74-9823-4fe3-9bfc-0e0f046bbd29", "comment": "Malware payload (Mirai)", "value": "210d2fb634bba33530ccec4b1149465c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778095305, "uuid": "0f428463-575c-4290-8abe-b49022196c21", "comment": "Malware payload (Mirai)", "value": "f73a75d3d339d12bd6a802612b628ad8824395a2ae5144bada99302f2d4f9449", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778095305, "uuid": "062932b3-4e11-4642-94e4-56a4a37ec26f", "comment": "Malware payload (Mirai)", "value": "8be906cea445daaccb5dc978036a692cd2ce4359", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778095305, "uuid": "8c39cd8e-08c8-4993-b988-c277f7a18f80", "comment": "Malware payload (Mirai)", "value": "8c4891246112ee19b3105b3de57c91fbd5eac18f0a1bd5043ad3bfc124b59b41a9cfcc83253dd6b45ade6c9d46b0b7f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778095305, "uuid": "62327974-cd87-47cd-b292-46300d307816", "value": "T11744E80AAB610FFBE8AFCD3746F90B0625CC541B22983B367674D928F54B64B45D3878", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778095305, "uuid": "8405fe74-6ab6-4fb9-a31d-7764f53aaa1f", "value": "3072:ncPjdcn0lZsG9z6vwG3veyZcxWr4VBfcwRkbROWYuO9KFm9harqK9rZ:ncP5fsIAed8rCc2kYWj2239d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778095305, "uuid": "0ce278b6-5385-47cf-a8ce-2d2da6a52195", "value": 267064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778095305, "uuid": "873f6ba6-5404-48f0-b958-fb4066c3d5fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778095305, "uuid": "2a150c24-caa9-40ad-9ca8-674871a07d77", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65d83dc2-492c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778059046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059046, "uuid": "c540f7ff-0898-440f-bb9b-b9a4e47548bf", "comment": "Malware payload", "value": "132ed179024b0cc0d18e4377591a5379", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "Kotak", "colour": "#C7D433", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059046, "uuid": "11c9af1e-776f-4740-bdb2-634aad7a4ced", "comment": "Malware payload", "value": "f7dc24966272b86432e72bfe7e0d56fb27e951ce67f3044c14e486c37bf116f8", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "Kotak", "colour": "#C7D433", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059046, "uuid": "7482718c-2db0-4f74-983f-06d510bf9149", "comment": "Malware payload", "value": "ef0d1de181fa64d1b384bcbba57ca6f22d193e21", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "Kotak", "colour": "#C7D433", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778059046, "uuid": "71bdea0f-fbe8-42e5-b70a-a677dfa9f6f7", "comment": "Malware payload", "value": "0564d4cb053cd256c1e93f32d3dda204a3a71fbd4757f9e8e9deb14fddfd297367b58003c4f7c6875f9079fe9c62a4c1", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "Kotak", "colour": "#C7D433", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778059046, "uuid": "6f2c4fc5-2c67-4210-8342-8e50ad23eaf0", "value": "T12AC612D6FBD8492AC8778072C96A12F1215B4D528B935F877904360C38B76E84FDABDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778059046, "uuid": "c7fdf5fe-31cf-4d5e-83b5-7261f94a793e", "value": "196608:uavXX2LthRaFOd7ZgIXd2Pqj3Hzbm+UidQjAkNVLWZx1zINP:JotjaFOd7ZQqjz6HOQj73evzG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778059046, "uuid": "d758fea5-cc10-44b0-ae2e-24415dc4c1d0", "value": 11978868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778059046, "uuid": "3e8770a5-cf27-41cd-8611-2a1d72244620", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778059046, "uuid": "c7c80f9e-0dbb-4202-afe0-9a2f6e0c285b", "value": "KOTAK 811.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ab55744-4966-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778083911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083911, "uuid": "754bb1b8-b941-4af6-86b8-38fe3f5b2167", "comment": "Malware payload", "value": "52c55457a45a555adf236a40e9fae7eb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083911, "uuid": "d50849e0-0fc9-40eb-938d-74c36e0a83f2", "comment": "Malware payload", "value": "f9ff9aaba61fa274343a96815ba7bba924d4b7301b1f37584c3f364f415fcbd4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083911, "uuid": "a022d874-4a24-4886-9432-18f62be68d28", "comment": "Malware payload", "value": "aa2b3fe642e3465645e12a88b073839d5aaef4d5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778083911, "uuid": "29fdb18d-7053-4a7d-95ff-105e679a14c8", "comment": "Malware payload", "value": "24b140f964a1f44267a508f3b0157dd6a68fb7a7dd6d2d5bd01f9e99c0f684a225678667e29da9bdc074cb66005392fc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778083911, "uuid": "138239a7-532b-4d37-b6b1-3a53a3bd41a5", "value": "T163512AA8C7421632FFAB183FFAA1205847C6AC03EB24504D5EFB5CCE01A0946A67CF16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778083911, "uuid": "59cf46c1-f0c7-4f26-9717-69b367d34963", "value": "48:Y+jnat9/xU1948pcm3jnFYOve4UuHCC9eEVQsMosBAd4H:YkatIUi3jnF7veaeWQszsm4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778083911, "uuid": "8bf8ed2f-ef2e-4537-945d-6d38ffb33115", "value": 2494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778083911, "uuid": "62b3a7d3-d300-484e-a6e1-076f60ac9cd1", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778083911, "uuid": "5ee9d520-1b1c-4ebc-b842-92f4ed4b9585", "value": "164.90.195.107_1778083899151680_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39b49212-492a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778058113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058113, "uuid": "2ffa323d-77df-42ff-9117-20363086b42a", "comment": "Malware payload", "value": "69af730690c817a34f7bcd43d373528a", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058113, "uuid": "078e926a-c088-43a7-b934-edf1f9bd2bb8", "comment": "Malware payload", "value": "fa1b8ce8ba1016cfd7bb81033483be7e9e07fc2b4b511fbfb126387c07a6c9aa", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058113, "uuid": "d4018db9-95c1-4d13-827a-ea5fb5b6ea00", "comment": "Malware payload", "value": "bcf29a3db97a77fa754997bdc6f3dbd5f1f13a99", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058113, "uuid": "cee7d456-52d2-424d-be7d-74c2eb124234", "comment": "Malware payload", "value": "62adad738f44bc1b0a323de4534d3a73da80cefc2f59568d81c67d721cb0b65865b305e7ffc8de3bbf9d23e852d2408d", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058113, "uuid": "898dc132-ef88-49db-af0b-cf68a066ca5c", "value": "T1AEC62259F399A72FC837103349FA5632129B0D478A829B535928B20C7DBB6F41F59FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058113, "uuid": "ea73ea59-2de5-45c5-8058-f0fdb0aa5978", "value": "196608:cDe3Xq5f14dlOwYFNrTkgH1eshNN6kxnNEHv7xu8lIpTjOvNBatJwNz/6ZsPPy7d:z3q14dkwCrTZYshK8nNWJZz8SzrC3h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778058113, "uuid": "6cfaf6cd-79b3-41eb-8808-c00923bf4009", "value": 11910475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778058113, "uuid": "ebc7c8ad-d64e-45c3-90c2-62a7d674d690", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058113, "uuid": "a4cd9b4b-98d3-4ebb-bf30-f629838991a2", "value": "app(13).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff73db1d-492e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778060162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060162, "uuid": "f29bd8b8-fd08-4f23-8b91-4317f1a7bbb7", "comment": "Malware payload", "value": "d0c620c020cbb44ccf7ec0f6dba20623", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "OMAD SHOU", "colour": "#321CB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060162, "uuid": "4ea44d92-4b93-46be-bc0d-c51f375a48eb", "comment": "Malware payload", "value": "faeb83e77a383e529cee0ae689fec98970099fa58758ba4526da1adadaefbe8a", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "OMAD SHOU", "colour": "#321CB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060162, "uuid": "4930ecf1-2fde-4f28-8474-d3ffdb2687a8", "comment": "Malware payload", "value": "96e6057c80a96e9e1304fc48a8cd79d4b59a5810", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "OMAD SHOU", "colour": "#321CB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778060162, "uuid": "579677fd-d40e-43bb-8886-ccd990a79fb0", "comment": "Malware payload", "value": "a1c7a05093d74692d5d45bd9cc43470c10b81c394d52b1e3fe14f3c59d3c48c887662e5d8e3eb890dba668d15b477195", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "OMAD SHOU", "colour": "#321CB5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778060162, "uuid": "f3e9fc51-29cb-4337-93cb-076149675346", "value": "T192A59D8AB749662FCC7614374DAA927122578D878E879B437448372C68776E80F1EFCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778060162, "uuid": "e98c4eb3-5d92-488a-b243-232fcb7578a4", "value": "49152:p7oJiBBQYBxyGAnaFiR33edTVJnH/y4glKic3x/vzJt:toJizQPLnRZudTnH/kKic3x/LJt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778060162, "uuid": "f4f85df3-373c-4a0c-b546-b5f995b391f7", "value": 2168968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778060162, "uuid": "acbabf56-ba71-4fc9-80fd-c72a323d7fc2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778060162, "uuid": "c82eecbb-c605-420e-8ebd-25c4b553c982", "value": "Omad Shou(1).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caa695b5-4980-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778095292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778095292, "uuid": "f1ab610c-5755-40e6-9d0c-e8146b7fcd79", "comment": "Malware payload (Mirai)", "value": "e155b20b7feeecfc9884b5faae29f409", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778095292, "uuid": "fb19b6b1-10ec-4bac-ad51-d5aff5783ec0", "comment": "Malware payload (Mirai)", "value": "fbacad494520f54254aa368a8d9a5e492c082f444f81dcc676d4625c4d04d051", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778095292, "uuid": "df1bb3ec-768c-4bbb-8839-7bcab5afbfe3", "comment": "Malware payload (Mirai)", "value": "f11636697153d45ef4980c404ec318da6cff4c02", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778095292, "uuid": "b5e9a3c0-abad-494c-af46-544518b41816", "comment": "Malware payload (Mirai)", "value": "dab21e8a9af7ca6096d970166fd1121a37e6f714b727ba156f24d5d1f6cc18492826473899a22f943cf5213b7207d91a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778095292, "uuid": "cbe809ae-dc20-4524-b246-09ee9dfa2644", "value": "T1878302E6044BA671D1B18C7C2FC20B401EF627BAFF127D890266D6B2A96742D0D67DF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778095292, "uuid": "6f9f243f-58b7-497a-ba92-0bfbd7a5ff51", "value": "1536:IEI9jq0Sf1MSRU/gg3aQE/SWuU28FgkIVoy7MNqQR5OwJLVJuL:7IJRKM8xruL85B/NdPVQL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778095292, "uuid": "09aba8ac-3cd6-403b-8566-52f36f21bbbb", "value": 82660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778095292, "uuid": "ee86ceaa-86d4-484e-bd50-fcbc1b319b83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778095292, "uuid": "93152de4-ad88-42e4-aa7c-230bca71f98e", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23e83444-498c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778100167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100167, "uuid": "5a0993bb-3ea7-49a5-b789-22c879ace7b7", "comment": "Malware payload", "value": "f44c773aa9f3ac231519ccf3b43a929a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100167, "uuid": "9b6c4c3c-b4b1-4925-9a04-654026f79d18", "comment": "Malware payload", "value": "fc47918f0a067210e77aef7b0c12fdca7f06cb9293f6594ccc5709d4d057abab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100167, "uuid": "4e33e014-9cc8-4b69-88ce-0f44c5fbbe13", "comment": "Malware payload", "value": "9d13011502378f666f6a06045088a4d0fe9cf354", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100167, "uuid": "105b1ed1-4d2c-4710-b22d-e901b58516cc", "comment": "Malware payload", "value": "74ed852e8a84977a227a775f92aae131f1e6a29ab8c848f7c96447e39f5f86a2acb71d57fa5c6250a2d2048dedfa92b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100167, "uuid": "da408e1a-a0fc-4e4b-b412-ea0034cd162f", "value": "T1AC08332C17225026CAF91C353D34A573DF08FA8229B67F5C96C7A86D34CACC656E6633", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100167, "uuid": "93dd05f3-cfaf-4434-8140-a53f823a5694", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100167, "uuid": "3791d81a-d662-48ec-9fba-8d3fb76190b3", "value": "1572864:et9IKPW50oRWYvBPJsVK1IXObb4kzIjUsrnv1PTjynlSW7:eUKE0oRWYhJHv4iIlnNbjfW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778100167, "uuid": "d91e02f4-94f4-4cc0-94b5-dc23916cc0cd", "value": 77255097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778100167, "uuid": "fb0b2802-84f4-460e-94ba-05cb9b4fb663", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100167, "uuid": "909f710b-6fca-4d85-98c7-65da6e0a5f1d", "value": "activator2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f079e64-4985-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778097367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778097367, "uuid": "002ba3e4-63f7-495f-8d88-e720a0a51b05", "comment": "Malware payload", "value": "b22b69647738954f8ab452a0af51f913", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778097367, "uuid": "f7124ac3-735e-452e-94ea-7b61b1bfd861", "comment": "Malware payload", "value": "fca83c90c2a21119421adf45582bcb333bb0423678e0c389f2d215466c28244c", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778097367, "uuid": "76075264-caac-4fca-bb2b-e169dc543a21", "comment": "Malware payload", "value": "87c4e8b7fdb5b584170e5d2d84be154a11baeb73", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778097367, "uuid": "e41fe7f1-4bde-4de2-b69b-db84c0d40fbf", "comment": "Malware payload", "value": "4a6e39cc468455d8c83c84178b4e020aa3e0c853987be0d574098c2f581f8e6592fa2a77f3c998f4ef1fc7c8f2f21baa", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778097367, "uuid": "07fa191e-2ff9-4417-8b81-62e5e4e976d0", "value": "T1CA953906799490BDD5D9B23088F5A2D57730B4481B3027E73B636EB92E36FD01E3A35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778097367, "uuid": "e7769b41-add9-49d0-9d16-6b194005f248", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778097367, "uuid": "15096908-a4ed-45d1-9339-05d4812bffec", "value": "49152:Fp7l/cQ/8vCG+7KzIxnPsLjJgXrWKHK1gU:LeU4EELjgtU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778097367, "uuid": "020896b2-0e1a-4a42-9a79-00a48d021669", "value": 1973888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778097367, "uuid": "4fd65770-606d-4b1d-81be-bdfcb315fd23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778097367, "uuid": "98198ba9-f038-4972-81cb-88edd8abc624", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49fe0a8f-4997-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778104955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778104955, "uuid": "ff5acdc7-b824-4d5c-8d6c-5f4639c329df", "comment": "Malware payload (Mirai)", "value": "0b20fd03426afe88fe5b3aab4f8228c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778104955, "uuid": "7281e589-4a19-46e3-9730-0b3457ec0c8d", "comment": "Malware payload (Mirai)", "value": "fce21ef360a08fbedec870d8e0fc1cf78ebf532c3bdf18ac5a5bb78a48255b57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778104955, "uuid": "65eb73f3-ff56-4983-88db-04be37391e2d", "comment": "Malware payload (Mirai)", "value": "d73f5ccf36f20c30446109b42d7cb8f7b911c0ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778104955, "uuid": "bc1a0a82-a855-4c36-a163-771cea8ea859", "comment": "Malware payload (Mirai)", "value": "5ecdd8a370c6a6e10577f540063defccf1b69252806f8cf7a34f1ff3fd310ad179fd591bcd3ee2c36d7f747808775559", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778104955, "uuid": "719346fd-ab32-4ee7-a74b-2275aed69225", "value": "T1DE636F0ABF610EF7EC2BCD375AE81B49308D641A11A87F357970E818FA1A55B09E3C75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778104955, "uuid": "5e0f765c-9f07-4b7e-96d7-d5788df5ae49", "value": "1536:IdgzXaB616355qBNdDG8ue0LD0l2CwbZn:IdxB6Q3PqnW2wbZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778104955, "uuid": "3f73dd33-d2e0-440d-bb63-1b859a118057", "value": 67892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778104955, "uuid": "8917180e-76f4-4086-8a34-cd396a43548e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778104955, "uuid": "4c2fcfdb-1d10-4ee1-b24e-4c8e9e8b68ba", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22b6a7c1-4929-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778057645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057645, "uuid": "44f0e0ef-d361-4b70-a6d7-557aa2fddb0d", "comment": "Malware payload", "value": "9b94a30f51a6985cd272f2f4cf15865e", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057645, "uuid": "fe870e39-d75d-4f48-b3fc-7e9784697485", "comment": "Malware payload", "value": "fd16ed0af3fd7fc17ef78ab6d484f6813c39b0192051263e2a6992070d0e5ebc", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057645, "uuid": "74931914-5e8e-4958-8065-e3c224168a5c", "comment": "Malware payload", "value": "9ca70a58489f2cc990ac599537d4236595da11b8", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778057645, "uuid": "b764b99c-4e82-4f60-a779-05528ba7e9f7", "comment": "Malware payload", "value": "03d83866e59a8ed89b3bf75b2e1553422fab56ca6c15234484d9f59c2fc4e1ead0021ed285e757ebbeee90c6b8c21d41", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057645, "uuid": "d04f5579-9604-4cb3-a81b-2372437d5521", "value": "T14AB61295F398AB2FC43B513349FB163212974C078A9297436928721C7EBB6F41F59BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057645, "uuid": "3651acd3-67ae-4b65-979a-06308e55595a", "value": "196608:tYo2/KLawJWjUrO4kgzE1ZZC4DnLGjDdS/RffXk1eshNN6kxnNEHO0+lYZ:2oAKLawc4ZzE1jnGf4ZXvshK8nNl0+OZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778057645, "uuid": "06f46f4f-1033-43a5-a598-582c89d056e7", "value": 11090959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778057645, "uuid": "083f7b67-9efa-4ea0-9c79-0a08bb1246c5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778057645, "uuid": "f86c62be-dad8-42bd-a560-fe4efd3f9628", "value": "app(9).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78d05d45-498d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778100739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100739, "uuid": "c9d1fc02-8ec4-47bf-87b8-ccce02e80bec", "comment": "Malware payload (Mirai)", "value": "b7067e7ccbfc45fa7155610a1dbc0bf4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100739, "uuid": "5393df69-3451-4fec-ab1e-4e2913484d46", "comment": "Malware payload (Mirai)", "value": "fef921e5be4e43e7a59d03b8b3bba50efff42cc5a2cfd2888aef767f8c85988d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100739, "uuid": "0567d6b1-c0d9-43c5-a9e7-a5f3efd37ba0", "comment": "Malware payload (Mirai)", "value": "1ded6e6f4a3b0a65dd261c697eda8e67014c1c57", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100739, "uuid": "c351d2ae-64a4-4099-874c-a9afeee1982e", "comment": "Malware payload (Mirai)", "value": "70f371cd20f485a0507587e6bf59427838afb63abf55ddd1e12bad01f682d458fd59b2887724292aaee7aeebed84eb8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100739, "uuid": "b6292851-a514-4d86-957c-d6b78d6c7ff5", "value": "T11BA349C5D6C3D8FAFC5204362026BF36DB33D67E212ADE87C7AD9A21A831511C61A75C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100739, "uuid": "7518654d-d1df-4469-8114-f7558808fb48", "value": "1536:NFyiVawbM+RD8dA4MP2Et/U9WViSu5jrckeSW:NQ72RDaJAt8oruZrcX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778100739, "uuid": "0943256e-c1d9-4f21-baba-3f0a611ecd5b", "value": 100968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778100739, "uuid": "a64f2127-b975-4cb5-83c5-4ef22f5ea6b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100739, "uuid": "d2e73dce-12dc-42f5-b72f-8478c4bba57f", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "782bc689-492a-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1778058217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058217, "uuid": "b953524d-e72e-4520-b0f8-f17f2c10c633", "comment": "Malware payload (GuLoader)", "value": "f02a38815eb8616d21ef9a028e438e5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058217, "uuid": "f144b4a6-67d0-4296-8eb6-bd9f377779d7", "comment": "Malware payload (GuLoader)", "value": "ffbe12bed5577664430cbe263d968e868807da96ac0c8b4d08ae34be6a78b35b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058217, "uuid": "4a938f2d-3825-43d8-9741-9f8a6ad8b791", "comment": "Malware payload (GuLoader)", "value": "8546f3ac3e0aa10d85635f311e8987ccfa504515", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778058217, "uuid": "345448c5-45de-4e39-be3f-8aade8bfda26", "comment": "Malware payload (GuLoader)", "value": "5c99ca3eee76e496d2cb1888ba7a9fdcc9621e267abd9c7d231f366a7bc3f79a16dfa3a070c08b798efb2e15aa95dbe5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058217, "uuid": "46febbf1-2a08-4513-b3c1-5a3a863ea4fe", "value": "T1EDC4F163BB00A4C3DC34C93019666352677AAF77D8D12A5333E1BF1EBCB3D86602A556", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058217, "uuid": "04c3b69e-d70c-4314-8141-be8b93a185a7", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058217, "uuid": "309e29d0-49c2-4f6b-8e5a-8e71f0406e6f", "value": "12288:wT3pPfVF/GSNnFKkOb3lyxafVXTfmq8b7ezGTWz8PsGKd:wTZPfVtGS5FKL3lyxUVD5EizGjs9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778058217, "uuid": "d9fec332-bc65-4fc0-8744-143c3d354553", "value": 578968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778058217, "uuid": "be9eb5ea-719f-4857-a4ad-79577fd80f72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778058217, "uuid": "c6b9cba0-905f-421d-b519-fbb37851b434", "value": "Cifferpositioners.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26aa2ac9-499a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778106184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778106184, "uuid": "7a99cf2b-c687-44d1-99fc-8bc193e4ff45", "comment": "Malware payload", "value": "974e9813d86ec7eafb5a4e62f78d0d55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778106184, "uuid": "6ad7612a-b0f8-48fe-b37e-e90446433760", "comment": "Malware payload", "value": "ffd448f1e3038c6c324570ab12dbf65ddbef471f0ababfb9f2a3bb47eead5bd7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778106184, "uuid": "beb0a9ec-f620-4033-86b5-c8cb6788c23a", "comment": "Malware payload", "value": "e4c0c9b3d3f85cb5e4015825a4ee87282ff8703f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778106184, "uuid": "c23e13f5-e552-4b8a-b886-338f439e0999", "comment": "Malware payload", "value": "3bf21d2aee38f1f201e01913a03f5e8883985d43834e1758ba0e904477c0d823587cf3d08fea9b6d1c2a562eaf2cf609", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778106184, "uuid": "91bc2074-eb2a-46e3-af92-067a653e9bb9", "value": "T17AF73308526CD36BEDFEC5BAC7C0D7E1D340C64F9EBA980E635E3898B5414C601DA7A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778106184, "uuid": "0c4bcd74-9daf-4092-ada9-e333dfd73cda", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778106184, "uuid": "9ab12ce7-92f8-477f-a4a8-920b22aabd43", "value": "1572864:5t9IKPUjRWYs+v4//v/bwcEOMOUHwDu8vkjUOle+dclSX7:5UKMjRWwLFOCwS8sjUOle+drX7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778106184, "uuid": "b8ea3124-aa36-4699-aa15-cec9ae754b87", "value": 76167986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778106184, "uuid": "925e6d47-a8e7-4114-bc1e-5d2e367db851", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778106184, "uuid": "f4d3df5f-532b-4471-9c00-f026a0e32f51", "value": "Updater_v2.211.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "455537b2-498d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778100652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100652, "uuid": "b66f82e6-f8b6-47de-a6bf-f7d255048daf", "comment": "Malware payload (Mirai)", "value": "733dab13d8485384e1a21e5007b4dda8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100652, "uuid": "60c699c6-83ba-4f53-81b3-ecfcffa8097f", "comment": "Malware payload (Mirai)", "value": "ffd6fe08b85e683bea65ea7cd4586cb12456c23c8f88a89b9417c9b1ab3f9b4c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100652, "uuid": "76ead014-9689-4098-8060-4b6222381ed2", "comment": "Malware payload (Mirai)", "value": "868c628540e22384e3ed7c644e088fdf13c14597", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778100652, "uuid": "0698ae65-0cb7-455e-9ba9-d77fe24dbf34", "comment": "Malware payload (Mirai)", "value": "71a364831000f9c8f5fdb6fb99e8599a7d46967c54eb9b5989b7997bfa178b86de708d2a4cf141826af691c3df983071", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100652, "uuid": "b11e9076-16ef-43ce-9600-04a5184fa89c", "value": "T183C36AA3CC766F99C658D0B4B074CF796B53992081472FBA156BC3B98043D9DFA093B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100652, "uuid": "489be09d-f8c1-4a40-a6ff-7665e04ae059", "value": "1536:8aM9akk8ep1uHTdt5rotCl4kmBXRkAWLHEJd2KpzQMANbnp:8L4zupt5rsGFmBX+AWDcJpcnp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778100652, "uuid": "b7b2ae5f-c7b4-41bd-b741-73296ea88f48", "value": 122564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778100652, "uuid": "9b552145-4382-430d-abb0-b64e6e4bc2c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778100652, "uuid": "864be5bb-4960-4042-9811-33d881f87476", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }